10 ms·
Oracle’s BlueKai tracks people across the web – that data spilled online
- the_duke 6y agoAn important feature of Firefox that isn't nearly as well known as it should be is first party isolation. It can be a bit annoying due to eg Recaptcha, but it works fine 99% of the time. Some sites will break, but these are far and few between. I just use another browser for those. It was upstreamed from TOR and will scope all data (cookies, caches, etc) per domain. It's not a panacea, but definitely a good step. (about:config , privacy.firstparty.isolate) I feel like something like this should be the (standardized) behaviour of browsers. Sharing any kind of observable state between domains should require an explicit opt-in with a prompt. Like: "Privacy Warning: techcrunch.com wants to share your data with facebook.com. Do you want to allow this?" (such fine grained permissions are a complicated topic of course, but that's a longer discussion...)
- GoblinSlayer 6y agoI just disabled third party cookies and everything works fine.
- kohtatsu 6y agoThankfully this became the default in Safari: https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/ https://webkit.org/blog/10218/full-third-party-cookie-blocki... Previously it only enabled third-party cookies for domains you had explicitly visited. https://www.theverge.com/2017/9/14/16308138/apple-safari-11-advertiser-groups-cookie-tracking-letter https://www.theverge.com/2017/9/14/16308138/apple-safari-11-...
- mywittyname 6y agoUnfortunately, people are working out ways to get around this now that it's become a default.
- kevin_thibedeau 6y agoUse a generic JS blocker. It protects you from workarounds and zero days.
- foobar_ 6y agoDoesn't stop tracking pixels.
- brunoqc 6y agoIf you use umatrix and only allow 1st party cookies it should block those right? The pixel would load but without any cookie.
- kevin_thibedeau 6y agoTracking pixels don't need a cookie if they're using dynamically generated URLs.
- guug 6y agoumatrix can block third-party images as easily as it blocks cookies.
- Wowfunhappy 6y agoIt also blocks JS.
- PhantomGremlin 6y agoYou say that like it's a bad thing?
- Merem 6y agoDisabling third-party cookies hasn't really been that useful in a long time though. "When third-party cookies are allowed, 101 domains can reconstruct over 50% of a user's history and 161 could recover over 40%. Even when these cookies are blocked, 44 domains could recover over 40% of a user's history."[1] [1] Study back in 2014: https://securehomes.esat.kuleuven.be/~gacar/persistent/the_web_never_forgets.pdf https://securehomes.esat.kuleuven.be/~gacar/persistent/the_w... Add to that web beacons, ads, like buttons, browser fingerprinting via HTTP header, javascript, canvas, plug-ins, add-ons or hardware, keystroke biometrics and gestures on smartphones. Of course, there are also several techniques for e-mail tracking as well as tracking of documents (word, .pdfs etc).
- m463 6y agoSharing would just be routed through cdn.firstparty.com
- cpeterso 6y agoFirefox's First Party Isolation can break some websites that might rely on third-party authentication. This may be acceptable for Tor users, but not regular users, which is why First Party Isolation is still off by default in Firefox. Mozilla is actively testing a variation called Dynamic First Party Isolation that will support those workflows. For more details, here is the Firefox bug report: https://bugzilla.mozilla.org/show_bug.cgi?id=1549587 https://bugzilla.mozilla.org/show_bug.cgi?id=1549587 To enable Dynamic First Party Isolation: in Firefox Nightly's about:preferences#privacy, select "Custom" Enhanced Tracking Protection and "Cookies" = "Cross-site and social media trackers, and isolate remaining cookies". Or just set `network.cookie.cookieBehavior` pref = 5 in about:config.
- the_resistence 6y agoThanks very much. Useful
- rbecker 6y ago> There’s no big conspiracy. Ad tech can be creepily accurate. > Tech giant Oracle is one of a few companies in Silicon Valley that has near-perfected the art of tracking people across the internet. The company has spent a decade and billions of dollars buying startups to build its very own panopticon of users’ web browsing data. Doesn't that exactly describe a big conspiracy?
- themodelplumber 6y ago> But BlueKai also uses more covert tactics like allowing websites to embed invisible pixel-sized images to collect information about you as soon as you open the page — hardware, operating system, browser and any information about the network connection. View-source Ctrl-f "pixel" :-) This seems really odd to include, given Techcrunch's use of pixels, and whatever their own covert pixel tactics may be...invisible pixel images are part and parcel when you start talking about pixels in general. (Edit: The author seems to have addressed this) Also, is that _Kai_ as in the Japanese word for ocean? Or is it _Kai_ as in meeting? Perhaps the entire word is a Japanese derivative, with buruukai meant to connote a gathering of nervous, fearful Oracle executives? Not the most auspicious reading...
- GoblinSlayer 6y agoThat's useless. If you have javascript, just make the request directly, why pixel? The facebook pixel is slightly above that and is done right.
- WrtCdEvrydy 6y agopixels work with javascript disabled...
- josephmosby 6y agoMy guess is that there was an Oracle MBA type who thought they were being very clever by not saying "Blue Ocean," but "Blue Kai." https://www.blueoceanstrategy.com/what-is-blue-ocean-strategy/ https://www.blueoceanstrategy.com/what-is-blue-ocean-strateg...
- pnw_hazor 6y agoOracle bought BlueKai in 2014.
- reaperducer 6y agoThis seems really odd to include, given Techcrunch's use of pixels So because TechCrunch does something bad, that makes Oracle doing the same thing not bad? Yes, it's hypocrisy at the macro level. But it's not an excuse for either party.
- ogre_codes 6y agoWhen I tell people I don't like tracking the defense of all this nonsense is "People prefer getting relevant adverts". The campaign to normalize this is so good I often here consumers repeating it. But the inherent assumption is that the data is only used for benign ad targeting and ignores the possibility that the data will end up in the wrong hands like it has here. The response seems to be "{{ad tech company}} has some of the best developers in the world and they want to protect that data!". Except leaks like this are inevitable. So long as tracking is a thing, data will leak, and hostile actors will abuse it.
- rbecker 6y ago> data will leak It doesn't even have to leak. HR departments and shady government agencies could just buy it (or legally seize it). PR firms could dig through protester history and smear them so very easily.
- reaperducer 6y agoWhen I tell people I don't like tracking the defense of all this nonsense is "People prefer getting relevant adverts" I then ask them, "Is it working? Do you really see advertisements online that mostly show you things that are meaningful to you? Are online ads more relevant to you than what you see on TV or hear on the radio?" The honest always answer "No."
- ogre_codes 6y agoI see more advertisements that are relevant to me I would otherwise. Often they are just off the mark though, often I see advertisements for products similar to one I just bought. But most people only need one lawn mower, one circular saw, etc etc. Overall, I don't see it as being remotely worth the trade-off.
- soared 6y agoHow many ads for hearing ads you have seen on TV? And how many ads for hearing ads have you seen online? The honest answer is a lot, and none.
- advisedwang 6y agoThe wide range of data the article hints at and the guesses at connecting data to users suggests that this data is probably full of inaccuracies. That is one of the really scary things - companies are making decision about me based on outright wrong data. This can be brutal for applications like credit worthiness, but I'm still worried about mistakes in data used for more mundane decisions like who to offer a discount to or which passenger to bump to business class.
- soared 6y agoThis type of data isn't really used for business decisions, since an audience like "good credit score" (highly highly regulated and almost never used, fyi) contains like 150MM unique identifiers (cookies, device ids, etc). Everyone using this data knows it contains inaccuracies, but it is much much better than not having any data at all.
- williesleg 6y agoThat's so fucking funny the Techcrunch site also has trackers turned on! Gotta love pi-hole!
- hamax 6y agoIf you want to check out what bluekai knows about your browser: https://datacloudoptout.oracle.com/registry/ https://datacloudoptout.oracle.com/registry/
- swsieber 6y agoHa ha! I disabled ublock origin, reloaded and it told me I have nothing.
- bitxbitxbitcoin 6y agoWhat kind of information do others see? I am currently getting: "No data available for this browser."
- soared 6y agoIt should be known that this tool is purposefully never updated and knowingly inaccurate.
- dws 6y agoMultiple Families / Single Family / Married / Single, and I apparently live in 3 different states. It did get the "Chrome" part right, though.
- booi 6y agoIt's probably more accurate to check the leaked data than this tool >_<
- billh 6y ago
- gdsdfe 6y agoas if we need more reasons to hate Oracle
- soared 6y agoI worked at oracle on the bluekai product (search 'oracle' in my comment history). I helped deliver data using bluekai from oracle to platforms like facebook and google. AMA. If you are curious what data is housed in bluekai, here is a 170 page pdf with lists and descriptions of different data providers/vendors: http://www.oracle.com/us/solutions/cloud/data-directory-2810741.pdf http://www.oracle.com/us/solutions/cloud/data-directory-2810...
- sailfast 6y agoWhat is the best way to opt-out / avoid tracking like this? The Oracle opt-out page requires providing your physical address / email / name and then only sets a cookie in your single browser.
- swsieber 6y agoI recommend ublock origin. When I checked with the disclosure page (give me everything you have on me), after disabling ublock origin for that page, it said they had nothing on me. The truth of that statement is debatable, but it seems to be effective.
- soared 6y agoA good adblocker and using this tool on all of your devices: https://optout.networkadvertising.org/?c=1 https://optout.networkadvertising.org/?c=1 Its difficult to actually opt out in full, but we will definitely get to that point in the future. Also if you use niche hardware/software (like netscape on an old linux distro) you're data will just get cleansed out. Nobody does fingerprinting unless you're a spy or in charge of purchasing for a hospital or something, so I wouldn't worry about that.
- jefftk 6y ago> Nobody does fingerprinting ... so I wouldn't worry about that. I'm not sure how long you've been out, but this has changed a lot recently. Many adtech companies (not us) have responded to ITP by building out fingerprinting to continue personalization. (Disclosure: I work on ads at Google)
- soared 6y agoThrough no fault of the author, he is confusing how bluekai operates. He talks a lot about the sanitized huge anonymous audience (like in-market for cars) but then skips to user-specific data (Steve who spent $10 gambling on 4/19.) These two things, 3rd party and 1st party data, are very different. Stored differently, different user access, different rules, etc. If Oracle accidentally made all their client's 1st party data public they'd get sued out of existence.
- manigandham 6y agoYes, although at this point I expect any adtech articles to be 90% inaccurate. The real issue is the poor security practices of this company, especially under Oracle's watch, and how much data is shared by partners. BlueKai can't get personal details unless someone shares it with them.
- soared 6y agoAgreed. Oracle sends their dataset to like 200 different partners and it’s in a constant state of being updated, so it’s not surprising one of those was misconfigured.
- m463 6y ago> If Oracle accidentally made all their client's 1st party data public they'd get sued out of existence. Historically speaking, I don't know any entity that has been sued out of existence for these kinds of things. Usually after the media cycle everything is back to normal.
- DeepYogurt 6y agoAnyone know where to find the dataset?
- gnicholas 6y agoI have a paid Chrome extension and recently implemented an uninstall survey to see why people are leaving. For people who indicate that cost is an issue, we explain that many "free" products are either supported by advertisements or by selling user data. We then ask people if we offered such a "free" option if they would choose that over our paid option (which costs less than $2/mo). Almost all of the respondents indicate that they would choose the "free" version. I was surprised that the feedback was this one-sided, especially after making the tradeoff salient (and especially for a browser plugin that sees every page you visit). Apparently most people just don't care about their privacy.
- mywittyname 6y agoI think a lot of this comes down to the fact that so many people are tracking where you go online that there's not much point in trying to stop it.
- user5994461 6y agoPrivacy has no "cost" whereas paying $2 right now is a very understandable cost. Also, it's not $2 but $50, for users wary of automatically extending monthly subscriptions.
- tomComb 6y agoThere are some very important distinctions there. Maybe you said your free version would use targeted ads - which I'm fine with personally. It's selling data or being dishonest about how the data is used that I have a problem with, so maybe the problem is that your users trust you so they are comfortable with you having and using their data.
- gnicholas 6y agoIn my survey, I didn't say anything about the type of ads or how we would use the data. We are very trustworthy, and part of that is that we don't monetize user data in any way. But of course if we created a free tier that was funded by monetizing user data, this would no longer be the case!
- 6y ago
- alfalfasprout 6y agoOh, BlueKai is only the tip of the iceberg. I used to work for a spammer (that called itself an "incubator") that used blukai among other better sources. 3rd party cookie impressions can be sent to a company like LiveRamp to identify what websites users have visited (in theory only in buckets, but that's trivial to bypass). With the exception of the very largest websites, you could see traffic to many, many websites and tie it back to an individual user (even if their IP changed, etc.). Companies like FullContact and People Data Labs offer the ability to take the few pieces of information you have a user and get their other info (eg; verify email using name and address, or get social media profiles, etc.). The problem is no matter how good you are about using VPNs, clearing cookies, etc. the weak link are the websites you're forced to give some info to. Many of them will well you out even if their TOS say otherwise.
- jefftk 6y ago> I used to work for a spammer (that called itself an "incubator") CogoLabs?
- alfalfasprout 6y agosmall world ;)
- jefftk 6y agoI was there about 10 years ago, and wrote a bunch of the initial email stuff. At the time, we sent email only for things that people explicitly signed up for (Groupon competitor), but...
- alfalfasprout 6y agoYeah, that changed completely haha.
- pwdisswordfish2 6y ago"Many of them will well you out even if their TOS say otherwise." Can you prove that?