11 ms·

Blacklight – A Real-Time Website Privacy Inspector

207 points by chris_f 6y ago

unnameduser1 6y ago
Looks interesting and is definitely a required tool to show what websites are doing that average users don’t realize. Sadly the really bad players detect that this is not a normal user and redirect to a error page. You will have to try harder to fool them into thinking your headless browser is a real user. Probably your test device is in a server center and they detect the IP isn’t a end user IP. Hope you get it working
tyingq 6y ago
That's really well done. I tried several ecommerce, airline, travel, etc, sites. I was surprised with the extent of fingerprinting and 3rd party sites. For example, American Airlines, aa.com: 17 ad trackers, 32 third party cookies, canvas fingerprinting, session keyboard and mouse tracking, data to facebook, linked in, amazon, and more. Ouch.
- Moru 6y ago
  I'm using uBlock and uMatrix so I'm not surprised. However I've been blocking such with whatever was at hand since javascript started out... In the start it was easy, just don't load javascript. Now it's even easier, just install uBlock and uMatrix and watch the whole modern web break together... :-)
rfreytag 6y ago
Check out https://themarkup.org/blacklight/?url=wapo.com https://themarkup.org/blacklight/?url=wapo.com Astonishing.
iruoy 6y ago
I tried some sites I thought might get a high score. Mostly news sites and webstores since they like to know a lot about you. Fox News [1] and Breitbart [2] got scarily high scores [1] https://themarkup.org/blacklight/?url=foxnews.com https://themarkup.org/blacklight/?url=foxnews.com [2] https://themarkup.org/blacklight/?url=breitbart.com https://themarkup.org/blacklight/?url=breitbart.com
- tyingq 6y ago
  61 third party cookies and 29 trackers for foxnews. Wow.
  - kube-system 6y ago
    https://themarkup.org/blacklight/?url=nypost.com https://themarkup.org/blacklight/?url=nypost.com 40 trackers, 65 third-party cookies https://themarkup.org/blacklight/?url=aljazeera.com https://themarkup.org/blacklight/?url=aljazeera.com 54 trackers, 148 third-party cookies https://themarkup.org/blacklight/?url=theonion.com https://themarkup.org/blacklight/?url=theonion.com 1 tracker, 0 third-party cookies
    - tyingq 6y ago
      https://gtmetrix.com/reports/nypost.com/vXp79Q5S https://gtmetrix.com/reports/nypost.com/vXp79Q5S 24 seconds to load, 585 individual http requests. Crazy. You would think someone there would raise this as an issue.
- ceejayoz 6y ago
  Be sure to load the "This website loads trackers on your computer that are designed to evade third-party cookie blockers." section's details and see the fingerprinting images that are used. Crazy stuff.
- ziml77 6y ago
  First one I tried was https://themarkup.org/blacklight/?url=nytimes.com https://themarkup.org/blacklight/?url=nytimes.com 12 trackers and 6 third-party cookies I'm surprised that they're not bad with tracking given how bad news sites tend to be. I thought maybe it could be explained by them being a paid site, but the WSJ is too and their analysis was abysmal with 32 trackers, 53 third-party cookies, fingerprinting, and session recording.
  - clairity 6y ago
    > "12 trackers and 6 third-party cookies ... they're not bad ..." that's still bad, and nytimes uses a bunch of first-party tracking as well. it's just not as bad as the worst ones, but in no way should you excuse them for their own bad behavior.
TedDoesntTalk 6y ago
I entered a website that got 0 for all categories... it was not obvious that the scanner was done or that all zeros was a good thing. Hmmm
- tyingq 6y ago
  It does have some explanatory text, like: 0 Third-party cookies not found. This is less than half the average of three that we found on popular sites.
mellosouls 6y ago
Looks good, but unfortunate name clash - I assume this is unrelated to the established Blacklight discovery platform used (ironically, considering The Markup's domain) in the Panama Papers exposure? https://projectblacklight.org/ https://projectblacklight.org/ https://source.opennews.org/articles/people-and-tech-behind-panama-papers/ https://source.opennews.org/articles/people-and-tech-behind-...
fxtentacle 6y ago
I feel like we should unify the copyright and privacy laws. If I copy a Disney movie without their knowledge and then extract value from it, for example by watching the movie without paying, everyone agrees that this is theft. And punishment is generally strong to excessive. If a website copies my private data without my knowledge or even after I decline permission by sending DNT headers, that is somehow considered completely fine. But to me, the value of my private data is vastly higher than the value of watching a copied movie. And the potential for financial damages stemming from a stolen identity is also much highest than the real damages from someone downloading an mp4. I suggest that we classify the secret collection of private data as theft. Edit: With my wording, I was referring to this old pro-copyright ad: https://m.youtube.com/watch?v=HmZm8vNHBSU https://m.youtube.com/watch?v=HmZm8vNHBSU
- Semaphor 6y ago
  > everyone agrees that this is theft No.
  - fxtentacle 6y ago
    I'm not aware of any court case where downloading and watching movies without the rights owner's permission was considered OK. Instead, the downloader always had to pay a fine.
    - _jal 6y ago
      That does not make it theft. Copyright infringement is not theft. Theft is legally distinct. It is also morally distinct - the 'owner' of the 'intellectual property' is not deprived of their ownership if someone violates the transactional model by looking without permission. Copyright infringement is not theft. It is interference with a business model. Please stop saying obviously incorrect things.
      - hairofadog 6y ago
        Respectfully, fxtentacle’s point didn’t hinge on the technical definition of theft. I think they’re trying to point out that illicit data transfers are punished harshly when an individual does it but are considered standard practice and even (by some) praised when corporations do it.
sbarre 6y ago
I also appreciate that you get an archive download of the results if you want one (at the bottom). Can be useful for historical comparisons.
Semaphor 6y ago
This does not work with GDPR compliant sites (the few that exist). I wonder if it would make sense to use something similar to [0] to auto-accept, note in the results that there is a consent gate and then list the trackers in the accepted state? [0]: https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
BonoboIO 6y ago
This is just like a highscore game ... 33 Trackers | 60 Third-Party Cookies https://themarkup.org/blacklight/?url=edition.cnn.com https://themarkup.org/blacklight/?url=edition.cnn.com 32 Trackers | 53 Third-Party Cookies https://themarkup.org/blacklight/?url=wsj.com https://themarkup.org/blacklight/?url=wsj.com The newspaper business is digging it's own grave. "This website could be monitoring your keystrokes and mouse clicks."
- aspaviento 6y ago
  35 Trackers | 92 Third-Party Cookies https://themarkup.org/blacklight/?url=publico.es https://themarkup.org/blacklight/?url=publico.es Absolutely insane.
- 0goel0 6y ago
  Do you pay for your news then I assume?
  - jorams 6y ago
    Note that one of their two examples is wsj.com, which only serves news to paying subscribers and still includes large ad banners.
- traspler 6y ago
  39 Trackers | 91 Third-Party Cookies | Evading Trackers | (Possible) Keystroke & Mouse Monitoring https://themarkup.org/blacklight/?url=arstechnica.com https://themarkup.org/blacklight/?url=arstechnica.com
  - arp242 6y ago
    At least Ars will allow you to disable almost all of that if you subscribe. I mean, they've got to pay their staff somehow, and if it's not subscriptions or ads then how?
    - traspler 6y ago
thestepdaddy 6y ago
ghostery plugin much more effective if you use chrome it tells you as you visit a site and gives you the option to block it, I don't know why this is ranked 1 on HN
deleted 6y ago
[deleted]
technotarek 6y ago
Maybe publishers who do well would proudly let their users know? A badge of sorts? https://themarkup.org/blacklight/?url=attic.city https://themarkup.org/blacklight/?url=attic.city
mywacaday 6y ago
Does anyone know of a way to quantify the cost of ad-trackers in terms of cpu/memory/bandwidth/battery? How much more responsive would websites be without all the trackers? How much longer would we keep our phones if they didn't struggle under the weight of all this tracking? How much less data center capacity would be required? How much more bandwidth would be available?
- fxtentacle 6y ago
  How much $ in terms of electricity costs are stolen from me per year by the tracking mafia?
- kube-system 6y ago
  You can use webpage benchmarking tools to measure the size of the script(s) and the resources required to load them.
- Sephr 6y ago
  You can quantify the impact of ad trackers on system resources by measuring the difference in a site's resource utilization with and without an ad blocker.
  - geerlingguy 6y ago
    Just counting Google Analytics, it added between 200-500ms total load time on my own website. I dropped it for Fathom, which dropped that to about 70ms. A log-based system would drop the overhead to 0, but Fathom is more convenient for me.
amq 6y ago
Next step: server-side tracking. With Firefox and Safari blocking JS tracking by default, many companies feel like they don't have other choice.
makepanic 6y ago
If any website implements this chromium headless bug [1] then one could potentially avoid detection in blacklight. [1] - https://bugs.chromium.org/p/chromium/issues/detail?id=1090429 https://bugs.chromium.org/p/chromium/issues/detail?id=109042...
mda 6y ago
Some popular tech sites: Anandtech: 29 Ad trackers, 76 3rd party cookies Arstechnica: 47 Ad trackers 110 3rd party cookies
quaffapint 6y ago
Running pi-hole it's astounding the percentage of the dns requests are for trackers/ad serving.
yalogin 6y ago
As per this tool, if you value privacy visiting pornhub is many times better than visiting TechCrunch. I wasn’t surprised that TechCrunch has so many trackers but surprised that a porn site has only one.
- llacb47 6y ago
  Their database must be lacking coverage of NSFW trackers, because pornhub is full of them. https://i.imgur.com/mNrupcC.png https://i.imgur.com/mNrupcC.png
llacb47 6y ago
Here are some bad ones: https://themarkup.org/blacklight/?url=thoughtcatalog.com https://themarkup.org/blacklight/?url=thoughtcatalog.com https://themarkup.org/blacklight/?url=factinate.com https://themarkup.org/blacklight/?url=factinate.com https://themarkup.org/blacklight/?url=sacbee.com https://themarkup.org/blacklight/?url=sacbee.com https://themarkup.org/blacklight/?url=mediabiasfactcheck.com https://themarkup.org/blacklight/?url=mediabiasfactcheck.com https://themarkup.org/blacklight/?url=www.thestar.com https://themarkup.org/blacklight/?url=www.thestar.com https://themarkup.org/blacklight/?url=space.com https://themarkup.org/blacklight/?url=space.com https://themarkup.org/blacklight/?url=laptopmag.com https://themarkup.org/blacklight/?url=laptopmag.com https://themarkup.org/blacklight/?url=hollywoodlife.com https://themarkup.org/blacklight/?url=hollywoodlife.com https://themarkup.org/blacklight/?url=nfl.com https://themarkup.org/blacklight/?url=nfl.com https://themarkup.org/blacklight/?url=kyma.com https://themarkup.org/blacklight/?url=kyma.com The worst so far: https://themarkup.org/blacklight/?url=thehindu.com https://themarkup.org/blacklight/?url=thehindu.com https://themarkup.org/blacklight/?url=m.economictimes.com https://themarkup.org/blacklight/?url=m.economictimes.com
eli 6y ago
There's some good stuff in here, but they're also using a very expansive definition of "tracker" that in some cases I think is just unfair. For example Adobe TypeKit serves fonts. It's not ad tech at all. The only thing it tracks is how many times a font was served. Adobe does also have ad tracking technology but TypeKit isn't part of it. Likewise the tool's author seems to misunderstand AWS CloudFront, which is a CDN and does not itself do any tracking nor is it connected to any Amazon ad tech.
- llacb47 6y ago
  I guess you tested one of your sites? I agree that typekit is not an ad tracker, and neither is cloudfront. https://themarkup.org/blacklight/?url=www.utilitydive.com https://themarkup.org/blacklight/?url=www.utilitydive.com
- Sephr 6y ago
  TypeKit does indeed send tracking data back to Adobe through the domain p.typekit.net. This is also likely reflected in Adobe's privacy policy. Luckily, it is possible to use Content-Security-Policy or client-side scripts to block this domain while allowing use.typekit.net, which simply hosts the font files.
  - eli 6y ago
    Like I said, they keep track of font usage. The billing is based on usage. That domain sets no cookies and the privacy policy doesn't permit the data to be used for ads: https://www.adobe.com/privacy/policies/adobe-fonts.html https://www.adobe.com/privacy/policies/adobe-fonts.html It's not ad tech. I think this is the problem with the "high score" approach to measuring the privacy impact of a site. Number of third-party cookies or "trackers" is not a great proxy for how well a site actually protects your data in ways you care about. I would also add New Relic as an example of a site that really shouldn't be in a list of "ad tech."
    - arp242 6y ago
      "Tracking" is almost a weasel word these days. What matters is what is tracks. Tracking some things is just fine, IMO. The problem now is a lack of trust, not the least of which because there's often not that much transparency and very little accountability in the way of law, as well as various actors that constantly try to skirt the line (i.e. Facebook, Google, etc.)
Amorymeltzer 6y ago
As always, it is truly amazing that Wikipedia, a top-10 global website, has none of this stuff: https://themarkup.org/blacklight/?url=en.wikipedia.org https://themarkup.org/blacklight/?url=en.wikipedia.org
- chris_f 6y ago
  Another refreshing site is Craigslist: https://themarkup.org/blacklight/?url=craigslist.org https://themarkup.org/blacklight/?url=craigslist.org
maproot 6y ago
Good one in the sea of evil https://themarkup.org/blacklight/?url=privacytoolslist.com https://themarkup.org/blacklight/?url=privacytoolslist.com
hinkley 6y ago
I forget sometimes how much happier I am in my philistine pig-ignorance of what really goes on. The title reminds me of two things. The blacklight sketch on SNL where everything had gross stuff all over it, and a week ago when I was trying to figure out why a button on a website wasn't working in Firefox, and so I opened the network tab. Every time I even moused over anything there were four network requests. To so many different origins. I did not want to see this (like the joke of turning your lights on in NYC so the roaches have a chance to scatter before you walk into the kitchen.) I kinda miss when we had a visual indicator that network traffic was going on. I might still not want to know but the social pressure of it would at least slow their roll a little bit. Maybe 1 request per mouseover.
bobblywobbles 6y ago
This is why websites/initiatives like scroll are so effective. I signed up and pay dollars a month to avoid paywalls and help fund news sources [that should also be avoiding ad-pixels!] https://scroll.com/ https://scroll.com/
zie 6y ago
Try your bank website... it won't be a nice result. Even banks are getting in on the action, it's gross.
bookofjoe 6y ago
>87 percent of websites are tracking you. This new tool will let you run a creepiness check. https://www.washingtonpost.com/technology/2020/09/25/privacy-check-blacklight/ https://www.washingtonpost.com/technology/2020/09/25/privacy... https://archive.vn/rOpOL https://archive.vn/rOpOL

207 points by chris_f 6y ago

Looks interesting and is definitely a required tool to show what websites are doing that average users don’t realize. Sadly the really bad players detect that this is not a normal user and redirect to a error page. You will have to try harder to fool them into thinking your headless browser is a real user. Probably your test device is in a server center and they detect the IP isn’t a end user IP. Hope you get it working

tyingq 6y ago

That's really well done. I tried several ecommerce, airline, travel, etc, sites. I was surprised with the extent of fingerprinting and 3rd party sites. For example, American Airlines, aa.com: 17 ad trackers, 32 third party cookies, canvas fingerprinting, session keyboard and mouse tracking, data to facebook, linked in, amazon, and more. Ouch.

Moru 6y ago
I'm using uBlock and uMatrix so I'm not surprised. However I've been blocking such with whatever was at hand since javascript started out... In the start it was easy, just don't load javascript. Now it's even easier, just install uBlock and uMatrix and watch the whole modern web break together... :-)

rfreytag 6y ago

Check out https://themarkup.org/blacklight/?url=wapo.com https://themarkup.org/blacklight/?url=wapo.com Astonishing.

iruoy 6y ago

I tried some sites I thought might get a high score. Mostly news sites and webstores since they like to know a lot about you. Fox News [1] and Breitbart [2] got scarily high scores [1] https://themarkup.org/blacklight/?url=foxnews.com https://themarkup.org/blacklight/?url=foxnews.com [2] https://themarkup.org/blacklight/?url=breitbart.com https://themarkup.org/blacklight/?url=breitbart.com

tyingq 6y ago
61 third party cookies and 29 trackers for foxnews. Wow.
- kube-system 6y ago
  https://themarkup.org/blacklight/?url=nypost.com https://themarkup.org/blacklight/?url=nypost.com 40 trackers, 65 third-party cookies https://themarkup.org/blacklight/?url=aljazeera.com https://themarkup.org/blacklight/?url=aljazeera.com 54 trackers, 148 third-party cookies https://themarkup.org/blacklight/?url=theonion.com https://themarkup.org/blacklight/?url=theonion.com 1 tracker, 0 third-party cookies
  - tyingq 6y ago
    https://gtmetrix.com/reports/nypost.com/vXp79Q5S https://gtmetrix.com/reports/nypost.com/vXp79Q5S 24 seconds to load, 585 individual http requests. Crazy. You would think someone there would raise this as an issue.
ceejayoz 6y ago
Be sure to load the "This website loads trackers on your computer that are designed to evade third-party cookie blockers." section's details and see the fingerprinting images that are used. Crazy stuff.
ziml77 6y ago
First one I tried was https://themarkup.org/blacklight/?url=nytimes.com https://themarkup.org/blacklight/?url=nytimes.com 12 trackers and 6 third-party cookies I'm surprised that they're not bad with tracking given how bad news sites tend to be. I thought maybe it could be explained by them being a paid site, but the WSJ is too and their analysis was abysmal with 32 trackers, 53 third-party cookies, fingerprinting, and session recording.
- clairity 6y ago
  > "12 trackers and 6 third-party cookies ... they're not bad ..." that's still bad, and nytimes uses a bunch of first-party tracking as well. it's just not as bad as the worst ones, but in no way should you excuse them for their own bad behavior.

TedDoesntTalk 6y ago

I entered a website that got 0 for all categories... it was not obvious that the scanner was done or that all zeros was a good thing. Hmmm

tyingq 6y ago
It does have some explanatory text, like: 0 Third-party cookies not found. This is less than half the average of three that we found on popular sites.

mellosouls 6y ago

Looks good, but unfortunate name clash - I assume this is unrelated to the established Blacklight discovery platform used (ironically, considering The Markup's domain) in the Panama Papers exposure? https://projectblacklight.org/ https://projectblacklight.org/ https://source.opennews.org/articles/people-and-tech-behind-panama-papers/ https://source.opennews.org/articles/people-and-tech-behind-...

fxtentacle 6y ago

I feel like we should unify the copyright and privacy laws. If I copy a Disney movie without their knowledge and then extract value from it, for example by watching the movie without paying, everyone agrees that this is theft. And punishment is generally strong to excessive. If a website copies my private data without my knowledge or even after I decline permission by sending DNT headers, that is somehow considered completely fine. But to me, the value of my private data is vastly higher than the value of watching a copied movie. And the potential for financial damages stemming from a stolen identity is also much highest than the real damages from someone downloading an mp4. I suggest that we classify the secret collection of private data as theft. Edit: With my wording, I was referring to this old pro-copyright ad: https://m.youtube.com/watch?v=HmZm8vNHBSU https://m.youtube.com/watch?v=HmZm8vNHBSU

Semaphor 6y ago
> everyone agrees that this is theft No.
- fxtentacle 6y ago
  I'm not aware of any court case where downloading and watching movies without the rights owner's permission was considered OK. Instead, the downloader always had to pay a fine.
  - _jal 6y ago
    That does not make it theft. Copyright infringement is not theft. Theft is legally distinct. It is also morally distinct - the 'owner' of the 'intellectual property' is not deprived of their ownership if someone violates the transactional model by looking without permission. Copyright infringement is not theft. It is interference with a business model. Please stop saying obviously incorrect things.
    - hairofadog 6y ago
      Respectfully, fxtentacle’s point didn’t hinge on the technical definition of theft. I think they’re trying to point out that illicit data transfers are punished harshly when an individual does it but are considered standard practice and even (by some) praised when corporations do it.

sbarre 6y ago

I also appreciate that you get an archive download of the results if you want one (at the bottom). Can be useful for historical comparisons.

Semaphor 6y ago

This does not work with GDPR compliant sites (the few that exist). I wonder if it would make sense to use something similar to [0] to auto-accept, note in the results that there is a consent gate and then list the trackers in the accepted state? [0]: https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/

BonoboIO 6y ago

This is just like a highscore game ... 33 Trackers | 60 Third-Party Cookies https://themarkup.org/blacklight/?url=edition.cnn.com https://themarkup.org/blacklight/?url=edition.cnn.com 32 Trackers | 53 Third-Party Cookies https://themarkup.org/blacklight/?url=wsj.com https://themarkup.org/blacklight/?url=wsj.com The newspaper business is digging it's own grave. "This website could be monitoring your keystrokes and mouse clicks."

aspaviento 6y ago
35 Trackers | 92 Third-Party Cookies https://themarkup.org/blacklight/?url=publico.es https://themarkup.org/blacklight/?url=publico.es Absolutely insane.
0goel0 6y ago
Do you pay for your news then I assume?
- jorams 6y ago
  Note that one of their two examples is wsj.com, which only serves news to paying subscribers and still includes large ad banners.
traspler 6y ago
39 Trackers | 91 Third-Party Cookies | Evading Trackers | (Possible) Keystroke & Mouse Monitoring https://themarkup.org/blacklight/?url=arstechnica.com https://themarkup.org/blacklight/?url=arstechnica.com
- arp242 6y ago
  At least Ars will allow you to disable almost all of that if you subscribe. I mean, they've got to pay their staff somehow, and if it's not subscriptions or ads then how?
  - traspler 6y ago

thestepdaddy 6y ago

ghostery plugin much more effective if you use chrome it tells you as you visit a site and gives you the option to block it, I don't know why this is ranked 1 on HN

deleted 6y ago

[deleted]

technotarek 6y ago

Maybe publishers who do well would proudly let their users know? A badge of sorts? https://themarkup.org/blacklight/?url=attic.city https://themarkup.org/blacklight/?url=attic.city

mywacaday 6y ago

Does anyone know of a way to quantify the cost of ad-trackers in terms of cpu/memory/bandwidth/battery? How much more responsive would websites be without all the trackers? How much longer would we keep our phones if they didn't struggle under the weight of all this tracking? How much less data center capacity would be required? How much more bandwidth would be available?

fxtentacle 6y ago
How much $ in terms of electricity costs are stolen from me per year by the tracking mafia?
kube-system 6y ago
You can use webpage benchmarking tools to measure the size of the script(s) and the resources required to load them.
Sephr 6y ago
You can quantify the impact of ad trackers on system resources by measuring the difference in a site's resource utilization with and without an ad blocker.
- geerlingguy 6y ago
  Just counting Google Analytics, it added between 200-500ms total load time on my own website. I dropped it for Fathom, which dropped that to about 70ms. A log-based system would drop the overhead to 0, but Fathom is more convenient for me.

amq 6y ago

Next step: server-side tracking. With Firefox and Safari blocking JS tracking by default, many companies feel like they don't have other choice.

makepanic 6y ago

If any website implements this chromium headless bug [1] then one could potentially avoid detection in blacklight. [1] - https://bugs.chromium.org/p/chromium/issues/detail?id=1090429 https://bugs.chromium.org/p/chromium/issues/detail?id=109042...

mda 6y ago

Some popular tech sites: Anandtech: 29 Ad trackers, 76 3rd party cookies Arstechnica: 47 Ad trackers 110 3rd party cookies

quaffapint 6y ago

Running pi-hole it's astounding the percentage of the dns requests are for trackers/ad serving.

yalogin 6y ago

As per this tool, if you value privacy visiting pornhub is many times better than visiting TechCrunch. I wasn’t surprised that TechCrunch has so many trackers but surprised that a porn site has only one.

llacb47 6y ago
Their database must be lacking coverage of NSFW trackers, because pornhub is full of them. https://i.imgur.com/mNrupcC.png https://i.imgur.com/mNrupcC.png

llacb47 6y ago

Here are some bad ones: https://themarkup.org/blacklight/?url=thoughtcatalog.com https://themarkup.org/blacklight/?url=thoughtcatalog.com https://themarkup.org/blacklight/?url=factinate.com https://themarkup.org/blacklight/?url=factinate.com https://themarkup.org/blacklight/?url=sacbee.com https://themarkup.org/blacklight/?url=sacbee.com https://themarkup.org/blacklight/?url=mediabiasfactcheck.com https://themarkup.org/blacklight/?url=mediabiasfactcheck.com https://themarkup.org/blacklight/?url=www.thestar.com https://themarkup.org/blacklight/?url=www.thestar.com https://themarkup.org/blacklight/?url=space.com https://themarkup.org/blacklight/?url=space.com https://themarkup.org/blacklight/?url=laptopmag.com https://themarkup.org/blacklight/?url=laptopmag.com https://themarkup.org/blacklight/?url=hollywoodlife.com https://themarkup.org/blacklight/?url=hollywoodlife.com https://themarkup.org/blacklight/?url=nfl.com https://themarkup.org/blacklight/?url=nfl.com https://themarkup.org/blacklight/?url=kyma.com https://themarkup.org/blacklight/?url=kyma.com The worst so far: https://themarkup.org/blacklight/?url=thehindu.com https://themarkup.org/blacklight/?url=thehindu.com https://themarkup.org/blacklight/?url=m.economictimes.com https://themarkup.org/blacklight/?url=m.economictimes.com

eli 6y ago

There's some good stuff in here, but they're also using a very expansive definition of "tracker" that in some cases I think is just unfair. For example Adobe TypeKit serves fonts. It's not ad tech at all. The only thing it tracks is how many times a font was served. Adobe does also have ad tracking technology but TypeKit isn't part of it. Likewise the tool's author seems to misunderstand AWS CloudFront, which is a CDN and does not itself do any tracking nor is it connected to any Amazon ad tech.

llacb47 6y ago
I guess you tested one of your sites? I agree that typekit is not an ad tracker, and neither is cloudfront. https://themarkup.org/blacklight/?url=www.utilitydive.com https://themarkup.org/blacklight/?url=www.utilitydive.com
Sephr 6y ago
TypeKit does indeed send tracking data back to Adobe through the domain p.typekit.net. This is also likely reflected in Adobe's privacy policy. Luckily, it is possible to use Content-Security-Policy or client-side scripts to block this domain while allowing use.typekit.net, which simply hosts the font files.
- eli 6y ago
  Like I said, they keep track of font usage. The billing is based on usage. That domain sets no cookies and the privacy policy doesn't permit the data to be used for ads: https://www.adobe.com/privacy/policies/adobe-fonts.html https://www.adobe.com/privacy/policies/adobe-fonts.html It's not ad tech. I think this is the problem with the "high score" approach to measuring the privacy impact of a site. Number of third-party cookies or "trackers" is not a great proxy for how well a site actually protects your data in ways you care about. I would also add New Relic as an example of a site that really shouldn't be in a list of "ad tech."
  - arp242 6y ago
    "Tracking" is almost a weasel word these days. What matters is what is tracks. Tracking some things is just fine, IMO. The problem now is a lack of trust, not the least of which because there's often not that much transparency and very little accountability in the way of law, as well as various actors that constantly try to skirt the line (i.e. Facebook, Google, etc.)

Amorymeltzer 6y ago

As always, it is truly amazing that Wikipedia, a top-10 global website, has none of this stuff: https://themarkup.org/blacklight/?url=en.wikipedia.org https://themarkup.org/blacklight/?url=en.wikipedia.org

chris_f 6y ago
Another refreshing site is Craigslist: https://themarkup.org/blacklight/?url=craigslist.org https://themarkup.org/blacklight/?url=craigslist.org

maproot 6y ago

Good one in the sea of evil https://themarkup.org/blacklight/?url=privacytoolslist.com https://themarkup.org/blacklight/?url=privacytoolslist.com

hinkley 6y ago

I forget sometimes how much happier I am in my philistine pig-ignorance of what really goes on. The title reminds me of two things. The blacklight sketch on SNL where everything had gross stuff all over it, and a week ago when I was trying to figure out why a button on a website wasn't working in Firefox, and so I opened the network tab. Every time I even moused over anything there were four network requests. To so many different origins. I did not want to see this (like the joke of turning your lights on in NYC so the roaches have a chance to scatter before you walk into the kitchen.) I kinda miss when we had a visual indicator that network traffic was going on. I might still not want to know but the social pressure of it would at least slow their roll a little bit. Maybe 1 request per mouseover.

bobblywobbles 6y ago

This is why websites/initiatives like scroll are so effective. I signed up and pay dollars a month to avoid paywalls and help fund news sources [that should also be avoiding ad-pixels!] https://scroll.com/ https://scroll.com/

zie 6y ago

Try your bank website... it won't be a nice result. Even banks are getting in on the action, it's gross.

bookofjoe 6y ago

>87 percent of websites are tracking you. This new tool will let you run a creepiness check. https://www.washingtonpost.com/technology/2020/09/25/privacy-check-blacklight/ https://www.washingtonpost.com/technology/2020/09/25/privacy... https://archive.vn/rOpOL https://archive.vn/rOpOL