4 ms·

By setting very high fines for those who don't comply?

petre 6y ago
Already done. It's up to 10% of turnover, not profits. Which the companies would happily go to court over. But how to actually prove in court that company X is tracking users if a leak doesn't occur? Subopenas? They need a court order for that. They need reasonable suspicion to get a court order.
- speedgoose 6y ago
  Right now it's very easy to see, the companies are not hiding it at all. They send the data to third-party trackers straight from their website or application.
  - EGreg 6y ago
    Disqus loads a million external resources That’s so stupid, why not just take your OWN cookie and use it in the backend to send to all these resources, proxying through your own server or having a CNAME for theirs under your domain?
    - speedgoose 6y ago
      I guess it's often much simpler and cheaper to not try to hide it. The CNAME practice is becoming more and more common. See https://blog.apnic.net/2020/08/04/characterizing-cname-cloaking-based-tracking/ https://blog.apnic.net/2020/08/04/characterizing-cname-cloak... or https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a https://medium.com/nextdns/cname-cloaking-the-dangerous-disg... or https://www.laquadrature.net/2020/10/05/le-deguisement-des-trackers-par-cname/ https://www.laquadrature.net/2020/10/05/le-deguisement-des-t... I think proxying or doing it server side only will be implemented later when these people will be forced to hide to save their shitty business model.
      - Sayrus 6y ago
        CNAME cloacking has gone even further, ad company now ask you to put a A/AAAA record pointing to one of their IPs as CNAME uncloaking was working pretty well.
      - _-david-_ 6y ago
        I think the move will be for ANAME records. ANAME is not a real record (yet), but some providers are supporting them. It is similar to a CNAME record but instead of storing the domain name you want to map to it pulls the A record and puts that IP as your A record.
- travisjungroth 6y ago
  Those issues aren’t unique to this problem. Courts already try to solve them. It’s the same as how you would find banks denying loan based on race. You find banks by complaints or wide search. You do an initial investigation from the outside with no warrant or subpoena. Like send in a white client and black client (or someone with a search history of fishing versus sewing) and see what happens. Then that’s enough to ask for all the secrets. Of course they could delete them, but that should be a big crime. I’m not saying this is a perfect system. It’s not. But it’s an attempt the problem you describe.
Nasrudith 6y ago
That is like saying if we make the punishment for any crime tortorous enough we won't need law enforcement. That only answers "what the punishment will theoretically be" not "How can it be found out when it is being broken? By whom? Will we able to take action against it?".
- maedla 6y ago
  Oh heaven help us if a trillion dollar enterprise gets a fine !!!!
  - caddywompus 6y ago
    I think what they mean is, how can you track which companies are not complicit, how do you organize the proof so that you can levy the fine successfully

Already done. It's up to 10% of turnover, not profits. Which the companies would happily go to court over. But how to actually prove in court that company X is tracking users if a leak doesn't occur? Subopenas? They need a court order for that. They need reasonable suspicion to get a court order.

speedgoose 6y ago
Right now it's very easy to see, the companies are not hiding it at all. They send the data to third-party trackers straight from their website or application.
- EGreg 6y ago
  Disqus loads a million external resources That’s so stupid, why not just take your OWN cookie and use it in the backend to send to all these resources, proxying through your own server or having a CNAME for theirs under your domain?
  - speedgoose 6y ago
    I guess it's often much simpler and cheaper to not try to hide it. The CNAME practice is becoming more and more common. See https://blog.apnic.net/2020/08/04/characterizing-cname-cloaking-based-tracking/ https://blog.apnic.net/2020/08/04/characterizing-cname-cloak... or https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a https://medium.com/nextdns/cname-cloaking-the-dangerous-disg... or https://www.laquadrature.net/2020/10/05/le-deguisement-des-trackers-par-cname/ https://www.laquadrature.net/2020/10/05/le-deguisement-des-t... I think proxying or doing it server side only will be implemented later when these people will be forced to hide to save their shitty business model.
    - Sayrus 6y ago
      CNAME cloacking has gone even further, ad company now ask you to put a A/AAAA record pointing to one of their IPs as CNAME uncloaking was working pretty well.
    - _-david-_ 6y ago
      I think the move will be for ANAME records. ANAME is not a real record (yet), but some providers are supporting them. It is similar to a CNAME record but instead of storing the domain name you want to map to it pulls the A record and puts that IP as your A record.
travisjungroth 6y ago
Those issues aren’t unique to this problem. Courts already try to solve them. It’s the same as how you would find banks denying loan based on race. You find banks by complaints or wide search. You do an initial investigation from the outside with no warrant or subpoena. Like send in a white client and black client (or someone with a search history of fishing versus sewing) and see what happens. Then that’s enough to ask for all the secrets. Of course they could delete them, but that should be a big crime. I’m not saying this is a perfect system. It’s not. But it’s an attempt the problem you describe.

Nasrudith 6y ago

That is like saying if we make the punishment for any crime tortorous enough we won't need law enforcement. That only answers "what the punishment will theoretically be" not "How can it be found out when it is being broken? By whom? Will we able to take action against it?".

maedla 6y ago
Oh heaven help us if a trillion dollar enterprise gets a fine !!!!
- caddywompus 6y ago
  I think what they mean is, how can you track which companies are not complicit, how do you organize the proof so that you can levy the fine successfully