4 ms·

Other than this is how cookies should have worked from the get-go, I have a question/scenario: 1. User visits site-a.com, which sets a cookie containing 'ThisI

Other than this is how cookies should have worked from the get-go, I have a question/scenario: 1. User visits site-a.com, which sets a cookie containing 'ThisIsUser9' 2. site-a.com also rewrites every external URL on the page, with a new param '&adtrack=ThisIsUser9' 3. User clicks on external link on site-a.com and goes to site-b.com 4. site-b.com's server sees the adtrack param on the end of the URL and sets a cookie 'ThisIsUser9' and also adds the adtrack param to all external URLs on the returned page. 5. Advertising company works with site-a and site-b (and many many other sites) to build up a persistent profile of your browsing habits. We can't stop this, even with this new FF cookie isolation. Those of us who care will install an extension to strip known trackers from all URLs, and 90% of all other web users, will still be tracked as usual. Face it, the private web is lost. :(

pantulis 6y ago
Isn't this more or less how tracking used to work before the days of adservers and programmatic advertising?
randomsearch 6y ago
this doesn't work if I don't go to site-a.com first most of the time I go direct to a URL by typing in the address bar > Face it, the private web is lost. this reads like marketing for Eric Schmidt https://www.eff.org/deeplinks/2009/12/google-ceo-eric-schmidt-dismisses-privacy https://www.eff.org/deeplinks/2009/12/google-ceo-eric-schmid...
alkonaut 6y ago
> site-b.com's server sees I can at least SEE that siteA passes my information to siteB. Or at least that it passes something (e.g. a huge base64 chunk in the url). That's a big step forward. I can also block the referrer headers so it's not visible in siteA url itself. If I want to navigate from SiteA to SiteB and the url doesn't look "expected", I can choose to not click it. Tracking that only takes place in URLS and only when I click things, isn't nearly as scary or problematic as cookies.
CRConrad 6y ago
There is a solution, but it's somewhat clumsy compared to just right-click, "Open in new tab / window": Right-click, "Copy URL", paste into a text editor, remove any suspicious bits, copy what's left, go back to the browser, open a new tab / window, paste in your sanitized URL. No, I don't think anyone does that with every damn link. I sure don't.

pantulis 6y ago

Isn't this more or less how tracking used to work before the days of adservers and programmatic advertising?

randomsearch 6y ago

this doesn't work if I don't go to site-a.com first most of the time I go direct to a URL by typing in the address bar > Face it, the private web is lost. this reads like marketing for Eric Schmidt https://www.eff.org/deeplinks/2009/12/google-ceo-eric-schmidt-dismisses-privacy https://www.eff.org/deeplinks/2009/12/google-ceo-eric-schmid...

alkonaut 6y ago

> site-b.com's server sees I can at least SEE that siteA passes my information to siteB. Or at least that it passes something (e.g. a huge base64 chunk in the url). That's a big step forward. I can also block the referrer headers so it's not visible in siteA url itself. If I want to navigate from SiteA to SiteB and the url doesn't look "expected", I can choose to not click it. Tracking that only takes place in URLS and only when I click things, isn't nearly as scary or problematic as cookies.

CRConrad 6y ago

There is a solution, but it's somewhat clumsy compared to just right-click, "Open in new tab / window": Right-click, "Copy URL", paste into a text editor, remove any suspicious bits, copy what's left, go back to the browser, open a new tab / window, paste in your sanitized URL. No, I don't think anyone does that with every damn link. I sure don't.