4 ms·

>It seems that browser vendors hurry to push forward as many features as possible without much thinking about user's privacy. Vendors in plural makes it sound

>It seems that browser vendors hurry to push forward as many features as possible without much thinking about user's privacy. Vendors in plural makes it sound like the market isn't a monopoly of Google at this point. Google naturally loves to be able to fingerprint people based on as many metrics as possible, for their ads.

shadowgovt 4y ago
Last I checked, Google still adheres to w3c standards on these things. And they haven't captured the w3c process itself... We need to be holding the w3c accountable for considering privacy as they refine new rfcs for apis.
- dmitriid 4y ago
  > Last I checked, Google still adheres to w3c standards on these things. It adheres to web standards that it primarily writes and pushes through. > We need to be holding the w3c accountable for considering privacy as they refine new rfcs for apis. You know, when w3c does that HN is ablaze with "Safari is the new IE" and "Firefox is irrelevant". See all of hardware APIs (Bluetooth, Serial, HID etc.) that are rejected by both Safari and Firefox primarily on privacy issues.
  - MomoXenosaga 4y ago
    How did that saying go? It Is Difficult to Get a Man to Understand Something When His Salary Depends Upon His Not Understanding It Follow the money, people in tech get their paychecks from companies that do not respect privacy. And I don't mean that as an accusation: in capitalism it is your duty to do whatever you can get away with.
- satao 4y ago
  Who do you think proposose the standards?
- pmoriarty 4y ago
  "We need to be holding the w3c accountable for considering privacy as they refine new rfcs for apis." How do we do that?
- losingom 4y ago
  It's actually the WHATWG you need to watch[0], not the W3C. The latter has had basically no power for some time now and only endorses what the WHATWG propose[1]. [0] https://github.com/whatwg/sg https://github.com/whatwg/sg [1] https://www.w3.org/2019/04/WHATWG-W3C-MOU.html https://www.w3.org/2019/04/WHATWG-W3C-MOU.html
- 0xy 4y ago
  You know Google literally writes the specifications that are subsequently used by advertisers to fingerprint users, right? For example, the AudioContext API allows websites with zero audio to query sensitive personalized information about your audio equipment, with no permission. It was written by a Google employee, and implemented first in Chrome, then abused throughout DoubleClick's (owned by Google) display advertising network.
  - shadowgovt 4y ago
    That's what I mean by "holding them accountable." So Safari and Firefox should implement that API behind a privacy-check flag (same as we get for location services, etc.). If Google complains it's not to spec, tell Google to fix the spec. Don't rubber stamp specs that aren't privacy-conscious; Apple, Mozilla, and Microsoft are WHATWG standards members too.
codedokode 4y ago
Indeed, the WebGL extension that leaks videocard and driver name [1] is written by Google's employee. [1] https://www.khronos.org/registry/webgl/extensions/WEBGL_debug_renderer_info/ https://www.khronos.org/registry/webgl/extensions/WEBGL_debu...
- mmis1000 4y ago
  I think you do need driver or video card name if you need to make it work (or have a usable performance) in every vendor. Video cards behaves wildly different between vendors. Some shader runs smoothly in one vendor while lag like hell in another. And some don't even run correctly under certain vendor. Without knowing the vendor, it is not possible to patch them up to get a usable program. They share the same API doesn't mean they behave identical.
  - cozzyd 4y ago
    Sure but most websites don't need this, and if they do they can ask nicely.
    - notriddle 4y ago
      There is no way you can expect a non-technical user to understand the full implications of a prompt like that.
      - codedokode 4y ago
        Then this feaure should be disabled so that nobody relies on it.
      - cozzyd 4y ago
        Something like: "This web site is requesting access to 3D acceleration. This is required for fancy 3D graphics, but can also give the web site more information about your computer than it would otherwise, which may be used to track you, so only say yes if you are expecting fancy 3D graphics and you trust this web site" seems usable?
satao 4y ago
Yes... And people keep bashing at the Safari team for holding the web development back. I mean, it's clear that the Safari team also has their own agenda, regarding competition with the App Store. But the stuff that Google is pushing is just more ways for them to track you in the end.
- mmis1000 4y ago
  The things safari lack isn't even relevant to privacy. They are more about buggy layout (not the shiny grid layout or style worker, it doesn't even works correctly with css2 a lot of time), incorrectly implemented API (not the 'not implemented due to privacy' one, they are those implemented but reporting wrong result). Firefox also rejects a lot of proposal due to security reasons. But for every one it supported, it works correctly. Instead of work in funny way and require devs to guess the browser and insert ransom workaround just to make it not using the improper result safari gives and breaking the page. Fun fact: Safari doesn't even handle the full ISO8601 correctly until very recent version. A timestamp without timezone will be parsed into incorrect timezone. A timestamp without colon in the middle of timezone don't even be parsed(which is unfortunately go's default output format).
  - codedokode 4y ago
    Regarding timezones, this seems to be a fault of ISO standard. Why do they allow several representations of the same thing?
greiskul 4y ago
> Google naturally loves to be able to fingerprint people based on as many metrics as possible, for their ads. I guess that's why they have a explicit policy of prohibiting browser fingerprinting in all their ad business. https://digiday.com/media/googles-opaque-practices-to-restrict-fingerprinting-create-confusion-among-its-ad-tech-partners/amp/ https://digiday.com/media/googles-opaque-practices-to-restri...
- anothernewdude 4y ago
  It is actually. They want their system to do it, but not the people who buy ads from them, so their advertisers become reliant on google's user segmentation.

shadowgovt 4y ago

Last I checked, Google still adheres to w3c standards on these things. And they haven't captured the w3c process itself... We need to be holding the w3c accountable for considering privacy as they refine new rfcs for apis.

dmitriid 4y ago
> Last I checked, Google still adheres to w3c standards on these things. It adheres to web standards that it primarily writes and pushes through. > We need to be holding the w3c accountable for considering privacy as they refine new rfcs for apis. You know, when w3c does that HN is ablaze with "Safari is the new IE" and "Firefox is irrelevant". See all of hardware APIs (Bluetooth, Serial, HID etc.) that are rejected by both Safari and Firefox primarily on privacy issues.
- MomoXenosaga 4y ago
  How did that saying go? It Is Difficult to Get a Man to Understand Something When His Salary Depends Upon His Not Understanding It Follow the money, people in tech get their paychecks from companies that do not respect privacy. And I don't mean that as an accusation: in capitalism it is your duty to do whatever you can get away with.
satao 4y ago
Who do you think proposose the standards?
pmoriarty 4y ago
"We need to be holding the w3c accountable for considering privacy as they refine new rfcs for apis." How do we do that?
losingom 4y ago
It's actually the WHATWG you need to watch[0], not the W3C. The latter has had basically no power for some time now and only endorses what the WHATWG propose[1]. [0] https://github.com/whatwg/sg https://github.com/whatwg/sg [1] https://www.w3.org/2019/04/WHATWG-W3C-MOU.html https://www.w3.org/2019/04/WHATWG-W3C-MOU.html
0xy 4y ago
You know Google literally writes the specifications that are subsequently used by advertisers to fingerprint users, right? For example, the AudioContext API allows websites with zero audio to query sensitive personalized information about your audio equipment, with no permission. It was written by a Google employee, and implemented first in Chrome, then abused throughout DoubleClick's (owned by Google) display advertising network.
- shadowgovt 4y ago
  That's what I mean by "holding them accountable." So Safari and Firefox should implement that API behind a privacy-check flag (same as we get for location services, etc.). If Google complains it's not to spec, tell Google to fix the spec. Don't rubber stamp specs that aren't privacy-conscious; Apple, Mozilla, and Microsoft are WHATWG standards members too.

codedokode 4y ago

Indeed, the WebGL extension that leaks videocard and driver name [1] is written by Google's employee. [1] https://www.khronos.org/registry/webgl/extensions/WEBGL_debug_renderer_info/ https://www.khronos.org/registry/webgl/extensions/WEBGL_debu...

mmis1000 4y ago
I think you do need driver or video card name if you need to make it work (or have a usable performance) in every vendor. Video cards behaves wildly different between vendors. Some shader runs smoothly in one vendor while lag like hell in another. And some don't even run correctly under certain vendor. Without knowing the vendor, it is not possible to patch them up to get a usable program. They share the same API doesn't mean they behave identical.
- cozzyd 4y ago
  Sure but most websites don't need this, and if they do they can ask nicely.
  - notriddle 4y ago
    There is no way you can expect a non-technical user to understand the full implications of a prompt like that.
    - codedokode 4y ago
      Then this feaure should be disabled so that nobody relies on it.
    - cozzyd 4y ago
      Something like: "This web site is requesting access to 3D acceleration. This is required for fancy 3D graphics, but can also give the web site more information about your computer than it would otherwise, which may be used to track you, so only say yes if you are expecting fancy 3D graphics and you trust this web site" seems usable?

satao 4y ago

Yes... And people keep bashing at the Safari team for holding the web development back. I mean, it's clear that the Safari team also has their own agenda, regarding competition with the App Store. But the stuff that Google is pushing is just more ways for them to track you in the end.

mmis1000 4y ago
The things safari lack isn't even relevant to privacy. They are more about buggy layout (not the shiny grid layout or style worker, it doesn't even works correctly with css2 a lot of time), incorrectly implemented API (not the 'not implemented due to privacy' one, they are those implemented but reporting wrong result). Firefox also rejects a lot of proposal due to security reasons. But for every one it supported, it works correctly. Instead of work in funny way and require devs to guess the browser and insert ransom workaround just to make it not using the improper result safari gives and breaking the page. Fun fact: Safari doesn't even handle the full ISO8601 correctly until very recent version. A timestamp without timezone will be parsed into incorrect timezone. A timestamp without colon in the middle of timezone don't even be parsed(which is unfortunately go's default output format).
- codedokode 4y ago
  Regarding timezones, this seems to be a fault of ISO standard. Why do they allow several representations of the same thing?

greiskul 4y ago

> Google naturally loves to be able to fingerprint people based on as many metrics as possible, for their ads. I guess that's why they have a explicit policy of prohibiting browser fingerprinting in all their ad business. https://digiday.com/media/googles-opaque-practices-to-restrict-fingerprinting-create-confusion-among-its-ad-tech-partners/amp/ https://digiday.com/media/googles-opaque-practices-to-restri...

anothernewdude 4y ago
It is actually. They want their system to do it, but not the people who buy ads from them, so their advertisers become reliant on google's user segmentation.