5 ms·

I don’t see how it can be used as described to identify an individual person. Multiple requests end up with the same time stamp which means individuals are not

I don’t see how it can be used as described to identify an individual person. Multiple requests end up with the same time stamp which means individuals are not traceable but as an aggregate countable

jahewson 4y ago
Only multiple requests within a given second get the same time stamp. So if you have less than 86k hits per day, then all your time stamps could be unique. Edit: I misread the article here, where it said each visit incremented the counter by one second. So my calculation is not correct!
- bradstewart 4y ago
  But how do I then tie that unique timestamp to an actual person? Which is what GDPR is concerned about. (edit: spelling)
- dahfizz 4y ago
  How do you go from timestamp to identifying someone? ~Every HTTP response has a Date field with a second-resolution timestamp that might be unique. Are you equally concerned about that?
- TylerE 4y ago
  Birthday paradox means that will be far lower.
- Thorrez 4y ago
  No, they are truncating the timestamp to the day. So all visitors to the site on a specific day get the same initial timestamp.
  - jahewson 4y ago
    Ah so they are, thanks! That’s much better. Though for a very, very low-traffic site this would still let me track unique visitors.
    - genewitch 4y ago
      It is designed to track unique visitors, but not differentiate between them at all. both you and i visit the same new site today, we both get a file our browser caches with today's date at 00:00:01. Tomorrow when we go to the same site, our browser says we got the file yesterday, so the server sends a new modified date to the browser, set to tomorrow's date at 00:00:02. Both of us have the same "new" file with the new modification date/time. if i go back the following day, the only thing the server knows for certain, from just this header, is that i've visited twice before. So i'm not counted as a unique visitor. That this could be used by assigning a unique timestamp to each visitor is where everyone's mind is going, and it feels like half are annoyed there's another way to leak information, and the other half are annoyed they didn't think of it prior to the end-of-year marketing bonus deadline.
    - Thorrez 4y ago
      The technique could be used for a lot of tracking. However, it sounds like they're using it just for quite minimal tracking. It sounds like the only thing they're tracking is how many people viewed the site how many times. They'll know that on a particular day, 1 person viewed the site 500 times, but won't know anything identifying about that person (e.g. IP, name, gender, any sort of unique ID).

jahewson 4y ago

Only multiple requests within a given second get the same time stamp. So if you have less than 86k hits per day, then all your time stamps could be unique. Edit: I misread the article here, where it said each visit incremented the counter by one second. So my calculation is not correct!

bradstewart 4y ago
But how do I then tie that unique timestamp to an actual person? Which is what GDPR is concerned about. (edit: spelling)
dahfizz 4y ago
How do you go from timestamp to identifying someone? ~Every HTTP response has a Date field with a second-resolution timestamp that might be unique. Are you equally concerned about that?
TylerE 4y ago
Birthday paradox means that will be far lower.
Thorrez 4y ago
No, they are truncating the timestamp to the day. So all visitors to the site on a specific day get the same initial timestamp.
- jahewson 4y ago
  Ah so they are, thanks! That’s much better. Though for a very, very low-traffic site this would still let me track unique visitors.
  - genewitch 4y ago
    It is designed to track unique visitors, but not differentiate between them at all. both you and i visit the same new site today, we both get a file our browser caches with today's date at 00:00:01. Tomorrow when we go to the same site, our browser says we got the file yesterday, so the server sends a new modified date to the browser, set to tomorrow's date at 00:00:02. Both of us have the same "new" file with the new modification date/time. if i go back the following day, the only thing the server knows for certain, from just this header, is that i've visited twice before. So i'm not counted as a unique visitor. That this could be used by assigning a unique timestamp to each visitor is where everyone's mind is going, and it feels like half are annoyed there's another way to leak information, and the other half are annoyed they didn't think of it prior to the end-of-year marketing bonus deadline.
  - Thorrez 4y ago
    The technique could be used for a lot of tracking. However, it sounds like they're using it just for quite minimal tracking. It sounds like the only thing they're tracking is how many people viewed the site how many times. They'll know that on a particular day, 1 person viewed the site 500 times, but won't know anything identifying about that person (e.g. IP, name, gender, any sort of unique ID).