10 ms·
Threads like this kinda make me sad about HN. Every single comment is about how this technique might possibly be abused to track users in very specific scenario
by dahfizz 4y ago
Threads like this kinda make me sad about HN. Every single comment is about how this technique might possibly be abused to track users in very specific scenarios (i.e. you may be able to identify your most active user).
If a web server wanted to track you, they would just use your IP. This is a clever technical trick to count your number of users without collecting any personal data. I don't understand why that is such a bad thing?
- tinus_hn 4y agoFirst, an IP address is considered personal data in the EU. Second, an IP address is not enough, it may change or be shared. The advertisers ‘need’ to track you forever to serve you relevant ads. So they devise all kinds of tricks to do so.
- rzzzt 4y agoCGNAT complicates matters even further. Sometimes I'm placed way off within <country> if a site tries to go by GeoIP databases, as the provider placed a bunch of households behind a single address.
- aardvarkr 4y ago> First, an IP address is considered personal data in the EU. I don’t believe that’s true. To my knowledge, GDPR only treats IP address as personal data if it is associated with actual identifying information (like name or address). Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR.
- fanso99 4y agoCollecting IP addresses and linking them to a user ID is considered PII as far as I know.
- EGreg 4y agoSo the idea is that you can’t legally collect information in private that you can technically collect. As long as a company is able to keep it a secret, they won’t get caught. Witness the hundreds of violations of public trust by Facebook: https://www.independent.co.uk/tech/facebook-app-recording-camera-iphone-ios-news-feed-bug-update-fix-workaround-a9200696.html?amp https://www.independent.co.uk/tech/facebook-app-recording-ca... The only complete solution is technological!
- mytailorisrich 4y agoThat's correct. IP addresses are not personal data in themselves but they may become so if further data are collected or accessible which allow to identify individuals when used together with IP addresses.
- nottorp 4y agoWe tend to object to people considering it normal to track us. Regardless of means.
- dahfizz 4y agoThis is not tracking. Could you explain why you think it is?
- fanso99 4y agoStoring a cookie with a counter still requires consent afaik. If I am right, then this technique is not sufficiently different and also requires consent.
- robertlagrant 4y agoWhy would that require consent?
- chriswarbo 4y agoConsent is always required; even if you just give people a random UUID, with no associated session/etc., that always requires consent. There is a separate question, of whether consent is implied. If the identifying information is required to provide the user with a service they requested (e.g. a cookie for their online shopping cart), then consent is implied; no need to ask.
- Hnrobert42 4y agoGiving a random UUID and giving someone a counter is significantly different. This is not identifying and thus does not require consent.
- Hnrobert42 4y agoI don’t think this would require consent. It is not, as described in the post, uniquely identifying. It is not even pseudononymous. Thus, it is not personal data and does not require consent.
- deleted 4y ago[deleted]
- fanso99 4y agoMy understanding is that most commenters are less critical of this specific implementation, but are alarmed by how this new technique could be used by other more nefarious parties in the future. Counting visits is probably still not a fully GDPR-complaint use case, as the server stores data on the client's machine which is indistinguishable from a cookie containing a counter.
- Hnrobert42 4y agoIANAL, but I spent a lot of time talking to them about GDPR. First, this data does not and could not be used, if implemented as described in the post, to uniquely identify someone. As such, it is not personal data and not in scope of GDPR. Second, DPAs have bigger fish to fry.
- account42 4y agoI'm pretty sure the police will also have bigger fish to fry than someone who nicks your wallet. But somehow I don't don't you'd see that as a good argument for why that behavior shouldn't be accepted.
- Sohcahtoa82 4y ago> If a web server wanted to track you, they would just use your IP. I'd think a HN user would know that using an IP to track isn't effective. For most home desktop users, at best, it tracks an individual household, not a person. For corporate users and highly privacy-conscious home users, it's probably completely worthless as VPNs will make everyone come from a single IP. For mobile users, it's completely worthless. You'd be tracking users of a specific WiFi network. If your phone is connecting via IPv4, then who knows who you're tracking, as phones on a mobile network will share an IP address.
- ketralnis 4y agoAnd if you think VPN users are too obscure a use case to account for, a specific case I've dealt with is (1) all of AOL coming from one IP in Virginia (yes this was a while ago) and (2) almost every university appearing as a single IP (on a website frequented by university students)
- jgalt212 4y agoAs recently as 2006, an entire country was behind a VPN using a single public IP address. If lore can be believed... https://superuser.com/questions/1013630/why-does-qatar-use-a-single-ip-address-when-800-000-ip-addresses-are-allocated-t https://superuser.com/questions/1013630/why-does-qatar-use-a...
- mike_d 4y agoAt a previous job we tracked unique visitors to prevent ad fraud. You'd find not only individual IPs with thousands of users behind them, but also larger populations of users numbering in the tens of thousands behind a small block of 8-16 IPs. The craziest was a large multinational corporation that (I guess for security?) changed their egress IP daily. The first three octets remained the same and the fourth was equal to the day of the month UTC. Really screws things up when you use a 14 day rolling window of previous traffic for comparisons.
- kccqzy 4y agoUniversities do that now? When I was in college, if one connects to the visitor network they'd give you a RFC1918 address with NAT and a restrictive firewall, but if one connects to the regular network and authenticates as a student, they give you a publicly routable IP address.
- JohnFen 4y agoAfter decades of straight-up abuse by this sector of the industry, including the subversion of countless "privacy respecting" data collection techniques, I think an extraordinary amount of skepticism and suspicion is more than understandable.
- kccqzy 4y agoWhy would you put privacy respecting in quotes? The subversion of those techniques are probably just because those techniques are so new and people haven't had better technologies yet. I personally consider those privacy respecting data collection techniques as a parallel with the development and use of cryptography on the web. In the beginning pretty much no one online used cryptography; later on we started using them but used weak ones ("export" cipher suites for example, or just look at the issues in early protocols like SSL 2.0 or SSL 3.0); nowadays almost everyone uses strong cryptography. Similarly, in the beginning pretty much no one cared about privacy when they did data collection; then we had begun to care more about privacy, but many schemes are easily broken due to for example misguided ideas of anonymization ("anonymization by hashing"), and we are also starting to see the development of newer private information retrieval schemes and differential privacy, etc. Unlike the cynics on this HN thread, I am quite confident that maybe a decade down the road the majority of data collection done by companies will be in a privacy preserving manner. Of course there will be outliers much like there are still websites that don't use https but those will be few and far between.
- JohnFen 4y agoI quoted the term not with the intention of disparaging the notion, but to indicate that I'm referring to a specific class of approaches. That said, the term has also been abused to the point where when it's used, I immediately doubt that it's accurate.
- account42 4y agoRight, it's like the common "We value your privacy" statement when the real meaning is "we put a value on your privacy and want to collect it".
- zackmorris 4y agoI think this cache date trick is clever! There are at least three fallacies with stuff like GDPR that trigger anxiety in people by convincing them that they can somehow safeguard their own privacy while surfing hundreds of websites per day, many in other countries. I'm not going to fully discredit them, just give counterexamples: 1) The internet can continue to work without tracking users - Targeted advertising (can't have both, although I can't say that I'll miss ads) 2) Users care that companies have their personally identifiable information (PII) - Users care how companies share and abuse their data for profit (they already know they're being tracked if they don't use something like TorBrowser) 3) Privacy protections actually result in privacy - PRISM and similar will always find you: https://en.wikipedia.org/wiki/List_of_government_mass_surveillance_projects https://en.wikipedia.org/wiki/List_of_government_mass_survei... So I view all of this security theater with utter skepticism. I think the only thing that can maybe save us is transparency. Letting users download their data and using the threat of audit to keep internet companies honest: https://securiti.ai/blog/dsar-rights-and-compliance/ https://securiti.ai/blog/dsar-rights-and-compliance/ The rest of the squabbling about "no that's PII, you can't save that!" has only resulted in endless nagging and distraction. It's like trying to hide your address from the post office or thinking that your phone number is secret because it's not in the phonebook. Although I do think it's kind of funny to make big companies feel like they're living under a police state. They'll work tirelessly to undermine these protections, which is why we'll eventually abandon them like we did with prohibition and McCarthyism because they just aren't enforceable when everyone is breaking the law. Or (equally likely) they'll work to bolster these laws to create new markets through power imbalance, ensuring that only the largest companies can meet compliance and smaller companies pay some sort of protection money against the threat of litigation, which opens the door to mass corruption. Both of these scenarios are ugly enough that I think this entire rabbit hole is suspect.
- EGreg 4y agoI mean, if people wanted to track visitors without cookies, they’d just use etags… https://www.secjuice.com/etag-entity-tag-tracking/ https://www.secjuice.com/etag-entity-tag-tracking/ Has Apple’s ITP closed this particular loophole by ignoring etags in third party iframes and capping them to 7 days etc. ? It seems browsers will want to restrict ALL first party cookies to 7 days unless the visitor explicitly allows some domain to store their identity. Frankly speaking, identity can be done better without cookies. Look at Web3 sign-ins, we need something built into the browser and seamless. For now maybe an extension. Then browser makers can have a privacy mode that retires cookies, entirely. But how are you supposed to do caching without storing and sending identifying data equivalent to cookies? Thoughts?
- IshKebab 4y agoIt's not a clever technical trick. It's a pointless technical trick. You can do exactly the same thing with cookies and they are better for privacy because there's an opt out mechanism. They're how you're supposed to do this sort of thing. Using a trick like this is no different to cookies in the eyes of the GDPR. So the only reason to use this trick is if you don't want to respect your users' privacy by being able to block cookies.
- Hnrobert42 4y agoThis is significantly different from than cookies from a GDPR perspective. This is not uniquely identifying. There is no way for the site to know if you are this user who has visited 100 times or that user who was visited 100 times.
- IshKebab 4y agoNo it isn't. Cookies don't have to uniquely identify you. Just put "visit_count=5" or whatever in a cookie.
- mozman 4y agoFingerprinting using WebRTC is far more effective. IPs are useless.