6 ms·

Cookies was a simple concept that politicians could glom on to and legislate around, but, yes, they're quite unimportant in the grand scale of things. In the e

by jerf 3y ago

Cookies was a simple concept that politicians could glom on to and legislate around, but, yes, they're quite unimportant in the grand scale of things. In the end, you've got two things to work with: Things you can convince the browser to actively identify itself with, and the things you can track regardless. Cookies are in the first category, but they are not alone. You can get things as simple as presenting an entire site with customized URLs that track a user through querystrings being appended to everything with an identifier. You can track certain caching differences. You can program a website to use local storage and submit a token on every URL click with a fairly simple handler. This isn't even remotely a complete list. In the second category, you've got IP address, browser versions, various settings... see something like https://www.amiunique.org/ https://www.amiunique.org/ . In a nutshell, your rich browser experience leaks so much data along so many axes that it is essentially inconceivable that you could ever prevent yourself from being fingerprinted. What you can do is try to detach that fingerprint from a real person, to a certain extent rotate what you can, etc. But in reality you can't be shipping up kilobytes of header information on each web request and expect there isn't something in there that can track you. https://www.amiunique.org/fingerprint https://www.amiunique.org/fingerprint says I'm 100% unique; with all the red lighting up I'm not surprised.

mnw21cam 3y ago
The important bit is that the cookies not only are irrelevant from the point of view of allowing tracking to occur technically, they're also irrelevant from a legal point of view. A company must have your consent to hold and process your information for a specific purpose, regardless of whether or not that is done using cookies or fingerprinting. If you have been presented with a consent popup and have not consented, and the company is tracking you by other methods, then that is illegal. (It'd be illegal also if they hadn't given a consent popup at all.)
- misja111 3y ago
  Under which law is this illegal? I'm only aware of legislation that forces websites to ask for consent for storing cookies.
  - Yujf 3y ago
    GDPR
  - robin_reala 3y ago
    The ePrivacy Directive (collaqually Cookie Law) doesn’t actual specify only cookies. Section 66 of https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32009L0136 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... just talks about third parties storing information on equipment: Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities.
    - Thorrez 3y ago
      That sounds like it applies to cookies and local storage, not all tracking. It doesn't sound like it applies to IP-based or device fingerprint-based tracking.
      - cccbbbaaa 3y ago
        If you are able to identify a unique user from its browser fingerprint, then it's personal data: GDPR applies. And for ad purposes, consent is pretty much required.
- dmattia 3y ago
  This is a critical thing that so many miss. If somebody has a website that doesn't use any cookies, but does send a POST request to www.bigcompanyanalytics.com/send-user-info with a body containing user-identifying information, then that is still illegal if the user has not consented to analytics (if they are in an area that requires opt-in for analytics). Cookies aren't really mentioned in GDPR or other privacy laws, folks just latched onto cookies as one area that can track users. But really, all personal data is subject to most of the privacy laws, including outbound requests as well as stored data. IANAL. But for context from lawyers, see: https://ico.org.uk/for-organisations/direct-marketing-and-electronic-communications/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/how-do-the-cookie-rules-relate-to-the-gdpr/#GDPR2 https://ico.org.uk/for-organisations/direct-marketing-and-el...
  - derefr 3y ago
    How does that work given that web servers have request logs that capture some identifying info? You already know some things about the user before you can even serve them the consent popup.
    - kzzzznot 3y ago
      I’m not an expert on this, but perhaps it’s the usage of that data and linking to a person that crosses the line. A web server’s logs may include the IP and http request they’ve made, but once you start attaching that to an identity instead it might count as data processing.
      - cccbbbaaa 3y ago
        Storing counts as processing under the GDPR; the definition is in article 4. It's not hard to find. > ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e1489-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... One can use the “legitimate interest” basis (recital 49 may be relevant here) or “compliance with a legal obligation” for logging.
leonidasv 3y ago
> You can program a website to use local storage and submit a token on every URL click with a fairly simple handler That still falls into the EU Cookie definition in the law. [0] If a website is doing this regardless of the user choosing not to allow cookies, it's committing a violation in the eyes of the law (in the EU at least). [0] https://softwareengineering.stackexchange.com/a/295212 https://softwareengineering.stackexchange.com/a/295212
gcoakes 3y ago
My favorite thing from that uniqueness website is that it shows cookies enabled as more common and thus more anonymizing. Not that they wouldn't just fingerprint you using those cookies if it was enabled. The other interesting thing is that it lists my plugins and "do not track" settings. They are both fairly unique. So, someone who attempts to anonimize themselves using plugins or browser features are just highlighting themselves. I wonder how unique `wget` would be.
- digging 3y ago
  Yes, I reduced my plugins count in firefox to slightly decrease my uniqueness. piling on additional tracking prevention addons means getting tracked more.
  - 2ICofafireteam 3y ago
    The absence of things can be as profound as their presence.
  - code_duck 3y ago
    Simply using Firefox is a problem in that regard. I think most recent number I saw for Firefox usage was 1%.
    - digging 3y ago
      Yes, that's true. I think Firefox now tries to hide itself by sending a false user agent? Everything is a trade-off though... using a version of firefox that's closer to stock is probably helping a tiny bit. Or maybe it's not, since Firefox wants people to use plugins (and for some reason, doesn't warn of the dingerprinting danger).
      - code_duck 3y ago
        Mine currently says Firefox in it. You can override it without a plugin in the about:config setting general.useragent.override. I would expect that any reasonably sophisticated fingerprinting system would not rely primarily on the useragent, and agree that anything that isn't stock only serves to distinguish you further.
IanCal 3y ago
> Cookies was a simple concept that politicians could glom on to and legislate around, but, yes, they're quite unimportant in the grand scale of things. GDPR absolutely does not rely on specific implementations. Even earlier things I'm pretty sure don't, but GDPR has a much more general coverage. It's extremely important people understand this when they're writing software.
- cccbbbaaa 3y ago
  Correct; the actual “cookie law” (ePrivacy 2002/58/CE) talks about “the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user”. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... So local storage is also covered by this law. For other fingerprinting techniques, if you can identify a user, GDPR applies. And for ad purposes, the only realistic legal basis is consent.
comfypotato 3y ago
I’ve been on a team doing fingerprinting research (specifically entropy sources). It’s amusing that you’re 100% unique and browsing HN commenting about fingerprinting. (You’re exactly a demographic that would be unique.) Most people aren’t unique, far from it. Consider iPhone 14 Pro Max users browsing through a 5G connection. All the users in the same cell look exactly the same. If I had to guess, based on what I know about you (what I mentioned in the previous paragraph), I would guess that you built your own computer. This almost guarantees a unique fingerprint. With the deprecation of 3rd party cookies, we will definitely see an increase in fingerprint-based tracking. That being said, it’s going to look different than unique cookies (and it doesn’t explain OP’s situation. (Or it might actually be that simple. Your fingerprint might be unique between IP re-addressing, and that’s all it is.)
- jerf 3y ago
  I'm on Linux in Brave, so in general that I'm unique didn't surprise me. As you say, that part is expected. Stock Dell laptop, though. Quite a lot of the specific details did surprise me though, to the point of wondering if there's a bug somewhere in their code determining percentages. "Audio context": "sampleRate : 44100, state : suspended" 0.05%? Gyroscope is a green check (I don't even 100% know what that means) and that's 0.13%? "Battery": "charging : true, chargingTime : 0, level : 1", 0.08%? (And is that even useful for fingerprinting over any significant period of time anyhow?)
  - iudqnolq 3y ago
    I suspect their database is very small and doesn't include many normal people. I also think they aren't taking into account the dimension of time: they say that the latest version of chrome is unusual.
- AmericanChopper 3y ago
  I’m pretty skeptical of this of this fingerprint test. I’m on a 5G connection, in a major city with a completely default current gen iPhone, and it seems to think I’m 100% unique. Which I don’t believe for a second.
BiteCode_dev 3y ago
GPRD doesn't target just cookies, but tracking in general, which must be known and consented. So basically what OP says is that most sites are just not following the European laws.
- mort96 3y ago
  Thank you! I find people repeating the "GDPR is stupid because there are other ways to track than using cookies" thing all the time and it's so frustrating. Misinformed comments like that usually end up at the very top of discussions like this.
  - axus 3y ago
    It's hard to convince someone when their livelihood depends on not understanding.
shmapf 3y ago
Looking through that site, one of the things used to identify you is the value of the "do not track" header... So the existence of that header actually makes tracking worse on the web
tinus_hn 3y ago
If a website uses local storage and submits tokens somewhere, the ad network only knows what a user does on that site, not all over the internet and it doesn’t know it’s you when it’s time to pick an ad.

by jerf 3y ago

mnw21cam 3y ago

The important bit is that the cookies not only are irrelevant from the point of view of allowing tracking to occur technically, they're also irrelevant from a legal point of view. A company must have your consent to hold and process your information for a specific purpose, regardless of whether or not that is done using cookies or fingerprinting. If you have been presented with a consent popup and have not consented, and the company is tracking you by other methods, then that is illegal. (It'd be illegal also if they hadn't given a consent popup at all.)

misja111 3y ago
Under which law is this illegal? I'm only aware of legislation that forces websites to ask for consent for storing cookies.
- Yujf 3y ago
  GDPR
- robin_reala 3y ago
  The ePrivacy Directive (collaqually Cookie Law) doesn’t actual specify only cookies. Section 66 of https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32009L0136 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... just talks about third parties storing information on equipment: Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities.
  - Thorrez 3y ago
    That sounds like it applies to cookies and local storage, not all tracking. It doesn't sound like it applies to IP-based or device fingerprint-based tracking.
    - cccbbbaaa 3y ago
      If you are able to identify a unique user from its browser fingerprint, then it's personal data: GDPR applies. And for ad purposes, consent is pretty much required.
dmattia 3y ago
This is a critical thing that so many miss. If somebody has a website that doesn't use any cookies, but does send a POST request to www.bigcompanyanalytics.com/send-user-info with a body containing user-identifying information, then that is still illegal if the user has not consented to analytics (if they are in an area that requires opt-in for analytics). Cookies aren't really mentioned in GDPR or other privacy laws, folks just latched onto cookies as one area that can track users. But really, all personal data is subject to most of the privacy laws, including outbound requests as well as stored data. IANAL. But for context from lawyers, see: https://ico.org.uk/for-organisations/direct-marketing-and-electronic-communications/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/how-do-the-cookie-rules-relate-to-the-gdpr/#GDPR2 https://ico.org.uk/for-organisations/direct-marketing-and-el...
- derefr 3y ago
  How does that work given that web servers have request logs that capture some identifying info? You already know some things about the user before you can even serve them the consent popup.
  - kzzzznot 3y ago
    I’m not an expert on this, but perhaps it’s the usage of that data and linking to a person that crosses the line. A web server’s logs may include the IP and http request they’ve made, but once you start attaching that to an identity instead it might count as data processing.
    - cccbbbaaa 3y ago
      Storing counts as processing under the GDPR; the definition is in article 4. It's not hard to find. > ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e1489-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... One can use the “legitimate interest” basis (recital 49 may be relevant here) or “compliance with a legal obligation” for logging.

leonidasv 3y ago

> You can program a website to use local storage and submit a token on every URL click with a fairly simple handler That still falls into the EU Cookie definition in the law. [0] If a website is doing this regardless of the user choosing not to allow cookies, it's committing a violation in the eyes of the law (in the EU at least). [0] https://softwareengineering.stackexchange.com/a/295212 https://softwareengineering.stackexchange.com/a/295212

gcoakes 3y ago

My favorite thing from that uniqueness website is that it shows cookies enabled as more common and thus more anonymizing. Not that they wouldn't just fingerprint you using those cookies if it was enabled. The other interesting thing is that it lists my plugins and "do not track" settings. They are both fairly unique. So, someone who attempts to anonimize themselves using plugins or browser features are just highlighting themselves. I wonder how unique `wget` would be.

digging 3y ago
Yes, I reduced my plugins count in firefox to slightly decrease my uniqueness. piling on additional tracking prevention addons means getting tracked more.
- 2ICofafireteam 3y ago
  The absence of things can be as profound as their presence.
- code_duck 3y ago
  Simply using Firefox is a problem in that regard. I think most recent number I saw for Firefox usage was 1%.
  - digging 3y ago
    Yes, that's true. I think Firefox now tries to hide itself by sending a false user agent? Everything is a trade-off though... using a version of firefox that's closer to stock is probably helping a tiny bit. Or maybe it's not, since Firefox wants people to use plugins (and for some reason, doesn't warn of the dingerprinting danger).
    - code_duck 3y ago
      Mine currently says Firefox in it. You can override it without a plugin in the about:config setting general.useragent.override. I would expect that any reasonably sophisticated fingerprinting system would not rely primarily on the useragent, and agree that anything that isn't stock only serves to distinguish you further.

IanCal 3y ago

> Cookies was a simple concept that politicians could glom on to and legislate around, but, yes, they're quite unimportant in the grand scale of things. GDPR absolutely does not rely on specific implementations. Even earlier things I'm pretty sure don't, but GDPR has a much more general coverage. It's extremely important people understand this when they're writing software.

cccbbbaaa 3y ago
Correct; the actual “cookie law” (ePrivacy 2002/58/CE) talks about “the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user”. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... So local storage is also covered by this law. For other fingerprinting techniques, if you can identify a user, GDPR applies. And for ad purposes, the only realistic legal basis is consent.

comfypotato 3y ago

I’ve been on a team doing fingerprinting research (specifically entropy sources). It’s amusing that you’re 100% unique and browsing HN commenting about fingerprinting. (You’re exactly a demographic that would be unique.) Most people aren’t unique, far from it. Consider iPhone 14 Pro Max users browsing through a 5G connection. All the users in the same cell look exactly the same. If I had to guess, based on what I know about you (what I mentioned in the previous paragraph), I would guess that you built your own computer. This almost guarantees a unique fingerprint. With the deprecation of 3rd party cookies, we will definitely see an increase in fingerprint-based tracking. That being said, it’s going to look different than unique cookies (and it doesn’t explain OP’s situation. (Or it might actually be that simple. Your fingerprint might be unique between IP re-addressing, and that’s all it is.)

jerf 3y ago
I'm on Linux in Brave, so in general that I'm unique didn't surprise me. As you say, that part is expected. Stock Dell laptop, though. Quite a lot of the specific details did surprise me though, to the point of wondering if there's a bug somewhere in their code determining percentages. "Audio context": "sampleRate : 44100, state : suspended" 0.05%? Gyroscope is a green check (I don't even 100% know what that means) and that's 0.13%? "Battery": "charging : true, chargingTime : 0, level : 1", 0.08%? (And is that even useful for fingerprinting over any significant period of time anyhow?)
- iudqnolq 3y ago
  I suspect their database is very small and doesn't include many normal people. I also think they aren't taking into account the dimension of time: they say that the latest version of chrome is unusual.
AmericanChopper 3y ago
I’m pretty skeptical of this of this fingerprint test. I’m on a 5G connection, in a major city with a completely default current gen iPhone, and it seems to think I’m 100% unique. Which I don’t believe for a second.

BiteCode_dev 3y ago

GPRD doesn't target just cookies, but tracking in general, which must be known and consented. So basically what OP says is that most sites are just not following the European laws.

mort96 3y ago
Thank you! I find people repeating the "GDPR is stupid because there are other ways to track than using cookies" thing all the time and it's so frustrating. Misinformed comments like that usually end up at the very top of discussions like this.
- axus 3y ago
  It's hard to convince someone when their livelihood depends on not understanding.

shmapf 3y ago

Looking through that site, one of the things used to identify you is the value of the "do not track" header... So the existence of that header actually makes tracking worse on the web

tinus_hn 3y ago

If a website uses local storage and submits tokens somewhere, the ad network only knows what a user does on that site, not all over the internet and it doesn’t know it’s you when it’s time to pick an ad.