13 ms·

Introducing Collusion: Discover who’s tracking you online

474 points by tbassetto 15y ago

zerop 15y ago
Great. How does it work...
- xpose2000 15y ago
  My guess is that it looks at HTTP requests on the site and looks to see if cookies are created. Then matches them to a database of sites/services that are known trackers. Essentially, just about any banner advertisement will show up on Collusion. Also, any type of javascript visitor tracking like GetClicky or Google Analytics.
  - Karunamon 15y ago
    As if there wasn't a compelling case for Adblock and the like already..
    - gcp 15y ago
      Adblock doesn't protect you against this. But something like Ghostery sure does.
rohit89 15y ago
Creepy. I wonder if a possible solution (for the tracking across sites part) is to make sure that each website can access only the cookies it creates. For example, chrome creates a seperate process for each tab and the process would have a lock on its cookies such that other processes can't access it. A VM for each process in a way.
- tomg 15y ago
  I think disabling third-party cookies (via your browsers preference) would accomplish this (though it's no VM), with the added benefit of not needing to re-log in for each tab/window. This doesn't, however, block all tracking scripts, as some may get your IP via an embedded 1x1 gif or other request. There's still the issues of super-cookies, or Flash cookies, or scripts that embed a unique image in your cache and then read it out, etc. So for this I recommend AdBlock or Ghostery. Edit: Here's aseful link on this topic: http://samy.pl/evercookie/ http://samy.pl/evercookie/
- nobody_nowhere 15y ago
  Safari does this already, I believe. Certainly on iphone, not sure about on mac.
- gbhn 15y ago
  The cookie protocol already works this way, and has for as long as cookies have existed. The issue is that a website can load content from a third-party domain, and the historical cookie protocol implementation has historically treated those requests as cookie-able. (Hence "tracking pixels," third-party ad services and stats collection, etc.) The demo mentions the privacy concerns of third-party cookies, but does not mention that there are significant positive uses for such cookies. In the demo, reference.com sets cookies for thesaurus.com and dictionary.com, which are different domains run by the same operator. Such cookies allow the operator to provide customized services across the domains. Third-party cookies allow for richer embedded-content experiences. Video is a great example of that. The revenue sites can get from third-party cookied ad networks is significantly higher than from unpersonalized third-party ads. Large sites like HuffPo and NYT are able to sell a lot of their premium inventory directly, so a big reduction there is likely to disproportionately affect smaller sites.
  - Sander_Marechal 15y ago
    I believe rohit89 means something else. Imagine you visit IMDB, which contains resources from doubleclick.net that set a doubleclick.net cookie. Next, surf to the WSJ which also has doubelclick.net content. Your browser could simply not send the doubleclick cookie because it knows that it came through IMDB and not through the WSJ. In order to do this, a browser (or extension) would need to track through which sites a 3rd party cookie was set, and only send the 3rd party if you're on that same site again. Else it should just pretend there is no 3rd party cookie. I'd definitely install an extension that would implement this process.
    - rohit89 15y ago
      Yup, that's what I meant. Sandboxing on a per tab basis. To put it another way, each new tab you open is like a new incognito session.
jeremyarussell 15y ago
This is great, I'm a big fan of transparency, I wonder how long it will take for the site's in question to either a) throw a fit about Collusion, or b) start making some workarounds to prevent it from working right. Which of course will be followed by the Collusion people figuring out how to keep up the transparency. It's times like this I wish I had tons of money, I'd donate a grip to Collusion and anyone else helping prevent sneaky corporations from being, well sneaky.
- draggnar 15y ago
  The one I consider the worst is IMR Worldwide. The best I can make of it is they are affiliated with Nielsen. They don't even have a website. How do I opt out of their tracking? How do I tell this private corporation to stop monitoring me? DoubleClick is very clear. They have a website. I can opt-out. The issue here is transparency.
joejohnson 15y ago
Does the demo require flash? I can't see anything.
- brown9-2 15y ago
  You have to click "click here"
jakubw 15y ago
I couldn't find a link to the source code but it seems to be this project on GitHub: https://github.com/toolness/collusion https://github.com/toolness/collusion
- Wilya 15y ago
  It is indeed this one. It is linked to at the end of the demo.
glinkov 15y ago
Chrome is probably not going to match this service, as google would prefer to track us. Will this drive people back to Mozilla?
- brown9-2 15y ago
  1. There are plenty of Chrome extensions which block trackers like this, such as Ghostery 2. You can disable third-party cookies in Chrome's preferences if you like
- blasterford 15y ago
  The majority of general users have not expressed any sentiment that they mind being tracked in this way on particular websites who have "opted in". In fact, based on advertising trends, they actually find it useful and respond well to it - adverts that show you products that you've recently been browsing for etc.
nthitz 15y ago
Introducing? Here's a post about it from >6 months ago http://threatpost.com/en_us/blogs/collusion-firefox-add-paints-picture-web-tracking-070811 http://threatpost.com/en_us/blogs/collusion-firefox-add-pain...
- StavrosK 15y ago
  Yep, I remember installing this way back when... Pretty nice, though.
- gkoberger 15y ago
  Mozilla works in the open, so our "launches" are rarely new or secret projects. Everything is on GitHub the day it's written. Most things we launch have been around for a while; a launch just signifies it's ready for public consumption. (Note: I work at Mozilla, however have no clue specifically about Collusion.)
nobody_nowhere 15y ago
In case anyone is curious, a couple of the key use cases for the tracking pixels are: 1. Tracking ad frequency and performance (e..g, did you buy something after you saw an ad; don't show you more than X ads for a given product) 2. ID synchronization between ad exchanges, ad buyers, and data targeters 3. Retargeting (e.g., showing you an ad after you've been to a site) 4. 3rd party data: things like guessing whether you're interested in cars or ceramic figurines and selling the ability to target you with ads 5. Site performance data (omniture, google analytics etc)
redstripe 15y ago
I find that unlike disabling cookies altogether, the web is a very usable with cookies set to expire when you close your browser. So all cookie based tracking is reset whenever I restart. In firefox you can alter rules on a per site basis. I only enable permanent cookies on my banking site which asks annoying "secret questions". This demo only showed me 3 cookies from IMDB (which I browsed in this session I guess). Note: the "restore my last session" link in firefox will work against this setting and reload your cookies from the last session.
- vasco 15y ago
  The only place that should indeed be more safe is the one you choose not to clear the data from. Shouldn't it be the other way around?
  - darkstar999 15y ago
    My bank asks dumb questions that the average person could possibly figure out. In which city does my eldest sibling live? Mother's maiden name? These are useless.
    - maxerickson 15y ago
      I've never had a problem getting them to accept answers that have nothing to do with the question and look more like passwords.
      - dhimes 15y ago
        Exactly my solution. And if I'm opening an account in person I usually feel obliged to lecture the poor banker on why these questions are a liability--remember Sarah Palin-- etc.
  - redstripe 15y ago
    I do this for privacy, not for security. It gives me more privacy than the default setting. Perhaps that's an irony that the bank should consider, or anyone that has weird password requirements that end up working against their goal.
brown9-2 15y ago
Very interesting idea and well executed, but the layout of the graph nodes makes it hard to tell who the worst sites are: http://f.cl.ly/items/3A2C0x2a1f0F370Y0d3E/Screen%20shot%202012-02-28%20at%201.55.05%20PM.png http://f.cl.ly/items/3A2C0x2a1f0F370Y0d3E/Screen%20shot%2020... It also seems to want to push some graph nodes off the screen.
- gcp 15y ago
  You can move along and pull the nodes to make it more readable. It's quite cute.
- JonoXia 15y ago
  In a previous version of the visualization, the nodes would increase in size proportionally to the number of incoming links. It was dropped during a UI overhaul as it didn't fit the new visual style. But I'm looking for another way to make the "worst" sites stand out in a crowded graph. I would welcome your suggestions.
nostromo 15y ago
All of these services / plugins / demos are incomplete without analyzing Flash cookies. I worry the result is people thinking they're more anonymous than they really are. (You can view your Flash cookies here: http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager07.html http://www.macromedia.com/support/documentation/en/flashplay...) I'd really like to see the browsers take on this practice. Safari, for example disables 3rd party cookies by default, but leaves open this huge hole via Flash.
- dpres 15y ago
  Can't speak for anyone else, but I always run my browsers with Flash disabled or uninstalled so Flash cookies make no difference to me.
  - grandalf 15y ago
    same here
  - kenrikm 15y ago
    ClicktoFlash/ClicktoPlugin (Mac) is great, you only execute flash if you want to. This little app saves me hours of battery life on my Macbook Air. I don't know what's available on Windows/Linux however if you're on a Mac I can't recommend it enough.
    - jarek 15y ago
      Depending on your browser, you might be able to do this directly in browser setting. In newer Opera versions, the setting to enable click to flash is at opera:config#UserPrefs|EnableOnDemandPlugin
    - caf 15y ago
      The FlashBlock plugin for Firefox provides "click to Flash" functionality.
    - spindritf 15y ago
      > you only execute flash if you want to NoSciprt allows you to do that, so does Flashblock. I'm sure there are similar plugins and extensions for browsers other than Firefox (well, maybe not NoScript, it seems pretty unique).
akashshah 15y ago
Does anyone know the library that is used to plot the graphs dynamically?
- waterside81 15y ago
  Here's the code: https://github.com/toolness/collusion/tree/master/data/ui https://github.com/toolness/collusion/tree/master/data/ui
- JonoXia 15y ago
  It uses the Force-Directed Graph library from d3.js. http://mbostock.github.com/d3/ex/force.html http://mbostock.github.com/d3/ex/force.html
twapi 15y ago
Use Adblock Plus. Stay Happy. :)
Sthorpe 15y ago
Here is my version of a tracker I wrote. https://github.com/sthorpe/tracked https://github.com/sthorpe/tracked It sniffs your local packets and tells you all the sites that connect to your computer while you browse. Then I organize them by number of times connected to your computer. It reveals some really weird sites. Like somehow pandora knows my age and sex....
- computerbob 15y ago
  That is because in the settings of your pandora account it asks for your age and your sex as a preference. They tell you as a side note that it is for ad targeting. Pretty honest (IMHO)
  - Sthorpe 15y ago
    Ahh, I signed up so long ago I had forgotten.
JonoXia 15y ago
Hello! Collusion main developer here. I am excited to be going live with this project and thrilled to see it being discussed on Hacker News (where I am a long time lurker, first time poster). I value the input from the community here. To answer an issue which Nostromo and others have brought up, I am well aware that the addon is incomplete until it also includes data on Flash cookies, tracking pixels, localstorage, iframes, useragent fingerprinting, etc. I plan to add all of these things; the bug for adding Flash cookies is at https://github.com/toolness/collusion/issues/22 https://github.com/toolness/collusion/issues/22 and I would greatly appreciate help with implementation from anyone who's interested (hint, hint!) I'm also working on making the graph actionable, i.e. you should be able to click any node and say "Block" (or "whitelist" for sites you are OK with). Firefox already has the ability to set site-specific 3rd party cookie policies, but the interface to it can charitably be described as "for experts only". Collusion could provide a much more usable way to control your browser's policies. The graph, for those who asked, is drawn using d3.js and SVG. The demo does not require flash; it uses SVG. You just have to click "click here".
- gghh 15y ago
  Hi JonoXia. I was already using collusion since quite a while, I guess I got the pointer here at HN some time ago: http://collusion.toolness.org/ http://collusion.toolness.org/ So what is happening? is the "new" collusion somehow more "official", i.e. released by Mozilla? EDIT: found the old HN post, http://news.ycombinator.com/item?id=2741249 http://news.ycombinator.com/item?id=2741249
  - JonoXia 15y ago
    Hi gghh, Collusion.toolness.org was started as a personal project/experiment by my good friend Atul Varma. It's recently gathered a lot of interest within Mozilla; we're talking about maybe eventually making it into a built-in Firefox feature (no promises). As described on mozilla.org/collusion, we've got a grant from the Ford Foundation to support development on it. So yeah, what's happening now is basically that Mozilla is committing some real development resources to turn it into a proper product.
instakill 15y ago
I just, erm, browsed around in private mode on FF for a bit and when I went back to normal mode, some of those sites are on the graph.
- JonoXia 15y ago
  Hi, Collusion dev here. I don't think that's supposed to happen, as cookies should not be written when in private browsing mode. I'm guessing it's a bug in Collusion's visualization. If you can reproduce the bug using 'generic' websites (I don't want to know about your private browsing habits), would you mind filing a bug report in https://github.com/toolness/collusion/issues https://github.com/toolness/collusion/issues ? It would be a big help. Thanks a lot.
  - mbrubeck 15y ago
    Issue filed and pull request sent. Thanks for the bug report, instakill! :) https://github.com/toolness/collusion/pull/67 https://github.com/toolness/collusion/pull/67
donohoe 15y ago
If anyone plans on porting this to a Chrome extension please let me know!
dubcanada 15y ago
I actually don't mind being tracked... It doesn't really bother me at all. I'd much rather have ads and stuff geared towards what I may be interested in, then some ad for girls pantyhose sale. I know it sounds strange, but it doesn't bother me one bit.
jdangu 15y ago
Publishers are lacking control over who tracks what on their site. My full time project http://www.clarityad.com http://www.clarityad.com monitors third-party ad tags and reports pixels dropped.
Craiggybear 15y ago
Very interesting, however it makes Firefox 10.0.2 crash if you refresh the page or click off the collusion tab then back on to it. At least it does in Linux. Will try it out on OS X later ...
- gcp 15y ago
  Please file a bug if this is reproducible.
magicalist 15y ago
I do find it somewhat ironic that the demo page includes the old > If you're not paying for something, you're not the customer; you're the product being sold. http://www.mozilla.org/en-US/collusion/demo/ http://www.mozilla.org/en-US/collusion/demo/ I also find the name "collusion" unfortunate. Part of my paycheck comes from advertising, and I include google analytics on my site. However, I also work hard to have a crystal clear privacy policy and I don't opt in to the shared analytics logging for my site, so the data only goes to me. But I'm lumped in with the scummiest of ad networks. Mozilla, of course, offers a free browser. Their funding ultimately comes from the "collusion" they're talking about here and the search traffic they generate feeds it. More directly, you can argue that they sell our search data to the highest(?) bidder. Why isn't DDG the default search provider? Why aren't third party cookies disabled by default and the Do Not Track header enabled by default? These are actually hard questions, and trite soundbites that ignore actual economics and the tensions inherent in the internet we have today do us no favors. Transparency is the answer in many of these problems we've created for ourselves, I believe, but we need to be able to talk about them with equal intellectual clarity. edit: as an example, I really liked EFF's Peter Eckersley's quotes in the ars technica article on DNT today: http://arstechnica.com/tech-policy/news/2012/02/can-do-not-track-tame-the-webs-cookie-monsters.ars http://arstechnica.com/tech-policy/news/2012/02/can-do-not-t...
- baltcode 15y ago
  Aren't Mozilla products open source? Someone should offer a pro-privacy flavor which has these settings by default.
  - cpeterso 15y ago
    Why not Mozilla? They developed the Collusion reporter, but why not attack the problem by bundling privacy tools like Ghostery with Firefox?
    - gcp 15y ago
      Ghostery still requires you to somewhat know what you're doing (if you block too much, sites stop working). It's not something that you can bundle by default.
figure8 15y ago
Does my accepting Google's new privacy policy allow them to link information possibly gained via Google Analytics (using their ubiquitous cookies like _utma, _utmb, _utmz) to my other Google product activities?
- tonfa 15y ago
  I don't think so, as far as I understand analytics, there is nothing to link with other Google products since it only uses first party cookies. http://code.google.com/apis/analytics/docs/concepts/gaConceptsOverview.html http://code.google.com/apis/analytics/docs/concepts/gaConcep... On a side note, the doubleclick cookie is explicitly excluded from linking without explicit consent: > We will not combine DoubleClick cookie information with personally identifiable information unless we have your opt-in consent.
  - figure8 15y ago
    Thanks. This was helpful. In theory, I see your point about Google not having direct access to a site's first party cookies, but Google is clever. If you monitor the requested resources when you visit any site with those cookies, you'll notice a request to http://www.google-analytics.com/__utm.gif http://www.google-analytics.com/__utm.gif? followed by parameters sending the values of those cookies to Google. So, they are tracking said cookies.
    - figure8 15y ago
      Furthermore, based on a quick estimate based on my current Firefox cookies, Google is (through Google Analytics) aware of 80%-90% of my browsing activity.
      - tonfa 15y ago
        But the cookie is per analytics domain, right? And not directly linked to other google cookies. So I think Analytics "sees" 80% of your browsing but it's multiple fragments, each going to different analytics domains. It's never seen as a single user.
jonpaul 15y ago
Tip of the hat to Mozilla for innovating and trying to make Firefox the best browser possible. It seems like Chrome usage keeps going up; I'm really happy to see Mozilla not sitting around.
newman314 15y ago
I wonder if RequestPolicy helps block this. My config is as follows: 1. AdBlock (+privacylist) 2. Ghostery 3. RequestPolicy 4. HTTPS Everywhere 5. /etc/hosts with common tracking hosts pointing to 127.0.0.1 6. Disconnect.me 7. Disable 3rd party cookies 8. Uninstall Flash (when I need Flash, I use Chrome) 9. Configure Chrome Flash to not allow any local storage 10. about:config set dom.storage.enabled to false. This is just a start and it would be nice to have some consistent way to disable localstorage.
- DellOrange12 15y ago
  My OS is Ubuntu and my Firefox config is: * AdBlock Plus (with 16 filter subscriptions) * BetterPrivacy * User Agent Switcher * RequestPolicy * NoScript * PrivacyChoice TrackerBlock * Ghostery * QuickJava After installing Collusion and going to both the BBC webpage and a random selection of Gawker Media's webpages, the Collusion graph is empty. I can now confirm my selection of security plug-ins prevents tracking. Sweet! :-D
- throwaway64 15y ago
  if site cookies are blocked on firefox, so is dom storage
newman314 15y ago
Actually, my bigger fear is for mobile browsers which are much further behind in terms of such features as compared to desktop browsers.
- Teapot 15y ago
  And it's a growing problem. For now i guess the only protection is clear Cache and Cookies. And then load it with opt-out cookies.

474 points by tbassetto 15y ago

zerop 15y ago

Great. How does it work...

xpose2000 15y ago
My guess is that it looks at HTTP requests on the site and looks to see if cookies are created. Then matches them to a database of sites/services that are known trackers. Essentially, just about any banner advertisement will show up on Collusion. Also, any type of javascript visitor tracking like GetClicky or Google Analytics.
- Karunamon 15y ago
  As if there wasn't a compelling case for Adblock and the like already..
  - gcp 15y ago
    Adblock doesn't protect you against this. But something like Ghostery sure does.

rohit89 15y ago

Creepy. I wonder if a possible solution (for the tracking across sites part) is to make sure that each website can access only the cookies it creates. For example, chrome creates a seperate process for each tab and the process would have a lock on its cookies such that other processes can't access it. A VM for each process in a way.

tomg 15y ago
I think disabling third-party cookies (via your browsers preference) would accomplish this (though it's no VM), with the added benefit of not needing to re-log in for each tab/window. This doesn't, however, block all tracking scripts, as some may get your IP via an embedded 1x1 gif or other request. There's still the issues of super-cookies, or Flash cookies, or scripts that embed a unique image in your cache and then read it out, etc. So for this I recommend AdBlock or Ghostery. Edit: Here's aseful link on this topic: http://samy.pl/evercookie/ http://samy.pl/evercookie/
nobody_nowhere 15y ago
Safari does this already, I believe. Certainly on iphone, not sure about on mac.
gbhn 15y ago
The cookie protocol already works this way, and has for as long as cookies have existed. The issue is that a website can load content from a third-party domain, and the historical cookie protocol implementation has historically treated those requests as cookie-able. (Hence "tracking pixels," third-party ad services and stats collection, etc.) The demo mentions the privacy concerns of third-party cookies, but does not mention that there are significant positive uses for such cookies. In the demo, reference.com sets cookies for thesaurus.com and dictionary.com, which are different domains run by the same operator. Such cookies allow the operator to provide customized services across the domains. Third-party cookies allow for richer embedded-content experiences. Video is a great example of that. The revenue sites can get from third-party cookied ad networks is significantly higher than from unpersonalized third-party ads. Large sites like HuffPo and NYT are able to sell a lot of their premium inventory directly, so a big reduction there is likely to disproportionately affect smaller sites.
- Sander_Marechal 15y ago
  I believe rohit89 means something else. Imagine you visit IMDB, which contains resources from doubleclick.net that set a doubleclick.net cookie. Next, surf to the WSJ which also has doubelclick.net content. Your browser could simply not send the doubleclick cookie because it knows that it came through IMDB and not through the WSJ. In order to do this, a browser (or extension) would need to track through which sites a 3rd party cookie was set, and only send the 3rd party if you're on that same site again. Else it should just pretend there is no 3rd party cookie. I'd definitely install an extension that would implement this process.
  - rohit89 15y ago
    Yup, that's what I meant. Sandboxing on a per tab basis. To put it another way, each new tab you open is like a new incognito session.

jeremyarussell 15y ago

This is great, I'm a big fan of transparency, I wonder how long it will take for the site's in question to either a) throw a fit about Collusion, or b) start making some workarounds to prevent it from working right. Which of course will be followed by the Collusion people figuring out how to keep up the transparency. It's times like this I wish I had tons of money, I'd donate a grip to Collusion and anyone else helping prevent sneaky corporations from being, well sneaky.

draggnar 15y ago
The one I consider the worst is IMR Worldwide. The best I can make of it is they are affiliated with Nielsen. They don't even have a website. How do I opt out of their tracking? How do I tell this private corporation to stop monitoring me? DoubleClick is very clear. They have a website. I can opt-out. The issue here is transparency.

joejohnson 15y ago

Does the demo require flash? I can't see anything.

brown9-2 15y ago
You have to click "click here"

jakubw 15y ago

I couldn't find a link to the source code but it seems to be this project on GitHub: https://github.com/toolness/collusion https://github.com/toolness/collusion

Wilya 15y ago
It is indeed this one. It is linked to at the end of the demo.

glinkov 15y ago

Chrome is probably not going to match this service, as google would prefer to track us. Will this drive people back to Mozilla?

brown9-2 15y ago
1. There are plenty of Chrome extensions which block trackers like this, such as Ghostery 2. You can disable third-party cookies in Chrome's preferences if you like
blasterford 15y ago
The majority of general users have not expressed any sentiment that they mind being tracked in this way on particular websites who have "opted in". In fact, based on advertising trends, they actually find it useful and respond well to it - adverts that show you products that you've recently been browsing for etc.

nthitz 15y ago

Introducing? Here's a post about it from >6 months ago http://threatpost.com/en_us/blogs/collusion-firefox-add-paints-picture-web-tracking-070811 http://threatpost.com/en_us/blogs/collusion-firefox-add-pain...

StavrosK 15y ago
Yep, I remember installing this way back when... Pretty nice, though.
gkoberger 15y ago
Mozilla works in the open, so our "launches" are rarely new or secret projects. Everything is on GitHub the day it's written. Most things we launch have been around for a while; a launch just signifies it's ready for public consumption. (Note: I work at Mozilla, however have no clue specifically about Collusion.)

nobody_nowhere 15y ago

In case anyone is curious, a couple of the key use cases for the tracking pixels are: 1. Tracking ad frequency and performance (e..g, did you buy something after you saw an ad; don't show you more than X ads for a given product) 2. ID synchronization between ad exchanges, ad buyers, and data targeters 3. Retargeting (e.g., showing you an ad after you've been to a site) 4. 3rd party data: things like guessing whether you're interested in cars or ceramic figurines and selling the ability to target you with ads 5. Site performance data (omniture, google analytics etc)

redstripe 15y ago

I find that unlike disabling cookies altogether, the web is a very usable with cookies set to expire when you close your browser. So all cookie based tracking is reset whenever I restart. In firefox you can alter rules on a per site basis. I only enable permanent cookies on my banking site which asks annoying "secret questions". This demo only showed me 3 cookies from IMDB (which I browsed in this session I guess). Note: the "restore my last session" link in firefox will work against this setting and reload your cookies from the last session.

vasco 15y ago
The only place that should indeed be more safe is the one you choose not to clear the data from. Shouldn't it be the other way around?
- darkstar999 15y ago
  My bank asks dumb questions that the average person could possibly figure out. In which city does my eldest sibling live? Mother's maiden name? These are useless.
  - maxerickson 15y ago
    I've never had a problem getting them to accept answers that have nothing to do with the question and look more like passwords.
    - dhimes 15y ago
      Exactly my solution. And if I'm opening an account in person I usually feel obliged to lecture the poor banker on why these questions are a liability--remember Sarah Palin-- etc.
- redstripe 15y ago
  I do this for privacy, not for security. It gives me more privacy than the default setting. Perhaps that's an irony that the bank should consider, or anyone that has weird password requirements that end up working against their goal.

brown9-2 15y ago

Very interesting idea and well executed, but the layout of the graph nodes makes it hard to tell who the worst sites are: http://f.cl.ly/items/3A2C0x2a1f0F370Y0d3E/Screen%20shot%202012-02-28%20at%201.55.05%20PM.png http://f.cl.ly/items/3A2C0x2a1f0F370Y0d3E/Screen%20shot%2020... It also seems to want to push some graph nodes off the screen.

gcp 15y ago
You can move along and pull the nodes to make it more readable. It's quite cute.
JonoXia 15y ago
In a previous version of the visualization, the nodes would increase in size proportionally to the number of incoming links. It was dropped during a UI overhaul as it didn't fit the new visual style. But I'm looking for another way to make the "worst" sites stand out in a crowded graph. I would welcome your suggestions.

nostromo 15y ago

All of these services / plugins / demos are incomplete without analyzing Flash cookies. I worry the result is people thinking they're more anonymous than they really are. (You can view your Flash cookies here: http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager07.html http://www.macromedia.com/support/documentation/en/flashplay...) I'd really like to see the browsers take on this practice. Safari, for example disables 3rd party cookies by default, but leaves open this huge hole via Flash.

dpres 15y ago
Can't speak for anyone else, but I always run my browsers with Flash disabled or uninstalled so Flash cookies make no difference to me.
- grandalf 15y ago
  same here
- kenrikm 15y ago
  ClicktoFlash/ClicktoPlugin (Mac) is great, you only execute flash if you want to. This little app saves me hours of battery life on my Macbook Air. I don't know what's available on Windows/Linux however if you're on a Mac I can't recommend it enough.
  - jarek 15y ago
    Depending on your browser, you might be able to do this directly in browser setting. In newer Opera versions, the setting to enable click to flash is at opera:config#UserPrefs|EnableOnDemandPlugin
  - caf 15y ago
    The FlashBlock plugin for Firefox provides "click to Flash" functionality.
  - spindritf 15y ago
    > you only execute flash if you want to NoSciprt allows you to do that, so does Flashblock. I'm sure there are similar plugins and extensions for browsers other than Firefox (well, maybe not NoScript, it seems pretty unique).

akashshah 15y ago

Does anyone know the library that is used to plot the graphs dynamically?

waterside81 15y ago
Here's the code: https://github.com/toolness/collusion/tree/master/data/ui https://github.com/toolness/collusion/tree/master/data/ui
JonoXia 15y ago
It uses the Force-Directed Graph library from d3.js. http://mbostock.github.com/d3/ex/force.html http://mbostock.github.com/d3/ex/force.html

twapi 15y ago

Use Adblock Plus. Stay Happy. :)

Sthorpe 15y ago

Here is my version of a tracker I wrote. https://github.com/sthorpe/tracked https://github.com/sthorpe/tracked It sniffs your local packets and tells you all the sites that connect to your computer while you browse. Then I organize them by number of times connected to your computer. It reveals some really weird sites. Like somehow pandora knows my age and sex....

computerbob 15y ago
That is because in the settings of your pandora account it asks for your age and your sex as a preference. They tell you as a side note that it is for ad targeting. Pretty honest (IMHO)
- Sthorpe 15y ago
  Ahh, I signed up so long ago I had forgotten.

JonoXia 15y ago

Hello! Collusion main developer here. I am excited to be going live with this project and thrilled to see it being discussed on Hacker News (where I am a long time lurker, first time poster). I value the input from the community here. To answer an issue which Nostromo and others have brought up, I am well aware that the addon is incomplete until it also includes data on Flash cookies, tracking pixels, localstorage, iframes, useragent fingerprinting, etc. I plan to add all of these things; the bug for adding Flash cookies is at https://github.com/toolness/collusion/issues/22 https://github.com/toolness/collusion/issues/22 and I would greatly appreciate help with implementation from anyone who's interested (hint, hint!) I'm also working on making the graph actionable, i.e. you should be able to click any node and say "Block" (or "whitelist" for sites you are OK with). Firefox already has the ability to set site-specific 3rd party cookie policies, but the interface to it can charitably be described as "for experts only". Collusion could provide a much more usable way to control your browser's policies. The graph, for those who asked, is drawn using d3.js and SVG. The demo does not require flash; it uses SVG. You just have to click "click here".

gghh 15y ago
Hi JonoXia. I was already using collusion since quite a while, I guess I got the pointer here at HN some time ago: http://collusion.toolness.org/ http://collusion.toolness.org/ So what is happening? is the "new" collusion somehow more "official", i.e. released by Mozilla? EDIT: found the old HN post, http://news.ycombinator.com/item?id=2741249 http://news.ycombinator.com/item?id=2741249
- JonoXia 15y ago
  Hi gghh, Collusion.toolness.org was started as a personal project/experiment by my good friend Atul Varma. It's recently gathered a lot of interest within Mozilla; we're talking about maybe eventually making it into a built-in Firefox feature (no promises). As described on mozilla.org/collusion, we've got a grant from the Ford Foundation to support development on it. So yeah, what's happening now is basically that Mozilla is committing some real development resources to turn it into a proper product.

instakill 15y ago

I just, erm, browsed around in private mode on FF for a bit and when I went back to normal mode, some of those sites are on the graph.

JonoXia 15y ago
Hi, Collusion dev here. I don't think that's supposed to happen, as cookies should not be written when in private browsing mode. I'm guessing it's a bug in Collusion's visualization. If you can reproduce the bug using 'generic' websites (I don't want to know about your private browsing habits), would you mind filing a bug report in https://github.com/toolness/collusion/issues https://github.com/toolness/collusion/issues ? It would be a big help. Thanks a lot.
- mbrubeck 15y ago
  Issue filed and pull request sent. Thanks for the bug report, instakill! :) https://github.com/toolness/collusion/pull/67 https://github.com/toolness/collusion/pull/67

donohoe 15y ago

If anyone plans on porting this to a Chrome extension please let me know!

dubcanada 15y ago

I actually don't mind being tracked... It doesn't really bother me at all. I'd much rather have ads and stuff geared towards what I may be interested in, then some ad for girls pantyhose sale. I know it sounds strange, but it doesn't bother me one bit.

jdangu 15y ago

Publishers are lacking control over who tracks what on their site. My full time project http://www.clarityad.com http://www.clarityad.com monitors third-party ad tags and reports pixels dropped.

Craiggybear 15y ago

Very interesting, however it makes Firefox 10.0.2 crash if you refresh the page or click off the collusion tab then back on to it. At least it does in Linux. Will try it out on OS X later ...

gcp 15y ago
Please file a bug if this is reproducible.

magicalist 15y ago

I do find it somewhat ironic that the demo page includes the old > If you're not paying for something, you're not the customer; you're the product being sold. http://www.mozilla.org/en-US/collusion/demo/ http://www.mozilla.org/en-US/collusion/demo/ I also find the name "collusion" unfortunate. Part of my paycheck comes from advertising, and I include google analytics on my site. However, I also work hard to have a crystal clear privacy policy and I don't opt in to the shared analytics logging for my site, so the data only goes to me. But I'm lumped in with the scummiest of ad networks. Mozilla, of course, offers a free browser. Their funding ultimately comes from the "collusion" they're talking about here and the search traffic they generate feeds it. More directly, you can argue that they sell our search data to the highest(?) bidder. Why isn't DDG the default search provider? Why aren't third party cookies disabled by default and the Do Not Track header enabled by default? These are actually hard questions, and trite soundbites that ignore actual economics and the tensions inherent in the internet we have today do us no favors. Transparency is the answer in many of these problems we've created for ourselves, I believe, but we need to be able to talk about them with equal intellectual clarity. edit: as an example, I really liked EFF's Peter Eckersley's quotes in the ars technica article on DNT today: http://arstechnica.com/tech-policy/news/2012/02/can-do-not-track-tame-the-webs-cookie-monsters.ars http://arstechnica.com/tech-policy/news/2012/02/can-do-not-t...

baltcode 15y ago
Aren't Mozilla products open source? Someone should offer a pro-privacy flavor which has these settings by default.
- cpeterso 15y ago
  Why not Mozilla? They developed the Collusion reporter, but why not attack the problem by bundling privacy tools like Ghostery with Firefox?
  - gcp 15y ago
    Ghostery still requires you to somewhat know what you're doing (if you block too much, sites stop working). It's not something that you can bundle by default.

figure8 15y ago

Does my accepting Google's new privacy policy allow them to link information possibly gained via Google Analytics (using their ubiquitous cookies like _utma, _utmb, _utmz) to my other Google product activities?

tonfa 15y ago
I don't think so, as far as I understand analytics, there is nothing to link with other Google products since it only uses first party cookies. http://code.google.com/apis/analytics/docs/concepts/gaConceptsOverview.html http://code.google.com/apis/analytics/docs/concepts/gaConcep... On a side note, the doubleclick cookie is explicitly excluded from linking without explicit consent: > We will not combine DoubleClick cookie information with personally identifiable information unless we have your opt-in consent.
- figure8 15y ago
  Thanks. This was helpful. In theory, I see your point about Google not having direct access to a site's first party cookies, but Google is clever. If you monitor the requested resources when you visit any site with those cookies, you'll notice a request to http://www.google-analytics.com/__utm.gif http://www.google-analytics.com/__utm.gif? followed by parameters sending the values of those cookies to Google. So, they are tracking said cookies.
  - figure8 15y ago
    Furthermore, based on a quick estimate based on my current Firefox cookies, Google is (through Google Analytics) aware of 80%-90% of my browsing activity.
    - tonfa 15y ago
      But the cookie is per analytics domain, right? And not directly linked to other google cookies. So I think Analytics "sees" 80% of your browsing but it's multiple fragments, each going to different analytics domains. It's never seen as a single user.

jonpaul 15y ago

Tip of the hat to Mozilla for innovating and trying to make Firefox the best browser possible. It seems like Chrome usage keeps going up; I'm really happy to see Mozilla not sitting around.

newman314 15y ago

I wonder if RequestPolicy helps block this. My config is as follows: 1. AdBlock (+privacylist) 2. Ghostery 3. RequestPolicy 4. HTTPS Everywhere 5. /etc/hosts with common tracking hosts pointing to 127.0.0.1 6. Disconnect.me 7. Disable 3rd party cookies 8. Uninstall Flash (when I need Flash, I use Chrome) 9. Configure Chrome Flash to not allow any local storage 10. about:config set dom.storage.enabled to false. This is just a start and it would be nice to have some consistent way to disable localstorage.

DellOrange12 15y ago
My OS is Ubuntu and my Firefox config is: * AdBlock Plus (with 16 filter subscriptions) * BetterPrivacy * User Agent Switcher * RequestPolicy * NoScript * PrivacyChoice TrackerBlock * Ghostery * QuickJava After installing Collusion and going to both the BBC webpage and a random selection of Gawker Media's webpages, the Collusion graph is empty. I can now confirm my selection of security plug-ins prevents tracking. Sweet! :-D
throwaway64 15y ago
if site cookies are blocked on firefox, so is dom storage

newman314 15y ago

Actually, my bigger fear is for mobile browsers which are much further behind in terms of such features as compared to desktop browsers.

Teapot 15y ago
And it's a growing problem. For now i guess the only protection is clear Cache and Cookies. And then load it with opt-out cookies.