7 ms·

IE10's 'Do-Not-Track' Default Dies Quick Death

77 points by mproud 14y ago

ggchappell 14y ago
An issue sidestepped by this article is whether the statement in the second paragraph is correct: > ... tech and ad companies who say they comply with Do Not Track could simply ignore the flag set by IE 10 and track those who use that browser. That doesn't quite work. Web servers don't know what browser is on the other end of a connection. Yes, they know the "User-Agent:" line, but that is not the same thing. Claiming to follow a privacy standard, but then ignoring it based on a conclusion reached via fallible means, is a bit scary. It strikes me as the beginning of a slippery slope, regardless of what position Microsoft ultimately takes with IE 10.
- Animus7 14y ago
  So don't forge your headers. I don't see how this would be slippery at all.
  - eli 14y ago
    The parent's point is that some of those IE10 users aren't just stuck with a default, they really did intend to turn DNT on.
    - adgar 14y ago
      Which is why DNT makes zero sense to be on by default.
  - ggchappell 14y ago
    Does the DNT standard require that User-Agent strings correctly reflect the browser? [1] Guaranteeing a site follows DNT means that it will follow it, not that it will follow it only if headers are not forged. Also, is "forging" really a dishonest thing in this instance? Browsers have been making themselves look like other browsers for years, in order to deal with stupid servers that make incorrect assumptions about the User-Agent string. [1] Not a rhetorical question. I don't know the answer.
- rurounijones 14y ago
  Yea, the whole idea of "They are not following part of the spec so we can treat them differently" seems like a sketchy argument. Is there a clearing house for certifying browsers as DNT compliant? Or can the websites just say "Oh, THAT browser? Well I don't think it is DNT compliant so I am going to ignore the DNT headers even though they are perfectly to spec"
pippy 14y ago
The whole concept of DNT is just stupid. It's misleading users and won't work. By telling users you have better privacy simply because your browser adds a random header tag onto requests you're misleading them. Sites have no obligation to obey it and it will give users a false sense of security. We already have proven, well defined method of DNT already: private browsing. This works by simply removing resources after the session ends. There's no reliance on servers, so it will always work.
- Animus7 14y ago
  > Sites have no obligation to obey it and it will give users a false sense of security. Until appropriate legislation comes into play. It worked reasonably well with the Do Not Call lists.
  - deleted 14y ago
    [deleted]
  - untog 14y ago
    Telephone networks are still largely national-based. The idea of individual countries implementing "Do Not Track" legislation is a mess. Do they only enforce it on sites based in their own country? If so, it's useless to users. If they apply it to all countries, it won't work.
  - gringomorcego 14y ago
    Germany still passes screwed up laws, but in terms of privacy they are leading the charge. Catching up is a matter of when, not if.
    - Xylakant 14y ago
      Message from Germany: Doesn't look like that from here. Our politicians are fighting the wrong battles and loosing most of them as well. I haven't seen a single law passed in the last 10 years that actually enhanced privacy in the real world.
  - 14y ago
mparlane 14y ago
Now imagine if Chrome made incognito browsing the default and you had to access a submenu to get a cookie keeper. Disrupt the web!
- eli 14y ago
  I don't think google is going to be the one leading the charge against targeted advertising.
  - mparlane 14y ago
    I realise this, I used Chrome as the example as I imagine it has the largest audience of users here. I wish I could set incognito per site. I.e. opt in to cookie keeping. e.g. set cookie_keeping=true for gmail.com.
deleted 14y ago
[deleted]
martingordon 14y ago
Does the current spec take into account that unscrupulous ISPs (I'm thinking about hotel WiFi in particular) can strip the header before forwarding a request to a server?
- lotu 14y ago
  It says they shouldn't do that. But you are never going to see enforcement, stripping headers can be sold as "security" to hotels who have no clue what they are doing.
ars 14y ago
Turning on DNT by default is a great way to ensure it will be utterly ignored. So I quite support the requirement that people explicitly enable it. Remember the DNT is voluntary - but if everyone does it by default, then there is nothing left to track, so websites will have no interest in paying attention to the flag.
- melvinmt 14y ago
  > then there is nothing left to track Isn't that the whole point? Websites may not have interest in tracking disabling policies, but a lot of people do. Maybe these advertising companies ought to incentivize users to opt-in to sell their data instead of the other way around.
  - coopdog 14y ago
    The whole business model is that users don't care if they're tracked, so let's track them (and others) and do things for them that we couldn't before I can see Google fully implementing DNT on the basis that users don't care, and for the few that do they're happy to comply But making it default to on, especially if no one gives a damn is the death knell to the whole business model Suddenly you have to pay for everything. Although I would be interested in using DNT if out had more granular control to block certain entities
    - ars 14y ago
      > Suddenly you have to pay for everything. I wonder if we'll see sites who honor the header, but require that it be off in order to access content.
      - Achshar 14y ago
        Na.. that will be too much work for the user, plus disabling DNT will mean it's disabled for everyone, not just the said website. It also does not make alot of sense, disabling DNT does not make site any money directly. So it will only raise suspicion in a casual user's minds, that why would the site need to track him/her when there is no apparent monetary profit to the site. Instead they can show a banner that DNT is enabled and when it is disabled, the banner is gone.
Cogito 14y ago
What is the situation if a user agent, on installation/upgrade, asks a user to update their DNT status but in doing so defaults to on? The user has to explicitly agree to turning this setting on (as they have to accept the configuration before proceeding), and is able to turn it off, but most people will just click through anyway.
- ars 14y ago
  If too many people turn on DNT websites will start ignoring it.
  - lwat 14y ago
    Most websites will just ignore it from day 1 anyway.
awaythrow 14y ago
Good for privacy litigation. "My client had DNT in her browser set to 'on' and the company intentionally ignored this and tracked her actions on the web, vioalting her right to privacy and causing monetary damages in the amount of $________." Web developers might hate it, but DNT could be potentially good for end-users who want to make privacy claims. It's just one extra header. A few extra bytes. Meanwhile things like XML and JSON, which add considerable bloat to web responses, are accepted without any complaint.
- lotu 14y ago
  On the other hand now every single line of code that gets changed has to reviews by a lawyer to make sure it is compliant with the DNT legislation. And if your a startup, the best way to take you down is probably a couple of frivolous DNT lawsuits.
rurounijones 14y ago
So instead IE10, on first run should just pop up a very scary looking dialog filled with text on why the user should choose the "do not let websites track me" button instead of the "Let websites track me" one. It is not default, the user has to choose.
jcampbell1 14y ago
This is sad. DNT is may be a good thing. Whenever you visit a website with an ad, DoubleClick knows you looked at that article, and uses that to build a profile about your preferences. I don't think when your average joe reads an article that it is fair that their preferences are being tracked in this way. We should survey the public and ask: "Do you think it is okay that internet ad companies use the type of article you read to target ads that are more likely relevant to you?" That is a reasonable question that gets to the crux of the issue. Retargeting and profile targeting may be borderline unethical, but Google and I both make good money doing it. I am not sure it is right, but we both have a vested interest in making sure we can continue.
clhodapp 14y ago
I apologize in advance that this will probably end up looking a bit like a rant. I'm sorry, but what is the deal with web-based tracking? I see comments like > Whenever you visit a website with an ad, DoubleClick knows you looked at that article, and uses that to build a profile about your preferences. I don't think when your average joe reads an article that it is fair that their preferences are being tracked in this way. and I honestly wonder how this sentiment can be so common, given the realities of our current society (note: this comment is not meant to say anything bad about that comment's author, it's just a convenient example of a trend in the discourse on this topic). First, we give up many "rights" as tradeoffs for other things that we want. We have the right to the pay from our jobs, but that doesn't mean that we are entitled to get things from the store for free. We have to give up ownership rights of our money in order to trade it for goods and services. We have the right to free speech, but that doesn't mean that someone can't ask us to leave their home or other property if we say something that upsets them. We give up our right to say whatever we want by going onto someone else's property. This sort of situation is so common that it would be impossible for me to list all of the times in which we are faced with it here. However, this argument would not be complete unless I also stated that web-based tracking is in exactly this category: someone has set up a situation where your computer can exchange data with their server. However, in doing so, it is possible that they will notice that you have done so and keep a record of this fact. In other words, if you, through your computer, communicate with a company or individual, that company or individual may know that you communicated with them and what the contents of those communications were. You are giving up your right not to be known to have performed a behavior by a set of potential witnesses in exchange for performing that behavior in front of those witnesses. It's unreasonable to say that, just because you are communicating through computerized agents the other party should not be able to keep a record of your exchange. Second, it is unfathomable (edit: To me. Please, tell me how your opinion differs) that this could be an issue for people because this is the state in which we constantly live. Every time you leave your house, your neighbors may take notice. Every time you go to the store, your actions are recorded (tracked!) by security cameras. The clerk knows what you bought and may recognize you as a regular customer. If you use a credit or loyalty card, the store keeps keeps a log (tracks) your purchases and builds a demographic profile. At a casino, the floor manager watches you gamble over security cameras. If they notice you winning a lot, they may ask you to leave for the day. I could go on like this all day. The point is that there are all kinds of times where we are tracked and where the only way to opt out is not to have dealings with the tracking entity or to not go out in public. There are all kinds of businesses built around or supplemented by tracking people. It seems to me that the tracking-things-you-witness ship has already sailed and if people wish to bring it back into harbor, they will first need to establish a reasonable test that makes it clear when tracking is actually abusive. It seems very unlikely to me that any test that wasn't specifically designed to do so would label all internet-based tracking as abusive, as some people seem to do, while calling these other behaviors OK. Am I wrong? Am I just an asshole?
TomGullen 14y ago
Honest question, why do people care if they are being tracked? The amount I care is quite far off from the amount everyone else seems to care, could someone educate me on why I need to care more?
- BitMastro 14y ago
  The same for me. Why should I care if I'm tracked? And if I don't want to be tracked I'll use private browsing (it's not just for porn, you know?). If I want even more privacy I'll use a clean vm, or if I'm going paranoid I could use an anonymous proxy or similar.
  - JoeAltmaier 14y ago
    Consider bubbling, e.g. Google returns search results consistent with your previous clickthroughs. You end up seeing only results you agree with; it insulates your searching experience from disturbing foreign ideas like evolution or liberalism. Tracking can be done by servers, using a workstation signature (ip/port, installed software versions etc, been discussed in other posts), it doesn't require your client station's consent (cookies).
    - BitMastro 14y ago
      Yet, when I look for "python", I'm not interested in snakes. When I look for "eclipse", it's almost sure that I'm not looking for astrological phenomena or (spare me!) books. It's incredibly useful to write "cinema" without having to specify which city I'm obviously in. The point is: I want to be bubbled. In almost every situation, apart from reading opinions, it is the right thing to do for me. In my humble opinion, the bubbling effect is overrated and (should be) avoidable with private browsing. Am I wrong?
    - TomGullen 14y ago
      A fair point, but the sentiment I get from the most vocal people is that it's to do with their privacy.

77 points by mproud 14y ago

An issue sidestepped by this article is whether the statement in the second paragraph is correct: > ... tech and ad companies who say they comply with Do Not Track could simply ignore the flag set by IE 10 and track those who use that browser. That doesn't quite work. Web servers don't know what browser is on the other end of a connection. Yes, they know the "User-Agent:" line, but that is not the same thing. Claiming to follow a privacy standard, but then ignoring it based on a conclusion reached via fallible means, is a bit scary. It strikes me as the beginning of a slippery slope, regardless of what position Microsoft ultimately takes with IE 10.

Animus7 14y ago
So don't forge your headers. I don't see how this would be slippery at all.
- eli 14y ago
  The parent's point is that some of those IE10 users aren't just stuck with a default, they really did intend to turn DNT on.
  - adgar 14y ago
    Which is why DNT makes zero sense to be on by default.
- ggchappell 14y ago
  Does the DNT standard require that User-Agent strings correctly reflect the browser? [1] Guaranteeing a site follows DNT means that it will follow it, not that it will follow it only if headers are not forged. Also, is "forging" really a dishonest thing in this instance? Browsers have been making themselves look like other browsers for years, in order to deal with stupid servers that make incorrect assumptions about the User-Agent string. [1] Not a rhetorical question. I don't know the answer.
rurounijones 14y ago
Yea, the whole idea of "They are not following part of the spec so we can treat them differently" seems like a sketchy argument. Is there a clearing house for certifying browsers as DNT compliant? Or can the websites just say "Oh, THAT browser? Well I don't think it is DNT compliant so I am going to ignore the DNT headers even though they are perfectly to spec"

pippy 14y ago

The whole concept of DNT is just stupid. It's misleading users and won't work. By telling users you have better privacy simply because your browser adds a random header tag onto requests you're misleading them. Sites have no obligation to obey it and it will give users a false sense of security. We already have proven, well defined method of DNT already: private browsing. This works by simply removing resources after the session ends. There's no reliance on servers, so it will always work.

Animus7 14y ago
> Sites have no obligation to obey it and it will give users a false sense of security. Until appropriate legislation comes into play. It worked reasonably well with the Do Not Call lists.
- deleted 14y ago
  [deleted]
- untog 14y ago
  Telephone networks are still largely national-based. The idea of individual countries implementing "Do Not Track" legislation is a mess. Do they only enforce it on sites based in their own country? If so, it's useless to users. If they apply it to all countries, it won't work.
- gringomorcego 14y ago
  Germany still passes screwed up laws, but in terms of privacy they are leading the charge. Catching up is a matter of when, not if.
  - Xylakant 14y ago
    Message from Germany: Doesn't look like that from here. Our politicians are fighting the wrong battles and loosing most of them as well. I haven't seen a single law passed in the last 10 years that actually enhanced privacy in the real world.
- 14y ago

mparlane 14y ago

Now imagine if Chrome made incognito browsing the default and you had to access a submenu to get a cookie keeper. Disrupt the web!

eli 14y ago
I don't think google is going to be the one leading the charge against targeted advertising.
- mparlane 14y ago
  I realise this, I used Chrome as the example as I imagine it has the largest audience of users here. I wish I could set incognito per site. I.e. opt in to cookie keeping. e.g. set cookie_keeping=true for gmail.com.

deleted 14y ago

[deleted]

martingordon 14y ago

Does the current spec take into account that unscrupulous ISPs (I'm thinking about hotel WiFi in particular) can strip the header before forwarding a request to a server?

lotu 14y ago
It says they shouldn't do that. But you are never going to see enforcement, stripping headers can be sold as "security" to hotels who have no clue what they are doing.

ars 14y ago

Turning on DNT by default is a great way to ensure it will be utterly ignored. So I quite support the requirement that people explicitly enable it. Remember the DNT is voluntary - but if everyone does it by default, then there is nothing left to track, so websites will have no interest in paying attention to the flag.

melvinmt 14y ago
> then there is nothing left to track Isn't that the whole point? Websites may not have interest in tracking disabling policies, but a lot of people do. Maybe these advertising companies ought to incentivize users to opt-in to sell their data instead of the other way around.
- coopdog 14y ago
  The whole business model is that users don't care if they're tracked, so let's track them (and others) and do things for them that we couldn't before I can see Google fully implementing DNT on the basis that users don't care, and for the few that do they're happy to comply But making it default to on, especially if no one gives a damn is the death knell to the whole business model Suddenly you have to pay for everything. Although I would be interested in using DNT if out had more granular control to block certain entities
  - ars 14y ago
    > Suddenly you have to pay for everything. I wonder if we'll see sites who honor the header, but require that it be off in order to access content.
    - Achshar 14y ago
      Na.. that will be too much work for the user, plus disabling DNT will mean it's disabled for everyone, not just the said website. It also does not make alot of sense, disabling DNT does not make site any money directly. So it will only raise suspicion in a casual user's minds, that why would the site need to track him/her when there is no apparent monetary profit to the site. Instead they can show a banner that DNT is enabled and when it is disabled, the banner is gone.

Cogito 14y ago

What is the situation if a user agent, on installation/upgrade, asks a user to update their DNT status but in doing so defaults to on? The user has to explicitly agree to turning this setting on (as they have to accept the configuration before proceeding), and is able to turn it off, but most people will just click through anyway.

ars 14y ago
If too many people turn on DNT websites will start ignoring it.
- lwat 14y ago
  Most websites will just ignore it from day 1 anyway.

awaythrow 14y ago

Good for privacy litigation. "My client had DNT in her browser set to 'on' and the company intentionally ignored this and tracked her actions on the web, vioalting her right to privacy and causing monetary damages in the amount of $________." Web developers might hate it, but DNT could be potentially good for end-users who want to make privacy claims. It's just one extra header. A few extra bytes. Meanwhile things like XML and JSON, which add considerable bloat to web responses, are accepted without any complaint.

lotu 14y ago
On the other hand now every single line of code that gets changed has to reviews by a lawyer to make sure it is compliant with the DNT legislation. And if your a startup, the best way to take you down is probably a couple of frivolous DNT lawsuits.

rurounijones 14y ago

So instead IE10, on first run should just pop up a very scary looking dialog filled with text on why the user should choose the "do not let websites track me" button instead of the "Let websites track me" one. It is not default, the user has to choose.

jcampbell1 14y ago

This is sad. DNT is may be a good thing. Whenever you visit a website with an ad, DoubleClick knows you looked at that article, and uses that to build a profile about your preferences. I don't think when your average joe reads an article that it is fair that their preferences are being tracked in this way. We should survey the public and ask: "Do you think it is okay that internet ad companies use the type of article you read to target ads that are more likely relevant to you?" That is a reasonable question that gets to the crux of the issue. Retargeting and profile targeting may be borderline unethical, but Google and I both make good money doing it. I am not sure it is right, but we both have a vested interest in making sure we can continue.

clhodapp 14y ago

I apologize in advance that this will probably end up looking a bit like a rant. I'm sorry, but what is the deal with web-based tracking? I see comments like > Whenever you visit a website with an ad, DoubleClick knows you looked at that article, and uses that to build a profile about your preferences. I don't think when your average joe reads an article that it is fair that their preferences are being tracked in this way. and I honestly wonder how this sentiment can be so common, given the realities of our current society (note: this comment is not meant to say anything bad about that comment's author, it's just a convenient example of a trend in the discourse on this topic). First, we give up many "rights" as tradeoffs for other things that we want. We have the right to the pay from our jobs, but that doesn't mean that we are entitled to get things from the store for free. We have to give up ownership rights of our money in order to trade it for goods and services. We have the right to free speech, but that doesn't mean that someone can't ask us to leave their home or other property if we say something that upsets them. We give up our right to say whatever we want by going onto someone else's property. This sort of situation is so common that it would be impossible for me to list all of the times in which we are faced with it here. However, this argument would not be complete unless I also stated that web-based tracking is in exactly this category: someone has set up a situation where your computer can exchange data with their server. However, in doing so, it is possible that they will notice that you have done so and keep a record of this fact. In other words, if you, through your computer, communicate with a company or individual, that company or individual may know that you communicated with them and what the contents of those communications were. You are giving up your right not to be known to have performed a behavior by a set of potential witnesses in exchange for performing that behavior in front of those witnesses. It's unreasonable to say that, just because you are communicating through computerized agents the other party should not be able to keep a record of your exchange. Second, it is unfathomable (edit: To me. Please, tell me how your opinion differs) that this could be an issue for people because this is the state in which we constantly live. Every time you leave your house, your neighbors may take notice. Every time you go to the store, your actions are recorded (tracked!) by security cameras. The clerk knows what you bought and may recognize you as a regular customer. If you use a credit or loyalty card, the store keeps keeps a log (tracks) your purchases and builds a demographic profile. At a casino, the floor manager watches you gamble over security cameras. If they notice you winning a lot, they may ask you to leave for the day. I could go on like this all day. The point is that there are all kinds of times where we are tracked and where the only way to opt out is not to have dealings with the tracking entity or to not go out in public. There are all kinds of businesses built around or supplemented by tracking people. It seems to me that the tracking-things-you-witness ship has already sailed and if people wish to bring it back into harbor, they will first need to establish a reasonable test that makes it clear when tracking is actually abusive. It seems very unlikely to me that any test that wasn't specifically designed to do so would label all internet-based tracking as abusive, as some people seem to do, while calling these other behaviors OK. Am I wrong? Am I just an asshole?

TomGullen 14y ago

Honest question, why do people care if they are being tracked? The amount I care is quite far off from the amount everyone else seems to care, could someone educate me on why I need to care more?

BitMastro 14y ago
The same for me. Why should I care if I'm tracked? And if I don't want to be tracked I'll use private browsing (it's not just for porn, you know?). If I want even more privacy I'll use a clean vm, or if I'm going paranoid I could use an anonymous proxy or similar.
- JoeAltmaier 14y ago
  Consider bubbling, e.g. Google returns search results consistent with your previous clickthroughs. You end up seeing only results you agree with; it insulates your searching experience from disturbing foreign ideas like evolution or liberalism. Tracking can be done by servers, using a workstation signature (ip/port, installed software versions etc, been discussed in other posts), it doesn't require your client station's consent (cookies).
  - BitMastro 14y ago
    Yet, when I look for "python", I'm not interested in snakes. When I look for "eclipse", it's almost sure that I'm not looking for astrological phenomena or (spare me!) books. It's incredibly useful to write "cinema" without having to specify which city I'm obviously in. The point is: I want to be bubbled. In almost every situation, apart from reading opinions, it is the right thing to do for me. In my humble opinion, the bubbling effect is overrated and (should be) avoidable with private browsing. Am I wrong?
  - TomGullen 14y ago
    A fair point, but the sentiment I get from the most vocal people is that it's to do with their privacy.