8 ms·

The whole concept of DNT is just stupid. It's misleading users and won't work. By telling users you have better privacy simply because your browser adds a rand

by pippy 14y ago

The whole concept of DNT is just stupid. It's misleading users and won't work. By telling users you have better privacy simply because your browser adds a random header tag onto requests you're misleading them. Sites have no obligation to obey it and it will give users a false sense of security. We already have proven, well defined method of DNT already: private browsing. This works by simply removing resources after the session ends. There's no reliance on servers, so it will always work.

Animus7 14y ago
> Sites have no obligation to obey it and it will give users a false sense of security. Until appropriate legislation comes into play. It worked reasonably well with the Do Not Call lists.
- deleted 14y ago
  [deleted]
- untog 14y ago
  Telephone networks are still largely national-based. The idea of individual countries implementing "Do Not Track" legislation is a mess. Do they only enforce it on sites based in their own country? If so, it's useless to users. If they apply it to all countries, it won't work.
- gringomorcego 14y ago
  Germany still passes screwed up laws, but in terms of privacy they are leading the charge. Catching up is a matter of when, not if.
  - Xylakant 14y ago
    Message from Germany: Doesn't look like that from here. Our politicians are fighting the wrong battles and loosing most of them as well. I haven't seen a single law passed in the last 10 years that actually enhanced privacy in the real world.
- mbrubeck 14y ago
  Or if a large portion of the industry decides to voluntarily adopt the standard, to counter the threat of legislation. A number of large ad networks have already announced support for DNT. Sure, there will always be sites that ignore the header, but there's also a realistic chance that it will give users a meaningful choice about how their behavioral data is used by many of the biggest sites they use most often.
  - rbanffy 14y ago
    If a large portion of the industry adopts it and that prevents legislation, the end users have an even more false sense of security.
  - stingraycharles 14y ago
    As the CTO of an adserving company, I can confirm that we consider (too) strict legislation a big threat, and as such are more than willing to adopt initiatives like the DNT header.
  - ticks 14y ago
    The good thing about legislation is you can go after those minority of bad guys. That's what happens when businesses call individuals who are on these privacy lists, they are reported to a regulator and the regulator investigates.
- elehack 14y ago
  There's a crucial difference: it's easy to tell when someone violates a Do Not Call list. They call you. It's a lot harder to detect, and probably harder yet to prove, when they're engaging in illicit tracking.
- lhnn 14y ago
  As if that would be appropriate or necessary to solve whatever privacy problems we have. It's the U.S. government trying to take anonymity and privacy away from the Internet; do we want them making weak, unenforceable, irremovable laws on how to implement an HTTP header?
- cheatercheater 14y ago
  Yeah, because the Internet is american. In fact, all the servers are in Kentucky.
- ZoFreX 14y ago
  Ha! People have been getting around the do not call lists in the UK for years now by dialling in from other countries where our regulatory bodies are powerless. Trying to regulate it on the world wide web would be even harder.
lotu 14y ago
I agree 100%, this whole fiasco is just a about convincing the US Congress not do anything (which they shouldn't btw). Anyways, the DNT specification has exceptions in it large enough to drive a truck through. On the other hand if it would finally shut up people whining about being tracked online that would be worth (though I doubt it will, as whining is too much fun).
CyrusL 14y ago
Individual sites are not really the ones auctioning ad inventory that is targeted by a user's cookies. That specific technology continues to become consolidated in a handful of exchanges. You could probably get 95%+ of cookie-targeted impressions compliant by regulating 5 or 10 companies.
ZeroGravitas 14y ago
I agree with your critique of DNT, but private browsing isn't magic, there's plenty a bad actor could do to track you regardless of what you throw away at the end of the session, which means the same critique applies (unless you're using it for it's intended purpose, privacy from other users of your computer, and even then it's got holes).
- BitMastro 14y ago
  How?
  - mike-cardwell 14y ago
    Current implementations of private browsing just throw everything away at the end of a session. That doesn't prevent cross site tracking during a session. If you start up a browser in private browsing mode, then log in to Facebook and visit some site with a like button on it. Facebook still knows you visited that site. At least, I think that's how it works.
    - BitMastro 14y ago
      Thanks. So a better implementation should perhaps instantiate a different session for each browser window (sharing the same session for the tabs in the same window). The user should also avoid logging in to any service linked to a known profile.
      - mike-cardwell 14y ago
        A better implementation would be one which instantiates a different session not on a per window basis, or even a per tab basis, but on a per "domain in address bar" basis. And by session, this wouldn't just be the cookie store, it would also be the cache store and everything else which can be manipulated for tracking purposes. EDIT: I'd also want it clearing between browser restarts too. If this became (over night) the default standard way for browsers to behave, the vast vast majority of websites (at least 99.9% I'd guess) would continue to work without issue and it would pretty much annihilate nearly all privacy/tracking issues on the web. Stuff like Google Analytics would continue to be able to work, but wouldn't be able to gather as many different types of information. Advertisers would be able to continue to advertise, but they would lose the ability to track you across sites, which potentially might hit their revenue a bit.
naner 14y ago
We already have proven, well defined method of DNT already: private browsing. You are still being tracked with private browsing. You IP, user agent, OS, screen resolution, etc. are enough to connect the dots in most situations. This is a decent idea that will need to be implemented to some degree if sites are eventually going to support under-13s, since it is illegal to track their behavior under current law. But you are right, I don't see a lot of places voluntarily signing up to make less money.

by pippy 14y ago

Animus7 14y ago

> Sites have no obligation to obey it and it will give users a false sense of security. Until appropriate legislation comes into play. It worked reasonably well with the Do Not Call lists.

deleted 14y ago
[deleted]
untog 14y ago
Telephone networks are still largely national-based. The idea of individual countries implementing "Do Not Track" legislation is a mess. Do they only enforce it on sites based in their own country? If so, it's useless to users. If they apply it to all countries, it won't work.
gringomorcego 14y ago
Germany still passes screwed up laws, but in terms of privacy they are leading the charge. Catching up is a matter of when, not if.
- Xylakant 14y ago
  Message from Germany: Doesn't look like that from here. Our politicians are fighting the wrong battles and loosing most of them as well. I haven't seen a single law passed in the last 10 years that actually enhanced privacy in the real world.
mbrubeck 14y ago
Or if a large portion of the industry decides to voluntarily adopt the standard, to counter the threat of legislation. A number of large ad networks have already announced support for DNT. Sure, there will always be sites that ignore the header, but there's also a realistic chance that it will give users a meaningful choice about how their behavioral data is used by many of the biggest sites they use most often.
- rbanffy 14y ago
  If a large portion of the industry adopts it and that prevents legislation, the end users have an even more false sense of security.
- stingraycharles 14y ago
  As the CTO of an adserving company, I can confirm that we consider (too) strict legislation a big threat, and as such are more than willing to adopt initiatives like the DNT header.
- ticks 14y ago
  The good thing about legislation is you can go after those minority of bad guys. That's what happens when businesses call individuals who are on these privacy lists, they are reported to a regulator and the regulator investigates.
elehack 14y ago
There's a crucial difference: it's easy to tell when someone violates a Do Not Call list. They call you. It's a lot harder to detect, and probably harder yet to prove, when they're engaging in illicit tracking.
lhnn 14y ago
As if that would be appropriate or necessary to solve whatever privacy problems we have. It's the U.S. government trying to take anonymity and privacy away from the Internet; do we want them making weak, unenforceable, irremovable laws on how to implement an HTTP header?
cheatercheater 14y ago
Yeah, because the Internet is american. In fact, all the servers are in Kentucky.
ZoFreX 14y ago
Ha! People have been getting around the do not call lists in the UK for years now by dialling in from other countries where our regulatory bodies are powerless. Trying to regulate it on the world wide web would be even harder.

lotu 14y ago

I agree 100%, this whole fiasco is just a about convincing the US Congress not do anything (which they shouldn't btw). Anyways, the DNT specification has exceptions in it large enough to drive a truck through. On the other hand if it would finally shut up people whining about being tracked online that would be worth (though I doubt it will, as whining is too much fun).

CyrusL 14y ago

Individual sites are not really the ones auctioning ad inventory that is targeted by a user's cookies. That specific technology continues to become consolidated in a handful of exchanges. You could probably get 95%+ of cookie-targeted impressions compliant by regulating 5 or 10 companies.

ZeroGravitas 14y ago

I agree with your critique of DNT, but private browsing isn't magic, there's plenty a bad actor could do to track you regardless of what you throw away at the end of the session, which means the same critique applies (unless you're using it for it's intended purpose, privacy from other users of your computer, and even then it's got holes).

BitMastro 14y ago
How?
- mike-cardwell 14y ago
  Current implementations of private browsing just throw everything away at the end of a session. That doesn't prevent cross site tracking during a session. If you start up a browser in private browsing mode, then log in to Facebook and visit some site with a like button on it. Facebook still knows you visited that site. At least, I think that's how it works.
  - BitMastro 14y ago
    Thanks. So a better implementation should perhaps instantiate a different session for each browser window (sharing the same session for the tabs in the same window). The user should also avoid logging in to any service linked to a known profile.
    - mike-cardwell 14y ago
      A better implementation would be one which instantiates a different session not on a per window basis, or even a per tab basis, but on a per "domain in address bar" basis. And by session, this wouldn't just be the cookie store, it would also be the cache store and everything else which can be manipulated for tracking purposes. EDIT: I'd also want it clearing between browser restarts too. If this became (over night) the default standard way for browsers to behave, the vast vast majority of websites (at least 99.9% I'd guess) would continue to work without issue and it would pretty much annihilate nearly all privacy/tracking issues on the web. Stuff like Google Analytics would continue to be able to work, but wouldn't be able to gather as many different types of information. Advertisers would be able to continue to advertise, but they would lose the ability to track you across sites, which potentially might hit their revenue a bit.

naner 14y ago

We already have proven, well defined method of DNT already: private browsing. You are still being tracked with private browsing. You IP, user agent, OS, screen resolution, etc. are enough to connect the dots in most situations. This is a decent idea that will need to be implemented to some degree if sites are eventually going to support under-13s, since it is illegal to track their behavior under current law. But you are right, I don't see a lot of places voluntarily signing up to make less money.