6 ms·

Both firefox and chromium have an option to disable third-party cookies. I believe this stops this sort of tracking, making each webpage a silo. I additionall

by jewel 12y ago

Both firefox and chromium have an option to disable third-party cookies. I believe this stops this sort of tracking, making each webpage a silo. I additionally isolate websites where I need to log in into their own profile using a shell script for each along the lines of the following: chromium-browser --app=http://facebook.com/ --user-data-dir=/home/jewel/work/facebook-profile

x1798DE 12y ago
Third party cookie blocking on all modern browsers is a joke. I turn third party cookies off as a start, but sites can play all kinds of games with cookies to create "first party" relationships you don't know about, and that's not even including things like flash cookies or browser fingerprinting. As a start, consider that if you turn off third party cookies, logging into gmail also logs you into youtube.com. Yes, both are owned by the same company, but they are clearly different domains and so youtube should be a third party in your transactions with gmail.
- orf 12y ago
  > As a start, consider that if you turn off third party cookies, logging into gmail also logs you into youtube.com. Yes, both are owned by the same company, but they are clearly different domains and so youtube should be a third party in your transactions with gmail. That's because you don't sign into youtube, you go through Google's single sign on stuff which is a different domain.
  - x1798DE 12y ago
    Check again. The two sites are on different domains. In order to log into both, at some point someone needs to convey state information to a third party. Gmail logins are managed through accounts.google.com, so either you have a third-party relationship with accounts.google.com when you are on youtube.com, or you have a third party relationship with youtube.com when you are on accounts.google.com. Either way, you pick up a third party cookie. You'll notice that even if you never (deliberately) went to youtube and you have 3rd party cookies turned off, a cookie for "youtube.com" will show up when you sign in. I haven't looked at it carefully, but I think they just put you through a chain of redirects when you click "log in" so that you have a first party relationship with each of the domains they want to sign you in to, and that's when they give you the cookie.
randomwalker 12y ago
I'm one of the authors of the paper. One of our findings was that third-party cookie blocking is only marginally effective. See the tables under cookie syncing in our summary [1] or in our full paper [2]. Trackers bypass cookie blocking in a variety of creative ways. We're currently investigating the bypassing mechanisms in more detail. On the other hand, add-ons like Ghostery work much better. [1] https://securehomes.esat.kuleuven.be/~gacar/persistent/index.html https://securehomes.esat.kuleuven.be/~gacar/persistent/index... [2] https://securehomes.esat.kuleuven.be/~gacar/persistent/the_web_never_forgets.pdf https://securehomes.esat.kuleuven.be/~gacar/persistent/the_w...
- b_emery 12y ago
  Can you summarize for us how to avoid this kind of tracking? Is there much we can do besides Ghostery?
  - laumars 12y ago
    I block tracking at the domain level via a custom hosts file: http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ Actually, I went one step further than this, I dump that hosts file into dnsmasq and set that as my primary domain controller for the home network. So anything connected via WiFi or ethernet (phones, tablets, laptops, etc) will also have tracking blocked.
    - b_emery 12y ago
      A belated thanks. Much appreciated.
- e12e 12y ago
  Slightly off-topic but something with my Iceweasel/FF install (v31) borks the layout of the blog completely -- content is shifted far to the right of the viewport for some reason. Looked fine on another computer, so not sure what's up. Also works fine in chromium. FYI.
- tamale 12y ago
  People need to stop promoting Ghostery. It's made by Evidon, yet another tracking company. Just checkout their website and it's clearly obvious that everyone that installs this extension is doing them a huge favor: https://www.ghosteryenterprise.com/ https://www.ghosteryenterprise.com/ It's identical to the adware companies that promise to help remove adware from your computer... but for some reason people keep using it!

by jewel 12y ago

x1798DE 12y ago

Third party cookie blocking on all modern browsers is a joke. I turn third party cookies off as a start, but sites can play all kinds of games with cookies to create "first party" relationships you don't know about, and that's not even including things like flash cookies or browser fingerprinting. As a start, consider that if you turn off third party cookies, logging into gmail also logs you into youtube.com. Yes, both are owned by the same company, but they are clearly different domains and so youtube should be a third party in your transactions with gmail.

orf 12y ago
> As a start, consider that if you turn off third party cookies, logging into gmail also logs you into youtube.com. Yes, both are owned by the same company, but they are clearly different domains and so youtube should be a third party in your transactions with gmail. That's because you don't sign into youtube, you go through Google's single sign on stuff which is a different domain.
- x1798DE 12y ago
  Check again. The two sites are on different domains. In order to log into both, at some point someone needs to convey state information to a third party. Gmail logins are managed through accounts.google.com, so either you have a third-party relationship with accounts.google.com when you are on youtube.com, or you have a third party relationship with youtube.com when you are on accounts.google.com. Either way, you pick up a third party cookie. You'll notice that even if you never (deliberately) went to youtube and you have 3rd party cookies turned off, a cookie for "youtube.com" will show up when you sign in. I haven't looked at it carefully, but I think they just put you through a chain of redirects when you click "log in" so that you have a first party relationship with each of the domains they want to sign you in to, and that's when they give you the cookie.

randomwalker 12y ago

I'm one of the authors of the paper. One of our findings was that third-party cookie blocking is only marginally effective. See the tables under cookie syncing in our summary [1] or in our full paper [2]. Trackers bypass cookie blocking in a variety of creative ways. We're currently investigating the bypassing mechanisms in more detail. On the other hand, add-ons like Ghostery work much better. [1] https://securehomes.esat.kuleuven.be/~gacar/persistent/index.html https://securehomes.esat.kuleuven.be/~gacar/persistent/index... [2] https://securehomes.esat.kuleuven.be/~gacar/persistent/the_web_never_forgets.pdf https://securehomes.esat.kuleuven.be/~gacar/persistent/the_w...

b_emery 12y ago
Can you summarize for us how to avoid this kind of tracking? Is there much we can do besides Ghostery?
- laumars 12y ago
  I block tracking at the domain level via a custom hosts file: http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ Actually, I went one step further than this, I dump that hosts file into dnsmasq and set that as my primary domain controller for the home network. So anything connected via WiFi or ethernet (phones, tablets, laptops, etc) will also have tracking blocked.
  - b_emery 12y ago
    A belated thanks. Much appreciated.
e12e 12y ago
Slightly off-topic but something with my Iceweasel/FF install (v31) borks the layout of the blog completely -- content is shifted far to the right of the viewport for some reason. Looked fine on another computer, so not sure what's up. Also works fine in chromium. FYI.
tamale 12y ago
People need to stop promoting Ghostery. It's made by Evidon, yet another tracking company. Just checkout their website and it's clearly obvious that everyone that installs this extension is doing them a huge favor: https://www.ghosteryenterprise.com/ https://www.ghosteryenterprise.com/ It's identical to the adware companies that promise to help remove adware from your computer... but for some reason people keep using it!