Reddit quietly updates 16 day old post: you are now tracked even if logged out | Hacker News Reader

Reddit quietly updates 16 day old post: you are now tracked even if logged out

voat.co

92 pointstemp37 comments

Before anyone gets wound up about this, they posted an explanation on voat: https://voat.co/v/MeanwhileOnReddit/comments/1083516/5406839

Assuming that gets deleted, basically it says "we just keep editing that post as we add more A/B tests so we can point people at that post if they have questions".

This post on HN is really just trying to fan the flames I think, there's nothing nefarious going on here -- they've been tracking how you move across the site for years, and if you don't like that, it's super simple to avoid.

You can block the cookie or just incognito mode.

The full comment if people don't feel like clicking or it does get deleted:

---------------------------

Jumping into the lions' den here, but I thought I'd drop in and offer a bit of clarification:

That post is mostly to help make sure we have something to point users at as an explanation when they post in /r/help or message in. Users blocking cookies or running script blockers are excluded from the test as a matter of rule. I didn't mean the edit to seem unhanded, it's just a matter of convenience to keep the A/B test log together.

The recent_srs cookie has been around for a really long time. When people buy self-serve headlines (those sponsored headline things at the top of your frontpage), they have to choose one or more subreddits to target. We use the recent subreddit cookie to give ads to logged-out users who end up browsing deep into the site (since they don't actually have subscriptions, like logged-in users)

I don't think cookies like that are exactly nefarious — they essentially say "in this session, the user saw these pages". That being said, if you want to prevent this behavior, you should block the recent_srs cookie.

I'd love to hear a bit of feedback on the testing process. Would it be best to have a "current A/B tests" page? Individual posts for each? A global opt-out option? If you have any ideas on the most ethical and privacy-conscious ways to go about A/B testing, I'd love to hear them.

Also, apparently there's already a drunken_economist on voat. I guess that's what I get for not reserving my username

"Assuming that gets deleted"

Are you saying that HackerNews deletes links related to Voat? I am genuinely not sure what you mean by this.

No I'm assuming Voat will delete the one comment that contradicts their conspiracy theory (although honestly I think HN should delete this because there is something fishy going on with the voting here).

The update clearly says that they will be using some sort of tracking (likely cookies) for non-registered users and customizing content for them, as a trial.

The poster worried publicly that this would mean too many stories about Hillary on the front page -- I read that to mean he's a conspiracy nut, and doesn't want Hillary to be in office in the US, and thinks reddit could be used to push her there with this technology.

This seems like responsible disclosure, and so very far from the level of customization many content sites do (have you ever seen an ad follow you to reddit? I didn't think so), that I'm kind of surprised it's a big deal.

That guy is 'a conspiracy nut.' Why would anyone think a social media site would push a political agenda? /s

Seriously? A post from Voat on HN? This is what you get when you search for voat on Google http://i.imgur.com/RnjbJTu.png

While Voat used to have some users that focused on privacy and anonymity, today the bad parts of Voat far outweigh the good parts.

Voat is now a hub for intolerant hate-based communities that have been banned from Reddit. The site as a whole is anti-Reddit, anti-immigration, anti-LGBT rights, heavily racist, anti-feminist, and white-supremacist.

To add to this mess, Voat has also turned into a gathering point for Child Pornography users, with their primary image host, Slimgur being banned multiple times by their hosts for hosting CP. Voat users like to say that "the SJWs planted CP to get Slimgur removed! conspiracy!" but one look at the google search results for Voat should disprove that.

Finally, multiple users on Voat have been doxxed, with the site owner Atk0 deciding to not do anything about it.

Voat does not have a single redeeming feature at this point.

It's strange, because while I don't typically agree with the decisions made to remove those distasteful subreddits, I find voat's obsession with them to be even more distasteful.

Yeah there's something fishy going on for this to shoot to the number one position so quickly. I hope dang looks into it if he can.

I don't know how crazy we're talking about here, but I just wanted to point out that Reddit has been doing a lot of anti-privacy crap in the last few weeks and just a couple of days ago, there was a post which got to the frontpage, originating from multiple subreddits as well, and that post pointed a lot of this shit out and also quoted the Reddit CEO talking down on users like you'd expect it from Mark Zuckerberg.

Here's the post, in case you want to read it yourself: https://www.reddit.com/r/privacy/comments/4ll9tc/it_looks_li...

In other words, maybe these upvotes are legitimate and there's just a big portion of really pissed off Reddit users here...

I looked at the vote data and didn't see anything fishy. My guess is that it shot up because people love smoking gun posts and Reddit is always a popular topic. Then it got heavily flagged and plummeted to the depths.

Indeed. Voat seems to exist for people primarily for people who don't think Reddit is toxic enough.

I'm really not surprised. I assume every website does this. On my Linux laptop, I run NoScript, and I've got Firefox configured to clear EVERYTHING when I close my browser. I don't run Flash or any other plugins. I haven't done much inspection, but the whole notion of "logging out" doesn't mean much to me. In the context of cookies, I just assume they clear the one that says "this guy is authenticated", to "not authenticated, but we know the last person that was here".

That really won't help you against modern browser fingerprinting technologies; it's fine to do of course, but generally it probably just makes your own experience worse without hampering tracking technology.

We ran some tests with a similar library and about 15% of the time we'd get hash collisions from completely different users. Sure, my setup might be totally unique, but other peoples vanilla installs are identical.

What would help against modern browser fingerprinting technologies?

Maybe Tor to some degree?

The design doc is full of references regarding fingerprinting and "fingerprinting anonymity/reduction" itself is mentioned explicitly within the adversaries chapter.

https://www.torproject.org/projects/torbrowser/design/

I'm not an expert, so there may be a better answer for this, but I choose to act online as if they are not defeatable.

What about a disposable VM in Qubes OS?

Sounds like all the fingerprinters would build up a profile of the one person running Qubes from your IP.

Be more specific, I know there are things like Canvas Fingerprinting. I'm not sure I can appreciate your claims without you citing specific examples.

That's not the nicest way to ask for additional information, but see:

https://panopticlick.eff.org/about#browser-fingerprinting

> The site you are visiting may choose to analyze your browser using JavaScript, Flash and other methods (just like Panopticlick does). It may look for what types of fonts you have installed, the language you’ve set, the add-ons you’ve installed, and other factors. The site may then create a type of profile of you, tied to this pattern of characteristics associated with your browser, rather than tied to a specific tracking cookie.

Presumably this is the kind of tracking that the EU ePrivacy directive prohibits.

Browser fingerprinting is really scary, but AFAIK there are no major websites using it yet right?

It should be fairly easy to detect if something you Google in an different browser session suddenly turns up as an ad on Reddit after you've deleted cookies and cleared history. Also it seems unlikely that Reddit would implement something like this after considering the outcry over the possibility of the Facebook mobile app recording audio. Especially since Reddit has a large technical userbase who are aware of privacy concerns in fingerprinting technologies.

E: why is this being downvoted?

Simplest way to see if you're fingerprintable is to go to https://panopticlick.eff.org/. I can't promise they are up to date, so if you get a 'Not fingerprintable' result, it may be incorrect.

But, if the EFF can fingerprint you, almost any website in the world can, or their ad network can.

You may be interested in the Self-Destructing Cookies add-on. It associates each cookies with the sites that send them and deletes the cookie when you close the tab with the site (as I understand it).

Interesting if for nothing else then because voat rarely makes the front page here?

Neither does the Drudge report, and there may be a reason for it.

That's not via us (we don't have keyword targeting or anything right now), and we definitely don't have amazon cookies on our site. Could be via chrome? Tbh, I don't know exactly hoe much Google collects through their browser.

You say "us", who are you representing?

Reddit reminds me of the Google, Don't be evil bullshit mantra with shenanigans like this almost every week. I understand the fucking "monetize, grow, and get bought out" mentality that every web business adopts, but it is pathetic when it comes to places founded by guys like Swartz.

> when it comes to places founded by guys like Swartz.

He had nothing to do with the founding of reddit, and also had no problem collecting the payout when it was sold.

Reply on news.ycombinator.com