It is easy to expose users' secret web habits, say researchers

In most cases, when you delete cookies, localStorage is deleted as well.

It's fairly clear that, absent a world government, national laws apply to companied outside of the nation based on the combination of will and ability of the particular nation to enforce penalties on foreign violations.

The ability side tends to be very high if the company at issue has any substantial assets held in the country trying to enforce the rules, or in a another country with an interest in keeping that country happy.

I agree, but that is going to change. There is new European legislation coming up (GDPR, effective May 2018) which will be a lot more restrictive than the current privacy laws. It will apply to any organization that monitors the online behavior of people in Europe, even if the company itself is in the US or somewhere else. With fines up to EUR 20M or 4% of worldwide turnover there will be a large incentive to comply. Already you can see big companies like Google and Mailchimp adapting to it.

I think it's fairly clear. If there are two parties to a transaction in two different countries, you can generally apply the laws of either country. That's the nature of international commerce.

The US for one feels entitled to go after gambling companies incorporated abroad.

If an American company doesn't like it, it can simply stop doing business in the world's largest market.

In the end, it's pretty simple: online companies that make money in the eu (even just selling ads) have something to lose and can be forced to comply. Others can't.

> Err, it's not clear that EU law applies to US companies online, nor should it. There are many things illegal in the EU that are quite allowable in the US including a lot of freedom of speech issues.

Err, yes it will. (https://en.wikipedia.org/wiki/General_Data_Protection_Regula...)

> The regulation applies if the data controller (organization that collects data from EU residents) or processor (organization that processes data on behalf of data controller e.g. cloud service providers) or the data subject (person) is based in the EU.

> I don't actually accept "the current state of affairs is bad" as a justification for new regulations.

And I don't accept "a previous regulation turned out to be pointless and annoying" as an argument against trying new regulations to fix "the current bad state of affairs." I don't think there's some magical third way to resolve issues with the failure of self-policing that doesn't involve regulation. Such arguments tend to have little positive outcome and usually just serve to discourage any attempts to actually fix problems.

Law, regulation, and enforcement are the solutions to reconciling the mismatch between selfish bad behavior and the public good. However, these regulations will undoubtedly have to be iterated on until a workable and effective solution is found.

In spirit of findings new paths, just an idea (and I'm not sure at all that this is a practical solution):

fail2ban---a tool commonly used in servers to automatically block remote attackers such as spammers---can be configured to automatically send an attack report to some e-mail address when it detects an attack.

A browser extension, such as PrivacyBadger, could do a similar thing when it detects a tracker. Let the report be sent to a law enforcement agency that is setup to deal with this kind of problem. If this agency collects enough data, then it can do some data mining to find, for example, the most violent trackers. If that works, maybe such a tool can be used to give law enforcement some actual power to punish these companies.

> Sometimes you have to accept that legislation isn't going to fix a problem.

And sometimes you have to accept that there will be zero change until legislation hits the big companies with an even bigger stick.

> Piracy, spamming, and so on aren't going to go away, even if we catch people periodically.

But if you never enforce against something at all, then it simply goes into a runaway loop.

Custom settings for history -> Accept third party cookies (Always/Never/From visited).

in case anyone is wondering.

I didn't mention Chrome because Google is an advertising company that benefits from cookie tracking and so I expect them to look out for their own interests.

I never heard of a Stackoverflow offering a full download. Is this the link you used? https://archive.org/details/stackexchange

Where do people obtain offline copies of stackoverflow ?

There should be a browser that explicitly attempts to present the blandest, most common profile to websites to foil tracking.

Pretty interesting how many bits of identifying information are available based on system fonts.

if you've never seen EFF's Panopticlick check out https://panopticlick.eff.org

Not just single-sign-on. Also a wide variety of services that provide APIs.

I'm using Chromium:

Version 48.0.2564.82 Ubuntu 14.04 (64-bit)

> Couldn't isolate what extension it was.

How not? Disabling them in a bisecting way should be a couple of minutes.

Someone else noticed the "page refresh" chrome extension making requests to that domain: https://frenchcoding.com/2015/11/12/faites-attention-aux-ext...

Researcher here, `gcp` is correct in that the NDR acquired the clickstream data from a data provider as part of an investigative story (the data was provided as a free sample), the deanonymization was demonstrated by linking individual URLs with publicly available information from various sources (Twitter, Youtube, Google+, ...), though this often wasn't necessary as many users had URLs that contained direct identifiers (e.g. their full name) as part of the URL and that we could use for efficient de-anonymization.

If you're a "data controller," then you may be required to register with the local DPA (Data Protection Authority). In the UK, for example [1]:

"The Data Protection Act 1998 requires every data controller (eg organisation, sole trader) who is processing personal information to register with the ICO, unless they are exempt. More than 400,000 organisations are currently registered."

Whether this registration achieves anything useful is another question.

[1] https://ico.org.uk/for-organisations/register/

Yes, for me "Trivial" was a Mathematical term.

Some mathematicians do have a definite over-fondness for handwaving away statements they can't be bothered to prove with the "it follows trivially that ...". It's all well and good when such a proof would be 20 minutes of basic algebra, but that's frequently not the case.

One of our lecturers at university was so renowned for this, everyone taking that module organised to write "the answer to this question is trivial, and is left as an exercise to the marker" for any question they couldn't figure out in the exam.

The claim here is not that people don't know the word "trivial," but that they don't know of its use to mean "easy to solve."

Learning the facts needed to be a good Trivial Pursuit player is literally a pointless pursuit. It's not easy though.

As far as I can tell, he's borrowing the mathematics sentiment, where "the proof is trivial" doesn't necessarily mean you'll find it easy - it just means that the interesting aspects of the problem have been dealt with and what's left is a simpler or more general case.

That said... I've never encountered "novel IP" as the actual standard for 'trivial' in mathematics or CS. It would take a very strong source to convince me that's a formal or most-common-use meaning. (The Wiki page on 'trivial (mathematics)' certainly doesn't offer that meaning.)

I'd imagine that is much worse. It's not random at all, you're basically giving them huge amounts of extra data points. That extension was supposed to used to mess up click rates for ads, not stop you from being tracked.

Advertisers would still win, though. Instead of showing you ads for 10,000 subjects of which one interests you, they are now showing you ads for 2 subjects of which one interests you. Much better targeting.

And if they want to link your profiles from elsewhere, two interests of which one is fake is still pretty powerful.

yes, rather than edit the original

The kind of people who would make this argument generally have authoritarian tendencies and wouldn't approve so wholeheartedly of your examples.

im not saying that because i am a hypocrite who says what he says because its in his best interest. its not. my interests are best served by secrecy. so i might suffer myself. but there are many good people.

im saying that because i think its in the interest of soceity that we know how naughty everybody is being. because people are being naughty.

For me, this is why it's such a big deal: I don't think it has to be porn to be used against you. It just needs to be some minor character flaw that breaks with your public image.

And I guess more troubling still, this kind of stuff could be used to blackmail normal people in the same way revenge porn is. What about threatening to reveal your porn habits to friends & family?

Again, doesn't need to be porn. What about your browsing history for medicine, self-help etc? All that stuff could be used to blackmail someone, especially if they're psychologically vulnerable.

>That's what I'm wondering and have been for a while. Where does the outrage come from? We all know we all watch porn. But if it comes out that so and so important figure watches porn, suddenly it's the end of the world? Why? Who decides which instance breeds outrage and which doesn't?

Well, ultimately others decide, so it's beyond your and my control.

> Where does the outrage come from? We all know we all watch porn.

Let's say Politician A runs on a platform of making legislation and supporting other things that make the lives of LGBTQ difficult (or dangerous). He gets totally awesome support, everyone loves him.

Then it is found that Politician A is browsing twink pr0n on his work computer. Or worse, he is blackmailed because of it, becomes corrupted, then is outed for his browsing habits.

You don't think this can't have real consequences? What if this was found long before, and he is being coerced into introducing legislation by some more powerful person or group who will expose his (now hypocritical) habits to the public, unless he pushes for legislation that will punish those that other group/person wants?

That's only one example (probably flawed in ways), but people get really bent when a politician says one thing, but is secretly doing another and it is found out - especially when that politician is doing things that oppress others. Some call it self-hate, or projection, or similar - which it may be. Whatever it is, it is justified to feel angry over such things.

What I don't understand is why people keep giving politicians such "benefit of doubt" before electing them - we always seem to regret it in some manner afterward (sometimes only a bit, sometimes a lot - very, very rarely do we see or get someone who is a benefit to everyone).

You don't need to cast it as some outlandish scenario, since there are many countries where being gay (or, to use the example in the OP, watching porn) are illegal and violators are really subject to penalties.

Well there's two ways this can go down.

Either these things that we all do become illegal and we're all criminals and the government uses it as a form of repression when people need to be put away for whatever reason the regime deems necessary. Or these things remain legal and become socially acceptable because once everyone understands everyone is doing it, we'll collectively stop caring.

Right now we're in this weird transitionary period where things are not illegal, but are frowned upon in polite society and it's first coming out that you know what, we're actually all weird behind the scenes and there's no such thing as normal. So we have weaponized public outrage.

I'm curious which way we'll go. Hopefully it's not the "we're all criminals" way. That would suck.

Hate to say it, but this is a rather naive perspective on human behavior and interaction. Like the GP said, the threat goes far beyond losing a job. For just one example, it is a very sad fact that transgender individuals face significantly higher rates of domestic violence, sexual violence, and stranger assault, especially trans individuals of color. More broadly, maybe it's true that fully outing all (or most, or many) closeted LGBTQ individuals would force faster societal change in the long term, but the short term effects may not be worth it, and anyway, I really don't think that decision should ever be in the hands of anyone other than the individuals themselves.

Yeah but if people had known earlier about how widespread homosexuality was - They would have realised how little it means in the context of all the other stuff that people do; it would have been accepted sooner.

I deliberately didn't give historical examples, because I think many people dismiss them as "Oh but that was in the past - we know better now, and there's no chance of that repeating." - they feel too distant, almost abstract.

And honestly, I mostly think they'll probably turn out to be correct - for those specific cases, for their countries. What I think will happen is some new group will be targeted - political, social, or ethnic. People that shouted a bit too loud at G20 protests, or condemned US involvement in the middle east too harshly, or published cracks for DRM.

To convince them, you have to give examples of things that are at risk right now. Show them the gun pointed at their head, not the abandoned gunpowder refinery nearby, and tales of how it might start up again.