Hacker News Reader

I once sat in on a pitch from an antivirus software company who was selling the ability to look at the full browsing history of people who had visited your website. You could see all of their searches, if they visited competitors, and more. Most of the time I get annoyed of the FUD of "they're selling my data!" but this was different. It was true and it was scary.

Why not name them?

If I had to guess, it's all of them. By "them" I mean all the anti-virus packages that are targeted at consumers and small business. That seems to have been part of the business model starting over a decade ago. My guess is that the negative effects of anti-virus is what prompted Microsoft to first build free products and then eventually roll anti-virus into Windows.

I'd put it this way. My first inkling that something was wrong was when Norton Anti-Virus shifted to a subscription model and charged me full retail for a renewal back around 2006. What does disabling virus updates for ordinary users with the explicit intent of leaving them vulnerable says about a company's attitude in regard to long term trust?

I left Norton for Kaspersky and paid it protection money for a few years. It seemed refreshing at first. One day, a few years later, I learned how to look at my LAN traffic and saw how often I was sending data to its servers. It was more often than seemed reasonable. That's about the time Microsoft started providing its own free anti-virus and I started switching machines...the Windows XP Professional x64 box stayed on Kaspersky despite my misgivings until I upgraded it to Windows 7 because Microsoft did not port its anti-virus to that platform.

Spyware is often the basis for free software. Adobe Reader and Google Chrome and the Ask toolbar that shipped with Java are pretty obvious examples.

If I could take a guess I'd say its likely to be Avast, which has multiple browser extensions that send all your browsing activity to them, while simultaneously offering a service to remove other browser extensions.

They'll even set their own search engine as your default homepage.

That would identify the GP to within a small group (the meeting). They probably worked under an NDA.

It would be great if an unrelated leak were to happen, though.

I'm not anonymous. You can identify me by going to my profile if you'd like.

To be completely honest, I don't remember. It was 2 years ago and I sit on lots of these pitches. I remember pushing back on them about the methodology, hearing how the sausage was made, and noping right out.

I want my team to be able to spend marketing dollars efficiently but I would never compromise my ethics to do so. Luckily I work somewhere that I can give a justified 'no' and keep my job.

> Luckily I work somewhere that I can give a justified 'no' and keep my job.

That is lucky! Where do you work?

> You can identify me by going to my profile if you'd like.

Actually, I can't identify you from your HN profile. I guess I could google your username or something, but I'm a little unclear why you wouldn't just, you know, say where you work.

https://news.ycombinator.com/user?id=teej

Currently - head of data engineering at Minted

> > [I'm not anonymous. You can identify me by going to my profile if you'd like. ...] Luckily I work somewhere that I can give a justified 'no' and keep my job.

> That is lucky! Where do you work?

I wonder if it was AVG.

Google can do this for anyone using 8.8.8.8 for DNS. You don't think they run it out of pure altruism do you?

Running a DNS service doesn't give you the ability to see which pages someone visited when they navigated a website - just that they resolved that website's host name for some reason.

Many individual things Google does aren't too bad by themselves; the problem is that they are all integrated.

Google isn't misrepresenting what a DNS service does. Zuck is kind of a slimy weasel.

I don't think most users fully appreciate that it exists purely to log your activity on sites that Google doesn't directly track through ads

I'm just a welder, but...

DNS can't log your activity on a website, can it? All DNS does is resolve hosts, right?

DNS service can log that you resolved a host, but doesn't know what you did with the IP address it returned.

It can log that you went somewhere that Google could not otherwise track you. And not just websites; mail, SSH, anything else. I'll wager a fair few people's attempts to avoid tracking for certain activities, clearing cookies, private mode, whatever, has been thwarted because they forgot they'd set this up.

I just want to clear here: a DNS server can't track that you visited a site, only that you request a specific record for a host name.

Is that technically correct?

It stands to reason the average internet user probably then made a visited that IP.

Yes, that is correct. Google use every means possible to track you wherever you go. If that can't get your exact activity, they at least get something.

That's a big distinction though. I don't think Google has the obligation to make sure users are educated and informed. The deceptive practice of Facebook with Onavo is what people object to.

True this. I think it was on Ars Technica that I was downvoted to oblivion for raising the privacy implications of Google's DNS service.

There is a huge segment of the semi-tech literate crowd that feel wise for using it. I think it's because it's the only time they get to type in an IP address and it makes them feel l33t.

To be fair, Google DNS is more trustworthy than ISP DNS, and if you're using Chrome, you're not exposing anything that Google isn't reading anyway. DNS requests are much less informative than full browsing history.

It is probably better to use OpenDNS, but they used to do the same spammy redirect on NXDOMAINs that ISPs do (I think I heard they stopped that). To be honest, the real reason I don't use them much anymore is that their IPs are harder to remember. It's easier to do 8.8.8.8 or 8.8.4.4.

The internet isn't just the web. Setting your DNS to Google's will also tell them what other applications you use and what you connect them to.

This reminds me of people who would re-sell search query data via aggregation of google referrals across a network (usually ad based.) In general, if there's a way to get that kind of data (search data is gold due to the ability to mine it for adwords niches), you can presume there are people out there who are going to skirt right up to the line of acceptable ethical behavior to try to aggregate it to sell it.

Yeah antivirus is kind of scary. I guess they could access all your files too if they wanted.

"ethically dubious", i consider it criminal; though they probably got some (lawyer written) fine print to say it is not so.

Yes, it sounds like malware. Had any other company done this, it would have caused outrage but for some reason Facebook just seems to get away with everything.

I remember how big a deal the News International phone hacking scandal was; this actually seems much worse.

Companies which track app download and engagement metrics also do this via VPN apps. That is how they are able to obtain such data. Not new, but also not discussed much.

I would be interested to hear from people with knowledge of EU and US law how shady this is in their respective jurisdictions.

I'm having a hard time imagining what they did is OK, but I'm probably wrong.

If you can identify personal data (which if they can tie it to the user's Facebook account, that's pretty easy to do) it's likely (note: not a lawyer) a violation of the EU GDPR regulations (http://www.eugdpr.org/)

Unfortunately GDPR enforcement is about 9 months away. I don't think it applies retroactively.

>seeing in real time how usage of competitive apps varies in response to new features and inform acquisition decisions.

They could also ping you with a fb notification as soon as they see you reach for Snapchat, to get you back on their platform

For crypto/security people on this thread, what encryption could app developers use to wrap their API call so that the least amount of information is leaked to this kind of man-in-the-middle services? I.e, is it possible to: 1) hide which apps are installed on iOS/Android; 2) hide or obfuscate how frequently the app is used; 3) hide specific API calls

I assume at least #3 should be achievable with additional encryption.

This really should be anti-trust, this is not a responsible or accountable way to use this information.

Shady af.