Hacker News Reader

My favorite part is...

"First, large scale blocking of cookies undermine people’s privacy..."

Oh yeah, users and their privacy first!

"Second, blocking cookies without another way to deliver relevant ads significantly reduces publishers’ primary means of funding..."

Also we make less money when you do this... But users, privacy and synergy first!

I think the second point is the real issue for Google. But of course they care about users first! I feel cynical as hell, but the whole thing reads so slimy to me. Like a used-car salesman twisting an obvious negative into a positive. "That's not a giant rust hole, that's just to reduce weight for efficiency!"

I think a great setup for privacy are temporary containers. In fact, using the Temporary Containers Firefox addon and domain level isolation works virtually everywhere except on Google / Gmail / Youtube...

That's because when you try to log into one of those, it tries to simultaneously log you into the other domains/Google products linked to your account and per-domain sandboxing prevents that.

My setup against tracking is as follows:

- Temporary Containers: Prevent cookie-based tracking

- ClearURLs: Prevent URL-based tracking, which Google and Amazon use everywhere

- VPN: Prevent IP-based tracking, to some degree

- uBlock Origin: Block adds and some nasty JavaScript

I find it quite hard to prevent fingerprinting. The privacy.resistFingerprinting in Firefox breaks tons of things. So does blocking JavaScript. And uMatrix is a bit time consuming to use, and not suited for inexperienced users.

Any alternatives considering aside from Tor Browser?

Your setup will marginally benefit from the addition of [Decentraleyes](https://addons.mozilla.org/en-US/firefox/addon/decentraleyes...), an add-on which prevents requests to CDNs by serving some content locally.

DNS filtering like pihole may be useful on your network for Ad blocking on Android/iOS. Not much more useful than ublock origin on your desktop though. Blocking at the DNS level is very effective.

I use Multi-Account Containers in Firefox plus the Cookie AutoDelete extension which integrates with it. Does the job for me. Here's my worry, though: the more broadly used cookie-blocking tools are, the greater incentive websites will have to use other, less-transparent methods to attempt to infer your identity without a cookie. These can be nefarious hacks that work like a cookie, or they can be statistical methods that estimate your identity with some degree of confidence. But one way or another, this would swing the pendulum back in the direction of sites knowing a massive amount about their users without users' awareness.

This will be an arms race and seems to be occurring over the course of decades. There will end up being extensions to regularize the timing of your keystrokes and mouseclicks because they give away your identity, VPNs will be integrated into the browser, anything to combat the information leakage.

> There will end up being extensions to regularize the timing of your keystrokes and mouseclicks because they give away your identity

.. and these users will be flagged as bots :) .. :(

> Also we make less money when you do this... But users, privacy and synergy first!

In practical terms, the point is important. Even if Google doesn't change their behavior to find other ways to invade your privacy, there are lots of other companies whose financial incentives point solidly that direction.

With enough people standing to gain enough money, someone's going to cross that moral line. Is this cynical? Absolutely. Correct? Almost certainly. Is it something we should take seriously as a result? I think so, though obviously opinions may differ on the subject.

Few publishers are confident in their ability to jettison an targeted-advertising-based business model for an alternative model that produces similar financial results.

Interesting to me is that Google's Privacy Model suggestions of "Identity is partitioned by First Party Site" and "Third Parties can be allowed access to a first-party identity"[1] come off as more coherent and effective than Apple's ML based Tracking Prevention policies[2].

Issue is Google's third suggestion, "A per-first-party identity can only be associated with small amounts of cross-site information", is clearly advertiser-focused, not privacy-focused.

I hope all can rally around the partitioning concepts and leave the others behind.

[1]https://github.com/michaelkleber/privacy-model [2]https://webkit.org/blog/8828/intelligent-tracking-prevention...

Google’s proposal sounds simple because it is vague, does not address all the ways websites can track you, and does not address all the possible compatibility problems with partitioning. WebKit’s policy (and more importantly our code) are what things look like when you actually try to ship tracking protection. Easy to be simple if you don’t have to spell out details or actually ship.

I don't believe it's very vague. This sentence in particular was succinct and represents a 90% solution to the problem:

The identity "Me while I'm visiting nytimes.com" is distinct from the identity "Me while visiting cnn.com".

To me, this means all client-triggered requests while my address bar ends in "nytimes.com" will have a distinct set of cookies that is only drawn from while I'm on nytimes.com.

I prefer a rules-based solution to an ML-based solution. ML is more opaque and it's harder for developers to know when their solution will run afoul of the classifier.

Are there significant compatibility problems this would cause?

It says “identity”, not cookies. Maybe it means cookies are partitioned. Maybe it means some new form of identity token is created (Googles have proposed them at various times) and is partitioned, but cookies are blocked. Maybe it means new token plus cookies remain as they are based on the “fingerprinting is even worse” argument. Maybe there are different settings. Who knows?

Anyway, the reason we moved away from cookie partitioning is that many third party embeds got confused when presented with non-empty cookies, but ones that weren’t the user’s canonical cookie for that site. Bugs were reported to us by embed providers, including Google web properties. This is a bummer because partitioning is elegant and has been WebKit’s go to approach since 2013, when we partitioned all storage besides cookies (LocalStorage, the HTTP cache, etc). A move that, incidentally was opposed by Chrime Engineers back when we shared an engine code base, though they are coming around now.

(I should mention also that partitioning cookies made many social embeds stop working at all until we provided Storage Access API and got embed providers to adopt them, which is why ITP originally had a 24 hour user interaction exception. Fortunately the web has adapted now.)

I should also mention, WebKit ML solution is deterministic. It’s trained offline. And it doesn’t substitute for enforcement actions, it substitutes for a block list of known trackers, which other tracking prevention systems use. One downside of strict rule based systems is that it may allow malicious players to game the system. So there has to be an out for changing the rules or ratcheting up enforcement.

Apologies, you're farther along than I was giving credit for. Storage Access API looks very much like the last 10% I was envisioning.

I do still wish the ML stuff weren't there, though. As a developer for a small company that's trying to become a big company (and develops on these boundaries), I fear we'll build something that works one day, but the next will be classified and the rules will change.

I'd rather have a policy that forces big and small sites to follow the same rules. Between storage access and link decoration detection, WebKit seems quite close to being able to detect cross-site tracking as it happens rather than via classifier, and I'd hope that could one day replace the ML component.

Is the expected outcome of these changes that most publishers migrate to Apple News instead of the web that's accessible via Mobile Safari?

> "If y'all had just handed over your wallet when we asked, we wouldn't have had to hurt you. So really, this is your fault."

Seeing as Google doesn't engage in fingerprinting and are actively taking steps to block it[1], I don't think this is a fair characterization of Google's position.

[1]: https://blog.chromium.org/2019/05/improving-privacy-and-secu...

Where does it say they don't engage in it?

Naturally, blocking other companies' fingerprinting is important to their business model.

Doesn't reCaptcha alone rely extensively on fingerprinting?

It does. The more anti-fingerprinting measures you enact, the harder it is to pass to the point that it becomes nearly impossible to do.

Unless of course you're state-of-the-art neural net. Oh the irony...

>This is why Chrome plans to more aggressively restrict fingerprinting across the web. One way in which we’ll be doing this is reducing the ways in which browsers can be passively fingerprinted, so that we can detect and intervene against active fingerprinting efforts as they happen.

That seems like a 180 from their stance 2 years ago[1]. Their statement is low on details so I'll believe it when I see it. Right now the only browser with meaningful fingerprinting protection is tor browser/firefox.

[1] https://bugs.chromium.org/p/chromium/issues/detail?id=49075

The initial statement was low on details because it was just an statement of intention. Specific steps they're taking to combat fingerprinting are visible in their public bug tracker[1]. Also, let's not forget the privacy budget[2] system they just announced in the OP. That seems rather promising.

[1]: https://bugs.chromium.org/p/chromium/issues/list?q=component...

[2]: https://github.com/bslassey/privacy-budget

The cynic in me is 100% sure they calculated the impact of these changes to their ability to track users and found the impact negligible. Still, it probably does make tracking more difficult for other advertisers, so there's that.

Since Google has cookies dropped by google.com properties that they can use for user tracking, I'm surprised they haven't worked harder to reduce the effectiveness of fingerprinting in Chrome. They could make user tracking more difficult for ad companies that don't have cookies dropped by sites as popular as google.com while accurately marketing the Chrome changes as improving user privacy.

Google does engage in fingerprinting in multiple of its products, but even if it didn't I don't think I would change my analogy.

Google's position here is, "obviously you're going to have to let us track you some way, and our way (cookies) is better than fingerprinting." It's still blaming privacy-conscious users for the actions that advertisers have taken, because those unreasonable privacy-conscious people couldn't be content with just blocking some of the trackers.

There's an underlying tone to this article that reads as, "you all messed this up because you didn't just leave well enough alone. Now we'll come in and fix it, but you're gonna have to compromise with us when we do." From my perspective -- no, users didn't break anything. This isn't our fault, and we should be allowed to broadly block cookies without being tracked in more pervasive ways.

But, if it makes you feel better you can change a word in my characterization to read:

> "If y'all had just handed over your wallet when we asked, they wouldn't have had to hurt you. So really, this is your fault."

I've downvoted you because, as others have pointed out, your statement that Google doesn't fingerprint is factually incorrect.

I disagree. No one has posted any evidence that Google engages in fingerprinting users beyond simple user-controllable mechanisms like cookies. (Though several have indeed made that assertion with no evidence.)

ReCaptcha and Analytics both fingerprint.

Google Analytics does not fingerprint. Hits are identified with a user either by a first-party cookie (called the Client ID), or with a user-id value provided by the site owner. The site owner could provide their own fingerprinting value as a user-id, but the fingerprinting is not done by analytics itself.

(There are some cases where identifiers are pulled in from other systems, but none of them can be used as the basis for unifying users.)

GA records a lot of data about the user such as screen resolution and browser version. It doesn't do full fingerprinting to identify unique users but it uses many common fingerprinting techniques.

Like collecting any data at all? I mean “what browsers and what versions do I need to support” and “what resolutions do I need to design for” are pretty benign questions.

Re-Captcha doesn't fingerprint users. It uses statistical models to guess whether a particular user is a bot or not; it doesn't de-anonymize users or identify them in any way.

Analytics doesn't either, it uses regular cookies. (See sibling comments.)

Statistical models based on what? Browser characteristics that could also be used for fingerprinting?

Cookies, browser characteristics, user behavior, etc. Just because a certain bit of information could theoretically be used for fingerprinting users, doesn't mean any system that uses that information is doing fingerprinting.

Agreed, but it's incredibly naive to assume they are not. Google's product is it's users, and it's a known fact they manipulate results based on what they want you to think or what they think you want to see. They are completely shady on privacy.

I don't know why HN seems to be so stubborn about things like this. It's clear as day they fingerprint users, but seems like the majority of users here refuse to believe a corporation or government has done anything wrong unless they literally admit it in a press release.

IP address, the client/user ID, type of interaction, timestamp and a few other bits of data like your device hardware.

GA isn't nearly as invasive as people think. The real problem is data being combined on the backed and correlated across websites by ad networks, not the analytics itself.

Edit: Worth a look if you're interested in what's being collected: https://developers.google.com/analytics/devguides/collection...

> IP address, the client/user ID, type of interaction, timestamp and a few other bits of data like your device hardware.

Unfortunately, that sounds exactly like the set of information that can be used to fingerprint users.

So...fingerprinting?

HN guidelines would prefer that you don't comment on downvoting, as it makes for boring reading. If you don't have anything substantive to add (such as, if "others have pointed out" your thoughts already), just vote and move on. :)

https://news.ycombinator.com/newsguidelines.html

Although the words "I'm downvoting you" aren't useful, I would argue that saying why you're downvoting someone is really important. Helps prevent the feeling of shooting the messenger.

In that case, "I'm downvoting you because you're wrong" could be condensed to "you're wrong."

Considering that we're talking about a company which owes probably nearly all of its not inconsiderable fortune to predicting people's behavior via mass surveillance, this comment seems to miss the forest for the trees a bit.

Fingerprinting is mostly dependent on Javascript and presence of browser numerous detectable "features".

What would happen to fingerprinting in the case of "large scale disabling of Javascript"?

Even more, what would happen if there was large scale movement away from Chrome and other browsers with "features" that make fingerpinting possible?

It would greatly reduce the amount of fingerprinting, but not completely eliminate it. I've written about this before, but there's more than just Javascript we need to worry about -- we'd want to strip down CSS a bit, rethink how asset caching works, and potentially send less information in request headers.

But it would certainly be a lot easier to do all of that without Javascript.

The problem is that one of two things would happen:

A) the majority of web apps would move to native platforms, where fingerprinting resistance is even worse. That would include a good many news sites, even though most news sites aren't really web-apps, and don't need Javascript to operate. They'd still do it.

B) the majority of users would not use those browsers. We're playing a kind of weird game with fingerprinting right now -- we want to block it without breaking most websites. This is why adblocking is fantastic: it observably makes the web better to even an average user, so there's an incentive for users to adblock en-mass, and publishers can't really leave the web. Adblocking is a way to fight surveillance apparatuses without making sacrifices.

It's a tricky situation to be in, and there's a lot more that could be said about the merits of different strategies.

That being said, if you don't care about an en-mass policy, and you're just looking to increase your own privacy, it would definitely be a good idea right now to use something like UMatrix to disable at least 3rd-party Javascript by default. You'll have to do a lot of per-website tweaking, but if you're at all technical it's honestly not that bad.

> maybe the majority of people will decide they don't want cookies

At the same time, a lot of people don't understand what cookies actually do (the good things they do, I mean) and thus having them disabled by default will deepen their belief that they're only bad.

I'm not sure what I'd do if cookies were blocked by default. What an absolutely inconvenient reality that would be as a web developer. You'd have to embed a token in the page on each request, like WebForms, or something.

Nobody has suggest nor enacted blocking all cookies by default. I'm not sure what you're referring to here. This is mostly about third party cookies and or Safari/Firefox's default privacy blocklists.

You seem to be conflating first-party cookies with third-party ones. The originating party of the cookie, with respect to the site the user get the cookie from, is the crucial point on that subject in this context.

Nobody in the comments sections has identified the most nefarious part of their plan. Their goal to develop an "open set of standards" is an attempt to control how other browsers protect user privacy.

This is Google saying, "oh looks like everyone else is doing things that hurt our business, so let's get everyone to work together on open standards, where we can block or delay attempts that run counter to our business model".