Hacker News Reader

Comment by AdmiralAsshat | Hacker News Reader

The downside of all of this is that I feel like sites are now intentionally being designed to break if this kind of stuff is blocked. I used to be able to use Firefox Focus (which has tracking protection built-in) to pay most of my bills. This was convenient because I would just open up the one site in FFF, pay the bill, and then close it, with all browsing history automatically deleted.

In the past month about 3 of my credit card sites stopped working on FFF, as well as my ISP's site. Some would flat out reject the agent ("Your browser is no longer supported"), others would let me log in but then immediately tell me I had been logged out or redirect back to the home page. So now I'm forced to open them back up in regular Firefox, history and tracking included.

It's one thing to say "Don't use sites that exploit your data", but it's not like the average person really has a choice when it comes to paying utility bills.

View on HN

That particular example is just extremely odd because… well, the business model of the utilities whose bills you pay (nor the bank's) shouldn't be based on advertising?? Maybe it's just a pile of web development fail, using 3rd party cookies for no good reason..

I’ve seen sites fail to load if google analytics doesn’t load, so that could be it.

Likely they've been sold a bunch of snake oil to prevent "fraud" based around sniffing up their customers' asses.

But you should still use all of the anti-surveillance tech you can, lest the downward spiral continue. The methods are implemented gradually, with soft heuristics. The more customers they have without such vulnerabilities, the harder it is to justify turning the screws.

Utilities shouldn't need advertising in theory, but utilities don't behave well (economically speaking) in general. There is to much regulation (limiting upside from selling their services means squeezing money out of less ethical verticals) or there are monopolistic incentives (you don't have a choice, so we can make you give us ad revenue)

It's arguably the second. Advertising/surveillance as an additional revenue stream is a no-brainer for ethically challenged companies.

Where is there too much regulation of utilities? Particularly considering the issue with PG&E, it seems unlikely this would be the case in the US; the money in the US is being squeezed toward bonuses and the like.

> well, the business model of the utilities whose bills you pay (nor the bank's) shouldn't be based on advertising??

They shouldn't need it, but from their point of view why on earth wouldn't they sell their customers out at every opportunity if it means more money for them? Companies are amoral monsters who care about nothing but making money. If a company can do something that will make them more money you should expect them do it regardless of how ethical or legal it is.

Here is why they track and collect:

“Hiding within those mounds of data is knowledge that could change the life of a patient, or change the world.” (Atul Butte, Stanford)

"Information is the oil of the 21st century, and analytics is the combustion engine” (Peter Sondergaard, Senior Vice President, Gartner)

“Without big data analytics, companies are blind and deaf, wandering out onto the web like deer on a freeway.” (Geoffrey Moore, author and consultant)

And the quotes go on and on...

Those aren't the reasons, they're just attempts at finding an argument that will make people lay down and take it.

Right, but regardless of the factuality of these claims, remind me how we continue to sidestep the issue of consent from those that are tracked? “Privacy nuts” such as myself do not struggle to see upsides to say a global DNA database with perfect coverage, it is the fact that we are very much aware of the terrible potential downsides of a world where privacy and consent is largely ignored that makes us concerned.

What I usually see if just poorly implemented tagging. For example, if Google Analytics javascript breaks then so do the links I want to click. I’ve seen it on my 529 plan website and in other places. I suppose tracking blockers could forge GA and other javascript objects to avoid this but what a battle this becomes.

Ghostery already does this kind of forging for many blocked gadgets.

>In the past month about 3 of my credit card sites stopped working on FFF, as well as my ISP's site.

Which sites are these? When you make claims like this, you should specifically name the businesses that do this, so the rest of us can try to avoid them.

I avoided doing so because I don't really want the internet to know what credit cards I have.

With that said, let's say I specifically name "Chase". Are you going to cancel your existing Chase bank account or credit card upon hearing this?

>With that said, let's say I specifically name "Chase". Are you going to cancel your existing Chase bank account or credit card upon hearing this?

Well put it this way: if you specifically name "Chase", I'm going to think twice about applying for a credit card there or opening a bank account there. It's harder when you're already invested in a business, but when someone is shopping for a new one, when they hear credible information that shows that business to be a bad actor or that it will provide them a bad experience, it's pretty easy to cause many of them to choose something else.

BTW, I would never advise anyone to get a Chase bank account; they're pretty well-known to be horrible. You can get far better service and interest rates from a good online bank like Ally, Schwab, Discover, etc.

> BTW, I would never advise anyone to get a Chase bank account; they're pretty well-known to be horrible. You can get far better service and interest rates from a good online bank like Ally, Schwab, Discover, etc.

Again, it was a placeholder name. But I'll be honest for the sake of those curious and just say "the credit card that's offered through Costco" :)

yah, absolutely avoid the big 4: chase, citibank, bank of america, and wells fargo. there's always a better local/regional/online alternative at a lower cost and with (often much) better service.

The principal here is that businesses with bad practices should be named and shamed. Companies that act like this are banking on their consumers not caring enough to do anything about it. Even a negative press reaction may be enough to dissuade companies from doing this. Refusing to name the companies is compliance.

> I avoided doing so because I don't really want the internet to know what credit cards I have.

And that is one of the reasons why we are allowed to have multiple accounts on this site, as long as they aren't all throwaways.

I bet you are aware of this already, so I'm mentioning this mostly for the benefit of those who haven't wasted half a decade (or more in my case here.)

The Toyota Financial web site (if you finance a Toyota/Lexus through them) became horribly broken recently. It required me to jump through so many hoops to log in (including turning off ad blocker, turning off tracking protection, not using "private browsing mode," etc.) that I just got fed up with it and went back to paper billing. It's so ridiculous.

I actually pay through my online banking now but I'm forced to receive paper bills unless I agreed to some insanely-long new T&C.

The online banking I use (some local credit union) uses a 3rd-party site so in order to use it I must accept 3rd party cookies on this site. But you don't whitelist <the bank site> you have to find and whitelist <the 3rd party site> which requires some knowledge/skill in this area. I don't know how any "normal" user will be able to use Firefox after these updates; if you can't log in to your bank you're just going to go back to Chrome, right?

> The downside of all of this is that I feel like sites are now intentionally being designed to break if this kind of stuff is blocked.

That's fine by me. It's an up-front indication that I don't want to use that service. In the case of bill pay, I would just change my user agent string.

> In the case of bill pay, I would just change my user agent string.

He also mentioned "others would let me log in but then immediately tell me I had been logged out". If they implement logging in with some tracking cookies, then changing your agent won't help.

You are working around the problem, but the underlying issue is still there, which is not fine. I do not consider those practices fine just because I may have found a workaround. :/

You can take a small action in support of privacy by complaining to your utility or your ISP that the website is not working in your browser.

We're talking about utility companies. It wouldn't surprise me if the answer is "Please use Internet Explorer 8"

Then our answer would be: fix your website or you lose a customer or maybe several of them.

I wouldn't expect it to succeed immediately. But there are often frontend developers within these companies that would prefer to build high-quality websites that work in many browsers, and if there are complaints from end users, it will help these people in their arguments that they should invest more time in quality.

> it's not like the average person really has a choice when it comes to paying utility bills.

You can always use a dedicated browser for that and only that. Brave, Opera, Vivaldi, IE, Chrome, whatever. At least there's enough browsers around to have each dedicated for certain purpose.

Well, that's the thing: Firefox Focus was my dedicated browser for that purpose. So now that's really no longer an option. I guess I can use Chrome in Incognito mode, but god knows how long it will be before payment sites start blacklisting that, too.

Temporary tab containers are a great alternative to a dedicated browser or incognito mode.

https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

No need. Use Incognito/Private Browsing.

With the usual provisos, of course:

https://en.wikipedia.org/wiki/Evercookie

https://panopticlick.eff.org/

Somewhat related, I saw a site today that did a fake Cloudflare style bot check countdown, and then said “click allow to confirm you’re not a bot” before popping up a notification send request UI. I bailed then but presumably it wouldn’t show anything if you declined that, who knows what spam they were sending if you didn’t. Thought that was a clever-ish very shitty way to work around permissions.

I had hoped that the notification API would just silently not send a notification if the user had explicitly denied this. Unfortunately that's not the case: https://developer.mozilla.org/en-US/docs/Web/API/Notificatio...

It's a shame the designers of this feature didn't think of the abuse potential.

I'd like to have that option, but i can understand why they did it this way. If you just hide the notification then the site can still use them to get around other restrictions like how much time the javascript is allowed to run in the background and things like that.

The more I protect my personal data (hi, GDPR!), the more websites are adding recaptacha to all their pages.

Blocking trackers makes Google suspicious, so they're adding more and more recaptcha challenges to let me pass their tests, sometimes 5 to 10 in a row. I'm now working for Google's IA for free just to be able to make purchases online, access some services that I already paid for, or filling in support request forms (sometimes it's for websites operated by local communities and funded by tax payers).

I have absolutely no control over what Google does with all my recaptcha inputs, it could be to build a fleet of autonomous cars (that could end up killing the public transportation in my city), or improving an algorithms that helps drones identify targets during a social unrest (could be a future me).

Just because I want my privacy rights to be respected to the minimum (just don't track me for political/advertising purposes), I have to spend several minutes of my day working for Google and help them make money on advertising and sell AI to governments.

How dystopian.

> that could end up killing the public transportation in my city

Don't forget that public transportation can also be self driving and it will be cheaper than riding in a self driving car. So I don't expect public transportation killed, I expect self driving buses.

Use Buster captha solver addon

Thanks for recommending Buster (author here), but I think the right solution is to encourage people to stand up against Google's abuse, especially because they are working on making reCAPTCHA even more pervasive an inescapable.

The recommended way of integrating reCAPTCHA v3 is to load it on every page of your site, not just on pages with forms. Given the popularity of this service, reCAPTCHA v3 is set to become a browsing history and behavioral data collector on a global scale.

What is the rationale for recommending reCAPTCHA on every page of a site??

Blocking scrapers?

So that they can watch your interactions with the site to confirm that you do it in a “normal” way, nevermind that this discriminates against those with disabilities.

They want to monitor your behavior (mouse movements, clicks, etc) site-wide so they can determine whether you're a bot before you get to the "protected" page. So the carrot for the website owner is that people that don't want to solve "click all the stop signs in these 9 pictures" challenges don't abandon your forms because they're never challenged, at the expense of adding behavioral tracking site-wide.

You could try Buster. It's an addon that solved Captchas when you tell it to.

How well does it work?

Has been said many times before but the problem is that you look like any other bot that also doesn't save cookies or have any past history. How do you expect recaptcha to identify you from those bots? Or more, how do you expect the websites to identify bots and stop things like credential stuffing attacks (even if recaptcha isn't perfect at stopping those either) without heavily investing in things like the anti-bot systems banks use?

I don't know, and at this point, I don't care.

Sites have brought this sort of thing on themselves by enabling (or directly engaging in) the abuse of users. That abuse forces me to take a very defensive posture when browsing the web. It's simply a matter of self defense.

If that means that I can't access the sites, whether it's because of recaptcha or other issues, then I won't access the sites. Easy.

does anyone have a script to keep triggering captchas and then providing[flood] the most wrong, and disruptive answer possible until ?

For something similar, I use a Firefox docker container whose data settings are saved to the ephemeral disk which disappears once the browser closes. It's just a standard Firefox (or Chrome, or Brave, or..) otherwise.

I use the same mechanism - but with persisting user data - for things like banking etc. in which I only open that one site.

Not usable on mobile, but one extension you might be interested in is Trash Panda: https://addons.mozilla.org/en-US/firefox/addon/trash-bear/

Whenever I see a link to a website I suspect of siphoning off all my data (usually news websites), I right-click it and select "Open in new Trash Container". Do my thing, then close the tab, and all cookies and such for that site are cleared. It's almost like a Firefox Focus tab, the main difference being that it's not discernable from a regular tab.

Or you could go all in with Multi-Account + Temporary containers :)

Tried that for a month and I couldn’t stand it.

When you open a link that opens in a new container, you loose the history that brought you to that link. Clicking a link actually opens a new tab and simultaneously closes your current one. Going backwards is now broken and you have to shift cmd t to go through all your recently closed tabs or dig through your history if you are a user who regularly uses back on a browser.

I also ran into a bug where infinite temporary containers would open until the browser finally crashed. The fix was removing the add on.

Great idea, sloppy implementation.

> Clicking a link actually opens a new tab

I don't have that enabled, even ctrl-clicking something opens in the same container for me. Not perfect in terms of privacy paranoia (my HN container gets cookies from sites I go from HN to, unless I take the effort to explicitly open in a different container) but it has never annoyed me.

Definitely complain to the site: an email saying that the site allows possible exploits might get somebody's attention.

But if I still need to allow/use the site, I use containers. Hopefully this gives me some security.

I agree you should email the site, but i would be careful not to suggest the site is vulnerable unless you have clear evidence of that or you risk not being taken seriously. Just be honest about it. The devs might not want that shit on their sites either, but were told they had to include them in which case they'd probably love to have something to show it's causing users problems.

Excellent point.

It's a pain, but what I do is pay by utility bills in other ways. Usually I can pay in person, over the phone, via a check in the mail, or login once and setup automatic billing.

Browser Fingerprinting is also used for fraud detection and identify verification. There is often overlap between persistent tracking and security verification services.

> it's not like the average person really has a choice when it comes to paying utility bills.

Your utility only takes payments through their website? That's hard to believe. In most places I've lived, the utility companies contract with various local businesses to allow you to pay your bills in person through them, and all have still accepted payments through the mail.

I think helps expose the actual (bidirectional) flow of information - web sites give you stuff because you give them stuff.

Usually you give them personal info about what you do on their site so that they can monetize you, in return you get news, messaging, etc.

If you're unwilling to give them that stuff, maybe it's OK that they are unwilling to give you their (presumably valuable, because you're requesting it) stuff (articles, videos, etc).

Often when I get "we won't show this to you with an adblocker on", I simply turn it off for that page. I want to read that article and I'm happy to exchange some personal info to get it for free. At least in this context I have the chance to opt-in.

I agree that there are probably a lot of places where anti-content-blocking tools are overused (i.e. services that I have already actually paid $$ for), and probably other situations where I'd like more options ("plz disable adblocker OR pay us $0.05 for this article [obviously need some way to pay that doesn't in turn expose my personal info]")

GP's specific situation was paying utility bills, so the stuff they give to those websites is... Actual money?

We're not talking about news or content sites here, we're talking about bill-paying sites. People should be able to pay their utility bills with whatever browser they want, without being tracked. The argument over free content vs. ads is a valid argument, but it doesn't apply here at all.

I don't want to sound naive, but... I wonder how much of this might be innocent bugs because developers just don't test the site on this browser configuration?

Well, rejoice. Now that the set of people for whom this breaks got expanded from "you" to "20% of everybody", they will likely fix the problem.

"20% of everybody" where everybody is somewhere between 4 and 9 percent.

They now have a setting in content blocking that lets you choose between a less or more aggressive block list similar to how ublock works.

I rarely see things break anymore.

We have squandered our privacy rights by using "free" services and software. Now getting those back will be an uphill battle.

That's really not a good excuse.

Doing the right thing should be a much greater desire than minor inconveniences.

Are there other reasons you don't like FFX or prefer other browsers?

Reply on news.ycombinator.com