Ultimately the only way out of all this tracking is regulation.
For example if there is an exploit to read your local files and upload them to the server, that would clearly be illegal.
What if you just got the names of the files?
What if you just got the count, e.g. 33413 and stored it against a name?
What about the count, but just used as a semi-anonymous tracking token?
What about system information, as a tracking token?
What about audio information specifically, as a tracking system? (Like this appears to be. Didn't read the article because it won't load for me).
As a comparison, think about speeding. It is technologically possible because there are cars that can pass most speed limits. I’m sure we can find a technological solution that eliminates speeding. But for the most part, regulations and enforcement is a sufficiently good measure.
You can also make JavaScript able to figure out how to play sound without letting it disclose what it knows about your sound system to a remote machine.
A social solution and technical solutions are needed. Firefox has put in a huge effort to prevent tracking but many useful features can also be used for tracking so a browser will not be able to determine useful and non useful code.
The site shouldn't be able to do anything without user's permission.
I want a browser that can get the task done with the least friction possible and a legal system that prevents abuse. The website should be the one to inform me that they are actually using the audio api for tracking and not just playing audio. With a large penalty for lying.
If we were talking about the issue of people being stabbed you don't suggest "Why should the stabber be penalized? The victim should have been wearing a Kevlar vest that doesn't allow them to be stabbed. If they weren't then they should simply expect that people will stab them."
The website can't do anything without your browser cooperating. The website can request the audio API as much as it wants but if your browser had a same configuration then it would just ignore it.
You're asking for legislation on a problem with a global scope. Countries that ignore your laws will still do all of this as long as your browser lets them.
>If we were talking about the issue of people being stabbed you don't suggest "Why should the stabber be penalized? The victim should have been wearing a Kevlar vest that doesn't allow them to be stabbed.
This is such a poor analogy. The server doesn't do anything without a client asking for something. In your case the victim went to the stabber and started the interaction. Then the victim's electric scooter (browser) malfunctioned or was poorly configured and drove into the stabber's knife.
Of course the server isn't blameless, because they are most likely knowingly exploiting this. But to suggest that the user has no control over this is foolish. It implies that the user can't be blamed for anything their computer does.
We need an automated approach. We need the ability to not only disable browser APIs but also make them return fake data to fool the website. We need the ability to inspect the data websites are sending back and redact data we don't want them to have just like corporations perform deep packet inspection to prevent data exfiltration.
> If we were talking about the issue of people being stabbed
In this case we handed them the knife. We thought they'd use it to cut something for us and they stabbed us instead. They even made the ability to stab us part of their terms of service. This cannot go on.
Browsers have been trying this for a long time but its not simple. Chrome has had multiple attempts at making it impossible to detect incognito mode but people keep finding ways. The old way was checking if the API to store data was available so chrome made it so that there is an emulated data store for incognito mode and then websites just check how fast the local data store is to check if it is on disk or in memory.
It would be an extraordinary effort to remove all of these issues since many of them are outside of the browser like what exact gpu and driver is in use could slightly change how the page is rendered or how long certain things take.
I didn't say it was gonna be easy. I said it was necessary. This is a perpetual arms race. If content blockers can maintain their huge blocklists, browsers should also be able to maintain their own counter-measures to abusive websites. Browser vendors created and standardized the APIs that websites are now exploiting. I expect them to clean it up.
> then websites just check how fast the local data store is to check if it is on disk or in memory.
Making both calls equally slow should prevent this particular side channel attack.
This is unacceptable under the GDPR. You must allow users to opt out. If this affects your business model than the legal option is to remove the free plan and charge a fee for the service.
This must be some new use of the word "simple" I was previously unaware of.
I don’t know if security / street cams actually record anything for more than a day, and I don’t know anyone with home security camera, but friends are always there!
I don't see how you solve this with regulation without breaking the internet. As far as I can tell, the solution ultimately is to consider privacy first as a user and a developer. Browsers and their users need to start providing less information to websites by default and prompt the user to share information.
If you try doing this through regulation then you end up with GDPR pop ups. What we need is for the browsers (and OS!) to stop leaking all of our information.