Hacker News Reader

Comment by jorge-d | Hacker News Reader

By setting very high fines for those who don't comply?

That is like saying if we make the punishment for any crime tortorous enough we won't need law enforcement. That only answers "what the punishment will theoretically be" not "How can it be found out when it is being broken? By whom? Will we able to take action against it?".

Oh heaven help us if a trillion dollar enterprise gets a fine !!!!

I think what they mean is, how can you track which companies are not complicit, how do you organize the proof so that you can levy the fine successfully

Already done. It's up to 10% of turnover, not profits. Which the companies would happily go to court over. But how to actually prove in court that company X is tracking users if a leak doesn't occur? Subopenas? They need a court order for that. They need reasonable suspicion to get a court order.

Those issues aren’t unique to this problem. Courts already try to solve them. It’s the same as how you would find banks denying loan based on race. You find banks by complaints or wide search. You do an initial investigation from the outside with no warrant or subpoena. Like send in a white client and black client (or someone with a search history of fishing versus sewing) and see what happens. Then that’s enough to ask for all the secrets. Of course they could delete them, but that should be a big crime.

I’m not saying this is a perfect system. It’s not. But it’s an attempt the problem you describe.

Right now it's very easy to see, the companies are not hiding it at all. They send the data to third-party trackers straight from their website or application.

Disqus loads a million external resources

That’s so stupid, why not just take your OWN cookie and use it in the backend to send to all these resources, proxying through your own server or having a CNAME for theirs under your domain?

I guess it's often much simpler and cheaper to not try to hide it.

The CNAME practice is becoming more and more common. See https://blog.apnic.net/2020/08/04/characterizing-cname-cloak... or https://medium.com/nextdns/cname-cloaking-the-dangerous-disg... or https://www.laquadrature.net/2020/10/05/le-deguisement-des-t...

I think proxying or doing it server side only will be implemented later when these people will be forced to hide to save their shitty business model.

CNAME cloacking has gone even further, ad company now ask you to put a A/AAAA record pointing to one of their IPs as CNAME uncloaking was working pretty well.

I think the move will be for ANAME records. ANAME is not a real record (yet), but some providers are supporting them.

It is similar to a CNAME record but instead of storing the domain name you want to map to it pulls the A record and puts that IP as your A record.

Reply on news.ycombinator.com