Hacker News Reader

Comment by EGreg | Hacker News Reader

Shouldnt this have been rendered impossible with Apple and Google’s crackdown on third-party cookies? Whether it a 1x1 tracking pixel or a full-blown Javascript, Apple’s ITP protection would seem to render it unables to track people across websites.

The key word is SEEM. I have no idea regarding all the contradictory news coming out of all the camps. I posted a question on StackOverflow with a significant bounty that expires in 5 hours and so far no one has even showed up to answer it:

https://stackoverflow.com/questions/73794780/what-exactly-do...

View on HN

I can shed some light on this maybe, don't have a SO account. You're completely right about "SEEM". It does do enough that it significantly lowers the resolution of data and ability for systems to infer your behaviors / persona. It will force more of the ad ecosystem to server to server data pass through: https://developers.google.com/tag-platform/tag-manager/serve...

I mention it in a post above, but data brokers have existed for a decade, which don't really care about any of this. Your email/phone/credit card + purchase behavior for instance, is likely sent to 3rd parties (as md5/sha hashed values) It boils down to sample resolution and sample size. Javascript made it really easy for literally every website to collect browse behaviors. ITP makes the skill ceiling / investment to collect this data much higher.

How would third parties track you across websites now? Given any skill level?

I can think of only one: convincing websites to add a CNAME to point subdomains to their servers.

I don't work in the ad space, but it's my understanding that that's where things are going.

See here for Facebook, but I'd expect other providers to do the same.

https://developers.facebook.com/docs/marketing-api/conversio...

ITP doesn't conceal the IP & user-agent, which is enough to track someone reliably since most connections still have a persistent-enough IP address. It only breaks down if you're behind NAT (sharing the public IP with lots of other people) and have a very common user-agent such as the one of the latest version of a mainstream browser.

The only way to defeat this is to 1) have all browsers standardize on a single user-agent that never changes going forwards and 2) per-origin VPNs so that the public IP seen by each origin is different.

ITP is with Safari, and most people using it will have the latest version, so will blend into the Apple user crowed that way. And private relay is pretty much a VPN.

CNAME wouldn’t work because then the cookie is bound to that domain. So the identity doesn’t travel from website to website.

Well, yes and no

First of all, the subdomain can redirect to google.com and back, loading it in a first-party context, and then redirect to your main domain page. I guess Google here would be a “second party”. https://learn.microsoft.com/en-us/azure/active-directory/dev...

Second way is that subdomain can load an iframe from google.com and the iframe will send a postMessage to the enclosing page, which will send a request to the server to set a cookie.

As long as you logged in ONCE in google (let’s say in a popup, or maybe using ITP’s click-to-login) then it will store the session cookie this way. And after that it can meep a cookie around for 10 years and track this guy across all the subdomains where he signed in once.

Reply on news.ycombinator.com