Hacker News Reader

Comment by willscott | Hacker News Reader

I still haven't heard a cogent explanation of what this is supposed to do.

"Do Not Track" sounds nice, but seems no easier to scope than the initial problem of excessive information collection. I think it's safe to say that I want companies to 'track' me in order to keep me logged in for a session. Likewise, I hope that my bank keeps logs of visitors, so that it can respond to abuse / hacking attempts. Is this aimed only at behavioral advertising, or is it meant to have a broader scope?

It seems like the technical execution is almost misguided without having the policy discussion first and figuring out what it is we disagree with. Without that, I don't feel like this is going to draw a strong enough line to separate people abusing tracking from the legitimate uses.

View on HN

From http://donottrack.us: "Do Not Track is a technology and policy proposal that enables users to opt out of tracking by websites they do not visit, including analytics services, advertising networks, and social platforms."

Emphasis on "websites they do not visit" directly, meaning that it only applies to iframes, popups, etc. If you typed it in the address bar, or clicked on a link to get there, the site isn't limited by DNT.

This is not legal advice.

I don't know what legal ramifications could follow sites which declare they support Do Not Track as a spec but in actuality do not support any of the features of the spec in a meaningful way. Other than just bad press if discovered, I don't think there is any punishment for not properly following a technical spec outside of civil lawsuits.

sites which declare they support Do Not Track as a spec but in actuality do not support any of the features of the spec in a meaningful way

Seems that it's like P3P[0], in that it causes problems for developers but in no way keeps a company from asserting things that they don't actually follow, and there's no way to verify that they are.

[0] http://en.wikipedia.org/wiki/P3P

The FTC would likely investigate, if you had a non-trivial number of users. You really don't want this.

What if they're not in the USA?

European regulators are worse, China is its own story, everywhere else is pretty lax afaik.

So who cares, shady operators will just move?

So Disqus, and any site that uses it is screwed then?

When you say 'screwed', how do you mean exactly?

Disqus isn't a site you visit directly, it is a plugin service which site owners can plug into their site.

As part of its functionality it relies on the ability to uniquely identify a user across sites (to provide user authentication).

There are quite a few other services that work in a similar way.

Many people are logged into Disqus all the time. I would think that an explicit login overrides any DNT header.

On the other hand, if I'm not logged in, I don't want them tracking me across all the Disqus-enabled sites I visit.

"Many people are logged in to Facebook all the time. I would think that an explicit login overrides any DNT header."

As a user, I want to be stay logged in to Facebook when posting a TC comment. But I don't want Facebook to track me when I visit some random site with a like button. How do we draw the line here?

Pragmatically, we draw it with Adblock and NoScript and friends.

Suggested friend: Ghostery.

Is Ghostery useful if a person is already using a privacy list for AdBlock, such as EasyPrivacy[1] or Fanboy Tracking List[2]?

[1] https://easylist.adblockplus.org/en/

[2] https://secure.fanboy.co.nz/

Yes, it lets you more easily re-enable things on a case-by-case basis. Like NoScript, but focused on privacy.

A solution that I've found works well for me is simply disabling cookies, and whitelisting any site that I want to use that requires them, or that I am attempting to log in to.

This is made easier for me by the fact that I don't use Facebook.

I think Facebook and Disqus are different cases. The only reason anyone ever logs into Disqus is to be able to use it on third-party sites. Not so for Facebook. People's intentions matter.

I would say authentication isn't tracking... its authentication.

That's a play on words. You can authenticate yourself to something and then be tracked for other reasons.

If you don't want to be tracked, the site that handles authentication can still keep you logged in, but it isn't allowed to track your whereabouts.

In the case of facebook they can show the "like" button, but they cant use the information that it has been shown for you on a particular site, on a particular date/time.

Yeah, but that is kind of useless.

Facebook's entire purpose is to show you things you are interested in. The fact you didn't like something on a given site is nearly as useful as if you did.

Thats from an advertiser perspective, not from a user perspective.

Not at all.

Facebook show's me updates from my friends activity. It can better match those to my interests if it knows what I am interested in.

Good.

So Facebook & Google are fine, too then. You authenticate with them, then they add features based on that.

Do not track me for advertisement, statistics, etc. is the intent.

Ending your list with etc. undermines your point. With this header set, can my site track what pages a user views to recommend pages to him later? Can compliant sites keep stats for engineering purposes? Grandparent is dead-on - it's bad enough that this does not affect the behavior of bad actors, but if it isn't even clear what effect it will have on good ones, the false sense of security may be worse than nothing.

Key word is "intent". Privacy != security. Close, but not quite.

statistics

WTF? So analytics packages will somehow have to exclude these browsers from all reports? Some reports? Can you count impressions from these users?

How that's "wtf"? If I don't want companies to make statistics using what I do that sounds perfectly legitimate to me.

Now then again DNT is an intent, the vendor does whatever he likes, and can support DNT for other features and still have statistics. There's no list of things you can do or not do. There's no agreement either. It's just the user indicating that they don't want to be tracked in any way.

It's a wtf because you can't draw any good lines on statistics. Web server admins have legitimate reasons to track (i.e. log) all requests to some extent against their web sites. We have good tools to help analyse a lot of this.

Consider a real world equivalent. Suppose you walk into a bookstore and buy a book with cash. The store might not be able to track you individually but they can track how many people visited, how many books they sold, etc. You can't say that's not legitimate.

So I could see an argument that the line that should be drawn is one that involved tracking cookies, but that is quite a narrow exclusion regarding statistics of individual users. You can still get pretty good stuff from the access log and there's no case to be made that DNT means Do Not Log.

Statistics != "logging"

Then again anyone is free to track/not track, stat/not stat (so far at least) and only "not track" subset of their data (as long as they don't lie)

Then again there's a few privacy-aware websites who do logging and some stats but on pseudonymized IPs which is also a pretty decent compromise.

But what about mining statistics from logs?

The intent is to enable users to "opt out of tracking by websites they do not visit, including analytics services, advertising networks, and social platforms". So you can have an analytics package on your site and do everything you mention, but you cannot offload your statistics gathering to yoursitename.statistics.net, which can track the user across websites, because the users are visiting your site, not statistics.net.

A hypothetical and largely incorrect real-life analogy: you can use cameras to recognize regular clients and keep statistics on them, but you cannot send the camera images to another company to have them processed, because your clients are visiting your store, and not that other company. (This analogy is largely incorrect because camera images are more privacy-sensitive than cookies, and different legal and moral issues are involved, but there's still a similarity.)

Does that mean the access_log should omit visitors who set this header? Does this mean log analysis tools should omit such records in the logs?

I am confused as to how this works for statistics purposes.

Reply on news.ycombinator.com