Hacker News Reader

Comment by spindritf | Hacker News Reader

The company opted to ignore the Do Not Track setting on Web browsers ... other Internet behemoths, including Google and Yahoo, have publicly confirmed that they also ignore Do Not Track

Am I the only one bothered by the silliness of "Do Not Track"? Or even worse, the EU cookie law?

You have a browser that leaks all kinds of info[1] about itself, tells everyone where you came from (sends referral), takes cookies from strangers like an untrained dog, making you uniquely identifiable and instead of fixing that, you ask everyone on the web to please disregard that info your browser just volunteered. How is that not completely backwards?

AdBlock, RefControl, and Disconnect, or their equivalents should be built into modern browsers. And maybe do something about the user agent, fonts, etc, too?

Don't educate users. Fix it.

[1] https://panopticlick.eff.org/

View on HN

I also walk around town completely uncamouflaged, voluntarily displaying my uniquely identifiable face and whatnot, and yet somehow most businesses can still restrain themselves and do not follow me around, colluding to enable each other to videotape my every step for analytics purpose.

Sure, there's some technical steps that can be taken but there's also a social or cultural dimension to what behavior is popularly accepted fro companies.

Do you wear an ID around your neck? Do you walk into an establishment, introduce yourself, tell the keeper where you came from, when was the last time you visited, check in with an inter-business tracking device, and then ask them to forget all that?

This is what a browser with (or more appropriately, on) DNT is doing. Long way from camouflage.

And offline, we should also employ techniques like randomizing MAC addresses in mobile devices. Just like you lock your car even though it's illegal to jack it.

No, that stuff only happens when I pay with my credit card, I guess.

And use a frequent shopper card.

And fill out those surveys on the back of the receipt where you would win $1,000 in gift cards.

Hmm... what if I re-post a legal-sounding statement as my status that refuses to give Facebook permission to use my information? That would work, right?

http://www.snopes.com/computer/facebook/privacy.asp

> Do you wear an ID around your neck? Do you walk into an establishment, introduce yourself, tell the keeper where you came from, when was the last time you visited, check in with an inter-business tracking device, and then ask them to forget all that?

Don't worry, there's a startup that's "fixing" that[0].

Nomi uses the MAC address of your phone to identify the brick-and-mortar venues you visit. It's opt-out for consumers, and the only way to opt-out is to register your MAC address with them[1].

[0] http://getnomi.com/

[1] http://nomi.com/privacy/

This actually gets killed by an upcoming iOS 8 update (which randomizes you MAC every time it searches for wifi networks). Big pro-privacy change from Apple. While it is problematic that this is iOS only (for now, at least), the large number of iOS device will introduce a ton of noise and make the tracking much less interesting for any company, even if they can theoretically still track Android devices.

Luckily there's a simple solution to that: randomized MAC addresses. My laptop assigns itself a random MAC address on boot. About the only downside is that some captive portals require me to re-sign-in on boot.

Another downside on some (private) networks is that it breaks MAC-based DHCP reservations.

Actually, I don't lock my car because the crime rate in my area is pretty low. In fact the front door of my parents' house is unlocked during the day when they're not home. They've never been burgled.

I don't think that's particularly fair.

The browser shows where you are coming from, similar to you walking from one store that sent you to a second store. The browser's identifying marks are more like the color and type of your vehicle. The ID around your neck? That really is more like a company that would use facial recognition, or tagging your phone and tracking that.

What websites do is exactly what the parent described, like to a T. Often stores track you inside the premises though for marketing and display purpsoes, or so I've been told.

Browser fingerprints are largely unique, so it's far more identifying than just the color of your car.

They are unique the same way your gender + birthdate + zip code are unique. That is to say, a combination of ordinary parameters that make it unique, and only identifiable if you go to the trouble to do something with the information.

I haven't seen many physical stores tracking license plates in a similar fashion.

>Do you wear an ID around your neck?

Yeah; it's called my face.

Can I follow you anywhere and photograph/record you doing everything? This is usually called stalking and it's illegal, unless it's done by the government, when it's called protecting from terrorists.

I agree with you 100%. There's no technical solution.

> Do you walk into an establishment, introduce yourself, tell the keeper where you came from, when was the last time you visited, check in with an inter-business tracking device, and then ask them to forget all that?

If the shopkeeper kept a logbook that recorded all of that, and then he published said logbook to other companies, you might feel that this was going a bit further than the social contract between you and the shopkeeper allows.

Though not a perfect analogy, the shopkeeper and you having small talk -- without anyone writing things and keeping the records forever -- would be tantamount to the server keeping the values in a transient fashion (i.e. for the duration of the request or session and then dropping them).

If you're in a car, yes you do. A license plate - and these scanners are all over the place.

Check out Pry-Fi by Chainfire for Mobile MAC address randomization.

Retail stores most definitely do follow you around and track every move you make in their store and on the parking lot.

> yet somehow most businesses can still restrain themselves and do not follow me around

Hmm no. It's just harder to do but they are working on it. Any big shop uses tons of tracking on every level. Pay by CC or use your fidelity card, facial tracking, MAC address of your phone. In London a company was providing the phone tracking service on the streets, installed on their bins, until they got shot down by the government.

Don't you know almost every shop tracks you by your CC, and they literally put up fake wireless networks, so they can track your phone MAC address when you walk around a store?

The world on the street is exactly as cynical as the one online. It's the same world. Online it's just easier to track people even more, so they get tracked even more.

It's a matter of cost/benefit to the businesses, that's all. When a business can track customers cheaply and finds the data useful, they just do it:

http://www.nytimes.com/2013/07/15/business/attention-shopper...

If you use any credit card, points or frequent shoppers card or participate in loyalty program, you are being tracked. If you use a e-coupon, you are being tracked. They are not colluding -- they collect this information and had it to the data mining companies.

Why do you think the buzz around big data exists ? Its not just for curing cancer ; its mostly to track and model individual consumer behavior.

The browser giving information automatically is not trivial to fix; the vast majority of users don't want the equivalent of a UAC popup every time they try to use a web app that has session cookies, for example. So the browser gives info by default because it's useful for making certain things work.

It seems to me that the best way to do this is to combine both approaches. There are some things you can do, but there's almost certainly going to be some clever way that people manage to circumvent these rules. One thing to consider is that the biggest threat is from the "omnipresent" companies like Google, Facebook, Twitter, etc, because they're the ones who have a 3rd party presence nearly everywhere on the web. Tracking someone's entire web history is a lot different than tracking 1 out of every 100 websites they go to, and the "big players" are the ones who are most likely to actually be scrutinized. I'm usually quite loathe to recommend any legislation, but I do think that these "big players" would likely comply with a legal requirement to respect "Do Not Track" requests, even if CoolBeanzTracker.biz would still ignore them.

In the end, I think the way forward should be to do our best to prevent our browsers from leaking such information, but also to punish people who, against our explicit wishes, take advantage of any small mistakes we make when we protect ourselves.

By analogy, it's probably not smart to go into a bad neighborhood at night alone with no protection, a large amount of cash and a flashy suit, but that doesn't mean that it's a silly thing to try and deter robberies and assaults on a societal level (either with social strategies like shaming and shunning or with violent strategies like law enforcement or retributive violence) - to the extent that it's cost-effective to do so.

Reply on news.ycombinator.com