XKeyscore Exposé Reaffirms the Need to Rid the Web of Tracking Cookies | Hacker News Reader

XKeyscore Exposé Reaffirms the Need to Rid the Web of Tracking Cookies

eff.org

129 pointsDiabloD343 comments

Its sometimes annoying (having to type in login credentials etc.) but I use Firefox with Self Destructing Cookie addon. It seems to control this problem quite well (at least I think it does). I whitelist sites I want to keep cookies for but basically everything else is destroyed as soon as the tab closes.

Someone please correct me if I'm wrong that this addon deletes this kind of cookie / localstorage.

Firefox is kinda good at storing passwords so I don't have to retype all my logins which removes most of the annoyance.

I do too, unfortunately with the new cookie law in place this means I get even more banners than those who openly allow cookies...

The people that wrote the EU cookie law should be forced to use a browser that deletes cookies when it closes. That way the pointlessness of the law should become obvious to them.

When my co-workers and I read the first version of the Danish version, we read two different things. I'm sure I read the law as it was intended, and the others found all the loop holes.

The sheer amount of tracking stuff injected into some sites are ridicules, 5, 8 15 or more different ad, tracking and retargeting services and all they have to do is say "Hey, we use cookies". That great, I bet you can tell me what half of them does or where they come from. Because that's another issue, you sign up for "sales tracking" with one company and you add their Javascript snippet AND BOOM, they side load three other services.

The sad part is that users don't even get better service, they just get more ads.

It would stop some tracking, but the people doing the tracking have many clever (and some not so clever as sometimes the simplest things just work!) ways to fingerprint you beyond cookie values. See things like https://en.wikipedia.org/wiki/Evercookie for an example of how much trouble you really need to go to in order to try avoid being tracked.

I keep toying with the idea of writing an add-on that doesn't just destroy tracking cookies (well, any non-white-listed cookies) but instead shares them around randomly - so next time you visit a site you might have the cookie from last time I did, or someone the other side of the world... That would also not affect anyone using mixed techniques like Evercookie (the discrepancy between what each state store has recorded could be seen and used to throw out the data instead if letting it pollute the tracking pool). Of course care would need to be taken here: if you share cookies from sites that take authentication you could open up session hijacking vulnerabilities. Only storing/sharing cookies from HTTP sites might help (no site requiring authentication should be running through un-Sed HTTP) but wouldn't be a perfect solution.

With the current state of affairs I think that poisoning the well is a better tactic than trying to prevent being tracked.

There's a great op-ed by Stanford's Jonathan Mayer and Princeton's Ed Felten explaining this problem.

http://www.slate.com/blogs/future_tense/2013/12/13/nsa_surve...

Their two labs also wrote a solid academic paper on the topic.

http://randomwalker.info/publications/cookie-surveillance-v2...

This really makes me want to see what happens if I could make my browser only accept secure cookies (cookies sent over https only). Unfortunately I can't find a chrome extension that implements this.

on second thought... I can already do this with Chrome's built in abilities to restrict cookies and override those restrictions with exceptions. We'll see how this works.

Set Chrome to block all cookies, but for https://*, clear on exit. And have a few exceptions for google.com / facebook.com / etc. so I don't have to always be logging in.

This may not be effective in some cases, given the NSA's history of targeting the plaintext before it gets wrapped in SSL. (i.e. the infamous "SSL added and removed here! :-)" sketch of Google's network[1]).

Additionally, far too many sites use cloudflare (or similar) to provide their SSL creating a single point of failure and a tempting target for eavesdroppers. (and who knows how many don't bother to encrypt the requests from the SSL proxy back to the actual serve?)

[1] https://www.washingtonpost.com/world/national-security/nsa-i...

The EFF might not like it, and most internet users might not like it either, but being able to track users pays for most of the free content we consume on the internet. Thats just the reality.

Less pragmatic people might argue "micro payments" or some such idea, but the fact is people have never really paid for news. News has always been subsidised heavily by advertising. Almost everyone who argues this is running an Adblocker.

Also third party cookies (and ads) are something any internet user can disable in a few clicks.

Whatever you think of advertising, it doesn't have to enable government spying. Moving ads to HTTPS would solve the eavesdropping problem. Google has already announced it's doing just that.

Also, it's not that simple for an Internet user to stop tracking or advertising. According to an academic paper from a few years back, there are dozens of ways to track a user, and many protections aren't very effective.

https://cyberlaw.stanford.edu/files/publication/files/tracki...

If entities on the internet are incentivized to track you, its likely the government can get the data whether or not it is encrypted in transit. (NSL, Hacking the company, blackmail, bribery, legal/business/tax threats, other court order)

(NSL, Hacking the company, blackmail, bribery, legal/business/tax threats, other court order)

That's how things used to work.

The government has always wanted to track specific people for specific reasons. Perhaps 1% (debatable) of the population. Like it or not, they will keep doing that.

What is abhorrent to me is that the government has decided to track 100% of the people 100% of the time. That's what everyone is fighting against.

How is proposing a solution for an acute problem "less pragmatic" than proceeding as if nothing changed?

It's true that we never payed for news, but news isn't what it used to be either. News is written by your friends these days, not companies (I'm exaggerating, but still). Micro payments seem to be the best replacement we currently have. They're not just useful for blogs an the like, but also open source software development — and with Bitcoin around, we might not even need services like Flattr all together.

The pragmatic thing to do is to give micro payments a fair shot.

I believe advertising based on tracking users across websites is more of a recent phenomenon. I don't really have a problem with a contextual ad based on what I'm currently looking at. I have a problem with ads that are contextual based on everything I've been visiting for the past month.

I doubt the effectiveness of the ad is drastically improved in the second case. But even if it's improved only by 10%, the ad industry would rather aggressively violate users' privacy to get that extra 10%.

Before this was the norm I used to consume tons of free content from the internet, frankly most of it was higher quality too.

There was plenty of high-quality content before tracking user became something worth paying for.

Being able to track users pays for most of the crap content on the Internet -- much of which is there to support tracking users, not the other way 'round.

It can go the way of the dodo as far as I'm concerned.

Whatever it is that is being paid for by participation in ad networks or affiliate programs tracking users... I don't want it.

They can just go away or pivot or whatever.

I'm sure 95% of it is crap, and if I cared to save the other 5% that got caught up in it and didn't have a plan B, maybe I'd suggest they open a Patreon or something.

Most of the free content we consume on the Internet is garbage, and if it all up and disappeared tomorrow, we'd be better off for it.

I block tracking cookies as a matter of course, and I wish everyone did the same.

I don't want content to be free. I want it to be reasonably priced, and to have easy ways to pay anonymously.

Some variation of bitcoin would do wonders for that.

News in Sweden was and is still mostly being paid by a pseudo-tax, one which is currently heavily discussed to be reformed into a real tax instead of the old system that was based on TV ownership. Few is actually promoting the idea of removing it competently and relying fully on ad supported news.

If we removed all state supported media, and removed any kind of donation based journalism, and blogs done on a volunteer basis, and patreon, and ignored the vacuum that ad supported news would create if they all when away, then maybe, maybe, news as free content would go away? Of course, review sites and similar news which informs people about products will still be there. People don't need to be tracked if they chose to seek up content which a company is willing to support.

It used indeed to pay for the content. But the amount of money paid to the websites decreased so much in the past few years it's not the case anymore. These days, advertising is mostly only worth it for clickbait article generators. Every website with a few employee with actual content you see on the internet has at least one or two other ways to get money because advertising is not paying enough these days.

That simply isn't true.

Take a fairly well respected tech publication like ArsTechnica. Their revenue is almost completely based on advertising[1] to the point that they experimented with blocking people using ad blockers[2]

[1] https://en.m.wikipedia.org/wiki/Ars_Technica#Revenue

[2] http://www.niemanlab.org/2010/03/how-ars-technica-made-the-a...

They are absolutely not representative of the average website, it's a massively popular website (look at the Alexa rank) and of course advertising works for this kind of websites because you have some leverage to negociate. I'm talking about the majority here. (And even them started to try paid membership, it really tells you the current state of advertising.)

A popular practice is popular because of business incentives?

Well, no shit. Everything in the status quo is there for a reason. If there wasn't incentive to do things, nobody would do it or it'd be easy to kill.

The point of organizations like the EFF is to not give up the importance of externalities as soon as someone offers a rationalization that the internalities are nice.

People make money off some advertising that doesn't/couldn't do tracking at the individual level. Why must internet ads include tracking of individuals? Just because they can? 2 companies could work out an agreement to show a static image that links to a specific page somewhere for some amount of time for a certain price and it could be hosted in the same domain as the content. Granted, it's not as convenient as the drop-in scripts. New sites would have to prove themselves before anyone would want to advertise with them and known sites would have to keep producing quality content if they want to keep their high paying advertisers. Maybe there's a third-party that collects a small fee to verify agreements are being followed if trust hasn't been established or comes into question.

Just so you know. I don't particularly mind many ads, even targeted ads; on rare occasions I've even found them helpful. I do mind being followed around and stalked though.

How do you propose that they target you without first understanding you?

By obtaining permission or establishing a mutually beneficial relationship that is fully disclosed, revocable, and that I have some degree of control over. Not with some catch all disclaimer "By continuing to use this site you hereby agree to allow us or our partners to follow you around and log your behavior and sell your dossier as a product and or service..." Most of all, by fucking off if I tick the box that says fuck off I don't want to be stalked right now/ever.

An example of a thing that I don't mind is if Amazon or some company that I have a relationship with noticed the frequency that I buy certain things like pet food or some other consumable and started placing relevant ads at about the time I might need to buy it again. I'd also like to be able to reject certain suppliers. I don't necessarily want them selling that info to the vendor(s), at least not without anonymizing it.

An example of a thing that I recently found amusing/annoying is that I purchased a large ticket home appliance recently, and for a week or more after that purchase there was a huge increase in ads for that particular large ticket item, as if I might buy more of them or something.

An example of a thing that I absolutely don't want is to tracked by companies / affiliate networks / whatever that I have no relationship with, and who basically just follow me around and sell a dossier of my browsing habits to anyone and everyone who wants it. Even if that means I can't have cat videos for free, or have to pay a little more for stuff.

I agree with all of this. It is just impractical - hence adblocking...

> An example of a thing that I recently found amusing/annoying is that I purchased a large ticket home appliance recently, and for a week or more after that purchase there was a huge increase in ads for that particular large ticket item, as if I might buy more of them or something.

This is actually solid marketing. They are trying to re-enforce in your mind that you made a good purchase. This should prevent buyers remorse and is aimed to manipulate you into telling other people how great your new whatever is.

>This is actually solid marketing. They are trying to re-enforce in your mind that you made a good purchase. This should prevent buyers remorse and is aimed to manipulate you into telling other people how great your new whatever is.

Well in that case, they don't know me as well as they think; because it does not do what they think it does. They also run a risk doing that kind of thing. Last year I bought two monitors, and within a week the price dropped by a large amount. I might not have have noticed that if they hadn't been spraying ads for the products I'd just bought in my direction. Amazon didn't want to honor the price-matching guarantee. I almost cancelled my Prime account over it. Now, I make a point to watch for price changes immediately after purchase.

http://camelcamelcamel.com/Samsung-23-6-Inch-Viewing-Monitor...

Ask me what I want and whether I'm interested.

Respect "no".

I sort of agree with you, but I do remember having newspapers that didn't have ads, or at least extremely few.

The bottom line is, in my mind, that if you can't make money selling your product, and needs to resort to ads to make a profit, then your products existence isn't justified. Displaying ads move money from profitable product, typically physical one, to products that doesn't provide any real value of their own.

The Internet is ruined in some degree, because we never paid for anything initially, so when companies moved in, it was expected that their stuff would be free to. Now we're stuck in a situation where the online only companies for the most part can't make money, without pimping the wares of companies with physical products, or selling their users data.

Don't forget, Classifies are advertising, and used to be a HUGE part of the newspaper revenue stream. Post-Ebay/Craig's List, not so much.

In the US perhaps, not so much here in Denmark, but a valid point though.

Newspapers really fucked themselves by sticking to unnamed old-school practices: $15-$50 for 2-3 lines in print, no online-only option for more copy and lower price. They could have simply out-Craigslisted Craigslist with online but chose not to. In the process the abandoned the market completely.

I used to work in the biz. We tried. We found any price > $0 to be nonviable.

So has Craigslist.

All adverts are free, with the following exceptions:

Help-wanted employment ads.

Housing, in New York City.

I believe a few other classifications, including "for sale by dealer" ads in some markets may also be paid.

The point is that most of your advertising activity does little but make a market: providing liquidity and interest in the classifieds market itself.

Within a select number of classifications, there are sufficient numbers of large players, readily identified and monetized, that you can support the rest of the operation.

Newspapers were basing forward models on past, not recognizing what had changed, or that it was simply necessary to support the classifieds marketplace itself on net, not to equitably charge every last comer.

What happened was that everyone fled.

Curiously, Craigslist is starting to get upended in specific classifications where other services can beat their offerings, not on price but on quality. Personals, some jobs classifications, "by dealer categories" (furniture's been worthless for years and years, etc. The problem for CL has always been that it relied on low-tech and pretty coarsely-operating crap filters, and increasingly those classifications are overrun.

The marginal cost of provision fell. No, classifieds weren't going to remain the cash cow they once were, but some market remained.

I run some forums that offer value to mostly teens. How do you propose I make money from them?

The more money I make from a forum, the more time I can invest in the forum which enhances its value to its community.

Adsense pays good money. Donations are always a joke. And somethingawful.com had to get impressively big before it could charge $10/registration. Oh, and teens have no money and nobody pays for forums.

"If it needs ads, it shouldn't exist" is just tone-deaf at best. Much of what people are willing to pay for and how they're willing to pay for it are perceptions that you have little control over.

The thing about ads is that people generally don't associate a cost with them. It's just how it is. The second you charge $1 for something, then your website now charges money while all of your competitors are "free" regardless of their ads. Whether it's acceptable to charge that $1 mostly comes down to convention and what people are already used to.

> "I run some forums that offer value to mostly teens. How do you propose I make money from them?"

I propose that you do not. Advertising to children, even teenagers, is abhorrent. Fortunately for you, I am not in charge, because it would be forbidden if I were.

I think technology will eventually solve this problem through P2P sites that no one owns. Ads will still exist but they'll be mostly as endorsements, official sponsorships, and infomercials (e.g., any corporate blog). People who can't be easily paid this way (e.g., researchers, investigative journalists, writers, artists, open source programmers, forum admins) will eventually collaborate to create a fair system of distributed payments for projects/content. That system will be funded both from the grass-roots and top-down by governments and large corporations.

teens have no money

Teens have lots of money. At least my daughter does (she has a part time job).

Your problem is that even when teens do have money, they won't spend it on your forums. E.g. if my daughter already has four swimsuits, why does she need to buy a few more? And does she need to spend $4 on a sugary drink several times a week?

The "free" website is more valuable to a teenager than the one charging $1. There's not much you can do to change that. As you say, "It's just how it is".

If I asked my daughter if she would be willing to spend $1 (per month?) on a website, she'd probably find that laughable. Most teenagers would.

The Freemium model for phone apps does work in extracting money from teenagers. Perhaps you can do something along those lines?

> Oh, and teens have no money

Teens have often been attractive target markets because they tend to have, effectively, lots of disposable "income", even if its not directly held in their name.

Getting teens to spend money on your product may be challenging, but that's a different issue.

Reply on news.ycombinator.com