DoubleClick Tries to Force Hand into Cookie Jar (1997)(wired.com)
wired.com
DoubleClick Tries to Force Hand into Cookie Jar (1997)
https://www.wired.com/1997/03/doubleclick-tries-to-force-hand-into-cookie-jar/
20 comments
and chromium, which should be renamed chrome beta, since a few years ago when all maintainers are Google employers, even went so far as rolling back all the privacy contributions such as options to disabled/disable 3rd party cookie and referrer. both of which are crucial aspects on how Google/doubleclick get paid by after showing you ads.
Could you give us more info about this?
I for one always run Chromium with third-party cookies disabled. Yesterday I went to try the new Firefox that everyone is going crazy about, and I couldn't find the option to disable third-party cookies.
I for one always run Chromium with third-party cookies disabled. Yesterday I went to try the new Firefox that everyone is going crazy about, and I couldn't find the option to disable third-party cookies.
Yeah, firefox after 56 is garbage on this front too.
but that is mostly trying to please sponsors, like google.
But do me a favour, try to find any setting, command line flag, developer setting, anything, to disable or limit referrer to the domain, on chromium/chrome. All three times i counted, the features were removed by google employees after added by outsider contributors. And 3rd party cookie is going the same way. Outside contributors add, google employees remove. Until everyone gives up and google has its way.
but that is mostly trying to please sponsors, like google.
But do me a favour, try to find any setting, command line flag, developer setting, anything, to disable or limit referrer to the domain, on chromium/chrome. All three times i counted, the features were removed by google employees after added by outsider contributors. And 3rd party cookie is going the same way. Outside contributors add, google employees remove. Until everyone gives up and google has its way.
I don't agree. In Chromium at least the feature to disable third-party cookies is in a very obvious place:
Settings > Advanced > Privacy and security > Content settings > Cookies
Regarding referrer you may be right. However you can change it with extensions. And now that I think about it, the same is true for third-party cookies.
Settings > Advanced > Privacy and security > Content settings > Cookies
Regarding referrer you may be right. However you can change it with extensions. And now that I think about it, the same is true for third-party cookies.
It's a bit obscure in Firefox 57 beta and newer. Open Preferences then click on Privacy & Security, then go to the "History" section. Select Firefox will "use custom settings for history" and you'll see the option to refuse third-party cookies.
Under History? Ridiculous.
Thank you.
Thank you.
Note that this is all a single screen. Just preferences > privacy. No extra navigation required.
It's is under the history sub-title, but you can see all the options in the screen at once. Not as hidden as in chrome.
It's is under the history sub-title, but you can see all the options in the screen at once. Not as hidden as in chrome.
Older technique, but tracking via etags was pretty clever. https://en.m.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETa...
Can you share more details about the battery status API tracking? Would love to see how that correlates to a unique user.
It's all about adding bits of information to improve confidence in tracking users across pages.
Lets assume that in page visits <10 minutes apart, a users battery won't change by more than 10%.
So say I go to volvo.com and then reddit.com - and my battery changes from 10% to 8%. When I request reddit.com - the user is clearly not a visitor who has had >20% battery. We also know the resolution of the phone. We know the user agent. And many other factors. Combining all of these means that you approach 100% certainty that it's the same user. No information on it's own is identifiable - but by combining enough sources - no two machines or phones are identical (at least that's what advertisers hope)
Lets assume that in page visits <10 minutes apart, a users battery won't change by more than 10%.
So say I go to volvo.com and then reddit.com - and my battery changes from 10% to 8%. When I request reddit.com - the user is clearly not a visitor who has had >20% battery. We also know the resolution of the phone. We know the user agent. And many other factors. Combining all of these means that you approach 100% certainty that it's the same user. No information on it's own is identifiable - but by combining enough sources - no two machines or phones are identical (at least that's what advertisers hope)
This is scarily close to how intelligence agencies infer information. If you ever wonder why government is so clandestine about even unclassified bits of data, consider how they could be used when combined. As someone else said, just imagine if they focused their efforts on something useful. Intelligence agencies basically are focusing on "something useful".
I see the relation - but it's also how nearly all information is gathered and infered - even at a human level. You take incomplete information, look at the landscape, and try to fill in the blanks.
A friend you're meeting tells you he's in the starbucks with a red shirt. That's not enough information to know his exact coordinates. But you combine and infer - you know how many starbucks there are in the vicinity, and which one he's likely to be at. You know he's in a red shirt - but there's several people. Luckily you already know his height well enough to filter out false positives within milliseconds.
The method I don't find intrinsically scary - but perhaps the scale and depth at which it happens, and for what motives.
A friend you're meeting tells you he's in the starbucks with a red shirt. That's not enough information to know his exact coordinates. But you combine and infer - you know how many starbucks there are in the vicinity, and which one he's likely to be at. You know he's in a red shirt - but there's several people. Luckily you already know his height well enough to filter out false positives within milliseconds.
The method I don't find intrinsically scary - but perhaps the scale and depth at which it happens, and for what motives.
[deleted]
It comes [this paper](https://eprint.iacr.org/2015/616.pdf) which made the HN front page at its time. The battery API exposes information about the current charge of the battery and its full charge capacity that is apparently a non-negligible fingerprinting vector for short-term tracking.
Battery status API support is pretty bad on mobile, but you could look at the rate of battery discharge which would probably be slightly different between devices etc.
Similar to how time skew is used for tracking as clocks go off sync.
Similar to how time skew is used for tracking as clocks go off sync.
Just a guess... your battery level isn't going to change dramatically from second to second. If its provided with a high degree of precision, it would be a pretty good short term key.
On mobile devices, I can see this API for decent tracking. However, for laptops, it seems easy to have the laptop fully charged and plugged in to defeat it as this is probably a very common state.
It would be fun to alter the API output to randomize the battery data. Even have it be off power, and slowly climb in charge.
It would be fun to alter the API output to randomize the battery data. Even have it be off power, and slowly climb in charge.
I mentioned it on my thread with BrendanEich: https://twitter.com/yuhong2/status/912757701163106304
As a side note DoubleClick has been own by Google since 2007.