Slashdot Mirror
Research To "Reveal the Unseen World of Cookies"
An anonymous reader writes "The Guardian newspaper has teamed up with Mozilla to research the monitoring of online behavior through cookies and other web trackers. After downloading the Collusion add-on for Firefox, you can generate a visual representation of all the cookies that have been downloaded which are linked to the sites you have visited. This shows quite an interesting picture. The Guardian staff then want the data from Collusion to be uploaded to their site, after which they say 'we can build up a picture of this unseen world. When we've found the biggest players, we'll start tracking them back — finding out what data are they monitoring, and why.'"
I hope implementing it in the right way (with publicly accessible statistical and analysis methods) will shed some light into how we're being tracked. Is there an equivalent of Collusion for Chrome?
On Firefox, disable HTML5/DOM storage, install CookieMonster 1.5 and BetterPrivacy.
"When information is power, privacy is freedom" - Jah-Wren Ryel
we'll start tracking them back — finding out what data are they monitoring, and why.
Well, here's my contribution;
The Guardian page in the link has six trackers:
24/7 Real Media
Audience Science
ForeSee
Maxymiser
Optimizely
Quantcast
I don't know what any of them do, and I blocked them all. Fuck 'em.
Science is all about firing a drunk pig out of a cannon just to see what happens.
Bit of a shoutout for the firefox extension cookieculler.
I have never found anything that matches cookieculler for features: it doesn't just purely delete cookies, it operates with a white-list based system (the way everything on the web should work). Cookieculler deletes all cookies each time you close the browser, except the ones you have whitelist "protected", that keep login information etc. as you choose.
Along with noscript, cookieculler is the main reason I stay on firefox.
Anyone else read the title and thought people were taking a deeper look at why those delicious baked goods are so tantalizing?
I read the title, and get all excited ... and then read the summary to find they're not talking about the Girl Scouts, Nabisco, or other things that might involve sugar and chocolate chips.
And now that I got my hopes up, I'm going to go see what's in the vending machine. There's usually animal crackers, at the very least.
Build it, and they will come^Hplain.
If average folks become aware of how many cookies get set (along with getting a user-friendly way* of turning them off), that could have a huge and entertaining effect on the world of Internet marketing**.
For example, right now, I can assume enough website visitors have JavaScript enabled to make it almost 100% (and not worth writing HTML for the case where they don't). But if I can only reasonably assume, say, 50% of my visitors/email through-clickers/etc. have cookies active, that plays havoc with my reporting.
* "User-friendly" defined as "something my dad can do without asking me for help".
** I spend all day every workday in this world.
You'd be shocked at how many cookies come from facebook across multiple sites. I use an extension called Ghostery (https://addons.mozilla.org/en-US/firefox/addon/ghostery/) to block most of them.
DNA -- National Dyslexic Association
Yo dawg... I heard u dislike being tracked, so we put a tracker in your trackers so you could be tracked while we track.
It will be interesting to see not only the results of this analysis, but also how they came any conclusions that they do.
Many cookies are used only to store a unique identifier. They data about a user many websites actually store is housed and maintained on their server, keyed by the unique id. This could include "pages visited", "duration of visit", "browser/system specs/settings" along with any derived demographic data.
It would be hard (though not necessarily impossible) to determine this from a cookie analysis.
I found out using its automated "graph-builder" that the 3 - 4 supposedly "safe" sites I visit most often, actually pass my user data on to Google, Facebook, DoubleClick, Mediaplex, Adroll and other services. Its quite educational to watch the graph go from a blank page to a fairly complex network of interconnections as you continue to browse. Its going to be interesting to see what results from this when the Guardian gets all the aggregate data from Collusion. It does seem indeed that there is such a thing as a "secret world of cookies" out on the internet, and I personally support that this "secret world" be uncovered fully, so we get to see what entities are clandestinely mining our supposedly "private" user information as we surf. --- The whole thing also reminds me of the book "Brandwashed", where the author explains at length how commercial establishments collect all sorts of data on us, and exploit it to sell us more products.
Why did the chicken cross the road? Because Elon Musk put an AI chip in its head.
No research needed, the truth about the unseen world of cookies has been known since 1968. They're made in a hollow tree by elves.
I would like to have a FF plug-in that messes up cookie data to make it useless to the trackers. A little bit of revenge...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
finding out what data are they monitoring, and why
Well, all the porn websites seem to know that I prefer brunettes over blonds.
Cookies are not the only evidence of tracking. Even Flash LSO, HTML5 local storage, etc.
There's a surprising amount of identifying information in request headers and what's available to javascript. (see http://panopticlick.eff.org/ for a demonstration.) That means, one often needn't accept or store a cookie to be tracked.
A really comprehensive pro-privacy browser extension would munge request headers and enumeration of fonts, plugins, screen resolutions, etc. to match one of, say, the top 5 most common desktop browser fingerprints - and to change every so often (Changing per request would itself be a trivially detectable signature.)
-Isaac
I am not a lawyer, and this is not legal advice. For Entertainment Purposes Only.
You know already who the "Big Players" are - Google, Facebook, Microsoft, your choice of a couple more related ones.
Then it descends into all these little companies. I would expect that some of them are subsidiaries of the big guys etc.
The ideal goal of each of these "thingies" (cookies, flash objects, etc etc) is to nail down who visits down to a unique user if possible.
So just copy the Ghostery block list, maybe the AdBlock block list, your choice of a couple more tools.
If you want a "market share per ad company" report then get one of those.
There's something bothering me with your study design but it's not clear yet.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
That's the one people should be the most concerned with. When I first started using NoScript, I was stunned at how many supposedly reputable sites were using javascript pulled from ten or twenty different unrelated sites. There's just NO good excuse for that at all.
ScoreCard Research Beacon. Without my consent.
That was my reaction too.
Combined with the technology being used, not installing it was a given.
It's really about understanding a bit more so that you can then take action to protect yourself if you want to. But yeah... I get the irony. The reason why I still thought it was worth going ahead with the protect was twofold: the aims of the Collusion team to educate and inform AND that all the information sent to us is anonymous. I would love to say we could identify people by the sites they visit, but in aggregate it seems like everyone likes internet shopping and porn. :)
It's not compatible with 3.6, which I prefer over the UI of later versions.
Wonder how many data points that will lose them.
Some days it's just not worth
chewing through my restraints.
Sure, why can't you host your notes at something like http://www.guardian.co.uk/JGeary/CookieStudy.html?
Then just keep uploading new iterations of the page.
And I figured out part of what was bothering me. You're asking for "data for research" but your initial article is "shadowed" - it reads like "give us data and we'll figure out what we want to write about".
Write two versions of your story: the Mass Market one "Look, it's 2012, we found all these cookies! They're evil!" and the other with a FAR More rigorous approach. (I'll let you off for not being a PHD academic, but tell us something we don't know - but remember your audience! I'm in the LOWER 50% and I already run Adblock and Ghostery and Collusion (from 2 months ago!) with screen shots of who Ghostery blocks. Chops that you said you want to do some "old time journalism" - then dig into the meat! "Obfuscated flash objects, zombie cookies, Firefox's Do Not Track vs it actually being followed, etc."
Regards,
--Tao
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
>< n/t