Slashdot Mirror
Do Not Track Ineffective and Dangerous, Says Researcher
Seeteufel writes "Nadim Kobeissi, security researcher, describes the Do Not Track standard of the W3C as dangerous. 'In fact, Google's search engine, as well as Microsoft's (Bing), both ignore the Do Not Track header even though both companies helped implement this feature into their web browsers. Yahoo Search also ignored Do Not Track requests. Some websites will politely inform you, however, of the fact that your Do Not Track request has been ignored, and explain that this has been done in order to preserve their advertising revenue. But not all websites, by a long shot, do this.' The revelations come as Congress and European legislators consider to tighten privacy standards amid massive advertiser lobbying. 'Do not track' received strong support from the European Commission."
Do Not Do Not Track?
The days of the wild west on the net are gone...If the big boys in the industry cant get their shit together soon, we will get legislation, and that will be bad for everyone!
Just once I wish these companies could see that it is in the best interest of everyone to keep the government out and work together to reach a policy that will be adopted as a general standard without a law mandating it...
Many of us here have been saying DNT is a bad idea since it first appeared (and often, on slashdot, we've been downmodded for it). The right way to do this is NOT to depend on the good will of the remote side. Even you passed laws that demand compliance, the data collection will just move out of the jurisdiction of those laws, and anyway, the companies involved will buy themselves exceptions and find creative loopholes. You can't win, that way.
You CAN avoid giving them much data in the first place. You don't have to load their web bugs, their trackers, accept their cookies, or flash objects, and you can obscure your user agent string, and if you're really paranoid, even your IP address. Don't give them the data, and they can't track you with it, or at least, can't tie it to any real world identity.
And it goes without saying, don't use bloody Facebook.
For a long time, advertisement didn't bother me. I refused to use ad blocking addons, and considered ads just part of a trade. Sites give me content, I look at the ads.
Then came pop-ups. Pop-unders. Flash adds. Ads with music. Ads that would make my cockatiel go into convulsion, and start to drool and chase the neighbor's cat. And I have to tell you, my neighbor really loves her cat. And being chased by a drooling cockatiel will really humiliate a cat, and all dogs will start making fun of it. Not an idea situation.
So, back to the issue at hand. What MOST sites did was poison the well: no one can drink front it. It got so bad that I eventually had to start using ad blocking addons.
Now people want to implement VOLUNTARY sensitive advertisement and privacy practices. Obviously, they are trying to convince people we no longer need our ad blocking addons. By saying they will do something that is exactly the opposite of what they have done so far, ostensibly.
Sure, some sites will do the would Do Not Track dance. But those are the same sites that already respect our privacy and my neighbor's cat. Exactly the ones that don't need it.
The ones that need it the most, will just ignore it.
Fun, isn't it?
Fuck Do No Track. I will keep my Javascript and Ad blocking addons.
morcego
They still act like there are just 3 network TV stations, and that if they write a witty line in an ad, 50 million people will see it and go buy their crap. Like "Think Mink", or "Got Milk?". They still think they can bombard the public's eyeballs with ads and force us to robotically buy whatever they are selling. "Do Not Track" isn't even a speed-bump for these geniuses.
The poster asserts that DNT is a (not very good) technical solution to a technical problem, and proposes other technical solutions.
The problem is that DNT is neither a technical solution, nor is it trying to solve a technical problem.
DNT is the first step in a legal solution to a social problem.
You may argue whether legal or technical solutions (or both, or neither) are more effective against this social problem. However, put DNT into the right bucket first!
I seem to remember the imputus for this stupid technology was that a Mozilla researcher was about to make available some technology that either blocked tracking cookies or made them relatively anonymous, but then Google and others stepped in and stopped it, and came up with this easily ignorable solution instead. Has anyone else heard of this or am I making it up? Since the story first broke I haven't been able to find any references to it.
Anything that leaves your privacy on the "good will" of the companies is inefficient to protect my privacy.
If I do want to protect it, I'll use tools like Ghostery and DNT+ where I can choose *myself* what info I send, and not rely on them honoring the DNT.
I know I will be flagged "flame" but honestly the DNT looks a lot like the "evil bit" to me.
Next up, being unarmed and begging pretty please shown not to prevent robberies.
This is just like the evil bit. Anything requiring cooperation from assholes is doomed to failure.
They use it as yet another indicator of your personality to better target ads.
Relying on the people who want to track you to honor your "Please don't" request is just guaranteeing disappointment.
Now there are plenty of ways you can clamp down on the tracking and cross-site leakage, from NoScript to RefControl, but the single easiest cross-browser cross-platform way to do it is Ghostery: https://www.ghostery.com/
Most importantly, unlike the other methods (NoScript in particular) it only very rarely breaks a page. So it's just set up and forget.
I'm sure it's not as effective as some other tactics, but the 'works on everything' and 'just works' is really key to just using it all the time everywhere.
Advertisers need to STFU as they are the reason all this happened. Most people really don't mind non-invasive ads that much. They'll let them happen and likely not even complain. However the advertisers seem to think that more obnoxious, more invasive, etc is the way to get attention. Eventually, it pushes people over the edge and they will block it.
Happened to me. I was fine with ads, I understand the need. However I really hated popups. No problem, popup blocker. Then game the fucking flash ads, ok fine so a flash blocker with click to pay for the stuff I want. Then, HTML 5 ads that take over a page. Ok, fuck you, all ads are blocked, I've had enough.
Happens with more people I know too. They'll ask me if there's a way to deal with it and I'll point them to Adblock.
Advertisers really need to understand that if you don't want your market to go away, you have to stop being dicks about it. Keep the ads low key and not fraudulent, and people will probably be ok with it by and large. Some won't, but most won't mind, at least not enough to do something. However the more invasive you are, the more people will block it out.
There is a trivial, 99% effective fix for this problem. In firefox, go to Edit:Preferences:Privacy and tell it to forget all cookies when you end a browser session. There is also a facility for whitelisting cookies from certain sites so that, for example, you don't have to log in to slashdot every time. Cookies from the whitelisted sites are remembered across browser sessions.
Find free books.
It's intrusive and/or obnoxious behavior. I don't use a form of ad blocking on all my machines, and the ones I see that I can confidently say are influenced by the other sites I've visited are generally tolerable. Compared to the canned ads for the wireless company/car manufacturer/etc that has a contract with the media company who bought out a website I frequent they look reasonable. They generally don't autoplay any audio or video, nor do they take up my whole screen if my mouse accidentally violates their airspace.
It sounds like a serious comittee and companies got an inspiration from the Evil Bit proposal, even though that one was an april fools joke.
Both in terms of the idea and design. There is no level of Trust in the design of "Do Not Track". The server on the other end has no real obligation to honor the flag. The client has no real way to check if it is honoring the flag.
Also something people miss: You can't legislate trust. How do you prove violations? Random audits on paper sound like the way to tackle conformance but again who is building that tool? Google, Microsoft, Amazon, etc? Again we have a lack of trust....
For me, I don't care whether the site honors that header or not. If they're going to abuse tracking, they're not likely to suddenly come over all ethical and change their servers to not track. What the DNT header does is give a standard, recognized signal present in every single browser request that I do not consent to tracking. It's like the fence with the locked gates and "Private Property - No Trespassing" signs around a property: it's not going to keep trespassers out, but it's a clear and more importantly legally-recognized demarcation. If they jump over the fence onto my land and get in trouble because of being there, the court's going to look at the fact the land was clearly posted and tell them "Sorry, we don't accept your claim that you didn't know it was private property.". With the DNT header, no Web site can claim they didn't know I didn't consent to tracking. They can't claim implicit consent, because there's explicit non-consent in the very request they serviced. And this is why the advertisers are making such a play to get the DNT header dismissed and abandoned. Up to now they've taken the position of "You must consent as a condition of access, you accessed so we can assume your consent.". As long as there's no standard way of saying "I do not consent.", they can get away with that. But with a standard DNT header they can't argue that it's infeasible to check every possible way of not consenting. There's just one, and it's not ambiguous. The counter-argument of "If they don't want to allow access to those who don't consent, why did they not simply return an HTTP error when they saw the DNT header?" becomes rather more convincing.
The secret the advertisers don't want to state up front is that they don't want to require consent to tracking. They just want to track everybody whether they consent or not. Anything that provides a clear, unambiguous message to them about consent or lack thereof is a threat to that position, because it makes it harder for them to argue a basis for their assuming consent.
And a message to every Web-site and ad-network operator out there: if you're serious, stop whining and configure your servers to return 403 Forbidden to every request with the DNT header set. It's not that hard.
I'm surprised that this is a minority view. This is a legal issue. There are no technical means to utterly prevent tracking, but this provides a legal means for punishing people who do it. Anyone who says DNT is harmful is selling something, or bought something stupid from someone who is.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
We've created a completely, utterly useless specification that every single (mainstream) browser now implements as a feature. In all, countless megabytes (gigabytes?) and countless manhours and processing-hours have been wasted, all for the sake of doing nothing.
Of course, anyone with half a brain saw this coming.
Ya know, last time I checked it was still illegal.
And I bet it's been lobbied into existence by some manager who wanted to make sure we can't get rid of 'em... sneaky bastards...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Hmm... if someone comes illegally onto my property after I clearly marked it, I may shoot him in defense. Say... does that work on that DNT too?
Please, oh please say yes...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Could you please be quiet? I can already see some pencil pusher go "hey, good idea!"
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
My subject says it all. I don't really care about being tracked, I just really don't want to see *any* ads and will actively block obtrusive or irrelevant ads through various browser extensions and Proxomitron.
It must have been something you assimilated. . . .
You mean, when all the major browsers enable DNT by default, everybody ends up just ignoring the flag, putting us back to where we started? I'm shocked.
Hosts file and no script, only enable the stuff that you need. Plus with all of that worthless javascript wasting cpu cycles and memory gone, you can use your computers resources for something more useful, like a hundred more tabs.
Of my "Please Do Not Mug" t-shirt.
If you were blocking sigs, you wouldn't have to read this.
Users who actively enable do not track know what it is and how it works. If they don’t know, then they’re not more in “danger” than if they did, because the only actualisation of that danger, i.e. getting spied by Google et al, lies still there unchanged whether do not track is offered and enabled or not.
Would the author claim that, say, air bags give a false sense of security to drivers and therefore should be abolished?
We have an online world where advertisers are willing to bare faced lie.
* Adverts try to fake the UI of the web site that hosts them, example Facebook and SourceForge.
* Adverts saying "You have a message", "Three friends have unfriended you" - yet they can't know this and in the case of a test account - it didn't have any friends or anyone to send it messages.
* Messages like "According to our records you are owed £3056.23 in PPI" - If you're going to lie to me why should I trust you with financial details?
With things like this common place do we expect them to honour DNT?
Google was sued because Google are the ones who breached privacy in that instance, obviously. Do you really believe that it should only be possible to prosecute a crime if you can round up every single person who has committed a particular offense?
No kidding!!! What do you say at this point?
Actually legislation helps a lot. By outlawing spam you have over 99% of companies in countries that have outlawed it not sending spam any more. By outlawing spam, ISPs get a legal reason to filter spam. There have been lawsuits against ISPs in the past from companies claiming large losses due to ISPs filtering their spam and the spam thus not reaching the ISPs subscribers. Yes, even though it's illegal in quite a few countries, it still happens. However, it's substantially less and legislation has helped the technical solutions to stay in place. Both have to work together in this case. The same should apply to privacy laws. If a certain company refuses to obey a countries privacy laws, it should be taken to court and fined so hard that any profit they might have gained will be taken from them plus an extra amount to make sure they or others will never try to do this again. Technical ways to stop tracking people are very hard to implement and the only real solution is to not visit web sites that track you any more. Either that, or have proper legislation in place and active prosecution of companies not following the rules.
I was promised a flying car. Where is my flying car?
No seriously. Thank you, Nadim Kobeissi, for using your media clout to bring the obvious to attention.
The world needs real Captain Obviouses. Chisel-jawed men with flashy capes and booming voices to land out of the sky and say what masses of experts already know but nobody has been listening to.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Two totally different things. No need to track me, to present ads to me.
High tech and software industries are some of the most competitive out there. Yet, I see many claims in the comments that the industry ignore its customers, that customers have much demand for such privacy features, etc. I would like to see such commenters at least trying to address this apparent discrepancy.
That said I agree with the editorial (DNT as implemented in browser does not offer functioning feature until providers support it). In my mind, the browsers jumped the gun and claimed victory where there was none. As implemented, the browser setting did not account for providers taking time to implement their part.
The DNT flag should not just be sent from the browser (and assume that the provider accepts it). The browser should assume that the provider has legacy behavior (ie still doing third party tracking) unless it receives some kind of acknowledgement back from the service.
The browser can display a warning to the user if not such DNT=ACK is returned by the site, so that the user is properly informed and not misled.
These comments are mine; I do not speak for my employer.