Slashdot Mirror
Yahoo Stops Honoring 'Do-Not-Track' Settings
An anonymous reader writes "When web browsers started implementing 'do-not-track' settings, Yahoo got some respect for being the first of the huge tech companies to honor those settings. Unfortunately, that respect has now gone out the door. As of this week, Yahoo will no longer alter their data collection if a user doesn't want to be tracked. They say there are two reasons for this. First, they want to provide a personalized web-browsing experience, which isn't possible using do-not-track. Second, they don't think do-not-track is viable. They say, '[W]e've been at the heart of conversations surrounding how to develop the most user-friendly standard. However, we have yet to see a single standard emerge that is effective, easy to use and has been adopted by the broader tech industry.' It looks like this is another blow to privacy on the web."
Horrible decision, a standard isn't being honored "EVERYWHERE" so you decide to undermine it entirely without replacement? What's the REAL reason, money?
Sell your assets and gtfo!
That is corporate speak for, "we decided we could make more money this way, so here is a bs reason for us to change, when we really just want more money."
Anyone savvy enough to care about this issue stop using Yahoo long ago anyway.
Has it ever been a surprise to anyone that a measure that service-providers must voluntarily follow would not be followed? I mean, if by not following the measure you can generate more cash than by following it then why would you choose to do it, especially if no one else does it either? No, do-not-track was doomed all the way from the beginning.
Yahoo stops using "Do-Not-Track" and in response people who care about it implement "Do-Not-Yahoo". These things tend to work themselves out over time.
Appended to the end of comments you post. 120 chars.
I am fine with sacrificing user friendliness for my privacy. Do not track me or I won't use your services. I have two yahoo emails which incidentally are used as account/spam dumps. I won't even use them for that if this is how Yahoo has chosen to do things.
>'we have yet to see a single standard emerge that is effective, easy to use and has been adopted by the broader tech industry.'
Here is my 'standard'; NoScript and AdBlock Plus.
First, they want to provide a personalized web-browsing experience, which isn't possible using do-not-track.
But the user clearly does not want a personalised web-browsing experience.
Ghostery, Secret Agent, CS Lite and NoScript are essential today, and nobody should EVER go online without those, or some equivalent. Let them personalise that.
The Web has been hijacked and is now fundamentally broken. It is being transformed into a locked-in content delivery platform, something like cable TV with a camera that records your every movement. It needs to be handled with gloves and goggles, like you would when accessing a chemical weapons research facility.
We'll need to develop another Internet, this one has been taken over by marketroids and is beyond saving.
The problem with "do not track" is that it was entirely up to the website to honour the browsing session. Most don't. And the ones that you'd reallywant to not have track you are the ones that really ignore it. It's therefore useless.
It's like a system of street privacy that relies on people being trusted to close their eyes when you walk by. Just because you ask them nicely. People will look, and you can't stop them.
If you want privacy you have to be the one in control of what is being revealed. You can't rely on others to keep your privacy for you.
I "opted out" about 10 seconds after seeing that message on a Yahoo site.
The thing is, I strenuously avoid Yahoo. After the latest Firefox update, though, typing a search in the address field doesn't go to my preferred (in settings) search engine, but instead to Yahoo.
Yahoo search results are terrible, but most of the screen is filled with jumping icons a million other things I was not searching for.
Fortunately, there is little or no loss to the modern day internet user experience by ignoring Yahoo completely, either.
We should learn what we need to know about issues, before we decide what we need to feel about them.
First, they want to provide a personalized web-browsing experience, which isn't possible using do-not-track.
This is one of the phrases and behaviors that annoy me the most about various sites, especially search sites. I search for both personal and work related things, don't want searches tailored to anything other than the specific thing for which I'm searching at that time. I generally don't care what I searched for 24h ago (looking at you Google side-bar).
In a related rant, I can't stand the Google side-bar, Instant and Suggestions and make every attempt to disable and or strip them out (using Proxomitron) though now that Google has switched to HTTPS, that makes things more difficult for me - sigh.
Dear Providers, Don't "help" me unless I ask for it.
It must have been something you assimilated. . . .
IIRC yahoo is worth less than nothing at the moment. Re: www.bloombergview.com/articles/2014-03-17/is-yahoo-s-business-worth-less-than-nothing
Why would I listen to a company with such outstanding performance?
Ever notice that Cobra Commander sounds an awful lot like Star scream?
I can't imagine why I would ever go near a Yahoo site. Yahoo Answers? Seriously? Didn't Stack Exchange demolish that nonsense? Yahoo email? With the `win tickets to the World Cup` spammy sigfiles a good 8 months after the World Cup finished? What do they offer than other companies don't offer, better, and without the lack of respect?
Slashdot Stops Honoring 'No Beta' Settings.
There's a headline for ya..
Noscript, only per session cookies, and surfing trough a proxy.
I can't say I'm surprised. Do not track settings that are optional on the part of the sites you're visiting are simply never going to work - the ones that'd honour it are also the sites you wouldn't be particularly worried about in the first place. Targeted advertising and profiling is big business, and the big revenue stream for the 'free' content providers. It really comes as no surprise - pretty fundamentally you get what you pay for. If you're paying nothing in monetary terms, then you'll be paying in privacy instead.
"However, we have yet to see a single standard emerge that is effective, easy to use and has been adopted by the broader tech industry.' It looks like this is another blow to privacy on the web."
I don't know about you, but I can think of one fairly effective and extremely easy to use "standard"... AdBlock.
Why does anyone use Yahoo? You can't get an email without giving up your cell number, their "answers" section is absurd, they really have nothing to offer IMO.
There are far better choices, it seems like a recently beheaded chicken, still running around on autonomic pilot.
"If any question why we died, Tell them because our fathers lied."
Maybe it's time for the legal system to get involved. If entities won't honor privacy, maybe we need the equivalent of the "Do Not Call" list for telephones implemented for the internet. Of course companies like Google and Yahoo will then just alter their service agreements to state that you do in fact agree to be tracked.
I've always said that the time to stop using a company is when they do things that aren't in your interests - or indeed the interests of any logic.
Companies that "rebrand".
Companies that give poor customer service.
Companies that gobble-up and retire old, famous brands.
Companies that force you to move to their "new" interface / app / whatever (take note, Slashdot!)
These things achieve nothing that a customer would want them to achieve and actually hint at lots of poor, cyclical management decisions in order to justify someone's job (Let's outsource! Let's bring in-house! Let's outsource!)
I stopped using Hotmail when they forced a new interface on me that was worse and never got fixed (and I was a paying customer back-in-the-day).
I stopped using Geocities when I had to convert it to a Yahoo Account.
I stopped using a Yahoo account (entirely separate to the above) when they started to hinder me getting to my email.
I've stayed on GMail because I learned my lesson and no longer rely on any web interface to stay static. You piss about, I'll use IMAP into my favourite webmail / browser. Done.
With free services, brand loyalty is lost incredibly quickly. When MySpace *went out of fashion* everyone jumped on alternatives.
Let's get this straight - you want me to view adverts? Make it as painless as possible and put something I WANT TO USE behind the adverts. And, you know what? I will.
> But the user clearly does not want a personalised web-browsing experience.
Until MSIE started lying about the user's preferences. The standard specifies what should be sent if the user has not expressed a preference. IE 10 lies and says the user requested a uncustomized version when they didn't. That makes the whole thing useless when browsers lie about what preferences the user expressed.
Yahoo! Groups is bloated with spam that can't be blocked by its admins.
Yahoo! Messenger is so fraught with bugs and bloatware that users are fleeing in droves.
The main Yahoo! website is dated and mindless.
Yahoo! Mail is an abomination of unusable kludges and missteps.
Lastly, who uses Yahoo! to search for anything anymore, anyway?
Put a wooden stake in it, this thing is dead.
*** Don't be dull.***
The DNT standard specifies what should be sent under three conditions:
a) The user expresses that they DO want customization
b) The user expresses that they do NOT want customization
c) The user doesn't express any preference
IE 10 lies and says b when the truth is c. That makes it impossible to know who actually chose DNT. The whole thing is useless now that it doesn't to indicate the user's stated preference.
Does Slashdot get all its news stories from FARK.com?
I read most of the current crop there first.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
Welcome to my HOSTS file, Yahoo.
Anyone working or have a easy to use program that writes a false browsing track? Let the trackers try to make sense out of compromised data. The "easy to use" is what I want.
Passionately Indifferent
Good day for the EFF to release the alpha of privacy badger that blocks tracking cookies http://www.pcworld.com/article... https://www.eff.org/privacybad...
"First Be Evil" is the motto of Google.
And now Yahoo is doing it.
Wonder where their CEO worked before?
"Lean In" my foot. More like "Steal Muchly".
-- Tigger warning: This post may contain tiggers! --
Any standard that's effective and easy to use will not be accepted by the advertising industry, so making the "success" of a standard contingent on that last is nonsense. The DNT standard does serve one useful purpose whether or not it's accepted: it provides a single, easy-to-interpret, unambiguous indication to advertisers as to whether or not the user has consented to tracking. It removes their ability to say "Well, they didn't say otherwise so we assumed they're OK with it.". It does that whether or not they honor it, and it gives us a good talking point when it comes to policy and regulatory discussions: "The DNT standard exists. It's in use. It's easy to interpret on their side. They're the only ones sticking their fingers in their ears going "Na Na Na Can't hear you!".". That makes regulation an easier sell.
The proposal you linked to was voted down several years ago. The last call standard is:
Key to that notion of expression is that the signal sent must reflect the user's preference, not the choice of some vendor, institution, site, or network-imposed mechanism ..
A user agent must have a default tracking preference of unset (not enabled)
See
> That's not lieing anymore than telling the server that you've opted in when you haven't.
Both of those would be a lie, which is why neither are allowed under the standard. ... the user has not yet made a choice for a specific preference".
The standard says that the browser "must not send a tracking preference expression if a tracking preference is not enabled. This means that no expression is sent for each of the following cases:
See:
http://www.w3.org/TR/2014/WD-t...
Exactly, we shouldn't be tracked regardless of the do-no-track setting. Who wants to willingly be e-stalked and data mined? They are stealing our info without permission and without compensation.
> the consensus is that opt-in is the correct choice in pretty much all cases. By default, users should always be opted out of things that infringe their privacy.
You might be right about that*. That's a different topic than the DNT RFC, though. The DNT header tells which preference the user specifically asked for. DNT does NOT specify anything about what a site should do - what cookies they should set or not set, etc. Let me quote from the DNT RFC for you "this document does not define site behavior for complying with a user's expressed tracking preference".
The DNT header is a way for the user to communicate their preferences to the server. What the server does by default, in the absence of any instructions from the user, is a separate issue entirely. It's not what DNT is about. Perhaps the following discussion will make it more clear.
* About defaults, what a site should do when a user doesn't express a preference (and when they do). It's my opinion that the default behavior, when the user hasn't made any selection, should normally be somewhere in the giant middle area between the two extremes. Here's an example or two.
Case1 - No preference chosen:
There are a lot of things that a site should NOT do by default. Let's just call one example "long-term advertising tracking". For our purposes today, there's no need to define exactly what that means.
There are some things the site SHOULD set a cookie for, or otherwise remember. Suppose I load Slashdot and I'm shown Beta. I click on the "Fuck Beta, give me the classic interface" button. Ten minutes later, I load Slashdot again. I'd prefer that Slashdot not give me beta again, by setting a "beta=no" cookie. Maybe that cookie will expire in a day, a week, or a month, but it would be good for Slashdot to recognize that "whoever this is, he doesn't like beta". So they track that preference, and I'm happy.
So by default, Slashdot could reasonably track some things and not others.
Case 2 - User specifically requested DNT:
If I've specifically requested privacy, the site should act similarly to the way the browser does in "incognito mode" - pretty much don't set any cookies, for example. Slashdot should NOT set a cookie to remember that you hate beta, if you ask them not to remember anything. On sites like Youtube and Craigslist with a "safe search" or "possible adult content" confirmation page SHOULD keep popping up that warning. That user has explicitly requested that the site not remember that they want safe search off.
Case 3 - User specifically requests "a customized experience" (DNT off)
If the user specifically says they want maximum customization, the site SHOULD remember that I hate beta and not show it to me again.
Safesearch should default to whatever I set it too - I've asked the site to remember my preferences. Ebay.com should, since I requested it, show me good deals on items I've been searching for recently.
The key here is that the best thing for a site to do is different between case 1 and case 2. If explicitly you ask that Slashdot NOT set any cookies, it should not set a "NoBeta" cookie. If you haven't expressed any preference, setting a "NoBeta" cookie is probably a good thing. Lying, saying that the user has explicitly requested no tracking when they haven't done so, means you can't respect the user's wishes. If you honor IE's bogus DNT header, everybody keeps getting sent to beta. If you disregard it, people who have actually set DNT get tracked after they've asked not to be. Nothing that the site can do with IE DNT would be right, because the site don't know whether the user actually wants their expressed preferences forgotten or not.
I always attach a hidden EULA to all my HTTP requests, so if the web site tracks me, they have violated my license and I can sue them for breech of contract and millions of dollars.
> Do I want to constantly see ads for XYZ just because I once searched for XYZ or once visited the XYZ website?
I understand that point. For me, if I search for X a lot, I'd actually rather see ads for X than for fungal cream, but that's personal preference.
Let me ask you about something else, though. You said:
> anyone else talking about a "personalized web-browsing experience"
Suppose an interactive site like Slashdot or Yahoo Mail is rolling out a new design. By default, they send people to the new version of the site *cough beta cough*, but they have a button labeled "screw this, show me the classic version". You click on the button. Ten minutes later, you load the site again. Which should the site do:
A) Take you back to beta, even though a few minutes ago you clicked the "fuck beta" button.
B) Set a "NoBeta" cookie that lasts 60 days, so you won't see beta again for at least 60 days.
That's a bit tougher. That may be a case where a "personalized web-browsing experience" makes the site a lot better.
What do you think?
Anyone who thinks their Internet activity is private...is deluding themselves. If the NSA couldn't keep their activities private, what makes you think YOU can?
As far as I understand the law here in the UK, the Office of the Data Protection Commissioner will probably be having a word with Yahoo shortly...
Calm down APK, I've already lost count of the amount of spam posts you made on this article (which use points I have already refuted long ago).
Change is certain; progress is not obligatory.
Many sites probably would have defaulted to lower privacy than some would like, but the DNT standard is NOT about what sites do. DNT allows the user to say "I opt in to customization", "I opt out", or neither. What sites do when the user doesn't choose, or when they do choose, is not part of the standard. The standard only specifies HOW the user can communicate their preference - not what affect that preference has.
There is no job you can do if the other party is not trustworthy - other than limiting your communication. All this convoluted header bullshit is useless.
Stop crying for a legal solution when there's a perfect technical one: STOP TALKING TO TRACKING SERVERS! Advertisers had their chance. They failed it. So ignore them and let them sulk in their own bullshit.
Of course it runs NetBSD. BTC: 1NT7QvbetmANwaMzhpVL6
Yes, and my statement still applies with regards to using my DNS solution:
You also forgot the other post where I tried your hosts file solution, which in turn generated multi-GB text file to do the equiv of a wildcard block on a domain for your preferred platform (Windows) and it broke windows services preventing DNS resolution from working. Not simply 'just working' as you would have us believe. Additionally, memory consumption was up.
I don't need to respond when you prove my case.
Change is certain; progress is not obligatory.
So, if I search for commercial ad blockers, I should expect targeted ads for better commercial ad blockers?
Yes, please. How do I adjust Ghostery and Ad-Block to allow this?
--
I'd like to set up a wireless ethernet, but I can't find any wireless cable.
I thought anybody could adjust the HOSTS file, why do they need to download something specific?
What's wrong with using both of them and / or Privacy Badger from EFF?
Using both of them has a couple of downsides:
1. The suggestion to replace Ghostery was based on the knowledge that its devs are willing to work *with* scumbag advertisers, which puts them on the wrong side of privacy concerns. Using both doesn't remove the untrusted extension.
2. Both (all 3) apps do the same thing. Ignoring the possibility of Ghostery "whitewashing" their own lists for pay (a legitimate concern given #1), they're likely using the same (or near enough) lists, so you're just adding overhead and slowdowns to every page load.
That said, I wasn't aware of badger, having changed to Disconnect when I learned about Ghostery going bad. I'll have to check it out, to see if it's better than Disconnect.
Because apparently a zone file that is less than a kilobyte to block an entire domain verses generating a multi-GB hosts file to come up with every single hostname combination to block a domain fully and then using that multi-GB hosts file requires less "cpu cycles, RAM, + other forms of I/O" etc.
Exactly, because it breaks it. Thanks for proving my point yet again.
Change is certain; progress is not obligatory.
But, for the majority of cases, I would. One of the few exceptions is a dyndns service website and those tend to get the issues sorted quickly on their own before I become aware of an issue.
I resolved that problem years ago by setting the preference for resolution over TCP while people were arguing about making dnssec a standard.
I've come across plenty of malware on other people's machines that modified the hosts file on Windows XP, Vista and 7 (I haven't given 'free help' to people since Windows 8 came out). I'm pretty certain the hosts file can be exploited exactly the same as before to direct people to malicious sites. That 'less parts complexity' didn't help there. Hell, making a large hosts file causes a default Windows service to 'breakdown' reliably.
Change is certain; progress is not obligatory.
Cool story. However, I have seen enough apps mark the hosts file as read only and modify by SYSTEM only through malware protection software like spybot. Doesn't help against the more vicious malware.
I don't see what moving/copying files has to do with this discussion.
I never said it was, I just don't think a good solution is one that involves breaking services on Windows and the only way to get around it is to give up things like DNS caching.
Actually if your hosts file exceeds 3.4GiB on a 32bit Linux system, you can end up prevented from logging in at the console because PAM can't handle the hostname look up for the local system. I don't even know if it's possible to load a hosts file if you don't have a RAM to hold it on Linux either. The file size I generated trying to block a single domain was far larger than that.
Resolution of cached stuff seems faster than querying 8.8.8.8 here?
Change is certain; progress is not obligatory.
What... If you're going to have an application running in the background, why not just use a write lock? Your method sounds like it's wasting a lot of CPU cycles.
Considering some of the ones I encountered involved rootkits that intercepted native reads (NtReadFile) and for most usermode applications would return the original file, that doesn't help.
Or a bad solution because it breaks a service that works normally just fine until your hosts thing is involved.
And waste it on a hi-res timer that messes with the hosts file instead...
Except the hosts file I generated was larger than the amount of RAM I had, for one domain. So, I don't see how that would work.
I wanna run away and never come back!
Change is certain; progress is not obligatory.
But pretty much resolves the security issue, instead of risking that your hosts file might not have the address in question.
I already countered this non-sense.
And that too.
Woha, you're scaring me!
Change is certain; progress is not obligatory.
I mentioned exactly which API call was being intercepted by a rootkit.
My 'overheads' resolve the security issue complete. Yours does not and breaks things.
Change is certain; progress is not obligatory.
Not an issue with my setup.
Not an issue with my setup.
Not an issue with my setup.
Not an issue with my setup.
As opposed to stuff like hosts file hijacking?
Because my tiny zone file that blocks an entire domain is going to use less CPU cycles, RAM and other forms of I/O over the multi-GB hosts file? I don't think so. Also, it's less likely to randomly break other stuff too (see: Dnscache, PAM) etc.
As is my setup.
I think it took 15 minutes to get to 35GB here, when trying to block an entire domain through generating every single combination because I can't do something like wildcards.
Change is certain; progress is not obligatory.
Indeed and it's not vulnerable. Unlike the hosts file workaround that will only work for certain for any site part of the hosts file.
Your methods break DNS caching and apparently generate overhead by running a hi-res timer and it still doesn't assure the situation is completely resolved.
Not very efficient if you have to manually maintain that stuff honestly.
No, my DNS server uses TCP for performing queries. It is not vulnerable to DNS spoofing.
Change is certain; progress is not obligatory.
It's going to be fairly more complex to target a DNS server with a rootkit than it is to intercept an API call for reading the hosts file. I'm also unaware of anything in the wild that does that with DNS servers.
You can't do DNS amplification attacks over TCP... For one, spoofing the IP address means you won't be able to even establish a connection to do the request in the first place. The size of a SYN-ACK packet is tiny, so there wouldn't even be any advantage to even try to exploit TCP based service in this way.
But by having a large hosts file to block for example, an entire domain, you then require massive amounts of disk space, RAM and even CPU to process such a thing plus hammering the hosts file with a hi-res timer...
You really shouldn't be saying this stuff in every post, when I keep showing you up.
Change is certain; progress is not obligatory.
Maybe, but I don't even notice the difference and it's definitely secured against issues. Your method is not.
Except DNS servers don't have a fixed configuration like hosts files, so the complexity is greater and I have not seen anything like that in the wild compared to hosts files.
You mean like the windows DNS cache or PAM on Linux? No, I don't really see it being that bad.
You don't even block malicious domains as a whole, just a few select subdomains from what is a known malicious domain which is why you have sub-GB hosts files. You are really making a bad case for security with host files and your 'lower' overhead doesn't excuse it.
Change is certain; progress is not obligatory.
I'm saying the likelyhood of that being an avenue to be exploited seems really unlikely and the fact that I have never seen this done against a DNS server, but I have with hosts files.
I countered other points just fine.
Sure, there is more overhead with TCP due to the need to exchange a few more packets, however the majority of packets... SYN, SYN-ACK, ACK etc. are certainly more. However, they are not doubling the bandwidth requirements, I'm not convinced the CPU load is notably changing etc. Calling this 'doubling the overhead' seems a bit of a stretch.
Less also just means 'less'. In this case, less security.
Change is certain; progress is not obligatory.