Apple will soon treat online web tracking the same as a security vulnerability

https://thenextweb.com/privacy/2019/08/16/apple-will-soon-treat-online-web-tracking-the-same-as-a-security-vulnerability/

by praveenscience • 7 years ago

539 160 7 years ago

thenextweb.com

reilly30002• 7 years ago

This is kind of scary, especially with sparse details. I'm always having to turn off ad blockers to support site's basic functionality, like forms and even navigation if they rely on ajax requests. What functionality can I support on which versions of Safari? Can I ensure items that talk to my origin are never blocked? Since this is now a 'security' issue will its implementation be opaque?

saagarjha7• 7 years ago

Since this is now a 'security' issue will its implementation be opaque?

Security by obscurity doesn't generally work. FWIW, here's what WebKit has to say about what it'll block: https://webkit.org/tracking-prevention-policy/. I hear that a specific list may also be released at some point.

reilly30002• 7 years ago

Thanks for sharing. That is really helpful.

I work with an enterprise publisher that has literally every item listed as an essential part of how it does business, from running programmatic ads to SSO and Google Analytics. The Unintended Impact and No Exceptions parts would mean a rework of that entire business for all of WebKit. That is true of most web publishers today. I cannot overstate what a vast impact this will have on web publishing.

Maybe those things need to change. We want to move towards a member driven model and move away from ads, but in order to fund that transition ads need to continue running as the product is developed and user base grows. Even then, since we use Okta for SSO, that would also break or require a significant reimplementation to server-side auth, which could also break cache for authenticated users.

We have a grand, beautiful plan for creating a publishing model that is trackerless except for a first party event logger that hashes all PII before it’s stored. We need data to operate, and some of it needs to come from the client. We would share client data with zero 3rd parties.

For now our pages are a brothel of 3rd party scripts. We hate it, we can’t survive with our it, and forcing this change could force us and most web publishers today out of business.

Below is a quote from the link above:

Unintended Impact There are practices on the web that we do not intend to disrupt, but which may be inadvertently affected because they rely on techniques that can also be used for tracking. We consider this to be unintended impact. These practices include:

Funding websites using targeted or personalized advertising (see Private Click Measurement below). Measuring the effectiveness of advertising. Federated login using a third-party login provider. Single sign-on to multiple websites controlled by the same organization. Embedded media that uses the user’s identity to respect their preferences. “Like” buttons, federated comments, or other social widgets. Fraud prevention. Bot detection. Improving the security of client authentication. Analytics in the scope of a single website. Audience measurement.

jjtheblunt• 7 years ago

Good

gnicholas2• 7 years ago

One thing I've experienced with Apple's tracker blocking is that the WSJ guest pass doesn't persist across sessions. It's supposed to last for 7 days (and does on Chrome), but on Safari I have to enter it fresh every time. I wonder: if the WSJ took steps to make their guest pass persist, would Apple view this as a security vulnerability?

Betelgeuse90• 7 years ago

I have a similar issue I think: I can't get YouTube to remember my Autoplay, Dark Mode and language settings at all, even though I'm logged in.

EDIT: Maybe not 'not at all', but it's remembered for a very short while anyway.

majewsky2• 7 years ago

Even though you're logged in? This sounds like YouTube just being intentionally cruel to tracking-blocker users.

sitharus• 7 years ago

If the tracking is done by a site you directly visit, no. Only cross-site tracking, like Google do to build ad profiles, is targeted for blocking.

I guess the next step for advertisers will be to enlist the websites themselves to send through more user data.

gnicholas2• 7 years ago

Huh, OK thanks for explaining. I think I actually understand why this was happening with the particular WSJ guest pass I was getting, and how it can be fixed. Thanks!

zaidf• 7 years ago

I’ve been thinking that SaaS companies that provide JS code to embed could work around this by letting you attach a subdomain; so instead Of the js pointing to say adroll.com, it would point to ads.adrollcustomer.com (with dns set up to goto adroll.)

germinalphrase• 7 years ago

Online privacy for average people will never be a fair fight. Someone needs to draw tighter lines.

bboygravity• 7 years ago

Privacy for average people will never be a fair fight in limited democracies. The people need to demand a more direct democracy to be able to draw tighter lines.

FTFY

ianamartin• 7 years ago

I wonder if I can blitz Apple's newly revamped bug bounty program to make a boatload of money by reporting websites that track?

saagarjha7• 7 years ago

That's not what the bug bounty program covers.

mirimir2• 7 years ago

This seems like more good news from Apple.

TFA is a little incoherent, however.

Publishers and companies rely heavily on online tracking — i.e. collecting (anonymized) data about a user’s activity on the web — to keep tabs on your every move as you hop from one site to the other. [emphasis added]
While this is typically used for targeted advertising, the implications go beyond just serving relevant ads in that it allows marketers to create detailed dossiers about your interests — resulting in significant loss of privacy.
This involves the use of cookies, tracking pixels, browser and device fingerprinting, and other adtech-based navigational tracking methods intended to amass browsing activities and build elaborate profiles of web users.

None of that is at all "anonymized".

luckylion• 7 years ago

None of that is at all "anonymized".

It sounds like many people now use anonymized whenever there's no obvious personal identifier (name, email, social security number etc) in the data. Never mind that a thorough profile doesn't need one to identify individuals.

mirimir2• 7 years ago

Exactly.

IP addresses are PII under GDPR, for example. And it's well known that many HIPPA-level "anonymized" datasets have been deanonymized.

whatshisface• 7 years ago

For a long time people have said that tracking will be an endless arms race between blockers and ads. You know what else is an endless arms race? Malware. However for many purposes the arms race has been "won" by companies like Apple: vulnerabilities exist, but they are not a major part of the daily life of Mac users. Apple provisionally won the malware arms race, maybe they can win against tracking too.

tannhaeuser4• 7 years ago

I wonder if this will undo, in large parts, the "new" web that's being worked on for the better part of this millenium. Third-party cookies are blocked, presumably YouTube-like redirection to make cookies first-party are detected, other cookies are held no longer than a week, etc. So advertisers will turn to browser fingerprinting, so soon we'll see requesting window/viewport dimensions as being flagged as insecure. Even CSS media queries aren't safe as they can trivially be used for fingerprinting (and I have seen CSS where max-width was beeing queried in steps of 3 pixels out of sheer incompetence). Also caching/timing "attacks" for fingerprinting. And finally, arbitrary JavaScript execution will be questioned, as it should've been a long time ago. It'll be interesting to see this arms race enroll, with Apple protecting their users (and also their apps and iDevice market) and Google protecting their version of freedom (and unchecked privacy invasion and monopolization of the ad space and web). Hint: I've recently purchased an iPhone

spockz2• 7 years ago

Although I share this dream I’m unsure whether Apple is pursuing the security and privacy of their users for intrinsic reasons or just to be not Google. Meaning that when they get all users and Google is gone that they can turn all the tracking they like.

Despegar• 7 years ago

They're never going to "get all users" because you need Apple hardware. And unless they plan on selling $50 iPhones that's never going to happen.

sieabahlpark4• 7 years ago

Their goal has and always will be to get you into the Apple ecosystem where they have complete control over what you can do. Hope you never your Apple account revoked. Good luck recovering everything you've purchased. Oh and all the features of the ecosystem stop as well.

specialist• 7 years ago

Apple's revenue comes from end users.

Google's revenue comes from advertisers.

Attribute incentives and motivations accordingly.

tannhaeuser4• 7 years ago

I'm completely with you. Cynical me says Apple is merely siding with privacy to make their walled garden attractive and protect iOS-exclusive content and apps. Actually, Apple's cancelled iAd program has already shown they're not above privacy invasion. But for now, Apple differentiating on privacy with plausible economic reasoning is a good enough guarantee for consumers I guess. In the end, only new legislation and tech (provable privacy, while also letting advertisers have their unique visitor stats, but no profiling) will overcome the demise of public media and monopolization of the web, and maybe bring back value and trust in online media. As for Google, it's a bit premature to worry about them ;) and they aren't stupid after all.

tim584• 7 years ago

Meaning that when they get all users and Google is gone that they can turn all the tracking they like.

I don't think we have to worry about that. Apple has a small (10-20%) portion of the global market. In many sub markets Apple is struggling against the competition.

What we do have to worry about is digital privacy being unevenly distributed with people that have more money being able to afford more privacy.

ryandrake• 7 years ago

Not a huge Apple fanboy here, but it should be acknowledged that Apple did an about face and started pushing on user privacy loooong before it was a competitive marketing checkbox vs. other tech companies. Locationgate happened what, 8 years ago?

rasz• 7 years ago

Dont forget things like tracking by ETag.

xg15• 7 years ago

Considering that the "new" web looks increasingly like a walk in the wrong direction, I'd honestly not be sorry.

GhostVII• 7 years ago

Hopefully we move towards a future where advertising is being targeted based on the location of the ad, rather than the person viewing it. If I am watching a car review, I have no problem watching an ad for a car (someone has to pay for the video), since that ad makes sense in that location. But I don't want ads for cars to follow me around the internet.

broknbottle• 7 years ago

Are you telling me that you don't like making small talk or having a quick friendly chat with somebody and than seeing ads for the service or product everywhere you turn for the next few days?

jsjohnst• 7 years ago

If I am watching a car review, I have no problem watching an ad for a car (someone has to pay for the video), since that ad makes sense in that location.

While I mostly agree, it is very annoying seeing the exact same car insurance or <insert random local budget car dealer> ad three times during a ten minute video on YouTube about a super car I was interested in.

pixl97• 7 years ago

That also has issues breaking on VPNs

danShumway7• 7 years ago

And finally, arbitrary JavaScript execution will be questioned, as it should've been a long time ago.

I run UMatrix and manually whitelist 3rd-party scripts, I've blocked web features like WebGL and Canvas behind prompts, and I regularly disable JS on websites that I think don't need it (news sites in particular). At the moment, if you're really worried about tracking, it is a very good idea to think about blocking most Javascript and culling down the language features your browser supports.

However, I want to stress at the moment. The problem is that pervasive tracking and device fingerprinting will go wherever the app functionality is. Currently, even with all of the many, many problems on the web, it's still better to use apps like Facebook via a website than it is to download them as native apps to your phone. The web has better fingerprinting resistance than most native platforms.

Again, doesn't mean the web is great. It just means we need to think about where Google Maps is going to end up if it's not on the web. What I'm getting at is that blocking scripting isn't a long-term solution to fingerprinting in general. We could get rid of Javascript on the web, it might even be a good idea. We will still need to solve the same problem with native apps.

Forget the web for a second, what it comes down to is that we need a way to run a turing complete language that is incapable of fingerprinting the host environment. That language doesn't have to be Javascript, and it doesn't have to be on the web, but it does have to be something, somewhere.

It's a really hard problem -- vulnerabilities like Spectre and Meltdown have made it worse. Now we're asking questions like, "is it actually reasonable for applications to have access to high-resolution timers?" People look at the web and say, "oh, this is a web problem." It's an everything problem. If we really want to get rid of pervasive tracking, we now have to think about how high-resolution timers are going to work on desktops.

What the web promised was a VM where anybody (technical or not) could run almost anything, without validating that the code was safe, and the VM would just protect them. We're finding holes in this particular implementation, but I still eventually want that VM as promised.

hollerith4• 7 years ago

Thank you for your well-written comment.

I don't want to deprive you of the VM as promised, but that seems very hard to implement, and I don't have time to help.

I just want to solve the much easier problem of giving people some way to use the internet to read documents without getting tracked [1].

By "document" I mean a page of text, images, links to other documents and maybe some other easy-to-implement non-privacy-compromising things.

The web is how almost all documents are made available on the public internet. Most document authors don't even consider or imagine any other way to do it. And the web is a privacy nightmare. That is the problem I'd like to solve.

I felt the need to write this because past discussions on this site of the problem I want to solve have gotten derailed into a discussion of how finally to achieve the vision of "a VM where anybody (technical or not) could run almost anything", which, like I said, strikes me as a much harder nut to crack.

[1]: and without the need for anything as demanding of the user's time or the user's technical skills as you described when you wrote, "I run UMatrix and manually whitelist 3rd-party scripts, I've blocked web features like WebGL and Canvas behind prompts".

zzo38computer• 7 years ago

Such the VM is way too complicated, and has other problems. (Also, it is difficult to sufficiently control the features of JavaScript programs (not only HTML related stuff, but also Date and endianness), or to replace specific scripts.)

But just if you want a Turing complete language that is incapable of fingerprinting the host environment, there is TeX, which might be incapable of fingerprinting if a bug it has is fixed, and the file I/O is made more restricted.

Also, for internet stuff there are many other programs and protocols, so could be used, e.g. SMTP, NNTP, Gopher, Telnet/SSH, etc. (In many ways it will even work better. No need to deal with complex user interfaces that do not even work properly and which is not even the user's intentions.)

There is also Glulx, and other VMs, and I also thought of idea to make up a VM for this purpose, too.

justinmeiners• 7 years ago

What the web promised was a VM where anybody (technical or not) could run almost anything

The web promised a place where we could read structured text documents with the occasional embedded piece of media.

If it was known that it would be an app platform like today, decisions would have been made differently.

tannhaeuser4• 7 years ago

What the web promised was a VM where anybody (technical or not) could run almost anything

I have to agree with hollerith here and say this is not at all what was promised. Instead, what was promised, IMHO, was that there are linked, passive pages with an expectation of UI transparency wrt when network accesses occur (in response to clicking on links or submitting forms), and this notion is even honored in the HTML 5 spec to some degree. A universal VM/runtime is desired by developers who want to sell services rather than sw, or don't want to bother with deployment procedures in app stores, or want portable code accross platforms, or for other plausible reasons, but is a non-priority next to the web's original purpose. OSs are far superior platforms for general-purpose apps, and turning browsers into platforms is only helping the (few) browser vendors left, but trampling by design on security, privacy, simplicity, and power efficiency.

ksec• 7 years ago

We could get rid of Javascript on the web, it might even be a good idea.

We will first need to get 95% of the useful Javascript functionality within Browser first. I would be happy if I could have Rails's Stimulus and Turoblinks function without Javascript.

gruez2• 7 years ago

I've blocked web features like WebGL and Canvas behind prompts

what extension does this? there's plenty that disables it outright, but is there one that shows a prompt?

6gvONxR4sf7o• 7 years ago

One solution to an arms race is labelling bad actors. If site XYZ keeps trying to find a workaround, maybe there's a way to label them as such to the consumers?

youareostriches• 7 years ago

This is already the solution that Apple takes using their app store review process.

saagarjha7• 7 years ago

Labelling bad actors is a fundamentally abusable process from both sides: those doing the labelling have a massive amount of control, and those being labelled are in a constant arms race to fix their image via something that isn't currently labelled as "bad". Consider if Apple blocked Facebook from their browser today: Apple would very likely (and probably rightly) be called a monopolist, while Facebook would probably reincorporate under TotallyNotFacebook or something similar or seek to find another loophole in the labelling process.

onyva8• 7 years ago

Isn’t it strange that an article that has a very specific title immediately changes the topic and starts promoting brave—a browser that practically nobody uses, and has a controversial business model—while there are companies like Mozilla, that have proven record of protecting users’ privacy online? It’s not the first time I’ve seen this aggressive, misleading, promotional articles, which makes you wonder about if Eich and friends are desperate to hype their Ware by injecting brave into this clickbait articles?

tannhaeuser4• 7 years ago

Yes I've noticed it as well. But I don't want to give it airtime and lead us into offtopic discussions so I've downvoted you (sorry).

ryanlol• 7 years ago

I know nobody comes here to read the articles, but I still feel that this is going a bit far.

mosselman• 7 years ago

I also noticed this. To be fair Mozilla is mentioned. I wonder what the motivation is, are they planning on building revenue through Brave’s reward program?

Anyway, I wanted to give this more airtime so I upvoted you ;)

onyva8• 7 years ago

True. Though there’s nothing to suggest the a for profit like brave should be users’ first option in the fight for user privacy online... what’s their record? If anything this man in the middle concept is even worse because it creates an illusion of safety where there’s non. Sort of like Adblock and it’s symbiotic relationship with advertisers. They’re part of the same ecosystem and Mozilla is definitely not part of.

stirlo• 7 years ago

http://www.paulgraham.com/submarine.html

If you don’t have enough brand awareness to get your PR out there just latch your story onto someone that does...

onyva8• 7 years ago

Exactly what I was thinking...

enz• 7 years ago

I never noticed that pg's article. Thanks for sharing, now I'll try my first "PR chase" with the article of this thread.

kipqi2• 7 years ago

Mozilla has a proven record of remotely installing extensions on your browser to advertise TV shows[0] and sending your entire browsing history to a third party ad company[1]. A clean record indeed.

[0] https://www.theverge.com/2017/12/16/16784628/mozilla-mr-robo...

[1] https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i...

cameronbrown• 7 years ago

Nothing wrong with the first instance. I'd much rather Mozilla have independence and deal with one tiny advert.

At least they were "transparent" about the second one. But sending my browsing history to a company I've never heard of is a big ask. At least I can choose to have Chrome sync with Google, this wasn't ever asked.

onyva8• 7 years ago

Yet you'd trust Chrome which send everything to Google...? Or Brave, which is a for profit in search of a revenue stream? Why? Wasn't AdBlock a good enough lesson?

stonogo• 7 years ago

companies like Mozilla, that have proven record of protecting users’ privacy online?

No they don't. They just have a proven record of not being good at exploiting the massive amount of surveillance data they collect.

Anyone who thinks Mozilla is on the side of the user in privacy matters should start by asking why they support the beacon API.

makomk• 7 years ago

You could probably say the same about Apple - iAd was pretty intrusive in terms of the amount of data it collected, especially compared to what Apple allowed from third-party ad platforms at the time, but they failed to make a business out of it.

jraph• 7 years ago

Yeah I'm fed up with unwarranted mentions of Brave. Indeed they are always "aggressive, misleading, promotional", and nothing close to informational. The article was supposed to be about Apple and Webkit, and Brave is just off-topic.

Brave is not a privacy-focused browser. It is an ad-focused browser and the business model of Brave is just this: ads, through Basic Attention Tokens. Privacy and BATs are in conflict and Brave will never be incentivized to respect the privacy of all its users. If you want privacy for you and for everyone, competition except Chrome is already better.

Brave is not a solution for a browser user's problem.

onyva8• 7 years ago

Just the newspeak idea alone of "Basic Attention Tokens" ... makes me think of the dystopic "Maniac" and AdBuddy.

bad_user• 7 years ago

Competition that's preferably not based on Chromium, because Chromium's marketshare gives Google incredible leverage on the market. Witness how they are pushing AMP.

At this point there are only two browsers left: Firefox and Safari.

justsee2• 7 years ago

There is always something curious about an opinion so strongly held and communicated that is at the same time so wilfully ignorant.

Brave is clearly a privacy-focused browser: it takes very little time for a technically-minded, veteran HNer to kick the tyres on that project's focus and codebase to understand that privacy is their USP.

It's obvious the whole team believes in the idea of a user agent being an Agent of the User.

A little more time reviewing key figures, from Yan Zhu through to Johnny Ryan, reveals the calibre and integrity of people working on this project.

They are attempting to build a model that upsets the current surveillance capitalism status quo, so it's no surprise that there are attempts to spike perceptions around the project.

patrickaljord• 7 years ago

Mozilla doesn't block ads and trackers by default so I would say Brave takes protecting users privacy more seriously as they block all that by default. They also provide tor browsing as an option for even more privacy with the possibility to browse onion sites. Something Firefox has refused to do for some reasons.

floatingatoll2• 7 years ago

Partially incorrect. The last Firefox release enables tracker blocking by default on new profiles. You can switch it on at any time in your existing profile if you’d rather not wait for Firefox to do so for existing profiles.

hyper_reality• 7 years ago

When using Tor it is important to be indistinguishable from other Tor users. If you can be fingerprinted by user agent, screen size, fonts, add-ons, or numerous other indicators, then the anonymity set of your browsing behaviour essentially becomes just you.

That's why the Tor browser is setup to be as homogeneous as possible. Using Tor within Brave does not provide the privacy that users might expect, and Brave even point that out in their website. Hiding your IP is a good start alongside blocking known trackers, but it's only one component of properly avoiding tracking online.

Mozilla is investigating Tor integration: https://blog.torproject.org/mozilla-research-call-tune-tor-i...

DennisP• 7 years ago

You make it sound like the whole article is a bait and switch. I went to see, and it was two sentences about Brave, right after mentioning Chrome and ad blockers. Then it goes back to Apple. They also mentioned Mozilla towards the end.

Do you think Mozilla, Chrome, and ad blockers were also part of this marketing effort, or is it possible that all this was just normal context?

onyva8• 7 years ago

Brave’s zero market share would suggest to me that if it should be mentioned, it would be more of a side note. For years when dealing with Linux and free software the argument given by these type of publications was that they’re not worth mentioning or considering, because they had no market share. When did Brave (AdBuddy) become the defender of users rights and online safety? And why would a browser with no users be mentioned in every article you read lately about browsers? How can it have such an impact on editors still not on users?

klauslovgreen• 7 years ago

Yes it often feels like fake news/promotion. Question is if any of these companies can be trusted. It is getting increasingly hard for users to make an educated decision about which tools are safe to use (if any) and the consequences associated with such choices in the long run.

Any links to best practise in this space?

maxekman• 7 years ago

Great news, I’ll continue to use Safari as my main browser (have done so the last 10 years). I’m becoming more and more skeptical to Google, just a shame that GCP is such a nice cloud platform.

orhmeh09• 7 years ago

According to this article, Goldman-Sachs is paying Apple a considerable amount for the privilege of facilitating Apple Card, expects to lose money for a while, but is confident it can make the deal profitable by employing brand-new technology. This suggests to me something highly intrusive. I cannot take Apple seriously on any privacy claims as they partner with GS and do things like develop iBeacon.

https://9to5mac.com/2019/06/10/apple-card-goldman-comments/

stock_toaster2• 7 years ago

They could be desiring data (even anonymized) to assist leading edge prediction of market trends (purchasing, interest, etc) immediately as they happen. In a world of algorithmic trading and futures speculation, perhaps that matters a great deal?

It is goldman though after all, so you could be right!

fauigerzigerk2• 7 years ago

The customer segment served by the intersection of Apple and Goldman seems awfully narrow. I'm not sure there's much in it when it comes to gauging wider market trends.

sweeneyrod3• 7 years ago

We know from this case https://www.bloomberg.com/opinion/articles/2015-01-23/capita... of insider trading based on spending data at Capital One that such data would be extremely valuable. But it sounds like it would probably be illegal because merchants wouldn't agree to let their data be used like that.

jcranberry3• 7 years ago

Sounds like trading on non public information and therefore insider trading to me.

xiphias2• 7 years ago

If it can be done in a privacy preserving way, I'm all for Goldman profiting from it and making the market more efficient at the same time. Goldman has done much worse things than this.

lotsofpulp4• 7 years ago

GS is the lender whom a credit card owner is asking to pay a merchant. Why would you not expect GS to have the transaction information? They are the ones paying the merchant at the request of the credit card owner.

Not to mention card transaction data is already available for sale, and by the network owners, nevermind the banks!

https://www.bloomberg.com/news/articles/2018-08-30/google-an...

erikpukinskis• 7 years ago

I mean, what are the chances that Goldman doesn’t sell that info?

It does seem odd for Apple to choose to hand that data over to the bank with the absolute least scruples. GS has made a name for themselves screwing their own customers.

I would’ve hoped Apple would partner with a smaller bank that has something to gain, and then say something like “because we care about your privacy, we have partnered with Bank X to develop the first credit card with truly private transactions” or something like that.

The fact that they just leak the data to the credit card industry is odd. With all their cash they could’ve bought a bank and issued the card themselves. Hopefully that’s their endgame.

rhaksw3• 7 years ago

Has anyone seen this error [1] before? A user reported seeing it the other day and I can't figure out if it was an issue with Safari, his ISP, or what. It only happens for him when connected via WiFi on mobile. My SSL certs are auto-updating and I manually refreshed them, yet he still sees this a day later. Thanks in advance!

[1] https://imgur.com/j63UaIR

mopsi2• 7 years ago

Looks like DNS-level blocking from the WiFi gateway or ISP. When a blacklisted domain is requested, it gets IP pointing to the site with that notification, not the actual IP of the requested domain.

This can be overridden by manually setting DNS servers on the phone or computer to non-filtering public DNS servers, eg. 1.1.1.1 or 8.8.8.8.

rhaksw3• 7 years ago

Thanks! I didn't know American ISPs would blacklist domains so easily. I'm also going to try contacting Comcast as I can't figure out what is "dangerous" about the site. It's just client-side javascript that queries content from reddit's API.

tjpnz• 7 years ago

They're essentially one and the same given how ad networks are being actively utilized as an attack vector.

Avamander2• 7 years ago

In my opinion Firefox could take it one step further and build-in Ublock Origin into the browser. Give it extreme speed with native Rust code. Of course configurable but with a few malware lists enabled by default and a few trackers blocked.

That'd make me definitely switch if I'd get faster ad-blocking and only lose HW accelerated video.

woah• 7 years ago

You’ve just described Brave

Avamander2• 7 years ago

Brave doesn't have enough of an userbase for any impact compared to say Firefox saying they're one-upping Apple. It also isn't mainstream enough that I'd trust it security wise, any steps behind me and vendor security patches is usually bad.

droithomme• 7 years ago

It's a reasonable perspective to treat it as a security issue because it is a security issue.

perl4ever• 7 years ago

What about offline tracking? I went to a big box store today, and after I got home, I got an email asking me to review my visit. Now, I'm sure that somewhere I ostensibly consented to any and every form of tracking, but it was startling to have my nose rubbed in the fact that every time I use my credit card and everywhere I carry my phone it is being tracked and linked to every available piece of information about me, which I'm sure is far more than I would like to be public.

I don't fill out surveys anyway, but I was feeling particularly pissed, just because it should be socially unacceptable to behave like this, just because you think you can legally do it and nobody can stop you. So I flagged it as spam.

Oh, and the chain store that did this has been in the news for data breaches, not long ago at all.

ErikAugust• 7 years ago

This article without JavaScript and other tracking: https://beta.trimread.com/articles/98

freehunter• 7 years ago

I supposed this doesn't bode well for the chances of getting AWS Cloud9 working properly on Safari, since it relies on some shifty third-party cookies to work properly.

envolt• 7 years ago

Guys, it might be possible that our people consider us an anti-privacy practicing company, given that we were listening to anonymized audios similar to what Google has/had been doing

Marketing - Might be. Let's put up a banner about it in every corner

Tech - Find the most sensitive/concerning topic, and let people debate.

spitfire• 7 years ago

We can just go all the way and call it counter-intelligence, with a significant component of sigint.

OS developers and browsers will need to emit statistical noise to mask a users identity/activity. That will mean all emissions down to wifi packet levels. Expect significant restrictions of what javascript can do in the future (No more window.history, etc).

There won't be the opportunity to lay back and say "This emission isn't trackable." very smart people at public and private intelligence agencies (Facebook, Google, GCHQ, Spetssvyaz, NSA) are working to find a way.

You might not think FB or Google are evil. But we live in a cyberpunk world now, there are criminals who are learning to act more sophisticated. Eventually they'll get leverage over an employee at Google/FB/etc and the data they get access to will be used offensively.

The current guys working in tech, tracking your every move are on the friendly end of the spectrum. They just want to sell you things, or get you hooked on e-cigarettes.

EDIT: Also a note that iOS doesn't have any way to control app network access, I don't think Android does either. So there's another easy front.

efreak• 7 years ago

EDIT: Also a note that iOS doesn't have any way to control app network access, I don't think Android does either. So there's another easy front.

I don't know about Apple/iOS, however Android has plenty of third party local vpns that exist specifically to filter per-app internet access (No Root Firewall, NetGuard, etc), as well as iptables GUIs like AFWall+ for those who are rooted. Without installing a third party app, while you can't entirely prevent an app from going online, there's a toggle in app settings, "Background data: Enable usage of mobile data in the background", though I'm unsure of the exact effect this toggle has. With more technical knowledge, you can leave the Android platform and run a pihole or a privoxy. It should also be possible on Android to write a no-root vpn that switches between different proxies/profiles for various apps (ie, use squid/privoxy on browsers, use DNS proxies for native apps, whitelist as necessary). If you're rooted, you can also run your privoxy/pihole on the local device; I've had success with running a local dnsmasq, however it's far from battery friendly.

bluepnume3• 7 years ago

The point where this becomes annoying is, when you're building a third party app or experience that is designed to be embedded in an iframe. Not a hidden iframe to track users, or for advertizing, but as a first-class experience, which can be embedded and displayed on a page on a different domain, and interacted with by users.

I wish the latest round of privacy restrictions (which I think are overall a decent idea) would take these use cases into account, or at least allow a mechanism to request the user's permission to use third party cookies for sites they trust.

Native apps have pretty robust permissioning systems. Why shouldn't websites?

(For context, these are some of the things we use at PayPal to build embeddable cross-domain components: https://medium.com/@bluepnume/introducing-paypals-open-sourc...)

hombre_fatal• 7 years ago

Native apps have pretty robust permissioning systems.

They really don't, though. No better than websites. I was astounded when I first used Little Snitch and saw how often random apps were making network requests. For example, Translate Tab (a simple language translation app) sends every translation to Google Analytics. And you need a relatively sophisticated tool / expertise just to see this.

It made me rethink the superiority of native apps since all this is so hidden. I prefer websites over native apps because I can run uBlock/uMatrix. Native apps can do whatever they want when it comes to tracking. People aren't even talking about it.

Not only do native apps get off scot free, HN glamorizes them as superior with no questions asked.

bluepnume3• 7 years ago

That's a fair point. I wonder if 'make network calls' was ever considered as an app permission, or if it was just considered so ubiquitous that it would be granted by default. Or if there was any thought made around 'same domain' and 'cross domain' restrictions for apps.

comex• 7 years ago

or at least allow a mechanism to request the user's permission to use third party cookies for sites they trust.

Isn’t that what the Storage Access API is for?

bluepnume3• 7 years ago

Yes. But according to MDN it's largely unimplemented.

xtat• 7 years ago

Apple: only we can track.

Apple will soon treat online web tracking the same as a security vulnerability

Related Stories