IE10's 'Do-Not-Track' Default Dies Quick Death

http://www.wired.com/threatlevel/2012/06/default-do-not-track/

by mproud • 14 years ago

77 64 14 years ago

ggchappell2• 14 years ago

An issue sidestepped by this article is whether the statement in the second paragraph is correct:

> ... tech and ad companies who say they comply with Do Not Track could simply ignore the flag set by IE 10 and track those who use that browser.

That doesn't quite work. Web servers don't know what browser is on the other end of a connection. Yes, they know the "User-Agent:" line, but that is not the same thing.

Claiming to follow a privacy standard, but then ignoring it based on a conclusion reached via fallible means, is a bit scary. It strikes me as the beginning of a slippery slope, regardless of what position Microsoft ultimately takes with IE 10.

Animus72• 14 years ago

So don't forge your headers.

I don't see how this would be slippery at all.

eli2• 14 years ago

The parent's point is that some of those IE10 users aren't just stuck with a default, they really did intend to turn DNT on.

ggchappell2• 14 years ago

Does the DNT standard require that User-Agent strings correctly reflect the browser? [1] Guaranteeing a site follows DNT means that it will follow it, not that it will follow it only if headers are not forged.

Also, is "forging" really a dishonest thing in this instance? Browsers have been making themselves look like other browsers for years, in order to deal with stupid servers that make incorrect assumptions about the User-Agent string.

[1] Not a rhetorical question. I don't know the answer.

rurounijones2• 14 years ago

Yea, the whole idea of "They are not following part of the spec so we can treat them differently" seems like a sketchy argument.

Is there a clearing house for certifying browsers as DNT compliant? Or can the websites just say "Oh, THAT browser? Well I don't think it is DNT compliant so I am going to ignore the DNT headers even though they are perfectly to spec"

pippy• 14 years ago

The whole concept of DNT is just stupid. It's misleading users and won't work.

By telling users you have better privacy simply because your browser adds a random header tag onto requests you're misleading them. Sites have no obligation to obey it and it will give users a false sense of security.

We already have proven, well defined method of DNT already: private browsing. This works by simply removing resources after the session ends. There's no reliance on servers, so it will always work.

Animus72• 14 years ago

> Sites have no obligation to obey it and it will give users a false sense of security.

Until appropriate legislation comes into play. It worked reasonably well with the Do Not Call lists.

untog• 14 years ago

Telephone networks are still largely national-based. The idea of individual countries implementing "Do Not Track" legislation is a mess. Do they only enforce it on sites based in their own country? If so, it's useless to users. If they apply it to all countries, it won't work.

gringomorcego• 14 years ago

Germany still passes screwed up laws, but in terms of privacy they are leading the charge.

Catching up is a matter of when, not if.

mbrubeck• 14 years ago

Or if a large portion of the industry decides to voluntarily adopt the standard, to counter the threat of legislation.

A number of large ad networks have already announced support for DNT. Sure, there will always be sites that ignore the header, but there's also a realistic chance that it will give users a meaningful choice about how their behavioral data is used by many of the biggest sites they use most often.

elehack• 14 years ago

There's a crucial difference: it's easy to tell when someone violates a Do Not Call list. They call you.

It's a lot harder to detect, and probably harder yet to prove, when they're engaging in illicit tracking.

lhnn• 14 years ago

As if that would be appropriate or necessary to solve whatever privacy problems we have.

It's the U.S. government trying to take anonymity and privacy away from the Internet; do we want them making weak, unenforceable, irremovable laws on how to implement an HTTP header?

cheatercheater• 14 years ago

Yeah, because the Internet is american. In fact, all the servers are in Kentucky.

ZoFreX• 14 years ago

Ha! People have been getting around the do not call lists in the UK for years now by dialling in from other countries where our regulatory bodies are powerless. Trying to regulate it on the world wide web would be even harder.

lotu3• 14 years ago

I agree 100%, this whole fiasco is just a about convincing the US Congress not do anything (which they shouldn't btw). Anyways, the DNT specification has exceptions in it large enough to drive a truck through. On the other hand if it would finally shut up people whining about being tracked online that would be worth (though I doubt it will, as whining is too much fun).

CyrusL• 14 years ago

Individual sites are not really the ones auctioning ad inventory that is targeted by a user's cookies. That specific technology continues to become consolidated in a handful of exchanges. You could probably get 95%+ of cookie-targeted impressions compliant by regulating 5 or 10 companies.

ZeroGravitas2• 14 years ago

I agree with your critique of DNT, but private browsing isn't magic, there's plenty a bad actor could do to track you regardless of what you throw away at the end of the session, which means the same critique applies (unless you're using it for it's intended purpose, privacy from other users of your computer, and even then it's got holes).

BitMastro5• 14 years ago

How?

naner• 14 years ago

We already have proven, well defined method of DNT already: private browsing.

You are still being tracked with private browsing. You IP, user agent, OS, screen resolution, etc. are enough to connect the dots in most situations.

This is a decent idea that will need to be implemented to some degree if sites are eventually going to support under-13s, since it is illegal to track their behavior under current law. But you are right, I don't see a lot of places voluntarily signing up to make less money.

mparlane2• 14 years ago

Now imagine if Chrome made incognito browsing the default and you had to access a submenu to get a cookie keeper. Disrupt the web!

eli2• 14 years ago

I don't think google is going to be the one leading the charge against targeted advertising.

mparlane2• 14 years ago

I realise this, I used Chrome as the example as I imagine it has the largest audience of users here. I wish I could set incognito per site. I.e. opt in to cookie keeping. e.g. set cookie_keeping=true for gmail.com.

martingordon• 14 years ago

Does the current spec take into account that unscrupulous ISPs (I'm thinking about hotel WiFi in particular) can strip the header before forwarding a request to a server?

lotu3• 14 years ago

It says they shouldn't do that. But you are never going to see enforcement, stripping headers can be sold as "security" to hotels who have no clue what they are doing.

ars3• 14 years ago

Turning on DNT by default is a great way to ensure it will be utterly ignored.

So I quite support the requirement that people explicitly enable it.

Remember the DNT is voluntary - but if everyone does it by default, then there is nothing left to track, so websites will have no interest in paying attention to the flag.

melvinmt• 14 years ago

> then there is nothing left to track

Isn't that the whole point? Websites may not have interest in tracking disabling policies, but a lot of people do. Maybe these advertising companies ought to incentivize users to opt-in to sell their data instead of the other way around.

coopdog• 14 years ago

The whole business model is that users don't care if they're tracked, so let's track them (and others) and do things for them that we couldn't before

I can see Google fully implementing DNT on the basis that users don't care, and for the few that do they're happy to comply

But making it default to on, especially if no one gives a damn is the death knell to the whole business model

Suddenly you have to pay for everything.

Although I would be interested in using DNT if out had more granular control to block certain entities

chc• 14 years ago

Yes, that is the whole point. Those people who are interested can send the Do Not Track header to indicate the preference. By sending it even when the user didn't indicate that preference, IE would have been the Boy Who Cried Wolf. Network owners wouldn't has been able to trust the header to indicate actual user preference.

earl• 14 years ago

The users already are getting tons of free content, and on the android platform, free apps.

Cogito• 14 years ago

What is the situation if a user agent, on installation/upgrade, asks a user to update their DNT status but in doing so defaults to on? The user has to explicitly agree to turning this setting on (as they have to accept the configuration before proceeding), and is able to turn it off, but most people will just click through anyway.

ars3• 14 years ago

If too many people turn on DNT websites will start ignoring it.

lwat• 14 years ago

Most websites will just ignore it from day 1 anyway.

awaythrow• 14 years ago

Good for privacy litigation. "My client had DNT in her browser set to 'on' and the company intentionally ignored this and tracked her actions on the web, vioalting her right to privacy and causing monetary damages in the amount of $________."

Web developers might hate it, but DNT could be potentially good for end-users who want to make privacy claims. It's just one extra header. A few extra bytes. Meanwhile things like XML and JSON, which add considerable bloat to web responses, are accepted without any complaint.

lotu3• 14 years ago

On the other hand now every single line of code that gets changed has to reviews by a lawyer to make sure it is compliant with the DNT legislation. And if your a startup, the best way to take you down is probably a couple of frivolous DNT lawsuits.

rurounijones2• 14 years ago

So instead IE10, on first run should just pop up a very scary looking dialog filled with text on why the user should choose the "do not let websites track me" button instead of the "Let websites track me" one.

It is not default, the user has to choose.

jcampbell1• 14 years ago

This is sad. DNT is may be a good thing.

Whenever you visit a website with an ad, DoubleClick knows you looked at that article, and uses that to build a profile about your preferences. I don't think when your average joe reads an article that it is fair that their preferences are being tracked in this way.

We should survey the public and ask: "Do you think it is okay that internet ad companies use the type of article you read to target ads that are more likely relevant to you?"

That is a reasonable question that gets to the crux of the issue. Retargeting and profile targeting may be borderline unethical, but Google and I both make good money doing it. I am not sure it is right, but we both have a vested interest in making sure we can continue.

clhodapp• 14 years ago

I apologize in advance that this will probably end up looking a bit like a rant.

I'm sorry, but what is the deal with web-based tracking? I see comments like

> Whenever you visit a website with an ad, DoubleClick knows you looked at that article, and uses that to build a profile about your preferences. I don't think when your average joe reads an article that it is fair that their preferences are being tracked in this way.

and I honestly wonder how this sentiment can be so common, given the realities of our current society (note: this comment is not meant to say anything bad about that comment's author, it's just a convenient example of a trend in the discourse on this topic).

First, we give up many "rights" as tradeoffs for other things that we want. We have the right to the pay from our jobs, but that doesn't mean that we are entitled to get things from the store for free. We have to give up ownership rights of our money in order to trade it for goods and services. We have the right to free speech, but that doesn't mean that someone can't ask us to leave their home or other property if we say something that upsets them. We give up our right to say whatever we want by going onto someone else's property. This sort of situation is so common that it would be impossible for me to list all of the times in which we are faced with it here. However, this argument would not be complete unless I also stated that web-based tracking is in exactly this category: someone has set up a situation where your computer can exchange data with their server. However, in doing so, it is possible that they will notice that you have done so and keep a record of this fact. In other words, if you, through your computer, communicate with a company or individual, that company or individual may know that you communicated with them and what the contents of those communications were. You are giving up your right not to be known to have performed a behavior by a set of potential witnesses in exchange for performing that behavior in front of those witnesses. It's unreasonable to say that, just because you are communicating through computerized agents the other party should not be able to keep a record of your exchange.

Second, it is unfathomable (edit: To me. Please, tell me how your opinion differs) that this could be an issue for people because this is the state in which we constantly live. Every time you leave your house, your neighbors may take notice. Every time you go to the store, your actions are recorded (tracked!) by security cameras. The clerk knows what you bought and may recognize you as a regular customer. If you use a credit or loyalty card, the store keeps keeps a log (tracks) your purchases and builds a demographic profile. At a casino, the floor manager watches you gamble over security cameras. If they notice you winning a lot, they may ask you to leave for the day. I could go on like this all day. The point is that there are all kinds of times where we are tracked and where the only way to opt out is not to have dealings with the tracking entity or to not go out in public. There are all kinds of businesses built around or supplemented by tracking people. It seems to me that the tracking-things-you-witness ship has already sailed and if people wish to bring it back into harbor, they will first need to establish a reasonable test that makes it clear when tracking is actually abusive. It seems very unlikely to me that any test that wasn't specifically designed to do so would label all internet-based tracking as abusive, as some people seem to do, while calling these other behaviors OK.

Am I wrong? Am I just an asshole?

lla0ajj2• 14 years ago

I think you're just upset because DNT might affect your income?

Tracking does not mean looking at server logs (or by analogy, reviewing security camera footage), it means things like cookies, Flash cookies, beacons and KISSmetrics.

Chances are DNT idea will have little effect. People raised issues with cookies back in the 1990's and in rerospect it hasn't impeded websites from tracking. People were forced to opt-in to cookies and everyone became desensitised to them over time. Now people don't even think about not accepting cookies. Tracking has gotten very aggressive though. Some of the behavioral tracking ideas are really pushing the limits.

DNT is hardly a draconian measure. Be glad that the web is still very much unregulated in comparison to meatspace.

ericflo• 14 years ago

What browser forces you to opt-in to cookies?

ZenPsycho• 14 years ago

There's a difference between a right that you are aware that you are giving in exchange for a service, and a right that you are unaware that you are giving. The way in which ad companies track users is so obscure that most people cannot be expected to be giving reasonable consent.

TomGullen2• 14 years ago

Honest question, why do people care if they are being tracked? The amount I care is quite far off from the amount everyone else seems to care, could someone educate me on why I need to care more?

BitMastro5• 14 years ago

The same for me. Why should I care if I'm tracked? And if I don't want to be tracked I'll use private browsing (it's not just for porn, you know?). If I want even more privacy I'll use a clean vm, or if I'm going paranoid I could use an anonymous proxy or similar.

JoeAltmaier2• 14 years ago

Consider bubbling, e.g. Google returns search results consistent with your previous clickthroughs. You end up seeing only results you agree with; it insulates your searching experience from disturbing foreign ideas like evolution or liberalism.

Tracking can be done by servers, using a workstation signature (ip/port, installed software versions etc, been discussed in other posts), it doesn't require your client station's consent (cookies).

IE10's 'Do-Not-Track' Default Dies Quick Death

Related Stories