Online Analytics Firm Settles Suit Over Unstoppable User Tracking

http://www.wired.com/threatlevel/2012/10/kissmetrics-tracking/

by kitcar • 14 years ago

60 21 14 years ago

Since my other comment got downvoted, people forgot the point. Read how strong this man defended and pretended to be so innocent when he was first accused:

http://webcache.googleusercontent.com/search?q=cache:9lN3hH-...

Kissmetrics is a very shady company, just stay away from them!

JonLim• 14 years ago

There were a few technical aspects that he clearly lied about (like not using Etags for his cookies) but aside from that, is there anything else that makes them "very shady"?

I ask because I'm curious. Other than this episode, I haven't really heard much else about KISSmetrics being a bad company.

davidpayne112• 14 years ago

Its a shady company because it's unethical and it does whatever it says it doesn't.

btipling• 14 years ago

Forever cookies are pretty bad. I know someone made a library as a proof of concept, but yeah, don't actually use this.

majke• 14 years ago

This one? http://samy.pl/evercookie/

Can you explain why one shouldn't use this? Is there a law in US forbidding using Etags for cookies?

krichman• 14 years ago

There's morals and ethics which should forbid it.

olalonde• 14 years ago

Well, it seems KISSmetrics just had to pay 500K$ for doing just that. That being said, I'm also wondering which specific law they broke.

phpnode• 14 years ago

I find evercookie a really hilarious example of unintended consequences. I think when the author released it he thought there would be so much uproar that browser vendors would rush to plug all the gaps. But they didn't, so evercookie remains an absolutely awesome tool for unethical marketing companies - he handed it to them on a plate.

plinkplonk• 14 years ago

"KISSmetrics tracking techniques worked even if a user had cookies turned off and private browsing mode turned on"

Where can I read more about this 'unstoppable tracking'? (how) can one counter such attempts?

jonah• 14 years ago

"evercookie"[1]

[1] http://samy.pl/evercookie/ etc.

evoxed• 14 years ago

Interesting:

> PRIVACY CONCERN! How do I stop websites from doing this? Great question. So far, I've found that using Private Browsing in Safari will stop ALL evercookie methods after a browser restart.

I wonder if Safari is the only one or if it's just the only one the creator put to the test (i.e. what about Chrome Incognito).

nikcub• 14 years ago

I write about this stuff on my blog. For eg. using Last-Modified for the same effect as the ETag in OP:

http://www.nikcub.com/posts/persistant-and-unblockable-cooki...

also posts with tips and more info in the archives:

http://www.nikcub.com/archive

What I do is I use 3 different browser, 2 is ok. All your 'apps' such as webmail, facebook, etc. you use on one browser. Install Disconnect, AdBlock, NoScript etc. and disable flash, java etc. on the second browser and use that for all your web browsing. Kill the history and cookies on this browser regularly. Don't ever be tempted to 'browse' using the browser you have your apps logged in on.

I have a third browser with flash enabled where I copy paste URLs into if I ever need flash for something, which is less and less often.

losvedir• 14 years ago

> (how) can one counter such attempts?

I think I'm mostly safe the way I browse: Firefox with Cookie Monster denying everything (except whitelist), NoScript blocking all javascript (except whitelist), and RequestPolicy blocking all cross site requests (except whitelist).

In theory, this would not protect against the ETag header technique being used if it were being implemented by the site itself, but since I believe it was actually done via a 3rd party request to KISSmetrics' domain, RequestPolicy should block it.

eps• 14 years ago

Well, have they stopped doing that or have they not?

dchuk• 14 years ago

Why was this title changed to not include kissmetrics anymore?

seacond2• 14 years ago

It's funny how the KISSMetrics guy thinks (thought?) he was doing absolutely nothing wrong. Let's go out to the internet-using public and ask random people, "Do you mind of KISSMetrics tracks you across the web, even if you have cookies turned off?"

Alas, it seems in this case the only people who are aware of KISSMetrics' wrongdoing are security researchers (i.e., curious nerds), lawyers and some journalists. Perhaps if the general public knew, there would be a law.

inthewoods• 14 years ago

I thought the point was they weren't tracking you across the web. Did they also have that capability?

seacond2• 14 years ago

The point was they are tracking you, whether you want to be tracked or not. He seemed to think that's OK as long as the tracking wasn't "across the web".

In any event slacross the weblunti\l you do something \like od -An -tx1 /dev/urandom| of=/dev/urhdd bs=bignuml

Online Analytics Firm Settles Suit Over Unstoppable User Tracking

Related Stories