News for hackers. Stuff that matters.

A comment on It is easy to expose users' secret web habits, say researchers.

Re:It is easy to expose users' secret web habits, say resear... by Pxtl on Monday July 31, 2017 @08:32AM (#14891288)
This business of using full HTTP requests with full cookies to domains that are secondary to the site I'm visiting needs to end. When I go to Foo.com, the browser does not need to send all my cookies and info to bar.com, even if we're fetching resources to display on Foo.com. Bar.com in this case is acting as a dumb file server, it doesn't need cookies.

Yes, this would make single-sign-on harder, but it would make it explicit and be worth the trouble so that when the user is talking to A, they're not being tracked by A's friends B, C, and D.

Of course, the big problem: the best browser is owned by the advertiser who stands to lose under such an arrangement. So at best you'd need Safari or IE to spearhead such a change. You can ape it with browser extensions, but without a big browser maker pushing for this kind of shift some sites would just break under such a model (particularly single-sign-on services like Gmail and Facebook).

[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by JoshTriplett on Monday July 31, 2017 @10:00AM (#14892013)
> This business of using full HTTP requests with full cookies to domains that are secondary to the site I'm visiting needs to end. When I go to Foo.com, the browser does not need to send all my cookies and info to bar.com, even if we're fetching resources to display on Foo.com. Bar.com in this case is acting as a dumb file server, it doesn't need cookies.

Many third-party services (not just ads and tracking) currently rely on this behavior. That's not trivial to retract.

[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by Pxtl on Monday July 31, 2017 @10:50AM (#14892482)
I didn't mean to imply it would be trivial. As I said, single-sign-on services would require substantial reworks.
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by JoshTriplett on Monday July 31, 2017 @11:10AM (#14892708)
Not just single-sign-on. Also a wide variety of services that provide APIs.
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by peteretep on Monday July 31, 2017 @09:36AM (#14891792)
I have switched to explicit cookie whitelisting, and a browser cache that automatically wipes at application quit. I'm sure I can probably still be fingerprinted somehow, but I hope I have reduced the low-hanging fruit.
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by mercer on Monday July 31, 2017 @12:09PM (#14893186)
Fonts strike me as particular low-hanging fruit, especially when targeting developers (who often like to customize everything - and fonts high on the list).

In the context of a browser, how much does anything else matter if you have installed some particular programming font?

[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by theEXTORTCIST on Monday July 31, 2017 @06:54PM (#14896576)
Pretty interesting how many bits of identifying information are available based on system fonts.

if you've never seen EFF's Panopticlick check out https://panopticlick.eff.org

[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by Chaebixi on Monday July 31, 2017 @04:08PM (#14895462)
There should be a browser that explicitly attempts to present the blandest, most common profile to websites to foil tracking.
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by voltagex_ on Monday July 31, 2017 @06:27PM (#14896426)
Firefox in the Tor Browser Bundle does some of this
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by hu87 on Monday July 31, 2017 @10:56AM (#14892555)
Well I have switched to offline Stackoverflow, Wikipedia and Khan academy, all my media from no js torrent site and all news sites blocked with stay focused. Lets see you beat that :p
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by for0one on Monday July 31, 2017 @11:51AM (#14893055)
I never heard of a Stackoverflow offering a full download. Is this the link you used? https://archive.org/details/stackexchange
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by bebopfunk on Monday July 31, 2017 @12:47PM (#14893622)
How is one supposed to browse these files once un-zipped? I will be honest and admit I am ignorant to XML and had trouble finding a solution after some quick googling. Any help would be appreciated.
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by for0one on Monday July 31, 2017 @01:18PM (#14893943)
Not exactly sure. That is why I asked if @hu87 downloaded from a different / better formatted source.
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by bebopfunk on Tuesday August 01, 2017 @09:26AM (#14900365)
Hu80 linked to what he uses. http://www.kiwix.org/. Not sure if you will get a notification or not since he replied to my comment.
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by bebopfunk on Monday July 31, 2017 @01:30PM (#14894116)
Cool thanks for the reply. If you find something better and get a chance, let me know, I'd be very appreciative. I'll take a look this evening and let you know if I find anything.
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by hu80 on Tuesday August 01, 2017 @03:28AM (#14898544)
Kiwix.org

Code for all platforms available on github.

[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by bebopfunk on Tuesday August 01, 2017 @09:15AM (#14900270)
Thank you!
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by hu80 on Tuesday August 01, 2017 @03:28AM (#14898546)
I use kiwix-js
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by rsync on Monday July 31, 2017 @11:51AM (#14893059)
Where do people obtain offline copies of stackoverflow ?
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by hu80 on Tuesday August 01, 2017 @03:29AM (#14898550)
Check out kiwix.org they have all the dumps and readers. Even full text search works for many archives
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by catamorphismic on Monday July 31, 2017 @08:56AM (#14891454)
Why do you mention Safari and IE but but Firefox?
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by Pxtl on Monday July 31, 2017 @10:49AM (#14892471)
Because Firefox no longer has the market share it once did and is not in a position to drive web standards like IE, Chrome, and Safari. If Apple decided to kill cookies for secondary requests, they would be dead just like Flash died.
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by falcolas on Monday July 31, 2017 @10:51AM (#14892487)
Because these are the first party web browsers associated with the two most popular OSes - he didn't mention Chrome either.

Firefox and Chrome doing the right thing won't help a large majority of non-technical users of the internet.

[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by Pxtl on Monday July 31, 2017 @10:57AM (#14892564)
I didn't mention Chrome because Google is an advertising company that benefits from cookie tracking and so I expect them to look out for their own interests.
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by catamorphismic on Monday July 31, 2017 @09:00AM (#14891482)
*but not

Can't edit from my mobile HN client.

[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by kuschku on Monday July 31, 2017 @09:00AM (#14891483)
Because Firefox already has implemented this.
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by gcp on Monday July 31, 2017 @09:29AM (#14891717)
Custom settings for history -> Accept third party cookies (Always/Never/From visited).

in case anyone is wondering.

[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by 0xffff2 on Monday July 31, 2017 @10:45AM (#14892439)
Chrome, IE, and Safari all have options to disable third party cookies as well. This has been a standard browser option for decades.
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by kuschku on Monday July 31, 2017 @05:15PM (#14895954)
No, this is different. Firefox has an option to encapsulate third-party cookies by origin page.

So, depending on if you click on a facebook like button on A.com or B.com, facebook sees two entirely separate browsers.

[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by 0xffff2 on Monday July 31, 2017 @06:08PM (#14896317)
This really isn't my area of expertise. Can you provide a link to what you're talking about? AFAIK, if you have third-party cookies set to "never", Facebook sees exactly the same (lack of) cookies no matter where I click on a like button outside of Facebook.com itself. So, if Firefox does what you say, I still don't see what it has to do with the third-party cookie option gcp pointed to.

Also, in trying to figure out exactly what feature you're talking about, I've come across quite a lot of sources that suggest that Safari has similar or more strict default settings than Firefox regarding third-party cookies.

[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by kuschku on Monday July 31, 2017 @07:10PM (#14896659)
It's part of the container tabs concept, but automatically putting each first-level origin (what you see in the URL bar) into its own container. This is atm only an about:config option in Nightly.
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by Pxtl on Tuesday August 01, 2017 @06:31PM (#14906070)
So how do you use this with systems that need it - can you log into the site for this "container"? Or would it leave the container when you go to the sign-in page? Like if I'm using Google or Facebook for single-sign-on, or I want to comment on a Disqus thread below a news article - since it's in its own container, I'm not logged in on this other site, but if I click a link to log in and it takes me away from this site, it takes me away from this container.
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by kuschku on Tuesday August 01, 2017 @07:44PM (#14906568)
That's actually an interesting issue I had with it, in some versions that actually didn't work. But, somehow, now it does, and I don't know why (haven't read up on it yet).

TL;DR: Can't tell you how, but it somehow works.

[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by dannysu on Monday July 31, 2017 @10:43AM (#14892415)
https://support.mozilla.org/en-US/kb/enable-and-disable-cook...

Link with pictures if anyone can't find it.

[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by ezequiel-garzon on Monday July 31, 2017 @09:34AM (#14891774)
Is there any hope the EU may flex some muscle on this regard?
[ Parent | on HN ]
Re:It is easy to expose users' secret web habits, say resear... by Pxtl on Monday July 31, 2017 @11:01AM (#14892606)
Yes, the technical solution would be so much better than the annoying "this site uses cookies" notice, a much as I don't trust governments to competently meddle in web standards it would be nice to see somebody big throw their weight around and protect consumers from this.
[ Parent | on HN ]