News for hackers. Stuff that matters.
Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by fizx on Sunday May 20, 2012 @08:23PM (#4000677)
From http://donottrack.us: "Do Not Track is a technology and policy proposal that enables users to opt out of tracking by websites they do not visit, including analytics services, advertising networks, and social platforms."

Emphasis on "websites they do not visit" directly, meaning that it only applies to iframes, popups, etc. If you typed it in the address bar, or clicked on a link to get there, the site isn't limited by DNT.

This is not legal advice.

Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by nl on Sunday May 20, 2012 @10:01PM (#4000929)
So Disqus, and any site that uses it is screwed then?
Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by godDLL on Sunday May 20, 2012 @11:22PM (#4001109)
When you say 'screwed', how do you mean exactly?
Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by nl on Sunday May 20, 2012 @11:27PM (#4001121)
Disqus isn't a site you visit directly, it is a plugin service which site owners can plug into their site.

As part of its functionality it relies on the ability to uniquely identify a user across sites (to provide user authentication).

There are quite a few other services that work in a similar way.

Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by kijin on Monday May 21, 2012 @12:44AM (#4001317)
Many people are logged into Disqus all the time. I would think that an explicit login overrides any DNT header.

On the other hand, if I'm not logged in, I don't want them tracking me across all the Disqus-enabled sites I visit.

Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by 2arrs2ells on Monday May 21, 2012 @01:22AM (#4001411)
"Many people are logged in to Facebook all the time. I would think that an explicit login overrides any DNT header."

As a user, I want to be stay logged in to Facebook when posting a TC comment. But I don't want Facebook to track me when I visit some random site with a like button. How do we draw the line here?

Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by Drbble on Monday May 21, 2012 @01:42AM (#4001455)
Pragmatically, we draw it with Adblock and NoScript and friends.
Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by sneak on Monday May 21, 2012 @02:44AM (#4001631)
A solution that I've found works well for me is simply disabling cookies, and whitelisting any site that I want to use that requires them, or that I am attempting to log in to.

This is made easier for me by the fact that I don't use Facebook.

Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by jacquesm on Monday May 21, 2012 @02:05AM (#4001510)
Suggested friend: Ghostery.
Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by subsection1h on Monday May 21, 2012 @02:43AM (#4001626)
Is Ghostery useful if a person is already using a privacy list for AdBlock, such as EasyPrivacy[1] or Fanboy Tracking List[2]?

[1] https://easylist.adblockplus.org/en/

[2] https://secure.fanboy.co.nz/

Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by lucian1900 on Monday May 21, 2012 @06:09AM (#4002103)
Yes, it lets you more easily re-enable things on a case-by-case basis. Like NoScript, but focused on privacy.
Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by kijin on Monday May 21, 2012 @06:45PM (#4005284)
I think Facebook and Disqus are different cases. The only reason anyone ever logs into Disqus is to be able to use it on third-party sites. Not so for Facebook. People's intentions matter.
Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by MindTwister on Monday May 21, 2012 @01:35AM (#4001443)
I would say authentication isn't tracking... its authentication.
Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by nl on Monday May 21, 2012 @04:49AM (#4001943)
Good.

So Facebook & Google are fine, too then. You authenticate with them, then they add features based on that.

Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by nodata on Monday May 21, 2012 @03:52AM (#4001801)
That's a play on words. You can authenticate yourself to something and then be tracked for other reasons.
Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by MindTwister on Monday May 21, 2012 @05:43AM (#4002046)
If you don't want to be tracked, the site that handles authentication can still keep you logged in, but it isn't allowed to track your whereabouts.

In the case of facebook they can show the "like" button, but they cant use the information that it has been shown for you on a particular site, on a particular date/time.

Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by nl on Monday May 21, 2012 @05:46AM (#4002052)
Yeah, but that is kind of useless.

Facebook's entire purpose is to show you things you are interested in. The fact you didn't like something on a given site is nearly as useful as if you did.

Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by MindTwister on Monday May 21, 2012 @07:41AM (#4002354)
Thats from an advertiser perspective, not from a user perspective.
Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by nl on Monday May 21, 2012 @07:34PM (#4005462)
Not at all.

Facebook show's me updates from my friends activity. It can better match those to my interests if it knows what I am interested in.

Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by smashing on Sunday May 20, 2012 @08:38PM (#4000732)
I don't know what legal ramifications could follow sites which declare they support Do Not Track as a spec but in actuality do not support any of the features of the spec in a meaningful way. Other than just bad press if discovered, I don't think there is any punishment for not properly following a technical spec outside of civil lawsuits.
Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by thwarted on Sunday May 20, 2012 @09:07PM (#4000813)
sites which declare they support Do Not Track as a spec but in actuality do not support any of the features of the spec in a meaningful way

Seems that it's like P3P[0], in that it causes problems for developers but in no way keeps a company from asserting things that they don't actually follow, and there's no way to verify that they are.

[0] http://en.wikipedia.org/wiki/P3P

Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by fizx on Sunday May 20, 2012 @09:18PM (#4000841)
The FTC would likely investigate, if you had a non-trivial number of users. You really don't want this.
Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by lwat on Sunday May 20, 2012 @09:47PM (#4000898)
What if they're not in the USA?
Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by fizx on Sunday May 20, 2012 @11:36PM (#4001146)
European regulators are worse, China is its own story, everywhere else is pretty lax afaik.
Re:"Do Not Track" HTTP header supported by IE, Opera, FF, Sa... by lwat on Monday May 21, 2012 @12:03AM (#4001224)
So who cares, shady operators will just move?