Forgot your password?
typodupeerror
Privacy Your Rights Online

Do Not Track Ineffective and Dangerous, Says Researcher 207

Posted by samzenpus
from the best-intentions dept.
Seeteufel writes "Nadim Kobeissi, security researcher, describes the Do Not Track standard of the W3C as dangerous. 'In fact, Google's search engine, as well as Microsoft's (Bing), both ignore the Do Not Track header even though both companies helped implement this feature into their web browsers. Yahoo Search also ignored Do Not Track requests. Some websites will politely inform you, however, of the fact that your Do Not Track request has been ignored, and explain that this has been done in order to preserve their advertising revenue. But not all websites, by a long shot, do this.' The revelations come as Congress and European legislators consider to tighten privacy standards amid massive advertiser lobbying. 'Do not track' received strong support from the European Commission."
This discussion has been archived. No new comments can be posted.

Do Not Track Ineffective and Dangerous, Says Researcher

Comments Filter:
  • by Anonymous Coward

    Do Not Do Not Track?

    • Google's search engine, as well as Microsoft's (Bing), both ignore the Do Not Track header . . . . . Yahoo Search also ignored Do Not Track requests . . . . . . this has been done in order to preserve their advertising revenue.

      File this under: Well, DUH!!!

    • No seriously. Thank you, Nadim Kobeissi, for using your media clout to bring the obvious to attention.

      The world needs real Captain Obviouses. Chisel-jawed men with flashy capes and booming voices to land out of the sky and say what masses of experts already know but nobody has been listening to.

  • Legislation (Score:5, Insightful)

    by anthony_greer (2623521) on Wednesday February 13, 2013 @08:56PM (#42890571)

    The days of the wild west on the net are gone...If the big boys in the industry cant get their shit together soon, we will get legislation, and that will be bad for everyone!

    Just once I wish these companies could see that it is in the best interest of everyone to keep the government out and work together to reach a policy that will be adopted as a general standard without a law mandating it...

    • by Andy Prough (2730467) on Wednesday February 13, 2013 @09:04PM (#42890671)
      They still act like there are just 3 network TV stations, and that if they write a witty line in an ad, 50 million people will see it and go buy their crap. Like "Think Mink", or "Got Milk?". They still think they can bombard the public's eyeballs with ads and force us to robotically buy whatever they are selling. "Do Not Track" isn't even a speed-bump for these geniuses.
      • I don't know about the tag line thing for the examples you give: Milk is a staple, been around long before modern advertising...and Think Mink? I never heard of it and cant really tell what they want me to buy with a quick google search for that term...

      • by alvinrod (889928) on Thursday February 14, 2013 @01:35AM (#42892647)
        It still works on some level though, otherwise they wouldn't bother doing it. Same reason there's still loads of spam. You don't need 50 million people to buy what you're selling. Just over the cost is fine, and anything beyond that is gravy. The market is relatively free, so it's going to tend towards equilibrium. So baring any external forces (e.g. government regulations) or some other massive change in the market, advertising isn't going to go away. At least there're things like ad block on the internet. Prior to DVRs there wasn't a good way to get around advertising on TV or the radio. Even if you left the room while it was on, it still ate into the program schedule. Even if you don't block ads on the web, they're by and large less obtrusive than what we had before.
    • Re:Legislation (Score:5, Informative)

      by jazman_777 (44742) on Wednesday February 13, 2013 @09:11PM (#42890735) Homepage
      Most big companies see it in their best interest to use the government to crush their competitors, all while the government gives them a free hand.
    • by Anonymous Coward

      How about we leave the government out of the fucking internet and people can vote with their visits? The fact that these sites are still popular shows that people overwhelmingly don't care about targeted advertisement. (and they shouldn't, as anyone with real intelligence already knows)

      Just like with companies off the internet, if you don't want to deal with them, then don't use them! Blacklist facebook, bing, yahoo, etc in your hosts file.

      • Re:Legislation (Score:4, Insightful)

        by Anonymous Coward on Wednesday February 13, 2013 @09:26PM (#42890859)

        It's 2013. Anyone who still thinks "vote with your wallet" works is a fucking idiot.

        "Vote with the ballot box" is and will always be the fairest way: one person, one vote.

        "Vote with your wallet" is similar but with the number of votes you get weighted by the size of your wallet.

        DNT fails because large corporations are a bunch of lying, two-faced bastards. Abandoning DNT is no more sensible than repealing any law or policy "because rich people don't feel like following it".

        Regulation works, except when regulatory capture happens. And regulatory capture happens when regulation is weak.

        It's time to end Free Market As Religion. The balance that was social democracy represented the pinnacle of human civilisation, and it's time that America moved forwards to pre-Reaganite progress, and Europe to pre-Thatcherite progress.

        • by epyT-R (613989)

          "Vote with the ballot box" is and will always be the fairest way: one person, one vote.

          hahahaha..hah.. ha.... You say wallet-voting fails then defend voting? What planet are you from? Neither works in systems where consensus and feelings matter more than truth and facts. It's hard to manipulate people who stick with the latter two, leaving corporates and government without much power, thus they work to maintain an impulsive, emotional buyer/voter base..

          DNT fails because it leaves the fox guarding the henhouse.. The only way to get rid of web tracking is to kill the scriptable browser.

          • "You say wallet-voting fails then defend voting?"
            I do.

            one is democracy, the other is essentially rule by those with enough money to vote.
          • "DNT fails because it leaves the fox guarding the henhouse.. The only way to get rid of web tracking is to kill the scriptable browser."
            Scriptable browsers are what makes most ad-blocking features work - and all online "apps", like Gmail etc. Advertisers would love it if you killed scriptable browsers, but online services would hate it. Kill cookies (other than session cookies), sure, but not scripting.

        • Last time I checked "Vote with the wallet" worked for the ballot box just fine. Of course, provided your wallet is big enough to buy the right politicians.

        • Re:Legislation (Score:4, Informative)

          by hairyfeet (841228) <bassbeast1968&gmail,com> on Thursday February 14, 2013 @07:33AM (#42894133) Journal

          I hate to break the news to ya sparky but in case you ain't kept up on current events the courts ruled "money equals speech" so your ballot box is worth jack and squat.

          You honestly think the best candidates anybody could come up with were Obama and Romney? Even though I don't believe in libertarianism you might want to look up "Jon Stewart Ron Paul" to see how badly the media is rigged, they treated Paul as "he who shall not be named" and the video ends with a reporter talking to an anchor and the reporter says "Here we are talking about Palin and Christie, who aren't even running, and not saying anything about paul who is doing good in the polls here" and the anchor gets a douchebag smirk and says "if you get any footage of Christie or Ppalin send it in, you can keep the Paul stuff"

          And THAT, that right there, is why your vote isn't worth used toilet paper. the media chooses which two shills you get, its coke in a can VS Coke in a bottle, because only pre-bought shills need apply. if you think voting would ever do anything ask yourself these questions: How many protested against the wars? How many sat out there in the cold during occupy? Think those people don't vote? of course they do but when your choice is Coke in a can VS in a bottle it don't really matter who you choose, its just different corporate masters. Obama is owned by the media cartels and his VP is the biggest media shill in DC, Romney was owned by Wall Street, 6 of one, half dozen of the other, either way you are fucked.

          • by Gibgezr (2025238)

            Jon Stewart is a comedian. It is a comedy routine. The Daily Show is aired on "Comedy Central".

            WTF? How did this guy get modded "+4 Informative" for an insane diatribe like this?

        • It's 2013. Anyone who still thinks "vote with your wallet" works is a fucking idiot.

          Not only do I think it works in many situations, I see that it has a good track record, confirmed again and again to be devastatingly effective strategy for dealing with many different kinds of shit. I'm talking about the exact opposite [xkcd.com] of Free Market As Religion. I have evidence, and it's repeatable so that you can recreate it whenever you want to.

          For example, there was a computer company that sold a truly piece-of-shi

    • Advertisers? Big boys? More like little bitches.

      Laws or no laws to keep these assholes in line, no one is going to stop me from using Adblock, NoScript, DoNotTrackMe, etc. or similar tools. I don't trust these crooked fucks to even follow the law, so privacy extensions aren't going anywhere.

    • by epyT-R (613989)

      Oppression is oppression, whether it's corporatocratic tyranny, or abuse by ivy league lawyers in governments who think what's best for them is best for everyone else...Oh wait, both have basically the same attitude. The real fun begins when each side helps the other out, as is happening more and more these days.

    • by Luckyo (1726890)

      And by "bad for everyone", you mean "bad for companies' bottom line and easy earnings". Consumers benefit. But consumers are rarely if ever part of that "everyone" when used by corporate shills.

    • The big boys in the industry ARE getting their shit together. That is exactly WHY we get legislation.

      What did you expect, invention? Lobbying is where you spend your money these days as a company, not innovation. It's not the better product that makes the race, it's the better lobbying.

    • by thegarbz (1787294)

      The days of the wild west on the net are gone...

      No they've just been pushed outside the view of the popular perception of the internet.

      The wild west is still there and if the pirate sites rising and falling, or the sharing sites being brought up under the same name as they were previously despite actual current ongoing legal battles are any indication we're a long way from any kind of enforcement by governments or corporations.

    • by Hentes (2461350)

      Tragedy of the commons. While many companies aren't playing fair when tracking their costumers, it's unrealistic to expect them to abandon that profit. I would say that the real blame lies with the W3C who have been completely ignoring all security concerns during standard design. If we want to make a safer web, we should make a safer web standard instead of handing control to the lawyers.

    • by AmiMoJo (196126) *

      I'm really, really glad that we are in the EU. Corporations don't rule us like they rule the US. Look at how much of a stink the "right to be forgotten" has caused.

      People say the EU is undemocratic, but it seems to act in the interests of its citizens far more than out national parliament.

    • by RockDoctor (15477)

      If the big boys in the industry cant get their shit together soon, we will get legislation, and that will be

      ... ignored by organisations based outside whichever jurisdiction has passed the laws you're talking about. So, companies will re-structure themselves.

      Countries that think that they're the only country in the world are in for a nasty shock, as multi-national corporations learn to "route around" the "damage" that legislation and taxes represent.

  • meanwhile... (Score:2, Interesting)

    by Anonymous Coward

    Many of us here have been saying DNT is a bad idea since it first appeared (and often, on slashdot, we've been downmodded for it). The right way to do this is NOT to depend on the good will of the remote side. Even you passed laws that demand compliance, the data collection will just move out of the jurisdiction of those laws, and anyway, the companies involved will buy themselves exceptions and find creative loopholes. You can't win, that way.

    You CAN avoid giving them much data in the first place. You

    • Re:meanwhile... (Score:4, Insightful)

      by Anonymous Coward on Wednesday February 13, 2013 @09:06PM (#42890683)

      Someone will say, "I shouldn't have to do that!", and they're right, they shouldn't. But the simple reality is that you do have to do all that, and some others in that ilk (only whitelist javascripts you trust). It's your computer which loads those trackers. You are free to tell it not to do that, but don't fool yourself into thinking businesses built around tracking your every move will ever have your best interests at heart.

    • So what's the problem with blocking all the garbage with the many tools we have and also having a DNT flag on top as a clear statement that the fact my browser didn't load any of the tracking crap was entirely intentional?

    • by Luckyo (1726890)

      This would actually not work too well in this case. Sure, you yourself can move out of jurisdiction, but where does your advertisement revenue comes from? Most likely vast majority of it comes from EU companies or companies with legal presence in EU..

      So let us imagine that getting dinged by this legislation bans EU based advertisers from selling advertisements to you under penalty of significant fine if caught. Suddenly all large advertisers face a clear cut choice: continue ignoring the law and lose vast m

    • by grcumb (781340)

      Many of us here have been saying DNT is a bad idea since it first appeared (and often, on slashdot, we've been downmodded for it). The right way to do this is NOT to depend on the good will of the remote side....

      What do you mean by 'us', Kemo Sabe?

      Okay, seriously: It's almost axiomatic in programming that you never trust your inputs, and you never assume that just because the external party (be it a function, another object, or a completely separate system) says it's going to X, that X will actually happen. So I'm good with the principle so far....

      You CAN avoid giving them much data in the first place. You don't have to load their web bugs, their trackers, accept their cookies, or flash objects, and you can obscure your user agent string, and if you're really paranoid, even your IP address.

      That's all well and good, but sometimes part of protecting yourself consists of telling someone else to stop doing what they're doing. Instead of just avoiding a particul

      • It is unfortunate that Do Not Track seems more like politely asking the school bully, 'Please stop taking my lunch money.'

        It is indeed unfortunate that people see it in such an unrealistic way. School bullies initiate action; they come to you, telling you to give them your lunch money. And if you refuse, then they do something bad to hurt you.

        Web tracking is where you make the decision to talk to someone else, and they decide to remember the conversation happened (and a lot of other details, like where the

    • The question is, HOW does someone go about doing that without their wife/parents getting annoyed when their school/office website chokes due to a blocked script. My general course of action is to install noscript and adblock, but the fine tuning involved makes the whole thing a hassle.

      For me, it's not hard to slowly add/deny portions of sites since I'm marginally familiar with how the web works, but I'm at a loss as to how to make it transparent for the SO.

  • Poisoning the well (Score:5, Insightful)

    by morcego (260031) on Wednesday February 13, 2013 @09:02PM (#42890637)

    For a long time, advertisement didn't bother me. I refused to use ad blocking addons, and considered ads just part of a trade. Sites give me content, I look at the ads.

    Then came pop-ups. Pop-unders. Flash adds. Ads with music. Ads that would make my cockatiel go into convulsion, and start to drool and chase the neighbor's cat. And I have to tell you, my neighbor really loves her cat. And being chased by a drooling cockatiel will really humiliate a cat, and all dogs will start making fun of it. Not an idea situation.

    So, back to the issue at hand. What MOST sites did was poison the well: no one can drink front it. It got so bad that I eventually had to start using ad blocking addons.

    Now people want to implement VOLUNTARY sensitive advertisement and privacy practices. Obviously, they are trying to convince people we no longer need our ad blocking addons. By saying they will do something that is exactly the opposite of what they have done so far, ostensibly.

    Sure, some sites will do the would Do Not Track dance. But those are the same sites that already respect our privacy and my neighbor's cat. Exactly the ones that don't need it.

    The ones that need it the most, will just ignore it.

    Fun, isn't it?

    Fuck Do No Track. I will keep my Javascript and Ad blocking addons.

    • by bmo (77928) on Wednesday February 13, 2013 @09:18PM (#42890791)

      Then came pop-ups. Pop-unders. Flash adds. Ads with music. Ads that would make my cockatiel go into convulsion, and start to drool and chase the neighbor's cat. And I have to tell you, my neighbor really loves her cat. And being chased by a drooling cockatiel will really humiliate a cat, and all dogs will start making fun of it. Not an idea situation.

      What you left out of that extensive list was malware served up through ad networks. It's not enough to go to "trusted sites" but you have to trust their ad servers too. On one site I still frequent, there was an ad serving up malware for an exploit in Windows. They have since clamped down on who their ad server is, but after that people installed adblock plus as a security measure.

      --
      BMO

    • No kidding (Score:5, Insightful)

      by Sycraft-fu (314770) on Wednesday February 13, 2013 @09:24PM (#42890843)

      Advertisers need to STFU as they are the reason all this happened. Most people really don't mind non-invasive ads that much. They'll let them happen and likely not even complain. However the advertisers seem to think that more obnoxious, more invasive, etc is the way to get attention. Eventually, it pushes people over the edge and they will block it.

      Happened to me. I was fine with ads, I understand the need. However I really hated popups. No problem, popup blocker. Then game the fucking flash ads, ok fine so a flash blocker with click to pay for the stuff I want. Then, HTML 5 ads that take over a page. Ok, fuck you, all ads are blocked, I've had enough.

      Happens with more people I know too. They'll ask me if there's a way to deal with it and I'll point them to Adblock.

      Advertisers really need to understand that if you don't want your market to go away, you have to stop being dicks about it. Keep the ads low key and not fraudulent, and people will probably be ok with it by and large. Some won't, but most won't mind, at least not enough to do something. However the more invasive you are, the more people will block it out.

      • by Anonymous Coward

        How much are you willing to pay to view your favorite sites?

        Unfortunately, the reality is that running websites costs money, and people do not want to pay to access them. You pay to access them by viewing advertising. When you block ads, you are effectively stealing from the sites you visit. If you were shopping for cars and the seller was asking too much for one you really liked, you wouldn't steal it. You would buy a different one. If you don't like how the sites you visit advertise, go to different ones.

        • by Omestes (471991)

          And if they aren't worth my money... I don't care. I don't need your content. Mostly I don't care about it, it is a distraction, nothing more. Perhaps a pleasurable one, but no more pleasurable than my hobbies, books, or friends. Something will fill the gap, we lived for hundred of thousands of years without your blog, and we can live a couple hundred thousand more without it again.

          Adapt or die. And the second you try to exploit me, is the second where I shop giving a shit about exploiting you.

        • by Darinbob (1142669)

          No, I am not stealing. The web sites are provided free and I'm just viewing some of the content they provide. Maybe I'm not viewing it the way they would like me to view it, but that is not the same as stealing and it is not immoral or unethical. This is little different from my throwing away my junk mail unopened.

          Do not blame the viewers of the web sites for this. Blame the the advertisers who came up with abusive ads and the companies that continue to buy the abusive ads. If the companies would behav

      • What most advertisers do is irrelevant. They can't force everyone else to play fair. All you need to ruin everything is one advertiser who serves up millions of horrible pop ups, autoplay video and viruses. Everyone will be forced to use adblock because of the one jerk.
        • Re:No kidding (Score:4, Informative)

          by azalin (67640) on Thursday February 14, 2013 @04:55AM (#42893501)
          There is an "allow unobtrusive adds" feature in ABP which might provide a solution to this dilemma. It provides reasons and rewards for playing nice. Should this idea take hold in a big way (yeah, the day pigs learn to fly) companies might actually choose the static, boring but seen by everyone ad over the fancy, super tracking, animated attention whore add seen only by the few slobs who don't have blocking yet.
          Of course the whole thing will be gamed and I have no idea, if it will ever take off.
          • by AmiMoJo (196126) *

            I'm surprised advertisers have not started deploying counter-measures already, but I suppose the number of users is too low. For example text ads can only be blocked easily if they come in a nice DIV you can name. Image ads are easier but again only if they have a file name or come in a named DIV that gives them away. The ad images could even be overlaid onto content images dynamically, making them virtually impossible to filter without making the site unusable.

            Sites help ad-blocking a lot with named HTML e

      • by Mandrel (765308)

        Advertisers really need to understand that if you don't want your market to go away, you have to stop being dicks about it. Keep the ads low key and not fraudulent, and people will probably be ok with it by and large.

        Making ads low-key only really works for sites where the ads are almost as compelling as the content — sites like search engines and content farms. Sites with top-quality content have a greater need for intrusive ads to pull people's attention away from that content. So I don't think the promotion of non-intrusive advertising is a solution to funding the media.

        • by Darinbob (1142669)

          Why fund the media? Find a job or source of income that isn't about pretending to be a journalist. This stuff is turning the net into a low-tech venture where it's about content instead of actually doing something new and interesting and advancing the state of the art.

          • by Mandrel (765308)

            Why fund the media? Find a job or source of income that isn't about pretending to be a journalist. This stuff is turning the net into a low-tech venture where it's about content instead of actually doing something new and interesting and advancing the state of the art.

            If you find some content useful, either because it's informative or entertaining, it's worth finding ways to encourage the producer of that content to make some more. I think the common view that there will always be an unlimited supply of free or cheaper just-as-good alternatives to any piece of quality content doesn't hold water.

            Quality doesn't have to be new and interesting. It's usually mundane. Most work is like that, but it keeps the world turning.

      • by azalin (67640)
        I think the "allow unobtrusive adds" feature in Adblock plus is a valid way to go. I don't mind the adds next to my search results and I don't mind un-animated picture adds on a site. Hell once in a while I actually clicked one, because it sounded interesting. These days though with fullscreen click through layers, flash tracking and malware serving ad servers it's simply a bad idea not to use a blocker.
        Sites require funding and advertisement provides funding. But advertisements does not "require" animati
      • by Tom (822)

        Advertisers need to STFU as they are the reason all this happened.

        +100

        Anyone who listens to the people who brought all this about is either stupid or corrupt or both. The entire discussion should happen with the advertisers excluded.

        I want DNT. I want it to be enabled by default on all browsers. And I want ignoring DNT to carry a fine large enough that intentionally doing it large-scale will bancrupt your company. And I want that kind of intentionally ignoring it carry criminal penalties for the C-level executives.

        Because that's the only way short of shooting them that th

      • by Darinbob (1142669)

        Adblock also greatly improves the performance of browsing the web, especially if you're on a slow network or dialup.

    • Then came pop-ups. Pop-unders. Flash adds. Ads with music. Ads that would make my cockatiel go into convulsion, and start to drool and chase the neighbor's cat.
      ...
      Fuck Do No Track. I will keep my Javascript and Ad blocking addons.

      FYI: You're a fool, but not for the reason you think. DNT:1 isn't going to stop any of that crap you're railing against. DNT:1 doesn't prevent you from using an ad-blocker. The Do Not Track header is a key piece of technology that legislation can be built around to limit the unwanted aggregation of data that even your precious Ad blocking addons are leaking by your mere visiting of the page. Hell run WireShark with ABP enabled and watch it leak like a damned sieve. Fucking moron. Protip: Try to actual

    • Came here to post this. You're already at +5, so I'll say that I agree instead.

      Do Not Track was the only current way in which advertisers would have me stop black-holing their networks at the border. As it is, I guess I'll just keep it as it is. More fool you, advertising networks. I'll just be sure to let the sites which ignore Do Not Track know that I'm blocking advertisements on their site.
  • by Anonymous Coward on Wednesday February 13, 2013 @09:06PM (#42890685)

    The poster asserts that DNT is a (not very good) technical solution to a technical problem, and proposes other technical solutions.

    The problem is that DNT is neither a technical solution, nor is it trying to solve a technical problem.

    DNT is the first step in a legal solution to a social problem.

    You may argue whether legal or technical solutions (or both, or neither) are more effective against this social problem. However, put DNT into the right bucket first!

    • Re: (Score:2, Redundant)

      by shentino (1139071)

      Wrong.

      Tracking is not a technical problem in the first place. It's an economic and social problem where people choose to track visitors on purpose for the sake of advertising revenue.

      It's not a technical problem because it's working exactly as intended.

  • I seem to remember the imputus for this stupid technology was that a Mozilla researcher was about to make available some technology that either blocked tracking cookies or made them relatively anonymous, but then Google and others stepped in and stopped it, and came up with this easily ignorable solution instead. Has anyone else heard of this or am I making it up? Since the story first broke I haven't been able to find any references to it.
    • by alostpacket (1972110) on Wednesday February 13, 2013 @10:13PM (#42891265) Homepage

      Interesting, but I am pretty sure DNT was Mozilla's Idea. And frankly, it always seemed like a waste of time. Given all the ways that one can be tracked though, a technical solution seems difficult as well.

      - Cookies
      - JavaScript
      - tracking pixels
      - HTML local DBs
      - Flash objects
      - fonts
      - screen size/colors
      - plugin config/versions
      - User agent
      - IP address
      - and now.... "DNT" toggle...

      It almost seems as the only way to keep from being tracked is via the TOR browser incognito mode in a freshly wiped VM or something. I honestly wonder if the 'net need to move more towards mesh/tor/ad-hoc networking. Basically if the "darknet" should be the "mainnet".

      Anyways, some info:

      EFF tool to see how well you can be tracked (fingerprinted)
      https://panopticlick.eff.org/index.php?action=log [eff.org]

      NAI (Network Advertising Initiative)
      Tracking opt out of 99 of some of the largest ad networks, including Google and MS (but guess who isn't there?)
      http://www.networkadvertising.org/choices/ [networkadvertising.org]

      Apple iAd opt out
      http://support.apple.com/kb/HT4228 [apple.com]

      • I seem to remember the impetus for this stupid technology was that a Mozilla researcher was about to make available some technology that either blocked tracking cookies or made them relatively anonymous, but then Google and others stepped in and stopped it, and came up with this easily ignorable solution instead. Has anyone else heard of this or am I making it up?

        Interesting, but I am pretty sure DNT was Mozilla's Idea.

        Hmm... From Mozilla Foundation [wikipedia.org]:

        The Mozilla Foundation was founded by the Netscape-affiliated Mozilla Organization, and is funded almost exclusively by Google Inc.

  • "Good will" (Score:3, Interesting)

    by stafil (1220982) on Wednesday February 13, 2013 @09:09PM (#42890707)

    Anything that leaves your privacy on the "good will" of the companies is inefficient to protect my privacy.

    If I do want to protect it, I'll use tools like Ghostery and DNT+ where I can choose *myself* what info I send, and not rely on them honoring the DNT.

    I know I will be flagged "flame" but honestly the DNT looks a lot like the "evil bit" to me.

    • by Legion303 (97901)

      "Anything that leaves your privacy on the 'good will' of the companies is inefficient to protect my privacy.

      If I do want to protect it, I'll use tools like Ghostery [snip]"

      So you're relying on the "good will" of a company that provides marketing data to the DMA? That seems kind of odd given your stated position on privacy.

    • by AmiMoJo (196126) *

      DNT was never designed to be a replacement for ad blocking, Ghostery and the like. It was to create a way of applying pressure to advertisers, via laws enforcing it if necessary, without creating an undue burden on the user.

      Instead of clicking "opt out of tracking" on every web site and every ad the user ticks one box in the browser. Self respecting companies with a reputation will hopefully honour it. It's like the telephone preference list / do not call list.

  • evil bit (Score:5, Funny)

    by shentino (1139071) on Wednesday February 13, 2013 @09:15PM (#42890767)

    Next up, being unarmed and begging pretty please shown not to prevent robberies.

    This is just like the evil bit. Anything requiring cooperation from assholes is doomed to failure.

  • by ark1 (873448) on Wednesday February 13, 2013 @09:21PM (#42890817)
    They use it as yet another indicator of your personality to better target ads.
  • by Sarusa (104047) on Wednesday February 13, 2013 @09:23PM (#42890829)

    Relying on the people who want to track you to honor your "Please don't" request is just guaranteeing disappointment.

    Now there are plenty of ways you can clamp down on the tracking and cross-site leakage, from NoScript to RefControl, but the single easiest cross-browser cross-platform way to do it is Ghostery: https://www.ghostery.com/ [ghostery.com]

    Most importantly, unlike the other methods (NoScript in particular) it only very rarely breaks a page. So it's just set up and forget.

    I'm sure it's not as effective as some other tactics, but the 'works on everything' and 'just works' is really key to just using it all the time everywhere.

  • by bcrowell (177657) on Wednesday February 13, 2013 @09:34PM (#42890935) Homepage

    There is a trivial, 99% effective fix for this problem. In firefox, go to Edit:Preferences:Privacy and tell it to forget all cookies when you end a browser session. There is also a facility for whitelisting cookies from certain sites so that, for example, you don't have to log in to slashdot every time. Cookies from the whitelisted sites are remembered across browser sessions.

    • by Anonymous Coward

      They can still track by IP address and you're browser fingerprint. Browser fingerprinting can be defeated though current browsers don't seem to want to help make it easier to do so.

      I'm not sure what we'll do when IPv6 rolls around and every device has a unique address. Either you go back to NAT and share addresses, which is not completely effective due to fingerprinting, or you change your address every few hours or days. Either solution defeats the purpose of IPv6.

      The only real solution is to use adblock,

      • by dririan (1131339) on Wednesday February 13, 2013 @10:09PM (#42891235)

        They can still track by IP address and you're browser fingerprint. Browser fingerprinting can be defeated though current browsers don't seem to want to help make it easier to do so.

        AC is right. Deleting cookies at the end of each session may help a bit, but there are still plenty of ways to identify you [eff.org] especially if you include your IP address (but that's not always reliable).

        I'm not sure what we'll do when IPv6 rolls around and every device has a unique address. Either you go back to NAT and share addresses, which is not completely effective due to fingerprinting, or you change your address every few hours or days. Either solution defeats the purpose of IPv6.

        There's already a solution for that. [wikipedia.org] Use the randomly-generated address for normal things, but use your static address for servers and the like. IPv6 privacy extensions are supported on Windows, Mac, and Linux.

        • by KPU (118762)

          How dare people chop of the trailing bits of an IPv6 address, thus rendering IPv6 privacy extensions ineffective.

          • by dririan (1131339)
            If you do that, then the IPv6 prefix is just as effective as a NAT'd IPv4 address tracking-wise. No more, no less. But you're right, no one dares to track you by your IPv4 address these days...
        • by AmiMoJo (196126) *

          Deleting cookies at the end of each session may help a bit, but there are still plenty of ways to identify you especially if you include your IP address (but that's not always reliable).

          What we need is an extension that doesn't delete cookies, it alters them to randomize unique ID numbers and other valuable data. As well as cookies it would randomize the browser user agent string and referrer when sending requests to known ad servers. The "proxy-for" header is also fun to play with and might help combat IP addressed based tracking.

          Don't just block tracking, screw it up and poison the databases with fake nonsense data.

    • by Tarmas (954439)
      That's no good for for those of us who put our computers to sleep instead of shutting down.
      • by bcrowell (177657)

        That's no good for for those of us who put our computers to sleep instead of shutting down.

        The cookies go away when you restart your browser, not just when you shut down your computer.

    • by Sockatume (732728)

      Blocking thirdparty cookies is also worth a crack, although as Google demonstrated, that can be worked around.

      • by allo (1728082)

        they can only work around flawed implementations of blocking third-party cookies (i.e. generating exceptions on the fly)

  • It's intrusive and/or obnoxious behavior. I don't use a form of ad blocking on all my machines, and the ones I see that I can confidently say are influenced by the other sites I've visited are generally tolerable. Compared to the canned ads for the wireless company/car manufacturer/etc that has a contract with the media company who bought out a website I frequent they look reasonable. They generally don't autoplay any audio or video, nor do they take up my whole screen if my mouse accidentally violates thei
  • It sounds like a serious comittee and companies got an inspiration from the Evil Bit proposal, even though that one was an april fools joke.

  • Both in terms of the idea and design. There is no level of Trust in the design of "Do Not Track". The server on the other end has no real obligation to honor the flag. The client has no real way to check if it is honoring the flag.

    Also something people miss: You can't legislate trust. How do you prove violations? Random audits on paper sound like the way to tackle conformance but again who is building that tool? Google, Microsoft, Amazon, etc? Again we have a lack of trust....

  • by Todd Knarr (15451) on Wednesday February 13, 2013 @11:45PM (#42892005) Homepage

    For me, I don't care whether the site honors that header or not. If they're going to abuse tracking, they're not likely to suddenly come over all ethical and change their servers to not track. What the DNT header does is give a standard, recognized signal present in every single browser request that I do not consent to tracking. It's like the fence with the locked gates and "Private Property - No Trespassing" signs around a property: it's not going to keep trespassers out, but it's a clear and more importantly legally-recognized demarcation. If they jump over the fence onto my land and get in trouble because of being there, the court's going to look at the fact the land was clearly posted and tell them "Sorry, we don't accept your claim that you didn't know it was private property.". With the DNT header, no Web site can claim they didn't know I didn't consent to tracking. They can't claim implicit consent, because there's explicit non-consent in the very request they serviced. And this is why the advertisers are making such a play to get the DNT header dismissed and abandoned. Up to now they've taken the position of "You must consent as a condition of access, you accessed so we can assume your consent.". As long as there's no standard way of saying "I do not consent.", they can get away with that. But with a standard DNT header they can't argue that it's infeasible to check every possible way of not consenting. There's just one, and it's not ambiguous. The counter-argument of "If they don't want to allow access to those who don't consent, why did they not simply return an HTTP error when they saw the DNT header?" becomes rather more convincing.

    The secret the advertisers don't want to state up front is that they don't want to require consent to tracking. They just want to track everybody whether they consent or not. Anything that provides a clear, unambiguous message to them about consent or lack thereof is a threat to that position, because it makes it harder for them to argue a basis for their assuming consent.

    And a message to every Web-site and ad-network operator out there: if you're serious, stop whining and configure your servers to return 403 Forbidden to every request with the DNT header set. It's not that hard.

    • by drinkypoo (153816)

      I'm surprised that this is a minority view. This is a legal issue. There are no technical means to utterly prevent tracking, but this provides a legal means for punishing people who do it. Anyone who says DNT is harmful is selling something, or bought something stupid from someone who is.

    • Hmm... if someone comes illegally onto my property after I clearly marked it, I may shoot him in defense. Say... does that work on that DNT too?

      Please, oh please say yes...

  • We've created a completely, utterly useless specification that every single (mainstream) browser now implements as a feature. In all, countless megabytes (gigabytes?) and countless manhours and processing-hours have been wasted, all for the sake of doing nothing.

    Of course, anyone with half a brain saw this coming.

  • My subject says it all. I don't really care about being tracked, I just really don't want to see *any* ads and will actively block obtrusive or irrelevant ads through various browser extensions and Proxomitron.
  • You mean, when all the major browsers enable DNT by default, everybody ends up just ignoring the flag, putting us back to where we started? I'm shocked.
  • by Rogerborg (306625) on Thursday February 14, 2013 @04:04AM (#42893269) Homepage
    Of my "Please Do Not Mug" t-shirt.
  • Two totally different things. No need to track me, to present ads to me.

All warranty and guarantee clauses become null and void upon payment of invoice.

Working...