Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If I'm understanding this correctly, it's only first party tracking in that it comes from a subdomain of the domain of the website you are browsing. But that subdomain points at a third party tracking provider. So this still seems like a single tracking provider on multiple website being able to correlate your browsing.


You still get full cookie separation because each website has a different subdomain and thus a different cookie. The analytics provider can track you across the internet, but they have to invest work and resources instead of getting it basically free.


Well, I'm hardly about to accept that it's legitimate to spy on me "because they invested work and resources instead of getting it basically for free".

It's like, a peeping Tom who just looks through a window - yuck that's gross. But a peeping Tom who spies by building a microdrone that can fly in the door when it opens and mount itself on the ceiling with suction pads - oh that's perfectly legitimate because of the work and resources Tom invested.

I mean, if it's gross to do something by accident and it's gross to do something without any investment, it's super gross to do it with resources.

It's not all that hard to track someone across the internet. I think many people have demonstrate hacks that steal legitimate functionality and get you there.

I think we'll probably have to go for a containerised internet (separate apps) and just deal with the disadvantages.


I agree that this is not an insignificant aspect. But I still don't think it is therefore something that should be tolerated.


But how would the provider track you across the internet with cookie separation (other than through fingerprinting)?


The provider a) is the other parts of the internet (think big cdn) and b) they communicate with other data brokers via a side channel instead of via cookie syncing.

This is already happening with large web publishers.


But even if they do that, how can they tell it is the same user on two different domains?


I wouldn't know, but fingerprinting is a thing and is bad enough.


Do you have a great way to block every fingerprinting method?


Firefox seems to be on the case. There is really no good reason to give any means for a website to fingerprint a browser.


uBlock origin (more specifically, EasyPrivacy list) blocks 1st party tracking as well.

For example, you could spin up an instance of Matomo (formerly Piwik) for your own website and still see no traffic from adblock users by default.


This is also why if you're using Matamo you should have it parse your access logs instead.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: