Pornography sites found to be riddled with trackers from major tech companies
nytimes.com
nytimes.com
Can you expand on why there's 'no good reason for it'?
The equivalent is my peering in your window to see and note down what you rub one out to... every time. And you don't know what I do with that information or where it will leak to.
That sounds perfectly fine to you, does it?
It's more like when I have a massive orgy with lots of drugs at my place and I invited a bouncer, who is really good at statistics, to keep track of who is coming in and who are leaving immediately. The bouncer is also keeping track of what each person is doing, and letting me know periodically. And you both are invited for a night of drug fueled insane sex.
From my perspective, I am doing this to make sure everyone is having fun at my party. From the bouncer's perspective, he is there just to collect stats and let me know. He is not there to invade my privacy. I want to do that. I hired the bouncer.
I think that is more is an accurate description.
Your users didn't hire the bouncer and don't want to be tracked. Secretly, the bouncer may use this data for nefarious purposes. You can't control how the bouncer will use the data.
The outrage is from the user's perspective. It's no different from being peeped on.
> It makes any "video tape service provider" that discloses rental [or sale] information outside the ordinary course of business liable for up to $2500 in actual damages.
Both the individuals visiting these sites, and possibly even the people making the decision to implement tracking don't know their browsing data is being used for anything other than analytics by the website provider, (if at all by the user, who likely feels safe behind a private browser).
That being said, this isn't really news (to us, at least), but it's good that newspapers keep banging this drum, as I doubt most other people have thought about all the tracking that happens everytime they visit a new site.
First, there is also a wider pattern in the US when it comes to privacy/computer legislation. We tend to have sectoral-focused laws which are often a response to media events, real and fictional. For example, Computer Fraud and Abuse Act was a response to the movie War Games. Video Privacy Protection Act was in response to a supreme court nominee's video rental history being leaked to the press. Children's Online Privacy Protection Act was partially spurned by concerted reporting (sometimes sensational) on risks to children online. So the pattern you are seeing is part of a larger system which often does produce real change, it is just a slow process. The press is called the "fourth estate" because they play an important part in the democratic process, which is what you are observing here.
Second, it is the very ubiquity of the systems these companies deploy which makes it possible to choose a given context (health, sex, etc) and find a privacy-violating technology. I'd love it if when I did these scans I turned up nothing, but the same set of bad actors are always to be found. Likewise, the definition of "well-known" on hacker news is far, far, far different from what a normal Internet user has any clue of. We have 20+ years of research showing people fundamentally don't understand this stuff, and just because you don't have a CS degree doesn't mean you don't have privacy rights.
Last, there is very good reason for outrage for many people. There are many places in the world you can be killed for being LGBTQ. Likewise, there are many state intelligence agencies that piggy-back on online tracking (see NSA/Doubleclick cookie), and some governments actively go after LGBTQ people. Even without state intel there is a long history of sexual data being leaked online. People killed themselves as a direct result of the Ashely Madison leak, and if any of these tracking companies porn sites - many of which do not have the security team of a FAANG - get hacked, people who are already marginalized by their societies may be at extreme risk.
Just to be clear, for porn sites that means who likes what sorts of porn.
Pretty much everyone knows that sites can track your usage. It’s surprising that Googbook is also being given all the data on the porn you watch.
I kinda prefer it when they make a lot of noise.
1. Use firefox with multi-account containers, with each domain set to auto-open in a different container (google, gmail, amazon, facebook, youtube, etc.). Make sure you're logged into google only in the gmail container (and not in the google search container), etc.
2. Use uMatrix and uBlock0, and enable limited third-party access using uMatrix dashboard only when a site breaks.
3. Enable DNS over https in firefox
4. Enable privacy.resistFingerprinting in firefox's about:config to thwart fingerprinting
5. Use the tor browser for browsing porn (or any site you really do not want associated with your IP).
Edit: Added resistFingerprinting to the list.
* = According to PanOptiClick.
As long as it's legal (so barring being in a regressive country where eg. gay porn is illegal), why would you go out of your way to use a VPN for it?
For sure, use DOH and HTTPS sites only, and I can understand if you're a public figure and don't want to accidentally like incest porn on your official Twitter account but beyond that, really who cares. A large majority of people watch and browse for porn, myself and most people in this thread included. Maybe time to dispense with the shame.
So, in practice, this means that these big companies have ammunition which could be used to destroy careers and relationships. Whether used directly or incidentally via a data leak (it's not like those ever happen /s).
It's a PIA for logging into things (e.g.: companies who use three different redirects to three different sub-domains) but that complaint is my fault, based on how I've configured it.
That plus deleting history on close of Firefox isn't enough to thwart the most egregious adversary (e.g.: those with three-lettered names) but should be enough for privacy concerns.
For 2, I might also recommend Canvas Fingerprint Detector[1]. Instead of not replying (which could be, in and of itself, a fingerprint[2]), it generates a random fingerprint signature in response; though, in principle, this might be a tracking vector, as well.
[0] - https://addons.mozilla.org/sv-SE/firefox/addon/temporary-con...
[1] - https://addons.mozilla.org/sv-SE/firefox/addon/canvas-finger...
[2] - https://multilogin.com/how-canvas-fingerprint-blockers-make-...
...which is why it's probably better to use multi-account containers that isolate and store your cookies in that container, for sites such as gmail that you use a lot. It's very simple to set it up to always auto-open in that container, no matter which container you type the address into.
Tor has a place, but in most countries regular internet porn isn't seriously illegal. Save the limited Tor bandwidth for people that actually need protection, like gays in the middle east, victims of repressive regimes, etc.
Get a regular VPN, user-agent switcher, etc. for your pronz.
So please do stream porn over Tor. Bandwidth capacity on the Tor network is just fine these days, and your use of Tor helps all those who really need the privacy and anonymity Tor can help to provide.
try solving them in chrome, and in firefox on different network and device afterwards.
In firefox i am constantly getting annoying slow ones that fetch new images after marking one.
In chrome i get piss easy fast static ones.
And in case the FBI or whatever is running your Tor entry guard, hit it via nested VPN chains.
If those onion sites and users had been hitting Tor through nested VPN chains, probably 90% at least would have been safe.
Tor Project folk like to hate on VPNs, but I'm not aware of any takedowns at that scale which involved VPN compromise.
But it cuts both ways, of course. So established social norms about privacy are also widely ignored. The fundamental business model is based on violating users' privacy. Two of the largest online businesses, Google and Facebook, rely on monetizing the violation of users' privacy.
So yeah, perhaps it's understandable, but it's gobsmacking naive to think that online porn would be an exception.
Nearly 20 years ago I worked as a Dell phone support technician for a few months and it was the best learning experience I've ever had in terms of understanding what the "average" person can actually comprehend. I think many technical people have experience with non-technical people who are otherwise fairly educated and clever (eg parents/grandparents), but there are a lot of people who have difficulty with the concepts, let alone the details. I think those people still deserve privacy.
I just think it unrealistic to expect that they'll get it.
And it's also arguably unrealistic to expect that they'll learn how to take it. So for sure, jawboning is also a viable option.
https://arxiv.org/abs/1907.06520
The "even in incognito mode" part seems odd:
> What Jack does not know is that incognito mode only ensures his browsing history is not stored on his computer. The sites he visits, aswell as any third-party trackers, may observe and record his online actions
The scope of incognito mode has recently expanded, but browsers still trust servers far too much (e.g. the Referrer header still exists, which is designed to leak private information).
> Your activity might still be visible to:
> - Websites you visit
> - Your employer or school
> - Your internet service provider
Edit: To clarify: The easiest would be an IP address check. More sophisticated techniques are browser fingerprinting. And I think there's no reason to assume that Google/Facebook/AdTech companies DON'T use these techniques.
Regarding IPs: it would be legally problematic and might be exposed leading to terrible press, large fines and a strong argument for more regulation, so there's a lot of incentive not to use it, and I'm not sure they would even need it given the vast amount of information they have on users.
Regarding fingerprinting: I believe somebody would have noticed. Google and FB are generally scrutinized much more than a random small ad-tech vendor.
It's incredible that on a site like HN people truly seem to believe that "incognito mode" equals some sort of anonymity and that there is such as thing like goodwill of Ad companies and that they won't take whatever data that is served on a silver plate (like the IP address).
And you know what's really troublesome? One's sexual preferences are unlikely to change by a lot. Once captured by tracking companies, it's in your profile. Doesn't matter if you prevent tracking later on.
Sure, and if you agree to it, they can. If you don't, however, and somebody blows the whistle, they'll be looking at huge fines in Europe and most of their lobbying will be void because their bought politicians will look very corrupt if they try to stop regulations.
Again, I don't believe that they don't do it because "it's not ethical". Rather, it's going to cost them lots of money if they do and get caught (and lots of good will, too), and I doubt that they need it. IPs would be another data point, but they have so many already that it may not add as much value. That's for FB, Google & co, of course, for small ad-tech companies it's different.
> Once captured by tracking companies, it's in your profile. Doesn't matter if you prevent tracking later on.
That's true, and the reason why you'd want to disable tracking completely. As a user, you gain nothing from companies being able to track you, but you lose plenty. Again, I'm not suggesting that companies aren't tracking users, I'm saying that Google and FB are likely not operating that obviously that far outside the law. They can, sure, but they'll need to run a large conspiracy to keep it secret, and large conspiracies are hard and rare.
Facebook collects data in shadow profiles.
Facebook collects login credentials for email accounts.
Facebook asks for phone numbers for "two-factor authentication" and then uses it in different ways.
Similar for Google. Most default options are enabled if you set up an Android phone (and these options and settings track you). Opt-in? Off by default? Nothing. Just to name one example.
Dark patterns to give consent everywhere, like buttons suggesting that opt-in is the only way to do it and so on.
All of this is kinda known, and illegal under GDPR. Consequences so far? None.
I'd vastly prefer that creative energy be directed to socially beneficial ends, but I have respect for the technical chops of people in adtech. However, it is fundamentally depressing that so many smart people spend their lives shattering the bounds of decency to get an ad impression for some useless item that will go into a landfill in 18 months. Aside from privacy the biggest tragedy here is the waste of brainpower spent promoting mindless consumerism in a world rapidly moving towards climate catastrophe.
It may be useful to tighten up anti-tracking-tech in incognito windows. Currently, since plugins aren't enabled in incognito windows by default, it has the opposite effect: while your cookies are hidden, you're loading each and every tracker when in incognito mode.
G and F could use other data, like the browser fingerprint, OS information and the IP address to associate the data, which may be illegal, at least in Europe. Thus they probably use some other technique, for example creating pseudonymous shadow profiles and associating them based on similarity. In their front-end the data would just show clusters of profiles, which means they can claim they do not collect personal data, but from a quick glance it would be obvious to see connections between a user and "anonymous" clusters, if the similarity borders on 100%.
Thus a good practice would be to use a different Operating system and browser, together with the usual protective measures.
https://www.wired.com/2015/04/john-oliver-edward-snowden-dic...
Ironic.
By this standard nobody would be allowed to talk about climate change, seeing as probably nobody has a 0% impact on climate change.
if their claims are valid or not is absolutely unrelated to the irony of that situation though.
Did anyone imply that if the content is 'ironical' we shouldn't write it or discuss it?
Lets say that I own a burger restaurant and I tell you that burgers at McDonalds are crap. Would that be ironic? Because that is what you are saying.
> Did anyone imply that if the content is 'ironical' we shouldn't write it or discuss it?
I interpret the original comment:
> Ironic.
as a means to discrediting the journalist. You are right though and instead of "Are they suddenly not allowed to write about privacy issues?" I should have written something along the lines of "Is it suddenly not credible for them to write about privacy issues?"
If you don't want to be tracked, pay for your porn. Or pirate it.
That thing is spreading like weed.
The one thing that isn't standard for porn sites is ad serving/tracking. They usually don't use ads served from Google and Facebook, probably because most people don't want their "regular" ads being served on a porn site. So most major porn sites have their own ad system.
Its disturbing to know that Google and Facebook have access to all this - they indeed know more about you, then you yourself.
And I also use PiHole at home.
Or even installed some apps like true-caller?
Browser finger-printing, 3rd-party tracking or the website itself. Better off with p0rn-torrents' magnet-URLs?
Of course google connecting porn searches with your other behavior is another level of scary.
0: https://www.pornhub.com/insights/ (sfw)
"Thanks to a Facebook event called “Storm Area 51” ...
Since July 12th, searches for “Area 51” have surged from zero to 160,000 in just 4 days. July 16th alone had nearly 59,000 searches.
...
The most popular alien related search is “alien impregnation” followed by “alien sex”. Other interesting searches include “alien belly” (a reference to the scene from the original 1979 Alien movie?), “alien eggs”, “alien abduction” and “alien probe”. "
So I always suspected, that the internet is a weird place, but good to have data to back that up.
But seriously, out of porn consumption statistics, you can get a deep analytical experience of the population. So yes, it is scary, if some companies have all that knowledge.
Indeed. It gives you insights that are otherwise hard to get.
Like predicting the viewership of events based on traffic changes like these:
https://cs.phncdn.com/insights-static/wp-content/uploads/201...
Or how many people care about a solar eclipse:
https://cs.phncdn.com/insights-static/wp-content/uploads/201...
Or these graphs:
https://cs.phncdn.com/insights-static/wp-content/uploads/201...
https://cs.phncdn.com/insights-static/wp-content/uploads/201...
https://cs.phncdn.com/insights-static/wp-content/uploads/201...
And all of those graphs are just scratching the surface. For example they seem to have good data on age, gender and sexual orientation (likely from signed up users and statistical inference), which allows them to say what percentage of lesbians aged 30-40 living in Minnesota watch solar eclipses or watch the royal wedding.
Or rather MindGeek, who owns pornhub.com, redtube.com, youporn.com, tube8.com, brazzers.com, xtube.com, spankwire.com, extremetube.com, keezmovies.com, pornmd.com, thumbzilla.com, realitykings.com, mydirtyhobby.com, seancody.com, men.com, digitalplayground.com, mofos.com, babes.com, gaytube.com, twistys.com, peeperz.com, sextube.com, porniq.com, and webcams.com.
They also run their own ad network called TrafficJunky.
NYT has become such a tabloid.
Study is here: https://arxiv.org/pdf/1907.06520.pdf
Now we can have a REAL Discussion.