Hacker News Reader

Comment by matheusmoreira | Hacker News Reader

> 10000 popups asking if it has permission to render an image

We need an automated approach. We need the ability to not only disable browser APIs but also make them return fake data to fool the website. We need the ability to inspect the data websites are sending back and redact data we don't want them to have just like corporations perform deep packet inspection to prevent data exfiltration.

> If we were talking about the issue of people being stabbed

In this case we handed them the knife. We thought they'd use it to cut something for us and they stabbed us instead. They even made the ability to stab us part of their terms of service. This cannot go on.

View on HN

>We need the ability to not only disable browser APIs but also make them return fake data to fool the website.

Browsers have been trying this for a long time but its not simple. Chrome has had multiple attempts at making it impossible to detect incognito mode but people keep finding ways. The old way was checking if the API to store data was available so chrome made it so that there is an emulated data store for incognito mode and then websites just check how fast the local data store is to check if it is on disk or in memory.

It would be an extraordinary effort to remove all of these issues since many of them are outside of the browser like what exact gpu and driver is in use could slightly change how the page is rendered or how long certain things take.

> Browsers have been trying this for a long time but its not simple.

I didn't say it was gonna be easy. I said it was necessary. This is a perpetual arms race. If content blockers can maintain their huge blocklists, browsers should also be able to maintain their own counter-measures to abusive websites. Browser vendors created and standardized the APIs that websites are now exploiting. I expect them to clean it up.

> then websites just check how fast the local data store is to check if it is on disk or in memory.

Making both calls equally slow should prevent this particular side channel attack.

What is very simple is just creating a law stating that you may only use exactly the data needed for the purpose of providing the service and any extra data must be requested from the user with the easy ability to decline. Now rather than years of cat and mouse where advertisers always have the upper hand, the advertisers suffer massive fines for misuse.

They'll just say the tracking is part of the business model and therefore needed to provide the service. The law's purpose is to allow users to negotiate the terms so it is worthless if it doesn't force websites to provide a "give me access to the service without any tracking" option. Imposing laws on the internet contributes to the regionalization of the network: what was once a completely free international network will be divided into many regulated national networks. Not all countries will have these laws so evading sanctions will be as simple as hosting something in a country like Russia.

>They'll just say the tracking is part of the business model and therefore needed to provide the service.

This is unacceptable under the GDPR. You must allow users to opt out. If this affects your business model than the legal option is to remove the free plan and charge a fee for the service.

> What is very simple is just creating a law

This must be some new use of the word "simple" I was previously unaware of.

Reply on news.ycombinator.com