Google, Facebook: "do not track" bill a threat to California economy | Hacker News Reader

Google, Facebook: "do not track" bill a threat to California economy

arstechnica.com

29 pointsevo_939 comments

I'm of two minds about this. I want my browsing habits to be a closed book to everyone, period, and I doubt I have the necessary technical savvy to achieve that goal. I'd therefore love to dump the responsibility on the government, and damn the consequences to the California economy.

I am afraid, though, that letting the government get a regulatory foot in the internet's door will send me out of the frying pan and into the fire, privacy-wise.

Never forget the US government's horrid track record at civil liberties, and always remember the corporations have better lobbyists than you.

I've always found it sadly ironic that the people who elected our representatives have less say in how our representatives act than corporations with lobbyists.

Then support public funds plus a ban on all private funds for elections. For example, look at the recent senate campaign in CA, Boxer vs Fiorina. Boxer spent $28MM and Fiorina $22MM [1]. The math is you must raise $2.8e7 / (52 * 6) = $89,743 PER WEEK for your entire term to finance your next campaign. There's simply no way that comes without strings.

[1] http://flapsblog.com/2010/12/03/ca-sen-barbara-boxer-outspen...

You'll probably also need to support a new constitutional amendment:

Amendment 28 - Congress may now pass a law abridging the freedom of speech, the freedom of the press, and the right of the people to peaceably assemble and petition the government for redress of grievances. But they should only do this to prevent rich people that I don't agree with from expressing their opinions on elections.

How about this:

Amendment 28: Money != speech. Corporations are not individuals and do not have the same rights as citizens.

Gee, that was pretty easy.

Amendment 29: lawn signs != speech. Lawn signs are not individuals, and therefore do not have the same rights as citizens.

Corporations, much like lawn signs, computers, etc, are property. They have no rights. Their owners do.

To quote Kennedy: When government seeks to use its full power, including the criminal law, to command where a person may get his or her information or what distrusted source he or she may not hear, it uses censorship to control thought...

Which people are you trying to prevent from hearing George Soros's or David Koch's message?

Why is that (that you want your browsing habits closed)? Would you expect your flying habits to be closed as well? Every business keeps a record of their customer, why do we attribute special derision to the same thing happening online? The perceived anonymity?

The short answer: I don't fly anywhere to look at porn.

The long answer:

There are laws that tell the airlines and the railroads to whom they are not allowed to sell information on my travel habits. Restrictive ones. There are certainly laws against wireless companies selling information on my whereabouts.

Because NOYDB (or anyone else's, for that matter), that's why. Because my data and my devices should be used for my interests, and only with my consent if for someone else's.

Second, the letter points out that the four leading Web browsers—Internet Explorer, Firefox, Safari, and Google Chrome—already offer various means of preventing advertising companies from tracking users.

Perhaps I'm wrong, and please correct me if I am, but I don't think this is true -- is it? I thought that features like Private Browsing (Safari) and Incognito (Chrome) only prevented the browser from recording page and search history (or using form autofills) on your local machine. This is the first I've heard that it affects user tracking by advertisers in any way, shape or form.

EDIT: And the more I think of it, the stupider this "solution" becomes -- basically, they're asking users to forego recording their own browsing history to avoid being tracked! Well, where do I sign up?

They also don't store regular cookies. But that doesn't prevent other techniques such as evercookie to track the user.

I think the article was referring to "do-not-track" features such as "Keep My Opt-Outs", https://chrome.google.com/webstore/detail/hhnjdplhmcnkiecamp...

I found the most interesting part of this article the following quote: "... and would make them more vulnerable to security threats." Allowing users to opt out of tracking increases their security threat? I'd like to see more detail on this.

Sites such as a banking site, track user location to help determine whether it's actually you logging in, or some account phisher overseas.

Allowing users to opt-out of such tracking would make those sites less secure.

or it might make it more secure by opt-in to being tracked where you are accessing it from.

Exactly. I find glorifying user-tracking like that really disgusting.

Can you try rewording this? As I'm having zero luck trying to figure out what you meant to say. :(

"... and would make them more vulnerable to security threats."

This claim has nothing behind it. Is it just FUD? If not, what's the argument?

Fraud identification becomes much harder. Gmail, for example, logs which IPs you log in from and warns (locks out?) if the timing of log in locations is suspicious.

They are absolutely right. And last time I checked the internet was global and not micromanaged on state level.

That era is slipping away. More and more the internet is becoming like everything else; controlled by people who's job security depends on having something to crow about.

There are already several means of stopping tracking: clearing your cookies and cache, using private mode, not visiting the sites that record this information.

clearing your cookies and cache, using private mode, not visiting the sites that record this information

I don't necessarily support this bill, but those methods are not nearly sufficient.

Please explain.

IP matching, supercookies, browser fingerprints (http://panopticlick.eff.org/)...

Supercookies, at least inside flash, are unlikely to be used following the lawsuit against quantcast and clearspring [1].

Full disclosure: I work for quantcast. This is nothing more than my personal opinion, and should not be taken as company policy. For company policy, feel free to review the settlement [2].

[1] http://www.wired.com/threatlevel/2010/07/zombie-cookies-laws...

[2] http://www.quantcast.com/inside-quantcast/2010/12/reaffirmin...

Companies who control enough net infrastructure or have visibility into enough sites can do a reasonably good job of tracking you without using cookies.

One way is to fingerprint a browser. EFF has a nice demo of this using HTTP headers. If you're operating at the packet level, you don't even need that.

So in that sense it's not a matter of avoiding certain sites or managing cookies properly, because the tracking is pervasive.

Current ftc discussions seem like they center around cookies, and personally identifiable information (PII), and do nothing to address other forms of tracking. That will favor large corporations and eviscerate startups in the adtech space.

The key thing that legitimate players in advertising want to do is understand which ads work well and which don't. Targeting users based on which sites they visit and based on offline demographic and shopping is very trendy right now, but it's not as necessary for keeping ads ROI-positive for advertisers in my opinion.

None of it really involves identifying individuals or PII, at least in the sense that people would be creeped out by. Hopefully there'll be a reasonable outcome to this which will allow this kind of legitimate use, since it finances so much of the net now.

^^^ This. The big Internet companies should take this as a clue and start campaigns to inform users on Internet privacy and actively push for more user friendly privacy management.

"not visiting the sites that record this information"

is, in fact, perfectly sufficient

I have to run, so: @falconas: of course this is a sacrifice. But if sufficient people feel similarly, over time, one would expect companies to act accordingly.

@nobody_nowhere: damn, I totally forgot about cdns. But I can't imagine cdn contracts allow the cdn to use visit information from clients... or do they?

Let's pretend, for a minute, that you did not want Google to have your surfing habits. How many sites would you have to avoid in order to prevent them from getting any whiff of your information?

I believe that "any site which uses adwords, google analytics or links youtube videos, or ..." is a good definition of insufficient.

Even if you're browsing in private mode on Comodo Dragon?

http://www.comodo.com/home/browsers-toolbars/browser.php

Just 127.0.0.1 google-analytics.com (and others) in your /etc/hosts

Google offer opt-outs for their stuff.

Bu that's not the point, the point is that if people are really that concerned about internet privacy they could install privacy software the same as with parental control software so their is no need to pile more restrictive innovation stifling laws.

Privacy software doesn't help when your information is directly sold to the highest bidder (which can be the government, see the latest TomTom kerfuffle).

There are technical steps we can take to minimize our publicly available footprint on the internet, but there's no way to completely control it, short of oversight on the corporations that mine our data.

Perhaps this is lack of imagination on my part, but how does offering people the ability to opt out of invasive data collection stifle innovation? Sure, it's another hurdle for any company to overcome (one amongst thousands, if you run a for-profit site), but it doesn't stop new software from coming about.

it's hard to hide from akamai :)

...it's even harder to hide from global crossing, juniper networks, and the like. or verizon.

Why pile new laws? if people are really that concerned about internet privacy they could install privacy software, the same as with parental control software.

There is no market failure to justify new regulations and advertising is what pays for the internet, new laws will just increase the barrier to entry and stifle innovation as everyone will need their lawyers present before launching anything.

Also this do-not-track concept doesn't make much sense, with phone marketing people didn't get anything in return here they get free content.

Unless the bill prohibits loyalty cards at VONS, too, this is just old business astro-turfing against internet businesses.

Loyalty cards at VONS are opt-in. Which means you, the consumer, have to sign up for the card, and then choose to use it when you make a purchase. This law is targeted against the equivalent of walking into a store, someone putting a tag on you, and tracking what you do now, and forever after you leave the store, _without your knowledge_.

Reply on news.ycombinator.com