Hacker News Reader

Comment by stingraycharles | Hacker News Reader

Reliably identifying a (unique) visitor is pretty difficult using ip logs, though.

Cookies generally make this much easier, at the very least identifying a visit.

With ip logs, you’re not just dealing with the fact that IP addresses are often shared between people (eg behind a NAT), you now also need to record IP addresses, which arguably is an even bigger privacy violation than just using cookies.

I’m not saying that one method is always better than the other, but it’s definitely not as black-and-white as you make it out to be.

View on HN

Why do you think you need to uniquely identify all your visitors?

Is that truly worth ruining your website and annoy your users to start?

There are very few things in life that are truly as black and white as this.

> Why do you think you need to uniquely identify all your visitors?

Why would I not? A brick-and-mortar store can tell when the same person walks in twice; it's easy to imagine webmasters wanting that too (to stay noting of having a chance of distinguishing real people from bots and scrapers).

Most brick and mortar stores can not reliably tell whether any single person has visited the store before unless they track them in some way. Probably only case is the store owner who is also the only worker with excellent memory for faces and details.

A single user may use different cookies depending on the device they use so either way it's unreliable.

Or like all of us who delete all cookies automatically when closing the browser.

It does not need to be perfectly reliable, just reliable enough

So, in other words, no need for cookies...

How fine grained detail do you actually need? I can't see how knowing if one person or two people in a house visited you're site helps. They could have easily just switched to their phone.

For logging, just hash it with a salt.

> just hash it with a salt

This would not satisfy privacy maximalists because you can easily unmask users later.

Hashing is borderline PII since you can feasibly reverse it to a unique IP, unless you use a slow hashing function like bcrypt.

> Reliably identifying a (unique) visitor is pretty difficult using ip logs, though.

> Cookies generally make this much easier, at the very least identifying a visit.

You don't actually need cookies to reliably identify unique users. Browser fingerprinting is very identifiable and difficult to obscure.

https://coveryourtracks.eff.org/

if it was that effective, why wouldn't just google switch to it and stop wasting money on ideas like FLoC, and ditch 3rd party cookies?

> if it was that effective, why wouldn't just google switch to it and stop wasting money on ideas like FLoC, and ditch 3rd party cookies?

First, I would be shocked if Google isn't using fingerprinting data in conjunction with cookies.

But also, this comment misunderstands what FLoC was. FLoC was, at least in theory, an attempt to get the benefits of targeted advertising without uniquely identifying users. That's what the "C" in FLoC refers to - users aren't targeted individually, but rather by the cohort they belong to.

FLoC unfortunately had many issues, one of which is that there were concerns that the cohorts were too granular and could still effectively denanonymize users. There's some research indicating that this was the case - FLoC cohorts revealed more info than they intended to, but also still less than individualized profiles do.

The stated goal of FLoC was actually more privacy-focused than the status quo (individualized profiles). Unfortunately, that's not what ended up happening - or at least, the general public didn't trust that it was.

fingerprinting probably brings in more identifyable bits, but without the cookies it would not be commercially reliable data to determine uniqueness.

i am aware what FLoC was and tried to be. it was a horrible idea with it's default optin putting onus on website operators to add headers to opt-out from a mass survelience exercise generating money for the surveillance capitalists.

> i am aware what FLoC was and tried to be.

Well, you asked (perhaps rhetorically) why Google didn't switch to using fingerprinting instead of FLoC. And the answer is that FLoC and fingerprinting suit different use cases. Fingerprinting doesn't serve the goals of FLoC, and FLoC doesn't provide the same data that fingerprinting would.

Yea on top of that you can fingerprint the TCP/IP/TLS settings of the user’s connection as an additional point of data: https://nmap.org/book/osdetect-fingerprint-format.html. My gut feel is that browser+tcp+ip+tls fingerprinting can get you pretty damn close to uniquely identifying users without needing cookies.

This whole argument is irrelevant since the GDPR is not about cookies

Publucations, radio, and TV were profitable without identifying unique users. Why does a website require this?

Nielsen ratings would disagree with this.

I think that's a disingenuous reading.

Nielsen ratings are for small subsets of users who explicitly opt in to tracking. That's not the same as "uniquely identify all end users of my website" it's like paying user testers.

Nielsen tried it’s best to get a demographically representative sample of households. It wasn’t purely a self selected sample. I doubt people were incentivized by the $5 they put in envelopes.

I didn't say self selected, I said opt in.

In addition to the sibling poster’s comment, publications had data on what parts of town and stores sold their publications at newsstands and the names and addresses of subscribers.

Before you could get free publications like MacWeek, you had to fill out demographic data to qualify.

Reply on news.ycombinator.com