Comment by nikcub | Hacker News Reader

Comment by nikcub | Hacker News Reader

DNT does not work based on trust and if somebody is going to track you they are going to track you regardless of if you send them a HTTP header asking not to, or not

(the tl;dr of the spec is that it adds this HTTP header to all requests:

    DNT: 1

it can be set to 1 or 0).

There is also a large risk here of creating a false sense of security amongst less knowledgable users. We should be teaching users cookie control, plugin and request blocking as part of using the web, not an 'install once, forget forever' solution that doesn't work.

DNT is also adding more entropy to HTTP requests, making you easier to identify or profile. You get less privacy. Think about how much an advertiser would love to know that you are privacy conscious, that puts you in a certain socio-economic group.

I am a huge privacy nut and advocate but DNT will not work. The only way to fix this is better third party blocking and controls in browsers.

I have been meaning to flesh out a blog post against DNT for a while, since I keep getting emails asking to comment on media stories about it being adopted.

"We should be teaching users cookie control, plugin and request blocking as part of using the web, not an 'install once, forget forever' solution that doesn't work."

Doomed to failure. Users shouldn't need to know this stuff, and the vast majority never will. Even if it is taught and tested at school. There are plenty of things we could do to improve privacy, but much of it will cause the major browser vendors to make less money, so is unlikely to happen.

1.) Tie all cookies to the domain in the address bar. No more third party cookie tracking.

2.) Tie all cache entries to the domain in the address bar. Gets rid of numerous tracking tricks at the cost of increasing bandwidth usage a little.

3.) Get rid of HTTP referrers. Completely. It's none of your business which site I was on before yours.

These three things alone would make a huge difference. It's the low hanging fruit that we need to get before we tackle the more difficult problems.

I think there's too much money involved though. The above improvements would definitely hit Microsofts and Googles bottom lines. But hey, there's no problem with insanely rich advertisers controlling the major browsers right. No conflict of interests there.

EDIT: I agree with all of your other points regarding DNT. Just not the user education one.

EDIT2: Another one:

4.) Make all cookies, session cookies. I configured my browser to delete all cookies on exit ages ago, and the web still works fine. I might have to type in my username each time I go to login to sites instead of having it auto-filled, but that's a good trade off. Besides, browser plugins like LastPass solve that problem better.

I wrote a Chrome extension to do what you describe, it breaks almost the entire web. I am experimenting with a generic rule set with a view of forking Chrome with a better default privacy and security policy.

I totally agree that users shouldn't need to know the details, but there are some things, like third-party cookies, that needs to be explained and simplified. A bit like not clicking on an exe email attachment.

I think the equivalent could be that users white-list websites, or 'install' them, if they trust them, which allows those sites to execute third-party cookies. Everything else would be 'incognito' by default.

But I am not entirely sure what would work, hence my experimentation at the moment. I know that the answer definitely isn't DNT.

How does it break the web and what has the most breaking impact in your experience?

I can't imagine a way that #1, #2 or #4 would be able to "break the web". Worse case scenario is they add a tiny amount of overhead. #3 might cause a tiny minority of websites to stop working, but they'd get fixed quickly if #3 was implemented.

Reply on news.ycombinator.com