Cookies etc.,

Wed Sep 01, 2010 4:50 pm   

On Wed, 01 Sep 2010 07:45:13 -0700, Joerg wrote:


The web site operator has that information regardless of whether they use
Google Analytics and regardless of any privacy extensions in your browser.
You can't view a web page without telling the server which page you want
and where to send it (your IP address).


Having a dynamic IP address makes it harder to track you, although not
necessarily impossible:

https://panopticlick.eff.org/

Wed Sep 01, 2010 4:59 pm   

On Wed, 01 Sep 2010 16:30:03 +0100, Nobody <nobody_at_nowhere.com> wrote:

[snip]

Same here. I only "allow" my bank and credit card accounts.
Everything else is by temporary privilege if I need it.

...Jim Thompson
--
| James E.Thompson, CTO | mens |
| Analog Innovations, Inc. | et |
| Analog/Mixed-Signal ASIC's and Discrete Systems | manus |
| Phoenix, Arizona 85048 Skype: Contacts Only | |
| Voice:(480)460-2350 Fax: Available upon request | Brass Rat |
| E-mail Icon at http://www.analog-innovations.com | 1962 |

Democrats are best served up prepared as a hash
Otherwise the dogs won't eat them

Wed Sep 01, 2010 5:02 pm   

On Wed, 01 Sep 2010 12:17:01 +0100, Rui Maciel wrote:


In practical terms, the only difference compared to cookies is the
increased size.

DOM storage can only be accessed via JavaScript, which could provide the
same functionality via a combination of cookies and storage on the web
server.

I'd be more concerned about "Flash cookies", as these can't be disabled
through the Firefox options dialog; you have to use a Flash applet on
Adobe's site to control local storage.

Wed Sep 01, 2010 8:45 pm   

Nobody wrote:

True, but at some point it's like having a lock, a deadbolt, a
Rottweiler and a Shepherd. The effort just becomes too much and the
intruding party choses to move on to easier targets ;-)

--
Regards, Joerg

http://www.analogconsultants.com/

"gmail" domain blocked because of excessive spam.
Use another domain or send PM.

Wed Sep 01, 2010 9:10 pm   

On Tue, 31 Aug 2010 17:15:15 -0700, JosephKK wrote:

Ah, heck! I was hoping it was like gingerbread men with swords or
something. ;-)

But just browser cookies? That's such a strawman. A cookie is a little
text snippet that the site offers to your browser, which stores it if
you accept it, and (at least when I learned about them) they can only
be retrieved by the site that set them. A COOKIE CAN'T BE EXECUTED!

To protect yourself from malware, just don't do your day-to-day work
as "administrator" - make a restricted user account, and DON'T CLICK
ON UNKNOWN LINKS!

It's not that hard; you just have to pay a little attention.

Cheers!
Rich

Thu Sep 02, 2010 12:23 am   

Nobody wrote:


Claiming that the Web Storage database "can only be accessed via JavaScript" can be misinterpreted
as this technology being completely harmless and only used under very specific circumstances. As
every browser offers a JavaScript implementation and some sites even force the user to enable
JavaScript to be able to access their site, claiming that the Web Storage database "can only be
accessed via JavaScript" is essentially the same as claiming that it can only be accessed through
every browser in the world.

From that, once we realize that there are companies that collect information on essentially all
WWW users by injecting their own JavaScript code on all the sites they can manage to access (and
as a consequence are able to collect piles on information such as browsing history and personal
profiles), providing a juicy RDBMS for them to store and retrieve information from our very own
hard drives is something which should trouble some people.



Yes, that's true. Nonetheless, Flash is essentially a gimmick which is essentially losing (if it
hasn't already lost) it's relevance in the web while cookies and this Web Storage thingie is based
on basic WWW standards, it's present in all major browsers and is already indissociable from the
web. To put it in other words, while Flash may be on it's way out, cookies and Web Storage are
deeply entrenched in the web and there is essentially no way around them.


Rui Maciel

Thu Sep 02, 2010 12:33 am   

Nobody wrote:


It's true that the web site operator can register IPs and monitor the cookies his site sets. Yet,
what Google Analytics and the sort does is far more insidious and overreaching than that. Google is
able to inject Google Analytics scripts on a vast number of sites, which enable it to not only
register IPs and monitor cookies but also to cross-reference that data with all the data collected
by all the Google Analytics scripts running on a vast number of sites. By doing that, Google is
able to create, build up and maintain a profile on every user which, among other things, includes
your browsing history and your web habits.

So, in essence, being able to say that "user X logged into my site at Y day" is a whole lot
different than "user X has these browsing habits and these personal interests".


Rui Maciel

Thu Sep 02, 2010 12:47 am   

m II wrote:


Essentially there isn't. You may try to mitigate this problem my refusing to run scripts that you
haven't explicitly authorized. One way to try to do that is to use NoScript and adblock extensions
and configure your browser to delete all data (cache, cookies, web storage, etc..) when closed.
Yet, even that doesn't guarantee a 100% success rate.


Rui Maciel

Thu Sep 02, 2010 1:45 am   

Rich Grise wrote:




This is leading up to it, though...scary.

http://tinyurl.com/2fy6rcn







mike

Thu Sep 02, 2010 6:30 am   

On Aug 31, 7:26 pm, m II <c...@in.the.hat> wrote:

Google is trivial compared to Obamacare. Obamacare truly tracks every
aspect of your life, and puts it in an internet-accessible database.

The 4th Amendment says you have the right to be secure in your person,
house, papers, and effects. Nope, that's changed.

--
Cheers,
James Arthur

Thu Sep 02, 2010 6:31 am   

On Aug 31, 7:37 pm, Joerg <inva...@invalid.invalid> wrote:

They still track you by IP address (if you have a static IP, that is).

Thu Sep 02, 2010 10:45 am   

Michael A. Terrell scribbled elsewhere and elsewhen:

Send me a bill or request for funds not in excess of $200 this month
as well as an estimate as to how much more may be required.
Since i am Socially InSecure, i can do only so much a month - which
varies according to expenses for weird things like food.

Thu Sep 02, 2010 6:34 pm   

On Thu, 02 Sep 2010 00:23:00 +0100, Rui Maciel wrote:


Wrong.

Dillo doesn't, for one.

--
"For a successful technology, reality must take precedence
over public relations, for nature cannot be fooled."
(Richard Feynman)

Thu Sep 02, 2010 6:47 pm   

On Thu, 02 Sep 2010 00:23:00 +0100, Rui Maciel wrote:


No, it's can only be accessed if the user enables JavaScript. If a site
has a "must use JS" policy, you can always walk away.

If you do enable JS, the capabilitities are unchanged with or without DOM
storage. A small cookie is enough to store a unique ID to identify the
user. Once you have that ID, any amount of data can be stored on the
originating server.

DOM storage simply replaces the combination of small, local storage plus
large, remote storage with large, local storage. This affects convenience,
not capability.


Anything they can do with DOM storage, they can do without it.

BTW, DOM storage is a key-value store, not an RDBMS. The SQL version is
still in the drafting stages, and ultimately doesn't offer any more than
DOM storage beyond convenience (i.e. not having to implement the
relational features yourself in JavaScript).


Well, I browse with JavaScript disabled. Even if you enable it, Firefox
has a options to ask before allowing a script to use DOM storage (Tools ->
Options -> Advanced -> Network -> Tell me when a website asks to store
data for offline use), and to remove any data which is currently stored.

Another thing to be more concerned about is tracking usage through
"visited" link styles. That can be still done even with JS disabled and
cookies blocked, by giving each link a "visited" style with a unique
background image URL. "Private browsing" (aka "porn mode") will prevent
that, but it means that your browsing history isn't available to you
either.

Fri Sep 03, 2010 8:49 pm   

dagmargoodboat_at_yahoo.com wrote:


I don't have a static IP :-)

--
Regards, Joerg

http://www.analogconsultants.com/

"gmail" domain blocked because of excessive spam.
Use another domain or send PM.