Ads, Trackers, Blockers, Super-Cookies, Private Modes and other Ghastly Beasts (redux)

Dan Appelquist, Open Web Advocate

@torgo

http://slides.com/torgo/beasts-lws/live#/

Disclosure of Allegiances

Who Pays My Bills:

Open Data Institute
UK Government Digital Service
Samsung

Co-Chair of W3C Technical Architecture Group
Co-founder and co-organizer of Over the Air

In Addition:

Some History

First Web Ad:
October 27, 1994 in Wired

An Industry is Born

From Ads to Ad Networks

How Do you Measure?

Analyzing log files (unreliable)
Enter cookies (also 1994)

1994 is when it all started to go wrong

Credit: Hadley Beeman

Cookies

are about

state

From Ad Networks to Tracking Networks

Ad Retargeting

You search for dishwashers
Suddenly dishwashers are stalking you around the web

Text

Only the tip of the personal data iceberg

It's Not About the Ads
It's About (Your) Data

Bought, Sold, Traded, Re-traded, Re-sold, Aggregated, Anonymized,
De-anonymized, Analyzed & Monetized
ad infinitum

Ad Blockers

Almost as soon as the first ads, the first ad blockers
First ad blockers were proxies
Evolved to: an extension API to hide an element or block a load based on a set of rules
AdBlock Plus is the standard bearer

Modern Ad Blockers are Tracking Blockers

Tracking Network Blocker Blockers

“Forbes asked readers to turn off ad blockers then immediately served them pop-under malware.”

Engadget 8-1-2016 : http://engt.co/1PNJZqf

And now...

http://reek.github.io/anti-adblock-killer/

The Many Faces of
“Do Not Track”

A "do not track" preference originally proposed by the US Federal Trade Commission in 2007
W3C workshop and working group followed
Supported by many digital rights groups (CDT, EFF)
Now the DNT preference and header is in every browser
Unfortunately almost no ad network honors it
No enforcement (yet)

Some Hope for DNT…

Privacy Badger?

Plug-in for Chrome & Firefox
Blocks tracking networks
Built by EFF
Lets content through that “respects users' privacy” (including DNT)
…Badger!

The Many Faces of
“Private Mode”

Process Privacy: Keep communication private from other users on the same machine
Network Privacy: Keep communication private from intervening networks
Server Privacy: Prevent the server from connecting activity to a user's Personally Identifying Information

Different browsers do better or worse jobs

Not just the
<ahem> mode

Share your browser with someone
Log into a different account
Test something without context
Search without context
Symptoms checker
Research medical condition
Battered spouse support
Marginalised groups
Research political topics
NGO or aid organization
...

BTW:
Private Browsing Modes Don't Protect You From Your ISP / Government / Wireless Hotspot etc...

Super-Cookies
and the Super-Evil People who Bake Them

“Unsanctioned Tracking” using any web technology for tracking that was not designed for tracking
https://www.w3.org/2001/tag/doc/unsanctioned-tracking/
e.g. Canvas, WebRTC...
“considered harmful”
Takes the agency away from the user
See also “Fingerprinting Guidance for Web Specification Authors": https://w3c.github.io/fingerprinting-guidance/

Network Operator
“Super Cookies”

postal address
email address
device info
age
interests
gender
browsing history
app usage
your location

Enough Said...

This is War

Title Text

The Tracker Resistance

e.g.:

Ghostery
Disconnect.me
Privacy Badger
Lightbeam

Panopticlick 2.0 from EFF

Test your browser for “tracker-i-ness.”

https://panopticlick.eff.org

Mozilla Lightbeam

“See who's tracking you online”

Mobile Browser Ad Blocking

Lots of resources, plugins, etc.. for desktop browsing
Held back on mobile - no extension APIs

Apple Throws in a Grenade

3rd party extension API
Over 40 blockers out there – some free, some paid
Notably, “Focus by Firefox” (uses Disconnect.me's blacklist)

Surprise, Surprise: Google Makes it More Difficult

Right now you either need to load a special browser, e.g. adblock plus browser
...or go through rigamarole of configuring a proxy (aoooga! aoooga! privacy alert!)

“Brave”

Title Text

Chromium(!?)-based browser
Started by Brendan Eich, inventor of JavaScript and brief CEO of Mozilla
Malware heuristics + tracking network blocking + “https everywhere”
Ex-TAG member and EFFer / author of https everywhere / Yan Zhu is on the team
They got brave.com
Betas now available

What we know about Brave:

Samsung Internet

Samsung (Chromium) browser from 4.0 will support “content filtering”
- 3rd Party Extension API Approach
Also featuring a private browsing (“secret”) mode
& “progressive webapp” support (Service Workers, Manifest…)
Default browser on Samsung phones

...but wait!

Text

Nope.

Thanks!

@torgo

Web Progressions – 9 May 2016 – Campus London @webprogressions