The opposite opposte approach

Posted Jul 23, 2020 13:52 UTC (Thu) by pabs (subscriber, #43278)
In reply to: The opposite opposte approach by ragnar
Parent article: The sad, slow-motion death of Do Not Track

Cookies that are used for login sessions are just another form of tracking.

to post comments

The opposite opposte approach

Posted Jul 24, 2020 13:42 UTC (Fri) by smurf (subscriber, #17840) [Link] (10 responses)

Well, the alternative is to log in on every visit *and* to mangle each and every one of your links with session IDs.

I'm not quite convinced that that approach has any advantages WRT cookies.

The opposite opposte approach

Posted Jul 25, 2020 4:15 UTC (Sat) by pabs (subscriber, #43278) [Link] (9 responses)

The technical mechanism used to login was not the point of my post.

The opposite opposte approach

Posted Jul 27, 2020 10:34 UTC (Mon) by anselm (subscriber, #2796) [Link] (8 responses)

I don't think people have anything against being “tracked” (through an HTTP cookie or otherwise) by a single web site that they have deliberately logged in to. It's being tracked by a large number of third parties, without explicit consent, across a large number of – otherwise unrelated – web sites that is objectionable to many of them.

The opposite opposte approach

Posted Jul 27, 2020 16:27 UTC (Mon) by rgmoore (✭ supporter ✭, #75) [Link] (7 responses)

This seems exactly right to me. Once I've accepted the need to sign on to a site, I've accepted their ability to gather my information. If I'm unhappy with that, I need to either stop dealing with them or complain to them about what they do with my data. The big problem comes when some third party I have no desire to have a relationship with gathers data on me from numerous sites. There is a huge potential for abuse there, and they've almost always evaded any attempt to get my consent.

The opposite opposte approach

Posted Jul 28, 2020 3:22 UTC (Tue) by pabs (subscriber, #43278) [Link] (6 responses)

I don't think it is appropriate, for eg, for LWN to record which articles and comments I am loading, which they could do since I am always signed in, so that I can read subscriber-only articles.

The opposite opposte approach

Posted Jul 28, 2020 7:44 UTC (Tue) by anselm (subscriber, #2796) [Link]

OTOH, you probably appreciate the “Unread comments” function (I certainly do).

In the end it comes down to a question of trust. Of course LWN.net sees everything I do on their site as I interact with their web server, and they remember enough of it to ensure that the site works conveniently for me. I do trust them that they won't build up a long-term profile of everything I look at on LWN.net and sell that to (whom exactly?) or give it to the likes of the NSA (unless compelled by law). I don't have that trust when it comes to the data RANDOM_AD_COMPANY collects via ads they serve to hundreds of sites that I might be visiting.

The opposite opposte approach

Posted Jul 28, 2020 20:18 UTC (Tue) by rgmoore (✭ supporter ✭, #75) [Link] (4 responses)

There are legitimate, user favorable reasons for wanting to track what things you have seen. For example, it makes it possible to show you only new comments, or to highlight new comments so you can quickly skip the stuff you've seen before. It would be good if LWN had an option not to record that information if you don't want them to track it, but I'm personally OK with it because I find the features it enables to be very helpful. I see that kind of simple feature as being qualitatively different from tracking intended to enable advertisers to profile me.

The opposite opposte approach

Posted Jul 29, 2020 1:12 UTC (Wed) by pabs (subscriber, #43278) [Link] (3 responses)

LWN's approach to unread comments appears to work without tracking what you have seen, it seems to be solely based on tracking the dates when you load the unread comments page. Thats marginally better, but of course article/comment delivery via email and MUA-side read tracking would be nicer.

Anyway, we appear to have gotten side-tracked, my point was that logins allow an increased level of tracking and browsers facilitate that by making login sessions long lasting instead of only for requests that "need" to be authenticated.

The opposite opposte approach

Posted Jul 29, 2020 11:52 UTC (Wed) by excors (subscriber, #95769) [Link] (2 responses)

I don't think that's correct, because the "unread comments" page is not the only way LWN indicates what you've read. For example when I view this article (https://lwn.net/Articles/826575/) all the comments are displayed as "old" (the faded yellow colour). But if I open your comment's parent (https://lwn.net/Articles/827260/), your comment is displayed as new, until I refresh the page and it's displayed as old. If I open your comment's grandparent (https://lwn.net/Articles/827186/) they're all displayed as new again. I expect (based on prior observations) that if I open those pages after posting this comment, my comment will initially be marked as new and the earlier comments will be marked as old.

I assume that means LWN is tracking the date you visited every /Articles/NNN/ URL (which includes comment pages, not just articles). If you've never visited that specific page, all comments are considered new (even if you've seen them via a parent page). If you have visited, only comments posted after the last visit are considered new. So LWN knows exactly which pages you have visited, and actively uses that information. I don't know how long that is tracked for - from some very rough testing I suspect it's at least a month, but not many months. LWN's privacy policy doesn't appear to disclose the collection of this information, but I can't see any other reasonable way the observed behaviour could be implemented.

(This all applies to a logged-in subscriber. I assume the behaviour is different for anonymous users and maybe for non-subscribers.)

Comment display

Posted Jul 29, 2020 13:04 UTC (Wed) by corbet (editor, #1) [Link] (1 responses)

The feature you describe is for project-leader subscribers; it is indeed implemented by storing the date/time the reader last looked at specific articles. That information is only kept for those subscribers, expired out after 60 days, and used for no other purpose.

I'll review the privacy policy and make sure that's covered.

Comment display

Posted Jul 29, 2020 14:41 UTC (Wed) by excors (subscriber, #95769) [Link]

Okay, thanks for clarifying that! (I have no problem with it personally, I was just curious in the context of this discussion.)