22 Aug 2017
List-based and behavior-based tracking protection
(update 13 Mar 2020: Remove link to the old Self-Destructing Cookies extension and add a link to the new Cookie AutoDelete extension. Both do about the same thing but Cookie AutoDelete is maintained on current browsers.)
In the news…
User privacy is at risk from both hackers and lawyers. Right now, lawyers are better at attacking lists, and hackers are better at modifying tracker behavior to get around protections.
The more I think about it, the more that I think it’s counterproductive to try to come up with one grand unified set of protection rules or cookie policies for everybody.
Spam filters don’t submit their scoring rules to ANSI—spammers would just work around them.
Search engines don’t standardize and publish their algorithms, because gray hat SEOs would just use the standard to make useless word salad pages that score high.
And different people have different needs.
If you’re a customer service rep at an HERBAL ENERGY SUPPLEMENTS company, you need a spam filter that can adjust for your real mail. And any user of a site that has problems with list-based tracking protection will need to have the browser adjust, and rely more on cleaning up third-party state after a session instead of blocking outright.
Does your company intranet become unusable if you fail to accept third-party tracking that comes from an internal domain that your employer acquired and still has some services running on? Browser developers can’t decide up front, so the browser will need to adjust. Every change breaks someone’s workflow.
That means the browser has to work to help the user pick a working set of protection methods and rules.
0. Send accurate Do Not Track
Inform sites of the user’s preferences on data sharing. (This will be more important in the future because Europe, but privacy-crazed Eurocrats will not save us from having to do our share of the work.
1. Block connections to third-party trackers
This will need to include both list-based protection and monitoring tracking behavior, like Privacy Badger, because hackers and lawyers are good at getting around different ones.
2. Limit data sent to third-party sites
Apple Safari does this, so it’s likely to get easier to do cookie double keying without breaking sites.
3. Scramble or delete unsafe data
If a tracking cookie or other identifier does get through, delete or scramble it on leaving the site or later, as the Cookie AutoDelete extension does. This could be a good backup for when the browser “learns” that a user needs some third-party state to do something like a shopping cart or comment form, but then doesn’t want the info to be used for “ads that follow me around” later.