Brave takes the spring out of creepy bounce tracking
- Reference: 1646814374
- News link: https://www.theregister.co.uk/2022/03/09/brave_bounce_tracking/
- Source link:
[1]Bounce tracking , also known as redirect tracking, dates back [2]at least to 2014 when ad companies were looking for ways to avoid third-party cookie blocking defenses.
"Bounce tracking is a way for trackers to track you even if browser-level privacy protections are in place," [3]explained Peter Synder, senior director of privacy at Brave, on Tuesday.
[4]
"Privacy respecting browsers try to prevent sites from learning about your behaviors and activities on other sites. Bounce tracking attempts to circumvent these protections by gaming how your browser behaves when you browse from one site to another."
[5]
[6]
Say a website embeds a third-party script from info.tracker . When the website is visited, the third-party script tries to read third-party cookies from info.tracker that have been stored in the visitor's browser.
If it can't – because third-party cookies are blocked – the script [7]redirects to the info.tracker domain by writing a new URL to the browser's window.location object or via some link hijacking method like injecting an info.tracker iframe into the original website.
[8]
Doing so puts info.tracker into a first-party context, enabling it to set tracking cookies.
Info.tracker then redirects back to the original website URL and info.tracker cookies can then be read in third-party contexts. By doing so across multiple different websites, info.tracker can develop a profile of the people's interests.
To curtail privacy intrusions of this sort, Brave software engineer Aleksey Khoroshilov and senior software engineer Ivan Efremov devised a defense called Unlinkable Bouncing.
[9]Facebook exposes 'god mode' token that could siphon data
[10]Apple, Google, Microsoft, Mozilla agree on something: Make web dev lives easier
[11]Facebook is one bad Chrome extension away from another Cambridge Analytica scandal
[12]Your app deleted all my files. And my wallpaper too!
Unlinkable Bouncing prevents bounce tracking sites from tracking people over time by linking past website visits to new ones. It's designed to augment Brave's previously implemented bounce tracking defenses, which include warnings prior to visiting bounce tracking sites, stripping query parameters added to URLs to facilitate tracking, and [13]debouncing , a mechanism for suppressing bounce tracking redirects.
Essentially, Unlinkable Bouncing enforces amnesia for bounce tracking sites. When navigating to a new URL, Brave checks its internal and its crowdsourced filter list for known bounce trackers.
[14]
If the URL is found, assuming a suitably strict browser privacy configuration, the browser creates a new temporary storage area for the bounce tracking site and then deletes it, purging any identifiers that were set. This prevents the bounce tracking site from re-identifying the visitor when any other website redirects to the bounce tracker.
Synder says Unlinkable Bouncing is Brave's first application of "first-party ephemeral storage," a capability being developed to make websites more forgetful.
"This is a set of techniques that allow sites to remember (or identify) you only for as long as you’re visiting the site," he said. "It’s similar to – though more powerful and user-friendly than – clearing your browser storage every time you leave a site."
Unlinkable Bouncing is available in Brave Nightly, the company's experimental build, and is expected in the upcoming version 1.37 release.
European data privacy law has established a right to be forgotten. Brave is working toward a future where web users' activities don't have to be remembered. ®
Get our [15]Tech Resources
[1] https://github.com/privacycg/proposals/issues/6
[2] https://lists.w3.org/Archives/Public/public-tracking/2014Jul/0009.html
[3] https://brave.com/privacy-updates/16-unlinkable-bouncing/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YiiI3tQtjtQ1AbHwXlw17wAAANA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YiiI3tQtjtQ1AbHwXlw17wAAANA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YiiI3tQtjtQ1AbHwXlw17wAAANA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://developer.mozilla.org/en-US/docs/Web/HTTP/Redirections
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YiiI3tQtjtQ1AbHwXlw17wAAANA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2022/02/12/facebook_god_mode/
[10] https://www.theregister.com/2022/03/04/web_dev_tech/
[11] https://www.theregister.com/2022/02/17/chrome_meta_token/
[12] https://www.theregister.com/2022/02/25/on_call/
[13] https://brave.com/privacy-updates/11-debouncing/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YiiI3tQtjtQ1AbHwXlw17wAAANA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://whitepapers.theregister.com/
Backwards world
Brave is working toward a future where web users' activities don't have to be remembered.
It is sad that this is needed. The spirit of GDPR is that all users should be in control of their data and must give informed permission before second and third parties are allowed to handle direct/indirect PI data (and not even getting into the problem of shadow profiles). So, yes, it is sad that we need technological measures to create more privacy.
We should consider a reverse burden of proof for websites when they employ any form of tracker technology on their website(s). They should be the ones to proof that your data is not being used for anything else than explicitly advertised.
Re: Backwards world
I agree. Its unfortunate that the spirit of GDPR was side-lined in the implementation. Whilst I am normally against legislative solutions, I think the time has come to just out-right ban tracking that uses 3rd parties.
The desperation to make an extra few pennies out of us is sickening and advertising is the scourge of the internet
"Say a website embeds a third-party script from info.tracker"
Say I'm using Firefox with NoScript.
Problem solved.
Or say that I'm blocking info.tracker's IP address at the firewall.
Problem solved again.
But I'm happy that there are people who are thinking about the deep mechanics of ad tracking. The more ways we have to block that, the better.
Re: "Say a website embeds a third-party script from info.tracker"
Hard blocking all connection attempts or cookie setting doesn't always work. As you get redirected (bounced) to the tracker site, which then redirects back to the site you are trying to access, a hard block just means that you get a browser failure message when it can't load the tracker site, and you never get the site you wanted.
Likewise, hard blocking cookies from the bounce tracker site can lead to you being constantly bounced between the site you want and the tracker site (site you want checks if third party tracker cookie exists, finds it doesn't and redirects to the tracker site, which tries and fails to set a first party cookie, before redirecting back the the site you want, which checks to see if the third party tracking cookie is there, finds it isn't and redirects you to the tracking site...) so you just get nothing happening in your browser for a few seconds, followed by a browser "too many redirects" failure message.
If you've ever struggled to load a site as your browser just gives you a "too many redirects" error, and you use some sort of ad or cookie blocking tool this is likely what's happening behind the scenes.
Re: "Say a website embeds a third-party script from info.tracker"
In my opinion, it shouldnt be necessary for us to have to take such evasive actions. I'll support any work to block this sort of crap
Aha
That's why Google ad links are failing to load on Brave now. A light has dawned.
Yeah but ...
Firefox addressed this issue back in 2020:
https://blog.mozilla.org/security/2020/08/04/firefox-79-includes-protections-against-redirect-tracking/
Interesting
How widespread is this bounce tracking these days? This is the first time I have heard of it, but maybe that's just me being ignorant.