Fear Your Browser, Episode 2: How They’re Tracking You

Let’s start with some of the simpler stuff (like a horror movie).

We all understand cookies, right? Sure we do! We don’t mind them at all. We let our bank and our Yahoo Groups and Google and every, well, yahoo out there set cookies on us. Newer browsers make dealing with this issue about as fun as athlete’s foot, and just as recurrent. Do you want to accept cookies from this site? From other sites? From third parties? For eternity? From Satan???

Usually we just wade through a series of Yeses and get back to surfing porn. But oh, boy, what we’re agreeing to! The last time I studied a Yahoo EULA, it seemed clear that once I visited my one Yahoo Group, by logging in automatically of course, I was “logged in to Yahoo” and my every click was being tracked.

One of these days these guys are going to find a way to tell how long our eyes rest on an image, and then all hell breaks loose. I won’t be able to pass a lingerie shop without my cell phone ringing with an ad for red panties. Ahem. And let me be clear that I don’t wear them.

In any case, this level of “traction” does not appeal to me, and it’s barely the beginning. Bad Issue No. 2: third-party cookies you “inherit” (or are afflicted, or even infected with) when you visit practically any site. Google’s gonna track my click-through, that’s a fact. But take a look at your cookies list sometime: you’ll have cookies from DoubleClick, Advertising.com, and a whole raft of other familiar-sounding names.

You don’t want those cookies. Those cookies are bad. They not just can be, but are in fact used to track your “interests” as you traverse the web. It’s not like gnorman.org setting a cookie for your local login. It’s like Google setting a cookie, or more likely reading one, because I have Google Ads on my site (as of this writing). Now certainly Google knows far too much, period. I agree with the Dos XX billboard: The bulk of your life should be off the record.

But it’s the advertisers I fear. We are headed, fast fast fast, toward the world of The Minority Report, where ads swarm around you every step of your way. This would shortly drive me to gunfire, personally.

They’re tracking you across hundreds or thousands of sites. Let your teenage son share your login (or hey, don’t use one at all) and suddenly you’re on a lot of records as having a proclivity to porn. Fortunately teens aren’t so unsafe, after all; they’re primarily interested in each other. However, their activity attracts people who are not safe at all, no indeed. I recall the NewMexicoKids.org bulletin board in the naive days of a decade ago, a great place for parents and kids to ask questions — and shortly, a great place for pedophiles.

Neat, huh? How those dramatically unintended consequences bite you in the butt?

Cookies are also subject to cross-site restrictions, by design. This can be a problem in web design, when for instance the same user may pass from networkworld.com to computerworld.com. Clever developers solved this nicely: they used Flash cookies instead.

If you bake chocolate chip cookies, and I bake a huge wedding cake and call it a “cookie,” we’d have about the same relationship as a Flash “cookie” has to a real browser cookie. If you call a dog’s tail a leg, how many legs does a dog have? Four, because calling it a leg doesn’t make it one. Unfortunately, in this case the term has indeed stuck.

Flash cookies are already the subject of rising legal attention, but for our purposes you must clearly understand that any page using Flash, even a single-pixel image, can set a Flash cookie. And these babies are tougher to deal with.

So now we should fear single-pixel GIFs and Flash images, cookies and third-party cookies, advertisers and certainly Google, Yahoo, MSN, and the mirror port at every major telecom facility that cables in to a highly secured closed room accessible only to the Federal government. Oh yeah, that too.

Next time: surfing through proxies.