Experts Divided On Risk Of Trackers On Porn Sites

In February warned a software engineer for the risk of trackers and other ways in which it can be followed online porn surfing habits of viewers, but experts are divided over how big the risk is real. Software engineer Brett Thomas suggested two months ago that the viewing habits on porn sites the next "big privacy scandal" can be. Many ways to websites and advertisers identify Internet users today and that is no different on porn sites.

This data could, for example end up using a hacked advertising company, tracker or porn site on the Internet. It does not matter if people such as "private browsing" to use to protect their browsing habits, so let experts opposite Vice Magazine know. Even if this option is enabled the user's IP address is on the website visited, and the trackers that are active thereon passed.

88% of the 500 most visited porn sites are active trackers. "If you look at porn on the Internet in 2015, even in incognito mode, you must assume that at some point your viewing habits public and will be linked to your name," said Thomas. In addition to the IP address has almost every computer to identify a unique fingerprint browser so that users are. "It is certainly cause for concern," said Justin Brookman, privacy expert of? Center for Democracy & Technology.

Alarmism

According to Cooper Quintin of the American civil rights movement EFF is possible that the viewing habits of one's membership in a porn site is known, but he calls the remark of Thomas later someone can easily put it online porn viewing habits of viewers on the Internet scaremongering. Vice Magazine porn sites also asked for a response, but received only sent a statement of PornHub. The site is on the 75th place of most visited websites on the Internet, just for Gmail.com , which stands on a 78th place.

The statement PornHub calls the assertion of Thomas not only utterly wrong but also dangerously misleading. According to the porn store the viewing habits of daily users would cost 3,600 terabytes. The searches of these data would be almost impossible and very time consuming. "The server logs PornHub contain only for a limited time the IP address and user agent, never a browser fingerprint," said a spokesman.

Incognito Mode Does Not Protect Against Super Cookies

Users who use the incognito or private browsing mode of their browser are still to follow through so-called "super cookies", according to an online test of the British developer Sam Greenhalgh . The problem is caused by a security measure called "HTTP Strict Transport Security" (HSTS). The measure ensures that websites only be accessed through a secure connection.

In case a website HSTS enabled the browser via a special "flag" remember and ensure that there is made only over HTTPS connection. If the user specifies HTTP in the address he is automatically redirected to HTTPS. However, this automatic forwarding can also be used by a malicious website to save a unique number in the user's browser and follow him. This number can then be read by other websites. HSTS can also be used as a tracking mechanism in this way.

To give users more privacy browsers have for some time been added incognito or private browsing mode. These cookies are not shared with existing web sites and the user can delete the cookies so they can be tracked online. Because HSTS is a security measure and is not really meant for tracking, browsers go it differently than is the case with cookies.

Some browsers such as Google Chrome, Firefox and Opera are trying to resolve this issue by removing both cookies stored as HSTS-flags. According to Greenhalgh, existing HSTS-flags, unlike cookies, or shared with other websites, even if the user incognito or private browsing mode enabled. In the case of Safari, the problem seems to be even greater because Safari users on an Apple device have no possibility to remove the HSTS-flags. She even be synchronized with iCloud, so they can be returned if the user clears his extension.

"I do not know if the technique is used in the wild to track users, although that does not mean that this is not so," said Greenhalgh. He calls the technical community to see how the tracking area can be resolved while the value of HSTS retained. In a response to Google Chrome Security Team states that there are measures added to the browser to address the problem, but it is ultimately a tradeoff between security and privacy. This form of "fingerprinting" would therefore not be solved unless fundamental changes are made to the way the web works. "