• 1 Post
  • 30 Comments
Joined 1Y ago
cake
Cake day: Aug 04, 2023

help-circle
rss

I have a flip-side story.

As a kid, I had a dog that we’d walk around the neighborhood kindof as a family on a regular basis. There was one spot along the walk where he would kindof flip out. Bark, pull hard on the leash, try to drag me into this one yard. And walk after walk, we had no idea what was possessing this dog.

So, finally, one day we decided to just let the dog pull us over and show us what it was going for. (This was in someone’s yard, so maybe a little weird and inconsiderate of their property, but yeah.)

He approached the concrete deer lawn ornament, gave it one confused bite on the neck, and realized the deer wasn’t prey. He was forever cured of the tugging on the leash at that specific spot on the usual walk route.

That dog wasn’t terribly bright.


Oh Jesus. Really?

Holy crap. That explains nearly everything. The only things that still seem weird are:

  • I’m 99% certain 273s is exactly where I left off watching yesterday, which seems like a weird coincidence.
  • I don’t remember it starting anywhere but the beginning when I first started it yesterday, but it’s possible I just immediately scrolled it back to the beginning without thinking about.
  • It doesn’t start there by default on my phone. Maybe YouTube doesn’t do that for mobile devices for some reason?
  • It doesn’t start at 273s if you use (at least certain) other search terms. Maybe YouTube decided that the bit that was relevant to my search term was at the 273s mark.
  • Someone else in this thread said they couldn’t reproduce the behavior I’m seeing by performing the same steps. It’s possible YouTube is A/B testing, though… though you’d think I wouldn’t consistently fall into the same “testing out the automatically starting you in the middle of the video feature” group and sometimes I’d get the control group where it didn’t give me that feature. Maybe they decide which group your in on the basis of “are you on mobile or not-mobile.” And maybe bamboo is on mobile or otherwise is on a machine that will consistently be picked for control group.

Still, though, the idea that it’s not “remembering me” and probably is just giving people that timestamp when they search that term by default even if they’ve never run across that video before seems like the most likely explanation.

Oh, and I did take a minute to go try this on (a fairly outdated version of) Firefox on another Arch Linux laptop on which I wasn’t logged in and all my cookies/history/form data/etc had all been deleted immediately before. I did get the indicator on that video when searching “gnu taler”. Which definitely seems like more validation of this theory.

Thank you for your input!


While logged out, https://www.youtube.com/feed/history gives me the following:

"Watch history isn't available when signed out."

And it’s still showing the indicator on the “gnu taler” search results page.

I suppose it might be worth closing my browser, opening my browser, going to YouTube, logging in, and checking that page, though. It might at least give some information or something. I’ll try that here and see if it lists the video in question. I’ll update when I’m done.

Edit: That video about GNU Taler does not show up in my viewing history while logged in. I tried viewing a random video while logged in and checking my viewing history and that random video shows up. But not the GNU Taler one that still has the indicator. I’m starting to think I’m losing my mind. Lol.


Right, the link has a timestamp in it. But I don’t know how the search results page knew what timestamp to put in the link to the video even after switching to TBB.


Yeah, forgot to mention I hadn’t logged in or anything. But that’s right. I didn’t log in during any of that testing. I’ve edited that detail in.

Still weird that it could possibly fingerprint even while using TBB, though.


Not sure I understand what you’re getting at here.

Yes, I linked to the video and didn’t think to remove the t=273s bit when I included the link in the OP. And, yes, I understand that having a &t=273s in the url makes it start not right at the beginning. My question is how did it know where to start (and how much red bar to show on the video thumbnail in the search results) given that my cookies had been deleted and, on subsequent tests, I even switched browsers.

I was purposefully telling my browsers to forget all the information YouTube could use to remember that and it still remembered somehow.

Now, I am concerned regarding the privacy aspect of how on earth it still persisted in TBB. But even when sites fingerprint you, if you delete your cookies they almost always at least pretend not to know you when you visit. I’d expect YouTube/Google to use fingerprinting to sell my information and do targeted advertising or whatever. But it’s weird that they’d even let on to me that they had figured out who I was even though I wasn’t sending them any cookies.


Also, did you return to that video with the same IP address as when you first watched it?

That’s (part of) why I tried Tor Browser Bundle, though. Because it would give me a different IP address. (And when I visited YouTube via TBB, it gave me the little superscript after the YouTube logo indicating a different country than I was in.)

I’ll just assume you didn’t log in to youtube when watching. :)

Ha! Should have thought to mention that. But yes, you’re right. I didn’t log in or anything. (And for that matter, in every test I did, when I first got to the home page, I got the “search to get started” prompt that YouTube gives as of pretty recently when you don’t have any cookies on visiting the index page.)


Yesterday, I started watching [a video on YouTube](https://www.youtube.com/watch?v=tFhn3IO23lE&t=273s&pp=ygUJZ251IHRhbGVy) but closed out of my browser (Firefox) only a few minutes into the video. I've got my Firefox set to delete all cookies, history, form data, etc on every close. (Pretty much everything but bookmarks.) The image on this post is a screenshot of my relevant settings. Today, after having exited my browser and fully shut down my computer for a while, I remembered the video and decided to continue watching it. In Firefox, I searched for the video (I used the search term "gnu taler" -- something worth looking into especially for folks interested in this particular Lemmy community by the way). In the search results, [the video I was searching for showed the red bar at the bottom indicating I'd watched only the first few minutes of it](https://lemmy.world/pictrs/image/63e07f0e-4a01-4cd6-b282-baf8acd0556d.png). Which seems weird given that I'd cleared all my browser data since I watched the first few minutes. So I did some experimentation. I closed my browser completely again and opened it back up, searched in YouTube, and it still had the indicator. I updated to the latest version of Firefox in the Arch package repository. Same indicator. I tried the same in Chromium (which I've also got set to delete all browser data on close). Still the indicator. I installed Tor Browser Bundle (specifically torbrowser-launcher on Arch Linux), changed none of the default settings at all, and searched in YouTube. The indicator is present. In Tor Browser Bundle. W T F ? Anybody have any idea how that's possible? My only guesses are: * That search is so niche as to be literally unique (which if true makes me sad -- I really hope GNU Taler takes off and becomes widespread) and YouTube is using that to identify me. * YouTube doesn't know where I left off at all. Not even my browser knows (because if it was my browser keeping track, it wouldn't persist between browsers). It's something else on my system that my browsers depend on or tap into. The only other pieces of relevant info I can think to share: * There's another video (also about GNU Taler) that I watched all the way through the same day that I *started* the video this post is about. It doesn't show any indicator. * I tried searching on my phone's browser. No indicator. But then I'm not sure my phone ever shows indicators. I haven't tried this on any other devices on my network or anything. * I still haven't watched the video in question. Heh. Thanks in advance for any insight you might have. Edit: Sorry for neglecting to mention previously that at no point during any of the above did I log in to YouTube. And the "Sign in" button was visible at the top of the page indicating I wasn't logged in. Since multiple people asked, I figured I should edit my OP with that info. Edit2: Two more things to mention. I think some folks are thinking I copied the link and pasted it between browsers during the above test or something? The only reason the timestamp is included in the link I posted above is because when I copied it into this post, I didn't think to remove the timestamp. But I didn't do anything like copying the link from the search results in one browser and then paste the link into TBB or anything. In each separate browser, immediately after opening the browser, I went to YouTube (by typing "youtube.com<enter>" into the address bar) and put "gnu taler" into the search bar and hit enter. And in each browser, YouTube somehow remembered where I'd left off in a whole different browser -- with a different IP address in the case of the switch from Chromium to TBB. And no urls were copied between browsers in any of the above. The other thing to mention. Changing my search term to the full title of the video ("Building an Open Source Payment System - Sebastian Javier Marchano, Taler System" sans quotes) gives the relevant video as the top search result, but no "left off" indicator. And I'm in the Firefox in which I first noticed it had remembered. Oh, actually, one *more* thing to mention. After posting this, I continued watching. I'm probably about 3/4 done with it now. But I closed my browser again before completing it, reopened my browser, and searched "gnu taler". It gives the indicator, but the position of the indicator is roughly (possibly exactly) where it was when I first noticed it had remembered. Not where I left off after watching to roughly the 3/4 mark. Edit3: Wow! Ok. I'm 99% sure folks smarter than me have hit upon what's going on here. Thanks in particular to Tony N and Chozo for the right answer. It looks like YouTube has a feature where, depending on your search terms, it may automatically skip you a certain ways into the video. (Like "oh, you searched for 'gnu taler'? Well, in *this* video result, this bit in the middle is the part that's relevant to your search terms, so we'll just start you such-and-such-many seconds into the video.") The red bar doesn't mean "you've watched this" at all. And YouTube isn't "remembering me" between browsers. It's just consistently (as long as I use the specific search terms "gnu taler") suggesting that I start that video 273 seconds in rather than from the beginning. And anyone who searches that exact search term should get similar results... unless they're on mobile for some weird reason? That paired with the coincidence that I'm pretty sure I just happened to have stopped the video yesterday right about at the same place where YouTube recommends you start had me very confused. Whatever the case, I'm satisfied this must be the right answer. Thanks again, ya'll!
fedilink

A lot of user fingerprinting techniques rely on JS. Plus, by shutting off JS, you reduce the attack surface of your browser. If, let’s say, there was a zero-day vulnerability in Firefox that required JS to exploit, you’d be shutting off that whole means of attack if you blocked all/most JS out there on the internet. Mining cryptocurrencies on your computer via your browser can only be accomplished with the help of Javascript. A lot of forever cookie techniques require Javascript.

uBlock origin is for kindof a different use case. It’s for if you’re on one website that you don’t necessarily suspect of evil dealings that might include buttons (like social media sharing buttons, for instance) or other scripts (like ad displaying scripts or analytics scripts) from third parties that might include evil tracking stuff. If I started a blog on https://theawesomeestblog.com/ and included script from Facebook that puts a share button on my page, and if you then visited my blog, Facebook would know because your browser would make requests from your IP with cookies they’d placed on your brower previously and JS included with the button could very well be used to do additional fingerprinting.

NoScript is for (among other things) when you don’t even necessarily trust the website you’re purposefully visiting. Like, I don’t know if cnn.com mines Bitcoin via JS on users’ browsers (and, honestly, it seems a little unlikely to me, I think), but if I disallow JS on cnn.com, then when I click a link in Lemmy to a cnn.com article (and maybe I don’t even really know I’m going to cnn.com when I click the link – it might use a link shortener or something – or maybe it’s not cnn.com, but some reasonably-trustworthy-sounding news-y-sounding domain that I haven’t heard of before), I know it’s not mining Bitcoin on my machine.

Oh, and as others have said, NoScript is Open Source. Says so right near the top of the home page.


/c/Libertarian is that way:

Iconic old meme image of a guy with his head up his own ass.

/c/Cryptocurrency is over there:

Image of the /r/Buttcoin community's logo


Generally, I’d recommend F-Droid as a best first place to go for app recommendations if you’re interested in privacy and such. The vast majority of software there will be ridiculously in line with your privacy wishes, and the ones that have minor caveats will be explicitly marked as such. And its search interface is very decent.


Regardless of 4chan’s privacy situation, it’s a total cesspool. Nothing worthwhile happens on 4chan.



The way I would look at it is:

  • If you aren’t sure you can trust your computer, you should probably cover your webcam.
  • Your level of risk tolerance can vary, so what a person would consider trustworthy may differ from person to person. (For some, maybe any proprietary software makes the computer untrustworthy. For others, maybe they feel smart enough to make good decisions about what software is trustworthy and they just don’t download anything that sets off their spidey sense. Or whatever.)
  • If you’re taking extreme measures to ensure your machine is trustworthy, you’re probably going much further out of your way than covering your webcam anyway. If you’ve picked a lot of the higher branches clean anyway, you probably ought to go ahead and pick that remaining low-hanging fruit.
  • Regarding Windows specifically, some would probably call Windows systems less trustworthy on some combination of that a) Microsoft is assholes that might themselves use webcam data in evil ways and/or b) Windows is more targeted by crackers and malware.

Yeah. That bit stood out to me as well. I posted in the other cross-post that I wonder if that means Nintendo’s going to try to go after stuff like Atmosphere and Hekate etc next.


Yeah. That’s tacky. You have to forge the ring in the chapel right after they exchange rings.



I heard they were caught selling search data to Microsoft.




As I’ve said in other comments in this thread, everything I’ve been able to find on the topic has indicated that cryptocurrency is used much more as a speculative investment than as any form of payment.


Search results on DuckDuckGo for the search term "does anybody use cryptocurrency as currency". The top result is an article on decrypt.co named "The Truth About Bitcoin: People Aren't Using It As Currency." Part of the text of the article is also visible below the title. "In brief. Bitcoin was originally billed as 'a peer-to-peer electronic cash system,' but most cryptocurrencies aren't used for payments. Surveys have shown that the majority of Bitcoin is held for speculative purposes. While some retailers accept Bitcoin, purchases have suffered from higher drop-out rates than cards and cash payments."

That’s a pro-cryptocurrency source. Scanning down the page, the first result from a source I recognize is an article called “Bitcoin Is A Cryptocurrency, But Is It Money?” from Forbes. It doesn’t directly answer the question my search term asked, but it does say “Economists say that money performs three functions. … Does Bitcoin do any or all these things? In brief, no.”


Three seconds of googling (well, I used DuckDuckGo, but anyway) suggests otherwise.


This. I very much hope Taler takes off and becomes something I can use to pay for my groceries or whatever.


Yeah, but in order to work as a private means of payment, cryptocurrencies first have to work as a means of payment (you know… as a “currency”). Until/unless they do, they’ll remain gambling with extra steps.



Jesus. Any idea how old a car I’d have to buy to be realtively certain it wasn’t phoning home?



Assuming everything you’re saying is true, the reason the honeypot existed in the first place is because incel communities often tend to spawn domestic terrorists.

If you’re looking for any kind of sympathy, even if only enough to get folks to give you useful advice, “I’m an incel and my incel activities got me on a government watchlist” is about as likely to get you sympathy as “I’m a nazi and my nazi activities got me on a government watchlist.”

My recommendation: get therapy.


Unfortunately, I can’t argue with much of that. In fact, if anything, you’re leaving out complexities.

There are a few browsers out there that use WebKit but none of Chromium. (Surf and Uzbl are a couple that I’ve used in the past.) With a little scripting, you could get them to, for instance, run two different “profiles” with different cookie stores at the same time. But they’re far from full-featured.

Maybe what we really need is to scrap the web and start fresh with something better.


I haven’t seen the video yet, but I very much believe what we really need is something better than either Firefox or 10 different flavors of Chromium.

Something that gives way more control over how it handles cookies. Something that lets you run multiple profiles at the same time. Something that lets you seamlessly switch identities.

Maybe something that’ll give you a whole different cookie store every time you change domains.