It is a story because some states might be able to sue for information regarding visitors to those sites due to local laws. Its about informing citizens that their private purchases might not be as private as they want.
Websites subject to GDPR use Google Analytics left and right. Even government websites do this. GDPR has good intentions but enforcement is lacking severely.
Actually, the longer GDPR has been around, the more I see websites popping up with a comprehensive modal that gives gentle explanations of what each toggle does.
Hell, now some websites even default to "non-required" tracking off, and literally do not require you to do anything to limit the data they harvest from you. And I'm pretty sure this is some third party's drop in solution.
It's intended to ask users for consent before stalking them. But lack of enforcement means that in practice implementations use a non-compliant popup that forces users to accept (and is often technically flawed in that the tracking scripts are loaded regardless of the user's answer).
Presumably the person ordering these drugs is already providing the site with payment information (credit card) and a shipping address... seems like anyone suing for this information would probably start there rather than with google analytics.
I am not going to visit or look up these sites on my work computer.
But if they are headquartered outside the US like many online pharmacies are, likely they are going to just ignore any law enforcement requests for user data.
Putting myself in the shoes of an online pharmacy selling abortion meds, I would be crazy to headquarter in the US. I'd be surprised if even a few were US-based.
I think bringing attention to common practices putting people in jeopardy is a good thing, because it’s likely website operators and the general public don’t think about these risks. If data is collected, it can be used by police and prosecutors. Ignoring the problem because everyone knows about analytics does not start necessary conversations. Google has increasingly been a target for law enforcement investigations, and the search warrants Google receives can be as broad as compelling Google to turn over data on the accounts or IP addresses of anyone who Googled someone’s name.[1]
That’s another worthwhile topic, but since the privacy threat model of a companies selling some types of birth control will be unusual for the foreseeable future, it is also worth talking about in isolation.
Every company in healthcare (and many other industries where privacy is important) needs to know that they should not be giving customer data to third parties.
It is, but if you're a website operator, it's much easier to not use Google Analytics than it is to convince your government to clamp down on law enforcement search powers.
Turning this into dichotomy between website operators needing to crusade on government overreach and not using GA has got the be the worst faith argument I've seen in a minute.
This entire premise of this article advantage of people who aren't technically inclined and can't know well enough to realize that reverse engineering GA fingerprints is not even close to how the government would de-anonymize visitors.
If your local government decides to overreach and find out who's getting abortion pills, Google Analytics will not even be your 1000th biggest problem. ISPs will readily share which sites people visit, the stores themselves will get leaned on, your mail carrier with share where you get packages from.
I mean did you even read the article? "Abortion Ease, BestAbortionPill.com, PrivacyPillRX, PillsOnlineRX, Secure Abortion Pills, AbortionRx, Generic Abortion Pills, Abortion Privacy and Online Abortion Pill Rx."
What do you think HTTPS is going to do when one of these urls shows up in your traffic, email inbox, and a reverse mail address look up leads to one of these?
> Turning this into dichotomy between website operators needing to crusade on government overreach and not using GA has got the be the worst faith argument I've seen in a minute.
Putting words in my mouth has got to be the worst faith argument I've seen in a minute.
> If your local government decides to overreach and find out who's getting abortion pills, Google Analytics will not even be your 1000th biggest problem. ISPs will readily share which sites people visit, the stores themselves will get leaned on, your mail carrier with share where you get packages from.
And it's much easier for website operators to stop using Google Analytics than it is for them to educate their customers on using VPNs and mailing their packages to dead drops (let alone for their customers to actually do those things).
This ain't about dichotomies or the lack thereof. This is about what people can do now to mitigate low-hanging fruit. Nobody said the solution is only to stop using GA; literally all that was actually said is that not using GA is something that the operators of such stores can trivially and immediately do.
That is:
> What do you think HTTPS is going to do when one of these urls shows up in your traffic, email inbox, and a reverse mail address look up leads to one of these?
The existence of problems outside your control does not erase the existence of problems entirely within your control. Website operators cannot force you to use a VPN or a secure email or an anonymous address. They can minimize the data of yours they're sending to third parties.
> I mean did you even read the article?
I mean did you even read the HN guideline specifically prohibiting such a question?
> Putting words in my mouth has got to be the worst faith argument I've seen in a minute.
"it's much easier to not use Google Analytics than it is to convince your government to clamp down on law enforcement search powers."
You literally wrote a one sentence comment that compares a decision for website owners to choose between not using GA and convincing their government not to clamp down on law enforcement search powers. I didn't put a single word in your mouth in stating what I did.
You wanting to walk back what you wrote doesn't make my comment put words in your mouth, they were the words you said.
> And it's much easier for website operators to stop using Google Analytics than it is for them to educate their customers on using VPNs and mailing their packages to dead drops (let alone for their customers to actually do those things).
GA is completely orthogonal to the entire discussion. That's the point that ProPublica (intentionally?) ignores, and apparently you're just unaware of.
It's doing literally nothing to protect or harm these people, because the government is not stooping to deanonymizing GA data when there are 1001 more direct and better established methods to achieve the same thing, it's a frankly absurd point.
Saying by not using GA they're even tangentially protecting customers shows a complete lack of understanding of why this government overreach is such a problem.
-
tl;dr/too technical;didn't understand: The government doesn't need your GA fingerprint they can get the things that the fingerprint is made and then some straight from Google... and your ISP... and the site's host... and the mail services.. and the list goes on.
They can literally ask for all people who searched for a given term in a 5 block radius and you're trying to talk about hashed fingerprints???
It's like worrying that the government is going to check for your DNA in the toilet at a local restaurant when the establishment can be compelled to give them a receipt with your card details, your bank will give them the transaction details, your search history with the restaurant name is up for grabs, the municipal security cameras that watched you drive up are up for grabs...
-
Once you understand that then the pointlessness of this line of reasoning comes up, and why ProPublica is doing this becomes more questionable.
By inventing some totally ludacris wrong, they're painting themselves as having uncovered some unique in-depth aspect to the dynamic between these abortion pill sites and their users, but to do so they're painting the sites as negligent with the most inane stretch of logic possible.
Instead of focusing more on the actual problem, the overreach, they create a new boogeyman because it gives their reporting a unique angle. But of course that boogeyman is serving the interests of people who are having their rights stomped on.
By completely misunderstanding the topic (and in ProPublica's case I'm not buying it was unintentional) both you and the article are just throwing FUD into the actual conversation that matters.
It's annoying to see supposedly creditable publications intentionally muddy things for their own benefit, and it's even more annoying to see people with a poor grasp of the situation just run with it blindly without taking 5 seconds to apply critical thinking and context to it all.
> You literally wrote a one sentence comment that compares a decision for website owners to choose between not using GA and convincing their government not to clamp down on law enforcement search powers.
Right, and note what I didn't say:
- Whether or not those things are a dichotomy or otherwise mutually exclusive
- Whether or not those things encompass the complete set of privacy violations or the mitigations thereof
Your assumption that I've made or even implied answers to either of those within the words "it's much easier to not use Google Analytics than it is to convince your government to clamp down on law enforcement search powers" - and then arguing against that assumption - is where you're putting words in my mouth. It's also what makes you accusing me of bad-faith argumentation or a lack of critical thinking or context hilariously ironic.
There's nothing for me to "walk back". You blew up at me for merely suggesting that businesses which should be valuing their customers' privacy can take very easy steps to actually signal that. Whether or not they're siphoning a bunch of data to third parties is a rather strong signal of whether or not they take their customers' privacy seriously, and the fact that you are not only incapable of understanding that concept but feel compelled to resort to unwarranted hostility and personal attacks in response to it speaks volumes.
> GA is completely orthogonal to the entire discussion.
GA is literally the context of the discussion. Just because there are other ways for others to violate your customers' privacy doesn't mean it's okay to willingly and deliberately violate your customers' privacy yourself. That you not only fail to understand this but are needlessly hostile to those who do understand this speaks volumes.
If you'd like to have an actually intelligent and civil discussion instead of angrily flinging insults at me, I'd be happy to oblige. Until then, have a nice day - hopefully better than whatever tragedy you're choosing to take out on me.
When you started this comment by saying "Yeah I created a division between those two options but that's not a dichotomy!" I questioned if I should bother reading
By the time I got to the invention of "angrily flung insults", and projection about bad days I had my answer...
Because it IS news to a lot of people. And putting it in context brings home the reality and implications of tracking that many people may not be aware of.
If you've ever seen any SaaS websites where they have...
- Our Product vs Competitor 1
- Our Product vs Competitor 2
- Our Product vs Competitor 3
- Our Product vs etc...
... then you can see why this is important from an SEO perspective.
Even though I disagree with the parent, HN has strict guidelines about calling people names and I'm actually in favor of these guidelines. We all fall prey to our emotions so please just edit the comment. If HN is overflowing with clowns we have to take extra caution not to become one ourselves and to dissuade them from coming here.
That you don’t think the possibility of governments prosecuting vulnerable women seeking health care in the US using surveillance capitalist tools is a story says more about you than the article.
Because in this instance, the consequence is that this data can now enable a quasi-fascist minority to impose their religious views on others, with consequences of serious jail time for (in other states) innocent and vulnerable women.
When will people realize that surveillance capitalism is morally bankrupt (aside from also being a fraud), and that personally identifiable information is toxic waste?
Because it is centered around a highly divisive topic abortion. If it were anything else no one would care, even activities that are not widely legal. For example:
Online retailers selling marijuana products send fingerprints to Google Analytics overwhelming majority would not care
Brothels selling appointments online send fingerprints to Google Analytics overwhelming majority would not care
Online retailers selling firearms send fingerprints to Google Analytics overwhelming majority would not care
Firearms people get pissed over the tracking. Before it was more broadly legal weed people used to be pissed over that. I presume the kind people who book prostitutes online don't like the data trail either.
The reason you're hearing about of this is because HN cares a lot about abortion whereas all those other topics are of much less importance around here.
It's a story because it's a privacy violation and also a HIPAA violation.
Very similar to the case where health care providers were using Facebook trackers which was sending PII and PHI (private health info) to Facebook which has triggered multiple lawsuits.
I guess that is true, it just makes it really hard to be hopeful that things are not going downhill in multiple ways due to exactly what you said happening.
My point more is here, given what happened I am not convinced that this is enough to put up enough controversy to make the government take the necessary action.
>The country cares, but a few ultra determined parties care more.
The sooner people realize that the "ultra determined" don't actually care about the issue, the better. They care about acquiring power. Pushing on abortion was a good way to get people riled up to vote for them. The people doing the pushing were using it as a tool to manipulate voters, they do not actually care. A lot of people have been made to care, of course, but the people pulling the strings do not. Any issue that can get people passionate will be used this way.
> Pushing on abortion was a good way to get people riled up to vote for them
But why? Why did they have an audience? Why did peddling abortion restrictions cause people to vote for them?
I'll tell you why. Because we intentionally gave them an citizenry equipped with the kinds of beliefs and moral compasses with which those sorts of arguments resonate. We spent decades raising people to think that human life is infinity valuable and that even the risk of harm is tantamount to blood in the streets. We have been raising people to err on the side of restricting people's freedom in order to prevent harm, both real harm and the statistical hypothetical small harm. We have done this on purpose so that people become outraged when they hear that some employer's machinery does not conform to the latest safety standards. We have done this so that people shun people who engage in slightly dangerous behavior. Of course, everything has tradeoffs and as a side effect of this we have created a society of people who are happy to err on the side of the fetus to the detriment of the mother's bodily autonomy and vote accordingly.
I'll precede this by stating that I'm all for abortion. I'm European and the only problem I have with abortion in my country is that it's a law rather than being coded into the constitution.
That said, the way it worked in the US never made sense to me. The idea of establishing trimesters from a Supreme Court decision seems contrived to say the least, not to mention the way the relationship to the constitution was drawn.
It further baffles me how many people seem to act as if what SCOTUS did was a ban on abortion. States are free to choose, so if the country actually does care it ought to show in the ballot box.
Abortion is only illegal in 5 states of the European Union (Malta, Vatican City, Liechtenstein, Andorra, and Poland) and yet I would oppose a European law establishing the right to abortion on all of its members. It's for them to decide.
Please let me educate you, as a European, why the supreme court decision acts as a functional ban on abortion for millions of americans.
Firstly, multiple states have been preparing for the overturning of Roe v Wade, the court case which specified the right to an abortion was privacy and therefore protected. There are multiple decades-old laws on the books that says if Roe v Wade is overturned abortion is automatically outlawed in the entire state. There's no ballot-box here.
Secondly, the Supreme Court has washed its hands of multiple institutions that would allow people to vote in politicians other than politicians already in power in their respective states. The Supreme Court has struck down or otherwise narrowed national mandates curtailing racist voting policies. The Supreme Court has outright stated they will now refuse to take up any more cases about gerrymandering, which is a process where politicians get to choose who votes for them basically. This enforces that pro-choice people will always be split up into districts where anti-abortionists are the majority.
The first point creates non-democratic law activation that bans abortion, followed by curtailing the ability for people to vote against this implementation even if they are, in aggregate, the majority of the state.
Now, it's also important to follow on the third point: the united states of america is a giant country. By land mass it is larger than the entire EU. A single state will dwarf multiple countries. This means that even though you have the right to travel to a state that allows abortion, the travel is long and expensive. They will have to fly, pay money for a hotel, and also not work for a week or more.
Overall, this means a severe curtailing of abortion access to millions of people, who are disempowered as a population to participate in democracy.
Civil liberties and democracy are often at odds. Where states that have implemented a ban, it has been done democratically. The fact that it was done in a previous congressional session doesn't change that. Democracy and civil liberties are both great, but in this case it's a "pick one" situation.
>Firstly, multiple states have been preparing for the overturning of Roe v Wade, the court case which specified the right to an abortion was privacy and therefore protected. There are multiple decades-old laws on the books that says if Roe v Wade is overturned abortion is automatically outlawed in the entire state. There's no ballot-box here.
That's precisely the ballot-box. Elected officials did that.
>The Supreme Court has outright stated they will now refuse to take up any more cases about gerrymandering, which is a process where politicians get to choose who votes for them basically.
I'm sorry but gerrymandering is orders of magnitude more complex than this. There is not even a widely agreed upon position on what would constitute fair voting districts.
If you truly believe the country simply isn't democratic then its problems are simply so large in comparison I can't imagine caring about abortion at all.
The truth of the matter, I believe, is that the national divide on abortion simply isn't solved yet, SCOTUS delayed it, but even after being established as legal in the entirety of the US for a long while a good bunch of US citizens still don't agree with the legality of the practice.
Democracy is great but it’s not enough. You need some mechanism to prevent to majority from stripping away rights from everyone else. For example, in the US it is illegal for any state to permit slavery, and this prevents individual states from legalizing slavery, which IMO is a good thing. Until recently, the right to abortion was guaranteed by the right to privacy implicit in the constitution.
> Until recently, the right to abortion was guaranteed by the right to privacy implicit in the constitution.
tldr; Something created by court opinion can be ended by court opinion
Abortion was guaranteed by a decision of the Supreme Court, which was based on the majority of the court's opinion of what the Constitution says. As the makeup of the court changes, it's opinion of what the Constitution says changes. Without a Federal law or even more powerfuly, an amendment to the Constitution, abortion is left to the states and subject to 50 different constitutions, courts and legislatures. That there has not been law or amendment says that there is not a strong enough majority or super majority of Americans that want that right guaranteed by the Constitution.
Many Americans see our country as more like a single country than an EU style coalition. We’re for example expected to send money to support some of the less successful states under the justification that we can’t leave our countrymen behind. We get dragged into wars because our countrymen feel like going on an adventure.
So we also expect things like human rights to be somewhat consistent. But we seem to be on a waning trend as far as national unity goes.
My personal gripe, as a european, with how I see abortion discussion from the US is that many seem to argue for 2nd/3rd trimester abortions for any/no reason.
And with overturning ROE, I saw it more as forcing the issue to be actually resolved, rather than having a, IMO, wrongful precedent. Aka, it"s a state issue, until it is codified into federal law.
I think the parent's comment is less specifically about abortion and more specifically about developers being concerned with building anti-privacy tools that are used in a myriad of concerning things, where abortion is just one of many. So I think your comment is missing the parent's point.
Roughly half of US voters disagreed with Roe/Casey. It's not an "attack on democratic institutions" that they were able to elect politicians who shared their views; that's how democracy works.
I agree that women's reproductive choices should not be subject to control by 50.1% of voters. The problem in this case is too much democracy, not too little.
How is it part of healthcare if nobody's health is threatened in 99% of cases? Do you consider steroids healthcare? What about something like plastic surgery?
They are all similar in that they are disrupting natural bodily processes. I wouldn't call it "healthcare" when they are opposing the body. It is not very healthy for the baby in the womb.
This. A remarkable amount of medical intervention is to externally moderate natural bodily processes that, if allowed to run to their conclusion, would disrupt the body to the point of destruction.
There's nothing special and privileged about "natural" processes; if there were we wouldn't need medicine at all.
When you're diagnosed with an easily-treated cancer, be sure to not be a hypocrite and refuse medical treatment for it, because that would be disrupting natural bodily processes.
Might be good to note as well that steroids are commonly prescribed for all kinds of ailments that people have, they're objectively healthcare as well.
Honestly that is one of those things that I did not know until recently.
Like I figured there was a legitimate reason they were prescribed, but I never actually knew first hand about. Now... my cats a small dose of steroids. The examples of people in this thread have been enlightening on that subject.
But unfortunately they do have a bad reputation. I mean if you hear steroids there is likely one image that comes to mind.
Because being pregnant is actually pretty dangerous for women. It can be especially dangerous if you're in your mid-30's or older. And it's also really dangerous if you're not planning to become pregnant because babies remove essential nutrients from your body. Don't get me started on the risk of eclampsia, gestational diabetes, and post-partum depression. Babies also modify your immune system and may make you more susceptible to diseases. Delivery can be very risky too depending on the shape of your body, and some women have to undergo physically altering surgeries to deliver. Miscarriages can also kill women by causing them to bleed to death really quickly.
I think it's important to allow women to make decisions about pregnancy based on their perceived risk, rather than blithely dismissing the morning after pill as being akin to steroids.
Steroids are healthcare, and they are legitimately used for treatment of ailments.
Plastic Surgery is healthcare, as it can help treat mental disorders affected by body dysmorphia. Additionally, plastic surgery is much, much more common than you think and not always done for vanity. Even if it was, that's the individual's choice to have the procedure performed.
Do you have a source on that 99%? Most sources I'm seeing from a quick google search state that pregnancy is objectively dangerous for people that can get pregnant in many cases, much more than 1%
Plastic surgery can save you if you have severe burn wounds or deformations that came out of an accident. So yes, plastic surgery is health care.
Did you have other things in mind when listening these things?
Furthermore, 1% "health threat" is quite high of a percentage, don't you think?
Oh so I guess we shouldn't consider vitamins and making sure the baby is fine reproductive health? The entire process falls under "reproductive health". Considering the process is very much still going on until that baby comes out... one way or another.
It is deeply depressing seeing comments like this on HN. But at least I feel better seeing the reaction.
The HN title is incorrect. The original article has no mention of "fingerprints".
The title in the article is more accurate: "...Are Sharing Sensitive Data With Google". Perhaps it was updated later. Or there was some misuse of the word "fingerprint" (i.e. browser/device fingerprint, opposed an actual scan of your finger).
I think the title is probably sensationalized and should be edited to match the page per the typical rules. I suspect good intent here though where this probably means "fingerprints" in the technical sense and the article does talk about that.
I disagree with your framing. It costs resources to target specific companies even small ones. Google has ALL the data on ALL the pharmacies. You get it from them and just not bother with each individual company
It's worth thinking about, but it's hard to say. Perhaps Google would voluntarily turn over the info without a search warrant, and/or would do it quietly without telling the customer even if not required by law to keep it quiet -- but the small pharmacy with the relationship with its customers would not. Perhaps law enforcement already has a relationship with google and established channels for accessing this info, whether with or without a court order.
> Perhaps Google would voluntarily turn over the info without a search warrant
Not in general in this scenario. Google has made exceptions in the past (generally around an emergency with threat to life involved), but they're reluctant to make such exceptions for even federal LEO. State-level LEO, which is who would be making these requests, has far less leverage over Google; they could make it harder for Google to do business in their state, but (a) the states we're talking about are doing that already, so Google cares less about a lever that's already being pulled and (b) the states don't have higher authority to appeal to (what are they gonna do, try to make a Supreme Court case out of noncompliance with... A warrantless data request?).
I'm AMAZED at the comments here. I see two common ones: 1) this is news? and 2) no experts used. Both are just insane.
For 1) not everyone is tech literate. You're telling me that everyone you know also knows that companies like Google, Apple, Amazon, Netflix, etc are capturing your data across the web? That they can (almost) uniquely identify you? You've probably been living in SV your entire life and never traveled around the bay -- or further -- if that is an honest statement. This statement comes off as self serving, saying that _you_ know better. Maybe the article isn't for you, and that's okay. You don't have to comment. The comment section may not be for you either. Post if you can _contribute_ to the discussion, otherwise don't.
For 2) I understand the concern, but ProPublica has long worked with topics like these and legal issues. I guarantee you that their staff has enough expertise to understand what browser fingerprints are. That's really not a high bar so your screams for experts are falling short. They list the tool they used and the websites in question. Your calls for expertise will raise if you give reason to them by pointing out how a tool might be flawed and/or that websites are actually capturing fingerprints like the article claims (but that can change after the article's release). So if you want to disprove the article disprove it instead of making a call to authority. Otherwise you're just noise.
Ironically these two types of posts are in direct contradiction to one another. But can we please stop and actually discuss the article instead of you? This is a stupid flame war and most of us just want to discuss the actual contents of the article. Please don't even respond to this, just participate in the conversation to the actual contents of the article.
You don't have to be tech literate to know that the man spies on you. Hell you don't even need to be literate.
I worked in construction about a decade ago when the Snowden thing was big and I asked a construction worker with a grade 10 education from a rural part of Canada what he thought of it and he chortled before saying 'of course they're spying on us. They've always been spying on us.'
Meanwhile I have a friend who is a lawyer for the federal govt and this guy just can't seem to grasp anything regarding privacy law and why people care about itm. Meanwhile he's flabbergasted that Madison Square Gardens has the technical means and gall to kick out any lawyers tenuously related to legal action against them.
At some point people are responsible for their level of ignorance. I dont know where that point is but I'm sure that it exists.
> You don't have to be tech literate to know that the man spies on you.
The article is about __HOW__ the man spies on you.
> At some point people are responsible for their level of ignorance
Sure, but my point is that we shouldn't enable that ignorance by making people feel stupid for not already knowing. That's not helpful to anyone involved. I'd explicitly consider this a worse position, which is why I'm complaining.
Oh BROWSER fingerprints. I thought the headline meant actual fingerprints from your hand. The "fingerprints" word is not in the current headline on propublica.org...
I understand the specific relevance of abortion pills given the taliban nature of some US states, but this is a general issue: healthcare companies have no business embedding 3rd party content on any of their sites, unless those are - maybe - HIPPA compliant authentication services (again maybe)
HIPAA doesn't prevent law enforcement from acquiring data in the interests of a criminal prosecution. Meanwhile, the data as currently silo'd is not sufficient to figure out who somebody is (ad companies are real keen on that, because they don't want the sites they serve to harvest ad data on their users and side-step the ad services; as a result, the fingerprints are usually double-blinded in a way such that only the user's browser can aggregate enough data to "know" who the user is).
115 comments
[ 0.20 ms ] story [ 209 ms ] threadWhy is this even a story?
We can't just wipe it away with "we already know this is happening" when its wrong in the first place.
Hell, now some websites even default to "non-required" tracking off, and literally do not require you to do anything to limit the data they harvest from you. And I'm pretty sure this is some third party's drop in solution.
GDPR doesn't specify UX.
But if they are headquartered outside the US like many online pharmacies are, likely they are going to just ignore any law enforcement requests for user data.
Putting myself in the shoes of an online pharmacy selling abortion meds, I would be crazy to headquarter in the US. I'd be surprised if even a few were US-based.
[1] https://www.techdirt.com/2017/03/17/judge-grants-search-warr...
This entire premise of this article advantage of people who aren't technically inclined and can't know well enough to realize that reverse engineering GA fingerprints is not even close to how the government would de-anonymize visitors.
If your local government decides to overreach and find out who's getting abortion pills, Google Analytics will not even be your 1000th biggest problem. ISPs will readily share which sites people visit, the stores themselves will get leaned on, your mail carrier with share where you get packages from.
I mean did you even read the article? "Abortion Ease, BestAbortionPill.com, PrivacyPillRX, PillsOnlineRX, Secure Abortion Pills, AbortionRx, Generic Abortion Pills, Abortion Privacy and Online Abortion Pill Rx."
What do you think HTTPS is going to do when one of these urls shows up in your traffic, email inbox, and a reverse mail address look up leads to one of these?
Putting words in my mouth has got to be the worst faith argument I've seen in a minute.
> If your local government decides to overreach and find out who's getting abortion pills, Google Analytics will not even be your 1000th biggest problem. ISPs will readily share which sites people visit, the stores themselves will get leaned on, your mail carrier with share where you get packages from.
And it's much easier for website operators to stop using Google Analytics than it is for them to educate their customers on using VPNs and mailing their packages to dead drops (let alone for their customers to actually do those things).
This ain't about dichotomies or the lack thereof. This is about what people can do now to mitigate low-hanging fruit. Nobody said the solution is only to stop using GA; literally all that was actually said is that not using GA is something that the operators of such stores can trivially and immediately do.
That is:
> What do you think HTTPS is going to do when one of these urls shows up in your traffic, email inbox, and a reverse mail address look up leads to one of these?
The existence of problems outside your control does not erase the existence of problems entirely within your control. Website operators cannot force you to use a VPN or a secure email or an anonymous address. They can minimize the data of yours they're sending to third parties.
> I mean did you even read the article?
I mean did you even read the HN guideline specifically prohibiting such a question?
"it's much easier to not use Google Analytics than it is to convince your government to clamp down on law enforcement search powers."
You literally wrote a one sentence comment that compares a decision for website owners to choose between not using GA and convincing their government not to clamp down on law enforcement search powers. I didn't put a single word in your mouth in stating what I did.
You wanting to walk back what you wrote doesn't make my comment put words in your mouth, they were the words you said.
> And it's much easier for website operators to stop using Google Analytics than it is for them to educate their customers on using VPNs and mailing their packages to dead drops (let alone for their customers to actually do those things).
GA is completely orthogonal to the entire discussion. That's the point that ProPublica (intentionally?) ignores, and apparently you're just unaware of.
It's doing literally nothing to protect or harm these people, because the government is not stooping to deanonymizing GA data when there are 1001 more direct and better established methods to achieve the same thing, it's a frankly absurd point.
Saying by not using GA they're even tangentially protecting customers shows a complete lack of understanding of why this government overreach is such a problem.
-
tl;dr/too technical;didn't understand: The government doesn't need your GA fingerprint they can get the things that the fingerprint is made and then some straight from Google... and your ISP... and the site's host... and the mail services.. and the list goes on.
They can literally ask for all people who searched for a given term in a 5 block radius and you're trying to talk about hashed fingerprints???
It's like worrying that the government is going to check for your DNA in the toilet at a local restaurant when the establishment can be compelled to give them a receipt with your card details, your bank will give them the transaction details, your search history with the restaurant name is up for grabs, the municipal security cameras that watched you drive up are up for grabs...
-
Once you understand that then the pointlessness of this line of reasoning comes up, and why ProPublica is doing this becomes more questionable.
By inventing some totally ludacris wrong, they're painting themselves as having uncovered some unique in-depth aspect to the dynamic between these abortion pill sites and their users, but to do so they're painting the sites as negligent with the most inane stretch of logic possible.
Instead of focusing more on the actual problem, the overreach, they create a new boogeyman because it gives their reporting a unique angle. But of course that boogeyman is serving the interests of people who are having their rights stomped on.
By completely misunderstanding the topic (and in ProPublica's case I'm not buying it was unintentional) both you and the article are just throwing FUD into the actual conversation that matters.
It's annoying to see supposedly creditable publications intentionally muddy things for their own benefit, and it's even more annoying to see people with a poor grasp of the situation just run with it blindly without taking 5 seconds to apply critical thinking and context to it all.
Right, and note what I didn't say:
- Whether or not those things are a dichotomy or otherwise mutually exclusive
- Whether or not those things encompass the complete set of privacy violations or the mitigations thereof
Your assumption that I've made or even implied answers to either of those within the words "it's much easier to not use Google Analytics than it is to convince your government to clamp down on law enforcement search powers" - and then arguing against that assumption - is where you're putting words in my mouth. It's also what makes you accusing me of bad-faith argumentation or a lack of critical thinking or context hilariously ironic.
There's nothing for me to "walk back". You blew up at me for merely suggesting that businesses which should be valuing their customers' privacy can take very easy steps to actually signal that. Whether or not they're siphoning a bunch of data to third parties is a rather strong signal of whether or not they take their customers' privacy seriously, and the fact that you are not only incapable of understanding that concept but feel compelled to resort to unwarranted hostility and personal attacks in response to it speaks volumes.
> GA is completely orthogonal to the entire discussion.
GA is literally the context of the discussion. Just because there are other ways for others to violate your customers' privacy doesn't mean it's okay to willingly and deliberately violate your customers' privacy yourself. That you not only fail to understand this but are needlessly hostile to those who do understand this speaks volumes.
If you'd like to have an actually intelligent and civil discussion instead of angrily flinging insults at me, I'd be happy to oblige. Until then, have a nice day - hopefully better than whatever tragedy you're choosing to take out on me.
By the time I got to the invention of "angrily flung insults", and projection about bad days I had my answer...
Either the writer or an editor who ultimately decided on the headline.
If you've ever seen any SaaS websites where they have...
- Our Product vs Competitor 1
- Our Product vs Competitor 2
- Our Product vs Competitor 3
- Our Product vs etc...
... then you can see why this is important from an SEO perspective.
The privacy implications here are totally different than for a travel blog.
When will people realize that surveillance capitalism is morally bankrupt (aside from also being a fraud), and that personally identifiable information is toxic waste?
This is so far beyond "Don't Be Evil" . . .
Online retailers selling marijuana products send fingerprints to Google Analytics overwhelming majority would not care
Brothels selling appointments online send fingerprints to Google Analytics overwhelming majority would not care
Online retailers selling firearms send fingerprints to Google Analytics overwhelming majority would not care
The reason you're hearing about of this is because HN cares a lot about abortion whereas all those other topics are of much less importance around here.
Breaking news: the business is a gym, and the area includes the showers.
It's a story because it's a privacy violation and also a HIPAA violation.
Very similar to the case where health care providers were using Facebook trackers which was sending PII and PHI (private health info) to Facebook which has triggered multiple lawsuits.
https://themarkup.org/pixel-hunt/2022/06/16/facebook-is-rece...
It's great that some light is being shined on these violations. You can't just put spyware tracking on sensitive websites.
My point more is here, given what happened I am not convinced that this is enough to put up enough controversy to make the government take the necessary action.
The sooner people realize that the "ultra determined" don't actually care about the issue, the better. They care about acquiring power. Pushing on abortion was a good way to get people riled up to vote for them. The people doing the pushing were using it as a tool to manipulate voters, they do not actually care. A lot of people have been made to care, of course, but the people pulling the strings do not. Any issue that can get people passionate will be used this way.
But why? Why did they have an audience? Why did peddling abortion restrictions cause people to vote for them?
I'll tell you why. Because we intentionally gave them an citizenry equipped with the kinds of beliefs and moral compasses with which those sorts of arguments resonate. We spent decades raising people to think that human life is infinity valuable and that even the risk of harm is tantamount to blood in the streets. We have been raising people to err on the side of restricting people's freedom in order to prevent harm, both real harm and the statistical hypothetical small harm. We have done this on purpose so that people become outraged when they hear that some employer's machinery does not conform to the latest safety standards. We have done this so that people shun people who engage in slightly dangerous behavior. Of course, everything has tradeoffs and as a side effect of this we have created a society of people who are happy to err on the side of the fetus to the detriment of the mother's bodily autonomy and vote accordingly.
In short, we are reaping exactly what we sowed.
I have not noticed this. Risky behavior now has challenges on tiktok. Heroin is popular again.
That said, the way it worked in the US never made sense to me. The idea of establishing trimesters from a Supreme Court decision seems contrived to say the least, not to mention the way the relationship to the constitution was drawn.
It further baffles me how many people seem to act as if what SCOTUS did was a ban on abortion. States are free to choose, so if the country actually does care it ought to show in the ballot box.
Abortion is only illegal in 5 states of the European Union (Malta, Vatican City, Liechtenstein, Andorra, and Poland) and yet I would oppose a European law establishing the right to abortion on all of its members. It's for them to decide.
Firstly, multiple states have been preparing for the overturning of Roe v Wade, the court case which specified the right to an abortion was privacy and therefore protected. There are multiple decades-old laws on the books that says if Roe v Wade is overturned abortion is automatically outlawed in the entire state. There's no ballot-box here.
Secondly, the Supreme Court has washed its hands of multiple institutions that would allow people to vote in politicians other than politicians already in power in their respective states. The Supreme Court has struck down or otherwise narrowed national mandates curtailing racist voting policies. The Supreme Court has outright stated they will now refuse to take up any more cases about gerrymandering, which is a process where politicians get to choose who votes for them basically. This enforces that pro-choice people will always be split up into districts where anti-abortionists are the majority.
The first point creates non-democratic law activation that bans abortion, followed by curtailing the ability for people to vote against this implementation even if they are, in aggregate, the majority of the state.
Now, it's also important to follow on the third point: the united states of america is a giant country. By land mass it is larger than the entire EU. A single state will dwarf multiple countries. This means that even though you have the right to travel to a state that allows abortion, the travel is long and expensive. They will have to fly, pay money for a hotel, and also not work for a week or more.
Overall, this means a severe curtailing of abortion access to millions of people, who are disempowered as a population to participate in democracy.
That's precisely the ballot-box. Elected officials did that.
>The Supreme Court has outright stated they will now refuse to take up any more cases about gerrymandering, which is a process where politicians get to choose who votes for them basically.
I'm sorry but gerrymandering is orders of magnitude more complex than this. There is not even a widely agreed upon position on what would constitute fair voting districts.
If you truly believe the country simply isn't democratic then its problems are simply so large in comparison I can't imagine caring about abortion at all. The truth of the matter, I believe, is that the national divide on abortion simply isn't solved yet, SCOTUS delayed it, but even after being established as legal in the entirety of the US for a long while a good bunch of US citizens still don't agree with the legality of the practice.
"Only" about 6 in 10 US citizens are pro-choice.
https://www.pewresearch.org/fact-tank/2022/07/15/key-facts-a...
except in certain cases
tldr; Something created by court opinion can be ended by court opinion
Abortion was guaranteed by a decision of the Supreme Court, which was based on the majority of the court's opinion of what the Constitution says. As the makeup of the court changes, it's opinion of what the Constitution says changes. Without a Federal law or even more powerfuly, an amendment to the Constitution, abortion is left to the states and subject to 50 different constitutions, courts and legislatures. That there has not been law or amendment says that there is not a strong enough majority or super majority of Americans that want that right guaranteed by the Constitution.
So we also expect things like human rights to be somewhat consistent. But we seem to be on a waning trend as far as national unity goes.
And with overturning ROE, I saw it more as forcing the issue to be actually resolved, rather than having a, IMO, wrongful precedent. Aka, it"s a state issue, until it is codified into federal law.
I agree that women's reproductive choices should not be subject to control by 50.1% of voters. The problem in this case is too much democracy, not too little.
Citation needed.
2/3rds of US voters did not support overturning Roe. [1]
[1] https://maristpoll.marist.edu/polls/npr-pbs-newshour-marist-...
Being able to get "abortion pills" is very much part of proper reproductive healthcare
Being forced to carry a pregnancy to term can cause bodily issues, psychological, and financial issues.
Or you know... just let a woman choose what they want to do with their body?
Plastic surgery is perfectly legal and you are fine to do it.
Steroids have shown averse and life threatening affects and really should only be prescribed.
I'd be interested in some scholarly sources regarding the efficacy of the information you're describing.
There's nothing special and privileged about "natural" processes; if there were we wouldn't need medicine at all.
Come back and re-read this sentence if you ever get cancer.
Sucks to be a parasite I guess
Like I figured there was a legitimate reason they were prescribed, but I never actually knew first hand about. Now... my cats a small dose of steroids. The examples of people in this thread have been enlightening on that subject.
But unfortunately they do have a bad reputation. I mean if you hear steroids there is likely one image that comes to mind.
Far more than 1% of pregnancies carry health risks. Not only that women denied abortions are more likely to have complications during their pregnancy.
> Do you consider steroids healthcare?
Do you not? I've been given steroids for allergies, rashes, and muscle injuries.
> What about something like plastic surgery?
How is surgery anything but healthcare?
Indeed; I'd put it at about 100%. Pregnancy is no joke.
I think it's important to allow women to make decisions about pregnancy based on their perceived risk, rather than blithely dismissing the morning after pill as being akin to steroids.
Plastic Surgery is healthcare, as it can help treat mental disorders affected by body dysmorphia. Additionally, plastic surgery is much, much more common than you think and not always done for vanity. Even if it was, that's the individual's choice to have the procedure performed.
Do you have a source on that 99%? Most sources I'm seeing from a quick google search state that pregnancy is objectively dangerous for people that can get pregnant in many cases, much more than 1%
Furthermore, 1% "health threat" is quite high of a percentage, don't you think?
It is deeply depressing seeing comments like this on HN. But at least I feel better seeing the reaction.
The title in the article is more accurate: "...Are Sharing Sensitive Data With Google". Perhaps it was updated later. Or there was some misuse of the word "fingerprint" (i.e. browser/device fingerprint, opposed an actual scan of your finger).
Seems like it would be easier for LE to threaten a small pharmacy versus a big corp like google.
Not in general in this scenario. Google has made exceptions in the past (generally around an emergency with threat to life involved), but they're reluctant to make such exceptions for even federal LEO. State-level LEO, which is who would be making these requests, has far less leverage over Google; they could make it harder for Google to do business in their state, but (a) the states we're talking about are doing that already, so Google cares less about a lever that's already being pulled and (b) the states don't have higher authority to appeal to (what are they gonna do, try to make a Supreme Court case out of noncompliance with... A warrantless data request?).
They review, question, narrow, and reject requests for user info. They also notify users unless prevented by a court.
https://policies.google.com/terms/information-requests?hl=en
For 1) not everyone is tech literate. You're telling me that everyone you know also knows that companies like Google, Apple, Amazon, Netflix, etc are capturing your data across the web? That they can (almost) uniquely identify you? You've probably been living in SV your entire life and never traveled around the bay -- or further -- if that is an honest statement. This statement comes off as self serving, saying that _you_ know better. Maybe the article isn't for you, and that's okay. You don't have to comment. The comment section may not be for you either. Post if you can _contribute_ to the discussion, otherwise don't.
For 2) I understand the concern, but ProPublica has long worked with topics like these and legal issues. I guarantee you that their staff has enough expertise to understand what browser fingerprints are. That's really not a high bar so your screams for experts are falling short. They list the tool they used and the websites in question. Your calls for expertise will raise if you give reason to them by pointing out how a tool might be flawed and/or that websites are actually capturing fingerprints like the article claims (but that can change after the article's release). So if you want to disprove the article disprove it instead of making a call to authority. Otherwise you're just noise.
Ironically these two types of posts are in direct contradiction to one another. But can we please stop and actually discuss the article instead of you? This is a stupid flame war and most of us just want to discuss the actual contents of the article. Please don't even respond to this, just participate in the conversation to the actual contents of the article.
I worked in construction about a decade ago when the Snowden thing was big and I asked a construction worker with a grade 10 education from a rural part of Canada what he thought of it and he chortled before saying 'of course they're spying on us. They've always been spying on us.'
Meanwhile I have a friend who is a lawyer for the federal govt and this guy just can't seem to grasp anything regarding privacy law and why people care about itm. Meanwhile he's flabbergasted that Madison Square Gardens has the technical means and gall to kick out any lawyers tenuously related to legal action against them.
At some point people are responsible for their level of ignorance. I dont know where that point is but I'm sure that it exists.
The article is about __HOW__ the man spies on you.
> At some point people are responsible for their level of ignorance
Sure, but my point is that we shouldn't enable that ignorance by making people feel stupid for not already knowing. That's not helpful to anyone involved. I'd explicitly consider this a worse position, which is why I'm complaining.
To somebody not tech literate, how big a difference is there between COVID tracking chips and the Google tracking cookies in online pharmacies?
HIPAA doesn't prevent law enforcement from acquiring data in the interests of a criminal prosecution. Meanwhile, the data as currently silo'd is not sufficient to figure out who somebody is (ad companies are real keen on that, because they don't want the sites they serve to harvest ad data on their users and side-step the ad services; as a result, the fingerprints are usually double-blinded in a way such that only the user's browser can aggregate enough data to "know" who the user is).
So, your bill from buying medical devices or drugs will be available as plaintext to Big Tech even if you block analytics third-parties.