from Hacker News

Tracking Sex: Implications of widespread data leakage and tracking on porn sites

by interweb on 7/30/19, 12:57 PM with 222 comments

  • by _b4ut on 7/30/19, 7:35 PM

    Maybe a good moment to commemorate the infamous RedTubeGate from 2013 in Germany:

    A couple lawyers and fishy business men launch an ad campaign on RedTube. Through that advertisement they collected IP addresses of visitors.

    Before launching that campaign they allegedly bought the rights for three cheap porn flicks.

    Now they also claim that they have some miraculous software which allows them to track who has been watching those flicks on RedTube. They even get a totally unclear blueprint for that software officially certified by a surveyor. [4]

    Then they appeal to a court in Cologne for the real world addresses corresponding to the IP addresses arguing they can prove those poor schmocks watched their illegally uploaded crap flicks.

    Suddenly thousands of people receive letters threatening legal action if they do not agree on paying a fee of 250 Euro. Many people comply out of fear for their reputation and just pay.

    1: https://web.archive.org/web/20140822000304/http://www.wbs-la...

    2: https://www.joyofdata.de/blog/tool-visualization-connections...

    3: https://web.archive.org/web/20140911214044/http://www.cracka...

    4: https://www.abmahnhelfer.de/wp-content/uploads/2013/12/EV.pd...

    (many of the original sources have been deleted and are only available through archive.org)

  • by pessimizer on 7/30/19, 4:30 PM

    Mindgeek runs all of the biggest porn sites, and also runs its own ad network. Since the biggest of those sites are their "tube" sites, they run into the same issues as youtube when it comes to tracking individual tastes. Since the product is porn, which is very easily classifiable with a list of the physical features of actors (with maybe a few behavioral distinctions), the actors in the video, how they are matched ("how" doing a lot of heavy lifting here) and possibly director, producer, and age of content, it would be easy for them to have a very specific dossier on all users. Moreover, it would be financially beneficial, because it'd be easy to maximize engagement with that stuff and a past record of engagement time, and that information would also aid conversions to their other paysite products (of which there are many.) The fact that they run so many paysites probably means they can associate specific sexual tastes (and schedules) with a credit card number.

    Mindgeek have also shown themselves to be extremely savvy technologists, so this stuff is probably already being done. If it's your own ad network, is it really a third party, though? The plethora of domains does give the user the impression that they're leaving one business and moving to another, when it's really more akin to switching rooms.

    example of unexpected situation: I used a credit card to join vanillanormalromance.com, but I watch weird stuff on redtube.

    -----

    edit: for some reason it didn't occur to me, but there would clearly be an interest to sell these categories to other porn sites, facebook-style, generating even more info from people not on Mindgeek sites.

    I feel like I remember a few Mindgeek/Manwin devs being good HN posters.

  • by johnedwards on 7/30/19, 4:26 PM

    Some friends noted that this had been up on HN for three hours with no comments. So I decided to read the paper and note some highlights.

    > What Jack does not know is that incognito mode only ensures his browsing history is not stored on his computer. Œe sites he visits, as well as any third-party trackers, may observe and record his online actions.

    > ‘30% of all the data transferred across the internet is porn,’ with site YouPorn using six times more bandwidth than Hulu (Kleinman, 2017)

    > Herein, we take such a ‘sex positive’ view of porn and access to online pornography. While acknowledging the many racist, misogynistic, heteronormative and other problematic histories and themes in pornography and its production, distribution and consumption, our work recognizes the ubiquity and permanence of porn and its many uses and social functions, and the danger of societal, state, and institutional narratives that might work to discipline gender and sex.

    > To identify third-parties found on a given website we used the webXray software platform. webXray 'is a tool for analyzing thirdparty content on web pages and identifying the companies which collect user data’ (webXray, 2018)

    > We used four coders from diverse backgrounds: one primary researcher and three volunteers. Three coders were women (one identifed her sexuality as fluid; the others as queer), and one was a heterosexual man.

    > Coders were instructed to code Presence for: ‘Any word or phrase that indicates or suggests the porn content will feature a specifc gender or sexual identity, orientation, or preference,’ and/or ‘Any word or phrase that indicates or suggests the porn content will feature a specifc sexual focus, body part or type, identity or character (like race, nationality, ethnicity, religion, profession), act, fetish, interest, porn genre, porn trope, etc.

    >Our March 2018 analysis successfully examined 22,484 sites drawn from the Alexa list of one million most popular websites where the URL, page title, or page description includes ‘porn.’ We found third-party tracking is widespread, privacy policies are difficult to understand and do not disclose such tracking, and third-parties may often be able to infer specifc sexual interests based solely on a site URL.

    > We identified 230 different companies and services tracking users in our sample. Such tracking is highly concentrated by a handful of major companies, some of which are pornography-specifc. Of non-pornography-specifc services, Google tracks 74% of sites, Oracle 24%, Facebook 10%, Cloudflare and Yadro 7%, and New Relic and Lotame 6%. Porn-specific trackers in the top ten are exoClick (40%), JuicyAds (11%), and EroAdvertising (9%).

    > Based on a random sample, 44.97%of porn site URLs expose or strongly suggest the site content includes or targets one or more specific gender or sexual: identities or orientations, and/or topic(s) of interest/focus.

    > We contend that the tracking of online porn consumption represents an even riskier violation of privacy, in line with Citron’s (2019:1870,1881) argument that: "Sexual privacy sits at the apex of privacy values because of its importance to sexual agency, intimacy, and equality. We are free only insofar as we can manage the boundaries around our bodies and intimate activities… It therefore deserves recognition and protection, in the same way that health privacy, financial privacy, communications privacy, children’s privacy, educational privacy, and intellectual privacy do."

    > For example, same-sex relations between consenting adults are criminalized in 70 United Nations member states, with punishments ranging from imprisonment to death (Fox et al., 2019). Thee consequences of sexual privacy violations in such contexts would clearly be severe. Even in societies with less regulation around sex, breaches of sexual privacy often have bodily stakes

    > Porn website privacy policies are long, dense, difficult to understand, and only 11% of the third-parties observed tracking users on a given page are listed in the policy, leaving users ignorant of which organizations may be assembling catalogues of their perceived sexual interests

    Edit: I have been adding to this comment as I read the study. I do have other things to do today.

  • by octosphere on 7/30/19, 4:09 PM

    > This paper explores tracking and privacy risks on pornography websites. Our analysis of 22,484 pornography websites indicated that 93% leak user data to a third party. Tracking on these sites is highly concentrated by a handful of major companies, which we identify. We successfully extracted privacy policies for 3,856 sites, 17% of the total. The policies were written such that one might need a two-year college education to understand them. Our content analysis of the sample's domains indicated 44.97% of them expose or suggest a specific gender/sexual identity or interest likely to be linked to the user. We identify three core implications of the quantitative results: 1) the unique/elevated risks of porn data leakage versus other types of data, 2) the particular risks/impact for vulnerable populations, and 3) the complications of providing consent for porn site users and the need for affirmative consent in these online sexual interactions.

  • by meruru on 7/30/19, 4:20 PM

    The hentai sites I tend to use are pretty good in this regard I think. Most of them even work with no JS. E.g. https://danbooru.donmai.us https://e-hentai.org

    Edit: I tried visiting them without adblock and I'm actually surprised they didn't even have ads.

  • by bfirsh on 7/30/19, 4:17 PM

    Here's an HTML version if you're on a phone: https://www.arxiv-vanity.com/papers/1907.06520/

  • by bitxbitxbitcoin on 7/30/19, 4:15 PM

    Looks like everyone - vulnerable population or not - should be using VPN when viewing pornographic content.[1]

    [1] https://www.privateinternetaccess.com/blog/2019/07/why-you-n...

  • by tdy721 on 7/30/19, 5:15 PM

    I always liked how thepiratebay.org seemed to make that tracking really transparent. Visit that site on a machine and observe the advertising. It’s not the deep shadow fingerprint we evolved into. But it’s something that has informed me over the years.

    Just visited on my mobile and didn’t get the same effect. It was different back in the day.

  • by wruza on 7/30/19, 4:23 PM

    At least it serves its main goal. Youtube is far behind with their stupid suggestions than any major porn aggregator.

  • by 300IQGAMER on 7/30/19, 7:05 PM

    I assume most people won’t sign up with their work or personal email or otherwise put revealing info on a porn site, so is this really an issue?

  • by 300IQGAMER on 7/30/19, 7:07 PM

    I doubt people use personal email or put other revealing info on those sites anyway. Would this be an issue if you didn’t?

  • by homakov on 8/1/19, 12:10 AM

    What does porn have to do with sex though?

  • by kingkawn on 7/30/19, 4:24 PM

    I've assumed (without evidence, only deduction) since the 90s that every pornographic thing anyone has ever looked at has been recorded for future blackmail use against social rebellions.

  • by jstewartmobile on 7/30/19, 5:07 PM

    Between Stormy Daniels, "grab 'em by the p", and Epstein's community service for pedophilia, perhaps we are living in a post-blackmail era?

    NXVIM, pizzagate, Weinstein, Epstein, the Catholic Church--all I see now are echoes of Elizabeth Bathory and feudalism.

  • by thanatropism on 7/30/19, 4:13 PM