This proposal coupled with phasing out third-party cookies inconveniences competitors, while allowing Google to continue gobbling up user data without disruption, because their tracking capabilities are way past needing any cookies, or this new cohort API.
Google only cares about privacy, when it disproportionately hurts the competition. Meanwhile they are using their leverage to infect web standards with a tracking proposal, and they market it as a privacy win.
Features used exclusively for tracking have no place among web standards, cohort-based or otherwise.
This looks to me as a way for Google to drastically increase their reach and track even more data about their "users".
They want the browser to "discover" the users interests automatically during browsing. For a page to be excluded from this, the page author would have to set a new policy header.
And then your browser reports these interest to whatever tracker (for example Google) asks for the information.
Suddently Google can learn about what you're browsing even if GA is blocked.
I think that's a good observation. That they don't need cookies or this proposal. So, anything that performs less well than cookies hurts them less than their competitors.
"Serial killer may have found a life-friendly substitute to knives."
No but seriously, does being in a group of "thousands" of people really preserve privacy particularly well? It seems quite likely that with groups that small, membership itself could be considered privacy-compromising, e.g., a group of people that all have some medical condition.
At the most fundamental level, I feel like if you know which advertisments are targetted to me, and those advertisements are well-targeted, then my privacy has been invaded.
It seems to me there is a fundamental conflict between good targetted ads and protection of privacy.
> The company said Monday that tests of FLoC to reach audiences show that advertisers can expect to see at least 95% of the conversions per dollar spent on ads when compared to cookie-based advertising. FLoC uses machine learning algorithms to analyze user data and then create a group of thousands of people based off of the sites that an individual visits. The data gathered locally from the browser is never shared. Instead, the data from the much wider cohort of thousands of people is shared, and that is then used to target ads.
If I was an advertiser I would have serious doubts about this, especially after the fact that ad spend on popular platforms have had no impact on many firm's bottom line.
I guess this is a response to all the pushbacks and dwindling PPC revenues from an increasingly wary advertisers who have quite possibly been duped into transferring their cash to Google & others over the decade.
> It seems to me there is a fundamental conflict between good targeted ads and protection of privacy.
True, but it is too much to ask Google to throw "the baby out with the bath water", as it were. For all their faults, I am encouraged that Android and Chrome, if no other product team at Google, is pioneering Federated Learning [0], Differential Privacy [1], and now are pushing ahead with Privacy Sandbox [2]. I wholeheartedly agree it simply isn't enough, but it is substantially better than what's in-use right now.
Like everyone else though, I am worried for the same reason I dislike AMP (accelerated mobile pages) despite it bringing noticeably better user-experience for many: Google has this nasty tendency to make things seem more "open", "benevolent", and "private" than they really are.
> True, but it is too much to ask Google to throw "the baby out with the bath water", as it were.
No it isn't, the 'baby' of targetted adverts is a net negative for society. We'd be net better off if most googlers just retired and spent their days digging holes and filling them in again. It is not "too much to ask" that people stop messing up society even if it's making them billions.
The problem is not the option to place cookies per se. The issue is its misuse which aims to de-anonymize users (in order to place ads).
I don't see how saving the user data somewhere else (in a browser add-on or in the browser natively) is helping here.
EDIT:
The official description [https://github.com/WICG/floc], does a better job in explaining the point.
They try to cluster (="cohort") users interests and exchange that with the ad-service.
This could maybe help to increase transparency and authority over your data as it's saved locally.
But I don't see a way to limit the access to the users cohorts (they even say that themself, see link above). Everybody could access my interests - not just Google and other ad services.
And of course, if you have 1000 categories and some meta information (region based on IP address etc.), you will be able to track down individual users with pretty good accuracy.
Rather than giving the advertiser a list of my interests, it'd be nice if the advertiser gave me a list of keywords for the ads it might show next and my browser requests the ad for me. A default browser could then be configured to learn with a thumbs up / thumbs down / never show me again type of Bayesian training. Or a non-mainstream browser could request random ads.
But most people would never up/down the ad, which means the ad would be targeted more randomly, which means it wouldn't be as effective, which means the website/content owner wouldn't get as much money for displaying it.
I don't think that solution works in the current environment, unfortunately.
They would never implement it because there is no valid signal here. The vast majority of users would just thumbs down every ad they see because they believe that will result in less ads.
Go check out the messaging around Ad Choices and how poorly it ended up working.
Ad networks are in business based on ad performance, which is driven by the user. Even though there's quite a lot of terrible UX with online ads (for lots of reasons), the user does matter more than you think.
As of today, some ads pay per click (CPC), but most ad spots pay per 1000 views (CPM). Ads can influence behavior after they are viewed, regardless of whether the user decides to interact with the ad. I'm sure Google has put tons of effort into trying to tie ad views to purchases, both online and offline (I bet GMail and Google Pay are leveraged for this).
I am not claiming this is good or bad, but clicks are not a good enough signal of efficacy for the vast majority of ads shown on the internet.
A good ad network's JS should be able to tell how long the ad was in the viewing portal, or for a video interstitial how long it played before the viewer skipped the end. That sort of signal could be useful, especially the way many sites use horizontal ad banners like horizontal rules in the pages.
That's for sure, and more fringe interests would still be more informative than more mainstream interests, too. It wouldn't be as direct and therefore provides a bit of a barrier.
From the Github page:
>Browsers would need a way to form clusters that are both useful and private
>The browser uses machine learning algorithms to develop a cohort based on the sites that an individual visits.
To me it sound like just another layer of indirection with google right in the center of it.
Even if this method works well enough from an advertising perspective, i expect there will soon be adverserial models to deanonymize.
Plus, if each cohort is a “group of [merely] thousands of people [any the worldwide internet population]”, the advertiser could probably narrow your identity pretty well using passive fingerprinting of cohort(s) + IP address + Chrome version + OS + OS version and maybe HTTP headers for languages locale and time zone, though those are probably strongly correlated with the client IP address.
According to the specs, the requests are made without user agent headers, leaving only IP address. Targeting ads based on IP address isn't particularly valuable to ad networks if they can't correlate it with anything other than the sandboxed cohort data.
If you give me a demographic group (age, sex, income, etc) of a thousand people, and give me the IP address I can uniquely identify the individual within that group using outside data sources like Experian.
What insane ramblings is this? Every site will be forced to use an approved CDN? Adding forced MitM to every connection is the opposite of what we should be trying to implement.
If you want to prevent fingerprinting, you need to look at where the identifying bits are coming from. (ex: https://coveryourtracks.eff.org/) The IP address provides enough bits to uniquely identify many users, and when combined with just a few more bits, to identify almost anyone.
> Browsers would need a way to form clusters that are both useful and private >The browser uses machine learning algorithms to develop a cohort based on the sites that an individual visits.
How would FLoC audience targeting work in non-chrome browsers? DV360 users deliver ads on all browsers, no?
FLoC is a proposal for a web standard, which other browsers could implement.
Today, in browsers where third party cookies were removed without replacement, companies like Google that aren't willing to fingerprint have pretty limited user targeting capabilities.
Does that mean advertisers using DV360 will have the option to target using known identifiers or FloC? Chrome market share in the US is 50%. FloC covers 50% of the total US market. Advertisers want all the scale. https://www.statista.com/statistics/276738/worldwide-and-us-...
Doesn't DV360 default to using IDs or cookies etc for targeting today? Those are user known identifiers. I am trying to wrap my head on how FloC would be used by advertisers since the world is not all FloC enabled and cookies are still around.
Sorry, you're right, advertising on Google's own properties is mostly unaffected by browsers removing support for third-party cookies. I was thinking about AdManager and AdSense; ads shown on publisher sites.
> if you have 1000 categories and some meta information (region based on IP address etc.), you will be able to track down individual users with pretty good accuracy.
Looking at the corresponding TURTLEDOVE proposal, it's sending only a handful of the known categories to any given ad network at any given time. Floc also claims that:
> The collection of cohorts will be analyzed to ensure that cohorts are of sufficient size
Browser fingerprinting is already pretty good if you can run arbitrary JS on a site. Add access to a FLOC, even a FLOC with 10k people, and you're basically at a place that's worse than third-party cookies were, because at least third-party cookies could be blocked. Ad networks are already using fingerprinting and this will be seen as a blessing to them.
If browsers would stop some edge case extensions such as rendering to canvas and reading the data back, it would be much more difficult. Browser JS envs just expose way way too much entropy from the user system
You'd have to get rid of a ton of modern features and somehow backfill / update all browsers to a set of constants
- audio waveform generation
- access to gpu/webgl info
- have to somehow dramatically change or remove ICE/webrtc
- standardize 'feature flags' e.g. somehow backfill old browser so they all show support for new JS objects
- access to only a small set of fonts
- somehow make rendering completely the same across browsers or remove measurement/rendering to like 5px increments or something. e.g. bounding rect of (747744.888some two character specific font or some svgcss transform etc)
- testing for a ton of css extensions
- supported mime types
- a bunch of SVG things (i dont think this has been explored much i have a hunch there are some good targets)
- a bunch of latency hacks
and more...
Things like string measurement is indeed tricky. Audio generation or reading back raster data simply shouldn’t be possible by default. I’d be happy to enable that on a per site basis like pop ups.
There is another issue of potential/actual misuse that few are discussing.
That is, the (mis)use of experiments on browser users. "Field trials." This is enabled by the use of "updates". When users agree to updates they agree to let a corporation silently install and run new code on their computer at will, at any time.
This permits the company to create a situation where person A's browser is not quite the same program as person B's, there will be differences. Thus the corporation can run an "experiment". Both person A and person B might believe "I am using XYZ browser". The two users believe it is the same program. However there are differences. The differences can be added and removed through "automatic updates".
How do users maintain privacy in that situtation. The company behind XYZ browser can easily isolate groups of users with similar/different traits by conducting such experiments and observing user behaviour. "Cohorts". While the company may argue it is only testing software, there is an argument that it can also be testing users.
The words in parentheticals above can be defined and redfined any way you like. What is important is what the corporation is actually doing, not the label/name/terminology they assign to it.
When cookies first appeared, my first response to someone pushing them was: you want to save data for your purposes? Save it on your own damned machine, I don't want it on mine. Of course they're 'abused', that was the whole intent.
honestly the thing that bugs me the most about the article is cookies == tracking.
Sure, cookies are used for tracking, but they are also used for authentication, which is something that nearly every webapp needs to do.
I just think that, due to articles like this, cookies end up being viewed as nothing but bad, when they are an important tool for the web when used properly.
More on-topic of the article:
this doesn't look like it really changes anything, to me. Like, so instead of cookies being used to track your data, they use a _browser extension_?? that is potentially even _more_ invasive. Sure, if it does what they say it will do, it kind of obfuscates your personal data. Really, what people want is just....less ads. Less targetted ads. This doesn't achieve that.
For basically everyone cookies == tracking. That is pretty much their only user-visible purpose. I think the best way forward would be to heavily restrict the persistent data that websites (that aren't installed as apps) can store in the browser to basically just an authentication token that is only sent by the browser and not accessible to JS.
It's kinda silly that we can't manage our website logins via the browser without clearing all the cookies for a site.
> Sure, cookies are used for tracking, but they are also used for authentication, which is something that nearly every webapp needs to do.
What if we could move authentication or more specifically the state held in the client for authentication to some other mechanism? Could we pitch cookies? Could we make this switch without making it somehow possible for advertisers to switch to the new mechanism?
Already exists. Custom HTTP Header with a JWT token for example. Also in the body of a post request can be the auth data. In the URL would also be possible but is a security risk due to e.g. browser history.
Most session providers use a session cookie and store all the required values on the server. Moving that to the client will require a lot of additional javascript. And will also make sure that browsing without javascript is definitely impossible. Not to think about the amount of additional security holes that would open.
There's no reason to if you specifically block third-party cookies, which is what is being suggested (and what Axios muddies considerably by using "cookie" and "third-party cookie" interchangably).
Unless you're going to throw out local storage and custom request headers, getting rid of cookies isn't really going to do anything except make the same thing less secure (since you won't be able to benefit from the HttpOnly flag).
Authentication, notably OAuth, from all of the large major providers comes from a domain other than the site content domain. Blocking third party cookies indiscriminately will render you unable to log into facebook, google, twitter, or any microsoft service, or anything that uses those tokens.
3rd-party cookies aren't actually intrinsic to OIDC auth flows. They might be used by some implementations under some flows, but they're not core to the spec.
Typically the user agent will redirect to a Google/etc login page where it'll have access to first-party cookies. Then will redirect back to the site which requested authentication, passing state in the query params. It's only when you get into using stuff like Okta as a delegated authentication service do you run into trouble with 3rd party cookies.
Edit: As an example, I just logged into Stackoverflow using Google as the authenticator, with umatrix blocking 3rd-party cookies. Worked without a hitch.
The user clicks 'log in with google', their browser gets forwarded to whatever.google.com, the (now first party) cookie gets checked, then the user gets forwarded back to your site with the access token as a parameter in the GET request.
> Blocking third party cookies indiscriminately will render you unable to log into facebook, google, twitter, or any microsoft service, or anything that uses those tokens.
I block third party cookies indiscriminately, and I never had issues logging into Facebook, Google, Twitter, or any Microsoft service except for Microsoft Teams. This includes logging into third-party services using the Google login.
It could be done, but first-party cookies aren't really the issue. Most browsers have the option to disable third-party cookies, but many ad-supported sites throw a fit if you browse them that way. I think the goal is to introduce some alternative, then switch blocking third-party cookies to a default. Finally cookies could be a first-party only solution.
what if we remove the JS, and just had the web browser echo a defined string back to the server? if this token uniquely identified the session, we could safely store the data server-side, with minimal leakage to other sites and no need for code execution at all!
Install client SSL certificates for the websites that needs would be a start, or cookies die within 60 seconds unless a password has been entered on the site.
Tracking and authentication aren't quite the same, but they aren't independent either. If you are logged in all the time (like many of us are for Hacker News), then your actions can be tracked pretty well.
That's kind of the point of being logged in, to let the website know who you are.
I'm sorry but I fail to see the point of this. you can choose to disable cookies, will you be able to disable this new thing? if so, what's the big deal about it, other than the same principle with a different name, probably to avoid some EU legislation.
Advertisers and trackers have been doing the same thing this thing is supposed to do for years. And where will they implement it? the only way would be at the application level, so every browser now also has to implement internal tracking services to aggregate all the data in their flocs, to then come back to the user to spice up their request? come on...
I'll keep supporting efforts to make the Internet a more privacy focused place. Advertisers have been buying TV ads for decades and I my TV hasn't asked me what I want to share with it, yet.
I get full access to everything you do online, and get to do anything I want with the information. Perhaps I'll use it to maybe target ads slightly better in some cases, and put myself into every value chain you're involved with so I can get a cut at every step.
Oh, and I'll do my best to move all computing online, so that 'everything you do online' equals 'everything you do with a computer'.
In exchange you'll get a web browser that is at times more performant than the others. Hell, I'll even throw in a free email account (where I can gather all the best bits of info)!
We live in the timeline where "Alphabet to replace cookies" is a legit headline.
What is the public understanding/perception of cookies? The past couple of years since the implementation of the GDPR has probably been the biggest and weirdest public education campaign (done entirely through brief pseudo-consent popups).
In addition to the whole fox guarding the henhouse issue, this doesn't address the primary harms of user tracking: That it's just bad for society that people are targeted and advertised to on this level, as it fosters filter bubbles and encourages unhealthy behaviors.
Tracking a group of 1,000 people to cater bad political ads isn't meaningfully better than targeting 1,000 individuals with bad political ads.
Targeted advertising needs to be treated like unfair gambling practices. Banned across the board, and the industry that remains needs to be heavily regulated and forced to be completely transparent about the process.
> Targeted advertising needs to be [...] banned across the board
You say that like an absolute that is enforceable. Advertising has been targeted since advertising exists. Advertisers have been choosing radio or billboard-slots for well over 100 years (well, radio for 100, print and billboards probably for centuries), using data or educated guesses to reach a target demographic. As advertisers now choose on which sites (or not) their ads should appear, in order to reach their target demographic. Of course, they can choose by a few more criteria now. How ubiquitous should a specific ad be, so that it would not be "targeted" advertisement?
I think we need legislation, but it's not black and white. There's a huge grey line that spans all of advertising history.
Edit: just to be clear, choosing whether to advertise in a newspaper (and which) on radio (and which channel), or on facebook, is already targeting for a desired audience.
I suppose I should clarify: User targeting should be banned across the board. Content targeting should not: Feel free to put ads next to particular news articles, sites, or TV shows.
It's no so cut and dry though. If you've ever watched golf on TV you will notice that the most prominent advertising is for insurance companies (User) not golf equipment (Content). They are advertising to the cohort of users that watch golf on tv (rich business people).
That's still content targeting: They're basing the ads they place next to content based on the expected audience for that content. Everyone watching that content sees that ad, no problem.
We get into issues when we're dealing with ads being placed based on who is viewing the content.
> You say that like an absolute that is enforceable.
It is possible to make it technically impossible. Not allowing third-party cookies is one way. This alone would only allow targeting by the coarse location derived from the IP and by the user agent string.
They did not find a replacement to cookies. Cookies have become too toxic and are harming them and so they found a way to not store anything on the device and yet be able to target users. This means it will be impossible to stop them from profiling and targeting users as users don’t control anything.
They are using privacy preserving techniques, and even if we assume they are doing it well, it just means that we will never get rid of the profiling and paying to get privacy will not happen with google services
If you read the 4th bullet point in the article you'd see that the data is actually stored on the device. Users will go from seeing only cookies, which are opaque ids, to their full behavioral profiles - basically, the opposite of what you just said.
This mainly looks like a push to remove even more user control over tracking. The spec says that the browser can return 'random' data, but I suspect that Chrome won't let you do that, or at least not for long.
Instead of the user disabling third-party cookies, every single page author would have to set a new HTTP header to have their page excluded from the machine learning.
It also looks like a massive GDPR pitfall.
Say you track conversions to a campaign, and track what "cohorts" a user entered your sales pipeline through. The moment you connect this data to the customer, it's personal data IMHO. If you operate in Europe, the user should be able to retrieve/delete the data, and request it changed if they say it's wrong.
Part of this is about the middle men. The NY Times cut off ad exchanges in EU and found it didn't kill their ad business [1]. One thing it did do was cut out the middle companies doing the brokering. Google has made A LOT of money just being a middle company. Like a car dealership.
The proposed system deals with large groups and machine learning. It requires a browser ad on or changes to the browser. This is not approachable for startups, small businesses, or those who are independent. It's targeted at Google and further helps solidify their position.
As people want to cut Google off from constantly monitoring them they are looking for ways to work around being cut off to keep the data flowing. Branding and marketing their work to make people want it.
>Part of this is about the middle men. The NY Times cut off ad exchanges in EU and found it didn't kill their ad business [1]. One thing it did do was cut out the middle companies doing the brokering. Google has made A LOT of money just being a middle company. Like a car dealership.
So NYT rediscovers publishing? Once upon a time, publishers had teams of sales people who had relationships with companies needing to advertise and coordinated theirs ads with the publishing schedule. Publishers then gave that advantage away to sell ads for a fraction of their current price on a per view basis and have been crying ever since.
Publishers have been seeing their ad revenue decrease. This is why they complain.
Companies like Google make billions on ads. A overwhelming majority of Googles income is from ads. It isn't just that Google served new markets or that publishers outsourced the work.
Ad systems use a bidding system. Google controls both sides of the bidding system. The system is setup in a way where Google has benefited more than others.
It reminds me of record labels and producers. They make the lions share of the money on record sales for most albums and music. The artists typically get a small share. Some artists have walk away with a medium income will selling millions of albums and having the label/producers making millions.
The lower income to publishers has caused them to do more shock and awe type articles that aren't good for us. They pay more inexperienced people less so there is less mentoring. Overall it means the quality of the published stuff has gone downhill.
I was in the printing industry in the 00’s and watched firsthand how publishers shot themselves in the foot. It’s funny how substack is doing what they should have done previously.
When you are the NY times, you can hire an ad sales team, and charge advertisers enough for non targeted ads to make that profitable. It turns out this is a little harder for "Joe Bloggs anime reviews"
Google has already lost the trust of being a company that remotely respects anybody's privacy, if any at all. I would rather spend time on some other privacy proposals.
What this means is not that google has found a privacy-friendly alternative.
It means that Google has found out that among 1000 people, your browsing criteria with HTTP headers alone is unique enough to identify you with 95% accuracy, which is actually even more frightening.
They can use "headers include random things" as a filter like they do with other headers presence/absence/value already. I don't think defining "random things" would be too hard for them.
Random would be even more unique. The solution (to this particular problem) is for a majority of users to set the exact same headers, regardless of the reality
Some browser vendors have started to remove the specific version from the User Agent string, for instance. Tor browser window is an actual square specifically to make that value (browser width & height) the same across all its users and improve their privacy (by making that value useless in finding uniqueness)
Hope that makes sense, sorry if I mis-explained some things
Yes, random values would be more unique, but if those values are changed on each request, wouldn't that make me harder to track?
For example suppose my user agent string (and canvas fingerprint, accept header, etc) was different on every request. Would this be enough to stop ad networks from correlating each of my very-unique requests, and prevent them from tracking me across different pages?
> Would an extension that sets random headers be a solution to blurring identity?
Nope, because the order a Browser Engine loads assets is different in Chrome vs. Firefox vs. Edgium, too. Combine that with Firefox's messed up Accept header and you'll have them TOR Browser users, for sure. "@supports" in CSS is additionally a very unblockable way to track users, as it varies uniquely per-Browser-version as features of CSS get implemented and/or get fixed.
Usually traffic analysis for a client (with a specific ETag header) is enough to uniquely find out whether it's the exact same machine, hence that's what the header is made for.
The approach behind my browser tries to actively modify the contents of said malicious HTTP headers and to rewrite the HTML, CSS and other assets in order to force-cache everything and by laying off as much traffic as possible to surrounding peers. [1] But it's far from production-ready.
There's also a frightening amount of CSS features that can be used to track users very easily. @supports, @media, and a combination of <link media=""> and "srcset" attributes in a quick prototype was enough to track every client with around 98.3% accuracy, and I decided to not release the fingerprint.css project due to concerns how it might be abused in the wild.
Especially with unicode behaviour inside the CSS files themselves. CSS ident-tokens [2] are specified as "non-ASCII" so they can be emojis, too. And those have varying support across all Browser versions due to the ICU library being embedded in them (and being absolutely unique in every single subminor release I've tested so far).
I am not a web expert but these all sound like things that can uniquely identify a particular browser version only? That doesn't seem like such a big issue - if all that can be determined is that I'm using the latest stable Chrome/Firefox, that doesn't sound so bad. Does it matter that the TOR Browser is identifiable if everyone is using the same version? I thought their goal is to make every user of their browser look the same? Where does the 98.3% accuracy come from?
That is a great question and no, mixing in noise makes it harder but doesn't make it impossible.
Mixing in noise feels like a solution because it is hard for a layperson to see how a signal can be extracted, proof by "difficulty to me". If you mix in noise that changes averages then you are removing signal. If you add in random noise, each individual measurement deviates, but the limit of the average will be the same value pre-mixing.
This has been known for years though. There have been a few sites out there over the years which would tell you how identify-able you are based entirely on what headers your browser sends.
This is wrong advice. Firefox's unique handling of asset loading, including how ETag and Accept headers are processed (e.g. loading a png as a <script src> and as an <img src>) make Firefox always uniquely identifiable.
Yeah. I don't understand why it's taking so much time and effort and debate when all it would really take is literally a single line of code to change the default value of the setting that blocks or allows third-party cookies. I'd bet most users won't even notice the difference.
The original RFC that introduced cookies specifically said that third-party cookies aren't permitted. Then Netscape broke it. Then everyone else did. It's about time browsers become spec-compliant.
Because Google makes billions on selling ads on other sites through their DV360 / Google AdX products. Those ads need third-party cookies for targeting, otherwise the price drops by a factor 5.
Google also happens to make the browser with by far the largest market share. So they're not going to axe third-party cookies as long as it drops their revenue 5x.
"A flock name would essentially be a behavioral credit score: a tattoo on your digital forehead that gives a succinct summary of who you are, what you like, where you go, what you buy, and with whom you associate."
I suspect part of that might be a reaction to us (as in the population in general) getting used to privacy violations. It takes a bit more drama to get our attention in a world where we are all willing to voluntarily carry a personal tracking device 24/7...
EFF has been taken over by privacy zealots. They used to be more focused on what their name says: freedom. That is, fighting censorship and regulation of the internet.
Yeah, but privacy used to be a part of the mission, with the understanding that privacy was a good thing but not the only thing. It seems like over the years the focus has shifted to privacy being the ultimate goal, and every other aspect of the mission happens in the name of privacy. And there's no acceptance of the idea that some well-informed people are willing to make a decision to sacrifice some privacy in exchange for convenience or cost, anybody who considers sacrificing some of their own privacy is treated as a moron who needs to be protected from themselves.
They’ve definitely zeroed in on it. I think it is understandable, though, from their position—privacy seems most acutely at-risk, at least stateside, and the vast majority of people affected aren’t among those well-informed.
The EFF needs to get to the point that politicians seriously consider fighting them. Its the only real way to effect change in the US. As we have seen multiple times, the other folks keep introducing bills over and over again. That needs to be a hard stop and the only way to get there is fear because logic just doesn't work for tech.
is more than a little ironic to me. I suppose it's like people saying you can't 'out-logic' a judge through a technicality, or that the law does not mean they are Perfect Laws of Logic; they're designed to be interpreted by judges.
I admire the EFF though, and I support what they advocate for. I was going to say I'd like them to be more pragmatic, but I suppose their hardline opinions are most of the reason they exist as an advocacy organization.
Logic is fine for technical folks and a lot of general public, it doesn't work very well in the political arena where waving the bloody shirt is the norm. Logic is a poor weapon in an emotional debate and doesn't work worth a damn.
To your actual point, though, I think you've totally nailed it. I'm not sure if emotion and politics are permanently inextricable, but from my limited, unfortunate experience, it seems as though any kind of logical argument doesn't or can't (!) sway anyone (myself, of course, included!)
Google openly choose the collective noun for sheep as the name of a technology for labelling humans; I don't think the EFF's response should be the primary source of discomfort here.
This made me laugh, and you're not wrong exactly, but I will note that "flock" is also used for birds, and birds are frequently used as a metaphor for freedom just as much as sheep are used as a metaphor for mindless group-following behaviour.
You should really investigate your biases if the first thought that comes to your mind is that Google chose flock because it thinks customers are sheep.
My first thought was birds, so perhaps I might turn that around and recommend a reciprocal investigation. Because only on further reflection did I see the darker side, and realise the likes of Google do not get to make the “oh-we-didn’t-realise-that” argument.
> BTW, Chrome users have been part of this system for nearly a year now.
The OP says "The API exists as a browser extension within Google Chrome," which made me think it was a separate browser extension that I would not have if I had not chosen to install.
Are you saying it's built into Chrome instead? Cite? And if so is there any way to disable it?
I don't believe Google because it could have eliminated all the ways to track people without their consent long ago if it wanted. Almost everybody uses Chrome/Blink and agrees to everything they decide. They can define and deprecate almost whatever browser APIs and behaviors they want. But it doesn't because they are the single biggest actor making use of these ways. E.g. it is known Google Captcha doesn't simply tell them you are a human, it tells them which particular human you are.
304 comments
[ 2.3 ms ] story [ 283 ms ] threadInconveniencing trackers is good for privacy, not bad.
Anyway, mods, here's a much better article that has more than one line of vague content: https://github.com/WICG/floc
Features used exclusively for tracking have no place among web standards, cohort-based or otherwise.
They want the browser to "discover" the users interests automatically during browsing. For a page to be excluded from this, the page author would have to set a new policy header.
And then your browser reports these interest to whatever tracker (for example Google) asks for the information.
Suddently Google can learn about what you're browsing even if GA is blocked.
No but seriously, does being in a group of "thousands" of people really preserve privacy particularly well? It seems quite likely that with groups that small, membership itself could be considered privacy-compromising, e.g., a group of people that all have some medical condition.
At the most fundamental level, I feel like if you know which advertisments are targetted to me, and those advertisements are well-targeted, then my privacy has been invaded.
It seems to me there is a fundamental conflict between good targetted ads and protection of privacy.
If I was an advertiser I would have serious doubts about this, especially after the fact that ad spend on popular platforms have had no impact on many firm's bottom line.
I guess this is a response to all the pushbacks and dwindling PPC revenues from an increasingly wary advertisers who have quite possibly been duped into transferring their cash to Google & others over the decade.
True, but it is too much to ask Google to throw "the baby out with the bath water", as it were. For all their faults, I am encouraged that Android and Chrome, if no other product team at Google, is pioneering Federated Learning [0], Differential Privacy [1], and now are pushing ahead with Privacy Sandbox [2]. I wholeheartedly agree it simply isn't enough, but it is substantially better than what's in-use right now.
Like everyone else though, I am worried for the same reason I dislike AMP (accelerated mobile pages) despite it bringing noticeably better user-experience for many: Google has this nasty tendency to make things seem more "open", "benevolent", and "private" than they really are.
[0] https://federated.withgoogle.com/#learn
[1] https://www.chromium.org/developers/design-documents/rappor
[2] https://news.ycombinator.com/item?id=20767891
No it isn't, the 'baby' of targetted adverts is a net negative for society. We'd be net better off if most googlers just retired and spent their days digging holes and filling them in again. It is not "too much to ask" that people stop messing up society even if it's making them billions.
Also there's no "privacy-friendly" tracking technology, it's an oxymoron an slick marketing/corporate strategy ( that works ).
EDIT: The official description [https://github.com/WICG/floc], does a better job in explaining the point. They try to cluster (="cohort") users interests and exchange that with the ad-service. This could maybe help to increase transparency and authority over your data as it's saved locally. But I don't see a way to limit the access to the users cohorts (they even say that themself, see link above). Everybody could access my interests - not just Google and other ad services. And of course, if you have 1000 categories and some meta information (region based on IP address etc.), you will be able to track down individual users with pretty good accuracy.
I don't think that solution works in the current environment, unfortunately.
But.. Ad networks will never implement this, cause priority there :
1) ad network 2) advertiser 3) publisher 4) user
This bumps user from 4th place to 1st place
Go check out the messaging around Ad Choices and how poorly it ended up working.
This... just doesn't apply to the scheme described:
>> If I clicked the ad, thumbs up, if not thumbs down. With appropriate weights this can work.
I am not claiming this is good or bad, but clicks are not a good enough signal of efficacy for the vast majority of ads shown on the internet.
To me it sound like just another layer of indirection with google right in the center of it. Even if this method works well enough from an advertising perspective, i expect there will soon be adverserial models to deanonymize.
The Chrome proposal is that it won't: https://github.com/bslassey/ip-blindness
TOR is one solution here, which you could potentially also describe as "adding forced MitM to every connection". The proposals in https://github.com/bslassey/ip-blindness/blob/master/near_pa... and https://github.com/bslassey/ip-blindness/blob/master/willful... have different tradeoffs than TOR, with the "TOR is painfully slow" problem being a big one.
If you have better ideas, though, I would be very interested in reading them!
(Disclosure: I work for Google, speaking only for myself.)
How would FLoC audience targeting work in non-chrome browsers? DV360 users deliver ads on all browsers, no?
Today, in browsers where third party cookies were removed without replacement, companies like Google that aren't willing to fingerprint have pretty limited user targeting capabilities.
(Not sure what you mean by "using known identifiers")
Looking at the corresponding TURTLEDOVE proposal, it's sending only a handful of the known categories to any given ad network at any given time. Floc also claims that:
> The collection of cohorts will be analyzed to ensure that cohorts are of sufficient size
- audio waveform generation - access to gpu/webgl info - have to somehow dramatically change or remove ICE/webrtc - standardize 'feature flags' e.g. somehow backfill old browser so they all show support for new JS objects - access to only a small set of fonts - somehow make rendering completely the same across browsers or remove measurement/rendering to like 5px increments or something. e.g. bounding rect of (747744.888some two character specific font or some svgcss transform etc) - testing for a ton of css extensions - supported mime types - a bunch of SVG things (i dont think this has been explored much i have a hunch there are some good targets) - a bunch of latency hacks and more...
That is, the (mis)use of experiments on browser users. "Field trials." This is enabled by the use of "updates". When users agree to updates they agree to let a corporation silently install and run new code on their computer at will, at any time.
This permits the company to create a situation where person A's browser is not quite the same program as person B's, there will be differences. Thus the corporation can run an "experiment". Both person A and person B might believe "I am using XYZ browser". The two users believe it is the same program. However there are differences. The differences can be added and removed through "automatic updates".
How do users maintain privacy in that situtation. The company behind XYZ browser can easily isolate groups of users with similar/different traits by conducting such experiments and observing user behaviour. "Cohorts". While the company may argue it is only testing software, there is an argument that it can also be testing users.
The words in parentheticals above can be defined and redfined any way you like. What is important is what the corporation is actually doing, not the label/name/terminology they assign to it.
Sure, cookies are used for tracking, but they are also used for authentication, which is something that nearly every webapp needs to do.
I just think that, due to articles like this, cookies end up being viewed as nothing but bad, when they are an important tool for the web when used properly.
More on-topic of the article:
this doesn't look like it really changes anything, to me. Like, so instead of cookies being used to track your data, they use a _browser extension_?? that is potentially even _more_ invasive. Sure, if it does what they say it will do, it kind of obfuscates your personal data. Really, what people want is just....less ads. Less targetted ads. This doesn't achieve that.
It's kinda silly that we can't manage our website logins via the browser without clearing all the cookies for a site.
What if we could move authentication or more specifically the state held in the client for authentication to some other mechanism? Could we pitch cookies? Could we make this switch without making it somehow possible for advertisers to switch to the new mechanism?
Unless you're going to throw out local storage and custom request headers, getting rid of cookies isn't really going to do anything except make the same thing less secure (since you won't be able to benefit from the HttpOnly flag).
Typically the user agent will redirect to a Google/etc login page where it'll have access to first-party cookies. Then will redirect back to the site which requested authentication, passing state in the query params. It's only when you get into using stuff like Okta as a delegated authentication service do you run into trouble with 3rd party cookies.
Edit: As an example, I just logged into Stackoverflow using Google as the authenticator, with umatrix blocking 3rd-party cookies. Worked without a hitch.
The user clicks 'log in with google', their browser gets forwarded to whatever.google.com, the (now first party) cookie gets checked, then the user gets forwarded back to your site with the access token as a parameter in the GET request.
No third party cookies needed.
I block third party cookies indiscriminately, and I never had issues logging into Facebook, Google, Twitter, or any Microsoft service except for Microsoft Teams. This includes logging into third-party services using the Google login.
If the site is essential I wipe the cookies before and after reading.
Most of the time I skip the site in favour of another one.
That's kind of the point of being logged in, to let the website know who you are.
Advertisers and trackers have been doing the same thing this thing is supposed to do for years. And where will they implement it? the only way would be at the application level, so every browser now also has to implement internal tracking services to aggregate all the data in their flocs, to then come back to the user to spice up their request? come on...
I'll keep supporting efforts to make the Internet a more privacy focused place. Advertisers have been buying TV ads for decades and I my TV hasn't asked me what I want to share with it, yet.
What makes Google think that Apple or Mozilla are going to add this to their browsers?
I get full access to everything you do online, and get to do anything I want with the information. Perhaps I'll use it to maybe target ads slightly better in some cases, and put myself into every value chain you're involved with so I can get a cut at every step.
Oh, and I'll do my best to move all computing online, so that 'everything you do online' equals 'everything you do with a computer'.
In exchange you'll get a web browser that is at times more performant than the others. Hell, I'll even throw in a free email account (where I can gather all the best bits of info)!
It's a pretty good deal, don't you think?"
https://www.pcworld.com/article/116657/article.html#drr-cont... (250mb free increase was suspected to be a response to Gmail)
What is the public understanding/perception of cookies? The past couple of years since the implementation of the GDPR has probably been the biggest and weirdest public education campaign (done entirely through brief pseudo-consent popups).
Tracking a group of 1,000 people to cater bad political ads isn't meaningfully better than targeting 1,000 individuals with bad political ads.
Targeted advertising needs to be treated like unfair gambling practices. Banned across the board, and the industry that remains needs to be heavily regulated and forced to be completely transparent about the process.
You say that like an absolute that is enforceable. Advertising has been targeted since advertising exists. Advertisers have been choosing radio or billboard-slots for well over 100 years (well, radio for 100, print and billboards probably for centuries), using data or educated guesses to reach a target demographic. As advertisers now choose on which sites (or not) their ads should appear, in order to reach their target demographic. Of course, they can choose by a few more criteria now. How ubiquitous should a specific ad be, so that it would not be "targeted" advertisement?
I think we need legislation, but it's not black and white. There's a huge grey line that spans all of advertising history.
Edit: just to be clear, choosing whether to advertise in a newspaper (and which) on radio (and which channel), or on facebook, is already targeting for a desired audience.
It's all user targeting.
We get into issues when we're dealing with ads being placed based on who is viewing the content.
It is possible to make it technically impossible. Not allowing third-party cookies is one way. This alone would only allow targeting by the coarse location derived from the IP and by the user agent string.
Cookies aren't required for that.
If I buy a MTB magazine, I do expect to see some ads from this or that bike-producing company (even though I'd prefer them not to be there).
They are using privacy preserving techniques, and even if we assume they are doing it well, it just means that we will never get rid of the profiling and paying to get privacy will not happen with google services
Instead of the user disabling third-party cookies, every single page author would have to set a new HTTP header to have their page excluded from the machine learning.
It also looks like a massive GDPR pitfall. Say you track conversions to a campaign, and track what "cohorts" a user entered your sales pipeline through. The moment you connect this data to the customer, it's personal data IMHO. If you operate in Europe, the user should be able to retrieve/delete the data, and request it changed if they say it's wrong.
The proposed system deals with large groups and machine learning. It requires a browser ad on or changes to the browser. This is not approachable for startups, small businesses, or those who are independent. It's targeted at Google and further helps solidify their position.
As people want to cut Google off from constantly monitoring them they are looking for ways to work around being cut off to keep the data flowing. Branding and marketing their work to make people want it.
[1] https://digiday.com/media/gumgumtest-new-york-times-gdpr-cut...
So NYT rediscovers publishing? Once upon a time, publishers had teams of sales people who had relationships with companies needing to advertise and coordinated theirs ads with the publishing schedule. Publishers then gave that advantage away to sell ads for a fraction of their current price on a per view basis and have been crying ever since.
Companies like Google make billions on ads. A overwhelming majority of Googles income is from ads. It isn't just that Google served new markets or that publishers outsourced the work.
Ad systems use a bidding system. Google controls both sides of the bidding system. The system is setup in a way where Google has benefited more than others.
It reminds me of record labels and producers. They make the lions share of the money on record sales for most albums and music. The artists typically get a small share. Some artists have walk away with a medium income will selling millions of albums and having the label/producers making millions.
The lower income to publishers has caused them to do more shock and awe type articles that aren't good for us. They pay more inexperienced people less so there is less mentoring. Overall it means the quality of the published stuff has gone downhill.
It means that Google has found out that among 1000 people, your browsing criteria with HTTP headers alone is unique enough to identify you with 95% accuracy, which is actually even more frightening.
Worst thing is, unless this is used by a very large chunk of the population, it would even be another tool to identify you.
How exactly? It seems like a difficult problem for a website to me.
2. They would have to track the noise over page requests to know that it was noise. The saving of and correlation of the saved state would be a pain.
Some browser vendors have started to remove the specific version from the User Agent string, for instance. Tor browser window is an actual square specifically to make that value (browser width & height) the same across all its users and improve their privacy (by making that value useless in finding uniqueness)
Hope that makes sense, sorry if I mis-explained some things
For example suppose my user agent string (and canvas fingerprint, accept header, etc) was different on every request. Would this be enough to stop ad networks from correlating each of my very-unique requests, and prevent them from tracking me across different pages?
Nope, because the order a Browser Engine loads assets is different in Chrome vs. Firefox vs. Edgium, too. Combine that with Firefox's messed up Accept header and you'll have them TOR Browser users, for sure. "@supports" in CSS is additionally a very unblockable way to track users, as it varies uniquely per-Browser-version as features of CSS get implemented and/or get fixed.
Usually traffic analysis for a client (with a specific ETag header) is enough to uniquely find out whether it's the exact same machine, hence that's what the header is made for.
The approach behind my browser tries to actively modify the contents of said malicious HTTP headers and to rewrite the HTML, CSS and other assets in order to force-cache everything and by laying off as much traffic as possible to surrounding peers. [1] But it's far from production-ready.
There's also a frightening amount of CSS features that can be used to track users very easily. @supports, @media, and a combination of <link media=""> and "srcset" attributes in a quick prototype was enough to track every client with around 98.3% accuracy, and I decided to not release the fingerprint.css project due to concerns how it might be abused in the wild.
Especially with unicode behaviour inside the CSS files themselves. CSS ident-tokens [2] are specified as "non-ASCII" so they can be emojis, too. And those have varying support across all Browser versions due to the ICU library being embedded in them (and being absolutely unique in every single subminor release I've tested so far).
[1] https://github.com/tholian-network/stealth
[2] https://www.w3.org/TR/css-syntax-3/#tokenization
Mixing in noise feels like a solution because it is hard for a layperson to see how a signal can be extracted, proof by "difficulty to me". If you mix in noise that changes averages then you are removing signal. If you add in random noise, each individual measurement deviates, but the limit of the average will be the same value pre-mixing.
This seems to work pretty well for me (Google got really confused, thinks I am on Windows now - I am not).
Just don't turn off media.gmp-widevinecdm if you want to keep watching DRM-protected content (e.g. Netflix)!
If it is the latter, please file a bug against Firefox to get it fixed.
The original RFC that introduced cookies specifically said that third-party cookies aren't permitted. Then Netscape broke it. Then everyone else did. It's about time browsers become spec-compliant.
Google also happens to make the browser with by far the largest market share. So they're not going to axe third-party cookies as long as it drops their revenue 5x.
"A flock name would essentially be a behavioral credit score: a tattoo on your digital forehead that gives a succinct summary of who you are, what you like, where you go, what you buy, and with whom you associate."
https://www.eff.org/deeplinks/2019/08/dont-play-googles-priv...
BTW, Chrome users have been part of this system for nearly a year now.
And the privacy folks love their hyperbole
Not necessarily disagreeing with your actual point, but neither of the F's in EFF stands for "freedom".
- give them money
- offer them a political advantage over their opponents
- build up enough grassroots support among their constituents that not supporting your positions would be effectively career suicide
The best organizations utilize all three.
> because logic just doesn't work for tech
is more than a little ironic to me. I suppose it's like people saying you can't 'out-logic' a judge through a technicality, or that the law does not mean they are Perfect Laws of Logic; they're designed to be interpreted by judges.
I admire the EFF though, and I support what they advocate for. I was going to say I'd like them to be more pragmatic, but I suppose their hardline opinions are most of the reason they exist as an advocacy organization.
To your actual point, though, I think you've totally nailed it. I'm not sure if emotion and politics are permanently inextricable, but from my limited, unfortunate experience, it seems as though any kind of logical argument doesn't or can't (!) sway anyone (myself, of course, included!)
It's hardly a big deal, I almost regret commenting about it.
Either way, I wouldn't read too much into it.
https://github.com/michaelkleber/pigin https://github.com/WICG/turtledove https://github.com/WICG/sparrow https://github.com/WICG/turtledove/blob/master/TERN.md https://github.com/prebid/identity-gatekeeper/blob/master/pr...
I believe "FLoC" comes from the phrase "birds of a feather flock together", which is a decent metaphor for how the proposal works
(Disclosure: I work for Google, speaking only for myself)
One false click and you're damned for weeks.
The OP says "The API exists as a browser extension within Google Chrome," which made me think it was a separate browser extension that I would not have if I had not chosen to install.
Are you saying it's built into Chrome instead? Cite? And if so is there any way to disable it?