I am unsure as to what purpose the game aspect serves, if you're installing this is a browser extension couldn't you just give the service access to all your cookies all at once rather than having to 'mine' them? What am I missing?
Because any decent implementation doesn't trust client cookies. Typically the server signs them so the only messing that can be done on the client side is to delete/not send them.
Randomly exchanging cookies with other users (assuming they are even structured that way) is a considerably larger coding challenge than just examining cookies and giving an arbitrary score.
Except that blocking cookies renders much of the web unusable. I use Ghostery and am often finding that videos don't load, sometimes whole pages don't load, etc.
I love the idea of a tool that actually uses advertising technology to subvert it.
Yeah, this sucks. It doesn't happen often to me, but Kickstarter and US Airways' online booking site come to mind as two I've hit a few times that are broken with Ghostery. Which is two too many.
Still, I'm willing to put up with the slight inconvenience of just disabling Ghostery on those sites once identified.
Not sure exactly how it works, but it gave me the thought that making collecting ads into a game could be fun. For example there could be competitions for getting specific ads (the most expensive loan, the weirdest health treatment, and so on...). Maybe this game already does that, not sure.
So is this a kind of a reverse-Denial-of-Service-by-misinformation attack ? You can bet some people in the Ad industry will insinuate this is a kind of "hacking".
I really don't see the point of this. Who is the target audience for this? Do they really think enough people will use this to the point that it will "kill digital ad targeting"?
There is no target audience, it's not available for any audience. There's also no 'they', it's one student who created a program as a class project.
It's interesting because the game involves collecting tracking cookies into your browser, so that any site that tries to track you thinks you're everyone in the cookies. It's hard to target a needle in a stack of needles.
a lot of people hate advertising, ads are everywhere, adding gamification to it creates a cool dynamic where people will take pleasure in sticking it to them, get a boost of privacy feeling and sense of power like(personal example) "oh marketers you want to teach this rails programmer rails? how cute, hadn't caught this one yet"
pokemon, man, it's fun. "eating cookies", you know? To me it's a really creative and beautiful idea
Are you saying that you've counter-measures against this type of attack? Poisened or fake-chunks/blocks have been infiltrated into P2P Networks for many years and P2P networks were able to fight against it pretty well.
But I cannot imagine a way how you can take measures against this type of attack. Please tell us more.
If the game manipulates cookies only, then all the other methods of tracking users are already immune. And many of the more "sophisticated" marketers have long ago adopted these methods in addition to or instead of standard cookies.
So the idea of the program would be, with enough mis-information it starts working for everyone not just users of the program. (Else there's little point to it)
So really it's not about the users it's about stopping them destroying your current accurate data.
So all you need to do is identify if a user is a malicious one and ignore them.
So how does one identify dodgy data? Benford's Law is one example.
Of course this can be fought, but then you fight back and the war begins.
From the end of the article kindly submitted here:
"'In its current state now it's a weapon,' said Ms. Law. 'Do I want it to get in the hands of the Syrian Electric Army? No!'
"To be fair, Ms. Law is not the most experienced computer programmer, so she said she needs assistance to make Vortex more secure. She has an undergraduate degree in Philosophy and Photography from the University of Melbourne in Australia, and 'crash-learned' programming."
So it sounds like the code base and the security model of this new project need thorough review. But if the project works, we could all have fun with an online game while obfuscating our consumer behavior data. Who would like to contribute to a project like this?
I don't get it, why is obfuscating consumer data a good thing? If I have to see ads, I'd much rather they be relevant things like hosting providers than random things I don't care about...
Firstly the term "relevant ads" is good marketing. They are really "ads targeted to extract maximal revenue from this user".
Well targeted ads are basically useless to the consumer since if you actually need something then you know this and you can search for it. The market operating in ad networks optimizes ads that sell enough to pay for more ads while remaining profitable, there is no mechanic that bubbles the best/least expensive offer to consumers since they are not the customer.
To enable all this targeting you need to implement surveillance on your targets as widely as possible.
So nearly all my internet is surveilled, by many parties, in order to spam the web with offers that are marked up enough to pay for winning ad auctions on popular terms for things I don't need, and could easily find if I did.
I get not caring about this. I don't get how anyone who understands how it works would not understanding the popular interest in subverting this mess.
Not keeping up with the latest fashions is value destroying. Not buying a new car every 3 years is value destroying. If I could modify my vision to not show me billboards, brands and placards I would. While I still have a choice whether to be or not to be the product I intend to exercise that choice. I refuse to be a cash cow for the highest bidder.
That's not quite analogous, because in this situation the ad-seller is also claiming to be the teacher. Google's mission is to return the most relevant content whenever you search. If they succeed at that, then every time you search for something, you will get the most relevant stuff as the top few organic search results. The ads will therefore just be noise; the organic search results will be exactly what you want.
Exactly this. Organic search always wins, while ads distract. I've never stopped finding ads to be the not-so-poor-man's way of not bothering to be good at SEO. I tend to view them as a rough analogue to a traffic camera ticket--do nothing to improve the public interest, and basically allow people who can afford it to not bother about playing by or learning the rules.
So you are contending that customers are informed of anything with ad targeting?
I worked in the online ad targeting/ad network industry for half a decade and strongly disagree with that premise.
The shadiest of products (penis enlargement, work from home, etc) are advertised with specifically "stupid" ads, because by eliminating the people who would never buy such a bad product in the first place they improve their CTR, screen before the click. That's the far end of the spectrum, but the premise is generally true for all advertising.
Informing your customers and competing on value is an inefficient method of advertising, it's much more profitable to find another, less rational, purchase trigger to exploit. There are many to choose from but traditionally this was still quite difficult and very risky. Now, with detailed analytics and advanced data processing you can just try them all and have the system cluster and optimize each approach.
"Relevant" ad targeting is sold as a method to display ads that will likely appeal to targets but an enormous part of it is screening those users who are informed enough to know that your product is not a wise purchasing decision.
And all of this lives in an auction model, so you either adapt to the more efficient methods or you get outbid on your keywords.
>This point of view is value-destroyingly cynical.
Value for who?
That may be true, but that doesn't make it incorrect. In fact, I do believe that it is in fact value-destroyingly cynical for technical people working in the valley; the current upswing in the business cycle (at least here in silicon valley) much like the first dot-com, is largely predicated on the idea that we are building the new advertising industry, and the technologies we are building for that new advertising industry make us dramatically more effective than the old advertising industry. so yeah, if you work in the area, you have a personal interest in others believing that targeted ads deliver a lot of value to the advertiser without subtracting too much value from the consumer. (I personally feel that the 'ads add value for the consumer' viewpoint that many googlers seem to espouse is so transparently self-serving as to be silly and ignorable[1].)
>That's like saying teaching in school is useless, because if I need to know something, I'll ask someone.
The difference here is the difference between asking for advice from a disinterested third party, and asking for advice from someone who gets money if you choose one choice over another - a salesman.
It's the fundamental problem with using ads to pay for search; The user of the search wants to find the most relevant answer; the provider of the search wants the user to find the most relevant answer that the provider is getting paid for. This is a fundamental conflict of interest.
I'd compare this with going to a VAR[2] for technical advice. The VAR may be run by someone technically way more competent than you are, but the VAR is paid by the people who sell you stuff. I mean, maybe the SAN that pays the best commission is also the best SAN for your needs... but maybe not, and if not, then that VAR has a conflict between choosing the highest commission for themselves and choosing the best solution for you (which would increase their reputation, and perhaps lead to larger, more profitable sales down the line.)
I mean, I'm not saying the VAR is always going to choose the short-term money over the long-term reputation... but there is a conflict, and most people seem to think that one should usually rely primarily on sources other than the salesperson for information about a big purchase.
[1]absurd claims (in your favor) weaken your position by showing disrespect for the intellect of your counterparty.
[2]In the corporate IT world, there's a 'general salesperson/technical help picking the right product to buy' role, called the VAR... the Value Added Re-seller. The difference between a VAR and a salesman is that a regular salesman works for one company; he can only sell, say, netapp products. The advantage of the VAR is that s/he can sell netapp, emc, and nexentia products, and get a commission for each. The idea is that the VAR will be more likely to steer you to an appropriate product for your needs than a salesman from one manufacturer. But it's still a salesman/woman.
(note, the other VAR role is just plain re-seller... manufacturers offer products to VARs at a discount, so some VARs will just sell you the product at below-list price, without "adding value")
>Well targeted ads are basically useless to the consumer since if you actually need something then you know this and you can search for it. The market operating in ad networks optimizes ads that sell enough to pay for more ads while remaining profitable, there is no mechanic that bubbles the best/least expensive offer to consumers since they are not the customer.
...
>I get not caring about this. I don't get how anyone who understands how it works would not understanding the popular interest in subverting this mess.
Well said. From the consumers point of view? this makes a lot of sense. An ad should convey no credibility.
What I find interesting here is that even as the customer, most of the data passed down to the small business owner (say, me when I'm buying display ads) is massaged by folks who are way smarter than I am, and who have an interest in taking credit for as much of my profitability as possible. I mean, it's possible that they have a better view than I do of what causes people to choose me... really, it's kinda likely. but they have no interest in sharing that data with me, and I lack the ability to understand that data even if they did want to share it with me.
I think the upshot is that most 'targeted ads' are not nearly as effective as the buyers of said ads are lead to believe. Sure, I can buy ads that bring up my company when a user searches for "VPS" or "Linux VPS" or what have you, but I don't think people are going to buy from me unless they've actually heard about me from a credible source. I mean,
Personally? when I buy advertising, one of my first questions is "Do I want to be associated with the content on the page" - I think of it more as 'sponsorship' - you know, when a beer company sponsors a baseball team. I think a lot of the value I get out of advertising is that association with the community, and the more intermediaries you have between me and the community generating the content, the less value I see in the transaction.
Really, Eivind Uggedal[1] probably deserves 80% of every advertising dollar I've spent in the last four years.
[1]http://uggedal.com/journal/vps-comparison-between-slicehost-... (yes, yes, I know he did one later where linode kicked my ass, (I argue that was because linode gives you more vcpus, optimizing for best case, while I give you fewer, optimizing for worst-case, but as far as I can tell, they have some I/O monitoring sauce I don't, that really is better) but still, things like that are what I think is primarily responsible for people going through with a purchase... that and word of mouth. Paying google because they gave me the 'last click' is kinda silly.)
It's a high area of local utility attack via the social layer. In other words, only showing me the things I care about already limits my aspirations and serves to further separate me from the rest of humanity. Indeed, if you have a good enough read on me, you can tell whether I'll be vulnerable to having one specific thing advertised to me excessively that's going to exclude other longer term higher value to £ ratio payoffs.
The most obvious examples of this sort of behaviour are people who spend all their time in front of the TV rather than developing deeper interests, or people who are vulnerable to drugs, but you can hook people on almost anything provided you make it look desirable and people don't have much contradicting data. So, if my algorithm decides that the people behind your IP address have no interest in formal education, and so doesn't market anything to do with learning to you, is that really good for you? Is it really good for your daughter or son?
It's like being search bubbled, only from the push end of things rather than the pull end.
Edit: Freshhawk's phrasing of it as extracting maximum value from the user is a good way of putting it, I think. Getting the most for the least doesn't necessarily work out in your favour unless you have a very good degree of self control and foresight.
"It's like being search bubbled, only from the push end of things rather than the pull end."
That is a good way of putting it.
I also like that you identified "you can tell whether I'll be vulnerable to having one specific thing advertised to me excessively". I got into that in a follow up comment because that's really what targeted ads are about, finding people's irrational purchase triggers because "hey, i'm well informed and this product is great value!" is an expensive trigger to target.
If cookies are being shared, and the users have access to them, what about the cookies from sites with passwords in them...? I don't _think_ I use any sites that do something that dumb, but I'm sure they exist.
I would never use this specifically because of that.
"Part of the goal is to understand how ad targeting algorithms peg people in specific audience segments. "That's why it needs critical mass, because only when enough people are playing can we start seeing patterns in what kind of cookies or attribute-identifiers companies look for and discriminate with," she said."
Doesn't sound like she knows how ad serving companies operate. These days many companies are just storing one cookie with some sort of unique identifier for the user, then storing user profiles, targeting data, behavioral tags, etc in a server-side cookie store. You're not going to be able to gather much data about companies that operate like that by analyzing huge numbers of their cookies, since every user will have a unique cookie.
By providing misleading cookie info, couldn't you make the targeted ads even worse?
For example, suppose that the cookies are arbitrarily altered, and they make advertisers think that I'm an older man who's extremely wealthy and takes vacations.
Now, whenever I visit travel websites, I'll see higher prices, whereas if I hadn't mislead the advertisers, I might see prices that are more reasonable and appropriate for my age / income bracket.
There's a mention about selecting a "shoe lover profile" when shoe shopping or something along those lines so it seemed to me that this was accounted for.
"For instance, if a user decides to go shoe-shopping for summer, he or she could equip their browser with the cookies most associated and aligned with shopping, shoes and summer"
You could do the same thing by trial and error switching profiles or some kind of way of sharing "this profile gives low prices at X travel site" information between users.
That wouldn't affect differentiated pricing based on user profile information. It would get you more ads in that vertical but wouldn't get you the cheapest prices.
Targeted ads are actually small businesses' greatest weapon against large businesses.
My company, LiveLoop, sells PowerPoint collaboration software. How do we get it in front of users? We buy Google ads. For 50 cents a click we get in front of the narrow sliver of people who desperately want our software NOW. And our users are ecstatic about our product once they start using it -- without targeted ads, they'd never have heard of us.
How does Google Apps, one of our competitors, advertise? However they want to. Billboards in Times Square. Super Bowl commercials. Anything they want, really.
Startups begin by serving narrow audiences, and targeted ads are today's best way of finding narrow audiences. This may end up hurting the wrong people.
62 comments
[ 4.3 ms ] story [ 109 ms ] threadThere is a precedent with barcode games of collecting things http://en.wikipedia.org/wiki/List_of_barcode_games
Randomly exchanging cookies with other users (assuming they are even structured that way) is a considerably larger coding challenge than just examining cookies and giving an arbitrary score.
Besides, I play the hosts game with advertisers.
I love the idea of a tool that actually uses advertising technology to subvert it.
Still, I'm willing to put up with the slight inconvenience of just disabling Ghostery on those sites once identified.
It's interesting because the game involves collecting tracking cookies into your browser, so that any site that tries to track you thinks you're everyone in the cookies. It's hard to target a needle in a stack of needles.
But an honest headline wouldn't have baited as many clicks.
(Flagged.)
pokemon, man, it's fun. "eating cookies", you know? To me it's a really creative and beautiful idea
http://www.faqs.org/patents/app/20120110469#b
I have yet to find anything that can really mess up our own targeting algorithms, but I do find what she has done to be quite fascinating.
But I cannot imagine a way how you can take measures against this type of attack. Please tell us more.
I still think this game is a charming idea.
So really it's not about the users it's about stopping them destroying your current accurate data.
So all you need to do is identify if a user is a malicious one and ignore them.
So how does one identify dodgy data? Benford's Law is one example.
Of course this can be fought, but then you fight back and the war begins.
"'In its current state now it's a weapon,' said Ms. Law. 'Do I want it to get in the hands of the Syrian Electric Army? No!'
"To be fair, Ms. Law is not the most experienced computer programmer, so she said she needs assistance to make Vortex more secure. She has an undergraduate degree in Philosophy and Photography from the University of Melbourne in Australia, and 'crash-learned' programming."
So it sounds like the code base and the security model of this new project need thorough review. But if the project works, we could all have fun with an online game while obfuscating our consumer behavior data. Who would like to contribute to a project like this?
Well targeted ads are basically useless to the consumer since if you actually need something then you know this and you can search for it. The market operating in ad networks optimizes ads that sell enough to pay for more ads while remaining profitable, there is no mechanic that bubbles the best/least expensive offer to consumers since they are not the customer.
To enable all this targeting you need to implement surveillance on your targets as widely as possible.
So nearly all my internet is surveilled, by many parties, in order to spam the web with offers that are marked up enough to pay for winning ad auctions on popular terms for things I don't need, and could easily find if I did.
I get not caring about this. I don't get how anyone who understands how it works would not understanding the popular interest in subverting this mess.
This point of view is value-destroyingly cynical.
I worked in the online ad targeting/ad network industry for half a decade and strongly disagree with that premise.
The shadiest of products (penis enlargement, work from home, etc) are advertised with specifically "stupid" ads, because by eliminating the people who would never buy such a bad product in the first place they improve their CTR, screen before the click. That's the far end of the spectrum, but the premise is generally true for all advertising.
Informing your customers and competing on value is an inefficient method of advertising, it's much more profitable to find another, less rational, purchase trigger to exploit. There are many to choose from but traditionally this was still quite difficult and very risky. Now, with detailed analytics and advanced data processing you can just try them all and have the system cluster and optimize each approach.
"Relevant" ad targeting is sold as a method to display ads that will likely appeal to targets but an enormous part of it is screening those users who are informed enough to know that your product is not a wise purchasing decision.
And all of this lives in an auction model, so you either adapt to the more efficient methods or you get outbid on your keywords.
Value for who?
That may be true, but that doesn't make it incorrect. In fact, I do believe that it is in fact value-destroyingly cynical for technical people working in the valley; the current upswing in the business cycle (at least here in silicon valley) much like the first dot-com, is largely predicated on the idea that we are building the new advertising industry, and the technologies we are building for that new advertising industry make us dramatically more effective than the old advertising industry. so yeah, if you work in the area, you have a personal interest in others believing that targeted ads deliver a lot of value to the advertiser without subtracting too much value from the consumer. (I personally feel that the 'ads add value for the consumer' viewpoint that many googlers seem to espouse is so transparently self-serving as to be silly and ignorable[1].)
>That's like saying teaching in school is useless, because if I need to know something, I'll ask someone.
The difference here is the difference between asking for advice from a disinterested third party, and asking for advice from someone who gets money if you choose one choice over another - a salesman.
It's the fundamental problem with using ads to pay for search; The user of the search wants to find the most relevant answer; the provider of the search wants the user to find the most relevant answer that the provider is getting paid for. This is a fundamental conflict of interest.
I'd compare this with going to a VAR[2] for technical advice. The VAR may be run by someone technically way more competent than you are, but the VAR is paid by the people who sell you stuff. I mean, maybe the SAN that pays the best commission is also the best SAN for your needs... but maybe not, and if not, then that VAR has a conflict between choosing the highest commission for themselves and choosing the best solution for you (which would increase their reputation, and perhaps lead to larger, more profitable sales down the line.)
I mean, I'm not saying the VAR is always going to choose the short-term money over the long-term reputation... but there is a conflict, and most people seem to think that one should usually rely primarily on sources other than the salesperson for information about a big purchase.
[1]absurd claims (in your favor) weaken your position by showing disrespect for the intellect of your counterparty.
[2]In the corporate IT world, there's a 'general salesperson/technical help picking the right product to buy' role, called the VAR... the Value Added Re-seller. The difference between a VAR and a salesman is that a regular salesman works for one company; he can only sell, say, netapp products. The advantage of the VAR is that s/he can sell netapp, emc, and nexentia products, and get a commission for each. The idea is that the VAR will be more likely to steer you to an appropriate product for your needs than a salesman from one manufacturer. But it's still a salesman/woman.
(note, the other VAR role is just plain re-seller... manufacturers offer products to VARs at a discount, so some VARs will just sell you the product at below-list price, without "adding value")
...
>I get not caring about this. I don't get how anyone who understands how it works would not understanding the popular interest in subverting this mess.
Well said. From the consumers point of view? this makes a lot of sense. An ad should convey no credibility.
What I find interesting here is that even as the customer, most of the data passed down to the small business owner (say, me when I'm buying display ads) is massaged by folks who are way smarter than I am, and who have an interest in taking credit for as much of my profitability as possible. I mean, it's possible that they have a better view than I do of what causes people to choose me... really, it's kinda likely. but they have no interest in sharing that data with me, and I lack the ability to understand that data even if they did want to share it with me.
I think the upshot is that most 'targeted ads' are not nearly as effective as the buyers of said ads are lead to believe. Sure, I can buy ads that bring up my company when a user searches for "VPS" or "Linux VPS" or what have you, but I don't think people are going to buy from me unless they've actually heard about me from a credible source. I mean,
Personally? when I buy advertising, one of my first questions is "Do I want to be associated with the content on the page" - I think of it more as 'sponsorship' - you know, when a beer company sponsors a baseball team. I think a lot of the value I get out of advertising is that association with the community, and the more intermediaries you have between me and the community generating the content, the less value I see in the transaction.
Really, Eivind Uggedal[1] probably deserves 80% of every advertising dollar I've spent in the last four years.
[1]http://uggedal.com/journal/vps-comparison-between-slicehost-... (yes, yes, I know he did one later where linode kicked my ass, (I argue that was because linode gives you more vcpus, optimizing for best case, while I give you fewer, optimizing for worst-case, but as far as I can tell, they have some I/O monitoring sauce I don't, that really is better) but still, things like that are what I think is primarily responsible for people going through with a purchase... that and word of mouth. Paying google because they gave me the 'last click' is kinda silly.)
The most obvious examples of this sort of behaviour are people who spend all their time in front of the TV rather than developing deeper interests, or people who are vulnerable to drugs, but you can hook people on almost anything provided you make it look desirable and people don't have much contradicting data. So, if my algorithm decides that the people behind your IP address have no interest in formal education, and so doesn't market anything to do with learning to you, is that really good for you? Is it really good for your daughter or son?
It's like being search bubbled, only from the push end of things rather than the pull end.
Edit: Freshhawk's phrasing of it as extracting maximum value from the user is a good way of putting it, I think. Getting the most for the least doesn't necessarily work out in your favour unless you have a very good degree of self control and foresight.
That is a good way of putting it.
I also like that you identified "you can tell whether I'll be vulnerable to having one specific thing advertised to me excessively". I got into that in a follow up comment because that's really what targeted ads are about, finding people's irrational purchase triggers because "hey, i'm well informed and this product is great value!" is an expensive trigger to target.
I would never use this specifically because of that.
Doesn't sound like she knows how ad serving companies operate. These days many companies are just storing one cookie with some sort of unique identifier for the user, then storing user profiles, targeting data, behavioral tags, etc in a server-side cookie store. You're not going to be able to gather much data about companies that operate like that by analyzing huge numbers of their cookies, since every user will have a unique cookie.
For example, suppose that the cookies are arbitrarily altered, and they make advertisers think that I'm an older man who's extremely wealthy and takes vacations.
Now, whenever I visit travel websites, I'll see higher prices, whereas if I hadn't mislead the advertisers, I might see prices that are more reasonable and appropriate for my age / income bracket.
"For instance, if a user decides to go shoe-shopping for summer, he or she could equip their browser with the cookies most associated and aligned with shopping, shoes and summer"
You could do the same thing by trial and error switching profiles or some kind of way of sharing "this profile gives low prices at X travel site" information between users.
My company, LiveLoop, sells PowerPoint collaboration software. How do we get it in front of users? We buy Google ads. For 50 cents a click we get in front of the narrow sliver of people who desperately want our software NOW. And our users are ecstatic about our product once they start using it -- without targeted ads, they'd never have heard of us.
How does Google Apps, one of our competitors, advertise? However they want to. Billboards in Times Square. Super Bowl commercials. Anything they want, really.
Startups begin by serving narrow audiences, and targeted ads are today's best way of finding narrow audiences. This may end up hurting the wrong people.