4 ms·
Very interesting article, but there is an easy fix unlike the article claims. Many platforms (like facebook) won't allow you to use a data pool if there is less
by soared 9y ago
Very interesting article, but there is an easy fix unlike the article claims. Many platforms (like facebook) won't allow you to use a data pool if there is less than 1000 users. I wasn't aware you could target specific device ids just by knowing a single id, but that seems like an obvious flaw in the system.
If dsp/exchanges just required 1k or 500 users be in a retargeting pool (or list of device ids) then this problem would be solved.
As for knowing how many users use a specific app in a location, that is an extremely fuzzy number and I doubt the accuracy of it. Almost no exchanges show you how many auctions you lost, so just finding out how many uniques you served to is flawed and much smaller than the real number.
> "This is so easy and it's industry-wide," says Tadayoshi Kohno
Maybe across the spying/intelligence industry, but advertisers don't care about individuals at all. This is an interesting experiment, but most platforms don't enable this type of tracking and no advertiser would ever need/want to do it.
- wtvanhest 9y ago> Maybe across the spying/intelligence industry, but advertisers don't care about individuals at all. This is an interesting experiment, but most platforms don't enable this type of tracking and no advertiser would ever need/want to do it. I disagree. If a company selling an extremely expensive implementation of something could serve ads directly to only the decision makers in that type of product, it would be a very valuable target and absolutely worth pushing ads to a single individual.
- soared 9y agoTrue except these are display ads and cost $1000, which would be 10x more effective if spent on another channel. I suppose 0.0001% of advertisers might use this.
- dmitriid 9y agoThink political campaigns, global product pushes etc. If you can bulk push near-individual custom ads tailored to highly specific target groups, you potentially gain much more than just blanket advertisement
- soared 9y agoWell if you want to spend $4000 (media costs, campaign management, creative, etc.) to acquire a user, I guess. But you can already tailor ads to incredibly specific groups, no need to get to an individual level. For global-size campaigns or political campaigns this level of granularity is needlessly expensive.
- wtvanhest 9y agoI wasn't commenting on the cost, just the statement that it had no value. But... I do think $1,000 to find out who + $2.00CPM to bombard a CFO about a $50mm financial software investment for years would be a massive ROI. It would just help the sales team make it work.
- soared 9y agoDefinitely worth it in rare situations, but the cpm to hit 1 person is massive - hundreds or even thousands of dollars.
- FridgeSeal 9y agoBut that doesn't matter because you'd only be targeting a single person and they're only going to generate at most a few hundred impressions, so your bill is going to be super cheap.
- abalone 9y ago> no advertiser would ever need/want to do it. No, the article details many such advertisers: abusive spouses who want to track their spouse, for example. The whole point of the attack is this high-precision geo-targeting mechanism can be exploited by attackers. And clearly some platforms do enable this type of tracking, because the experiment worked.
- soared 9y agoMy intent was to argue against the quote, not the article. He is implying that the advertising industry uses this, which is not true and could easily be converted into scary clickbait ('Advertisers now have the ability to track your every move - why does coco cola know where you buy coffee?' ) I do wish they would've said what dsp or exchange they used, I'm not familiar with any that could do this.
- PotatoEngineer 9y agoIf the advertisers can see the MAID for each ad impression, then there's no need to be too specific about who you target - it'll just cost you more. On the other hand, if the advertiser doesn't get to see the MAID-per-impression, then the easy solution is to supply your one target MAID, plus another 999 bogus MAIDs (or, if the platform verifies that MAIDs are accurate before allowing you to use them, then you use 999 MAIDs from Liberia or some other country that your target won't visit).
- soared 9y agoAgreed, the platform would need some verification that you aren't skirting the rules.
- SOLAR_FIELDS 9y agoRegarding the pool size for facebook, it wasn’t always like this. The half amusing half creepy story here shows what it was like before the change was made :http://ghostinfluence.com/the-ultimate-retaliation-pranking-my-roommate-with-targeted-facebook-ads/ http://ghostinfluence.com/the-ultimate-retaliation-pranking-...
- hayksaakian 9y agoThe pool size restrictions can be worked around too: Put 999 Indian IDs in your pool and 1 from your target in the USA. Then run your campaign targeting USA only. There's other work around like this, but I think you get the idea.
- soared 9y agoWhich can be easily identified and blocked.. "If <10% of users in the pool are actually being served ads, block that pool" "If other rules w/in the campaign exclude x% of the pool, block that pool"
- psandersen 9y agoIf your targeting is machine learning driven and linked to other databases so you can create 100k+ ads with optimized variations all linked to A/B style tests then that targeting is extremely useful. Maybe peoples responses give you enough to then followup with cold calls/direct mail etc. Frankly there is way too much that can be done by combining different data and ML that the traditional way we think about preserving privacy is insufficient.
- soared 9y agoI don't really understand how half of the time people claim display ads are completely inneffective, while other times they can argue spending $1k on a user for display ads is worth it.