17 ms·

The Washington Post is preparing for post-cookie ad targeting

182 points by madspindel 7y ago

pdkl95 7y ago
> what URL they have used to arrive there This is yet another example of why sending the Referrer header is insane. It's a massive privacy breach by design. Anything serious about protecting privacy needs to stop intentionally betraying the user's browsing path and simply remove the header from all HTTP requests. Anything that functionally relies on a valid referrer is at best an unfortunate but necessary casualty. However, I suspect that far too often this is simply a way to obfuscate the usual tracking. If you tie your functionality to something designed to violate user privacy, don't be surprised if that functionality breaks when the privacy leak is finally fixed.
- mosselman 7y ago
  I agree. There are some add-ons that spoof/disable this header for you, but as you said, this breaks some sites. I agree, as a consumer, that website that rely on the header are out of luck with regards to my business, but at work I don't always have a choice with regards to which online tools we use. But white listing the things that break is a fine solution in that case.
  - pessimizer 7y ago
    I forge the referer as the root of the site, except in the case of news sites that allow referers from google news to bypass the paywall, in which case I always forge that. This very rarely breaks anything (one out of a million sites expect an external or specific referer.)
- rubinelli 7y ago
  There are very goods reasons for the Referrer header to be used. If you see a lot of traffic going to a URL with a typo, you will want to know where that typo is. If someone hotlinks to a large file in your domain, you will want to know who it is and block it. Any alternative would be much more intrusive.
  - pdkl95 7y ago
    > you will want to know where that typo is ... you will want to know who it I know you want to know those things. Find another way to handle those issues. To be a "good reason", you need to show why your reason is worth paying the high price of betraying every user's browsing path to every server. Worrying about hotlinks and typos... "ain't the same fuckin' ballpark, it ain't the same league, it ain't even the same fuckin' sport". > Any alternative would be much more intrusive. Did you consider only serving that "large file" only when accompanied with a proper session cookie created when they loaded the HTML file? There are many solutions to those problems, including some that are sever-side-only.
    - spiderfarmer 7y ago
      Find another way to handle those issues. If there's another way, it would lead to the same privacy concerns. why your reason is worth paying the high price of betraying every user's browsing path to every server First explain why it's a) betrayal b) a high price. a proper session cookie This again could lead to privacy concerns.
    - dvfjsdhgfv 7y ago
      I understand your concerns very well, but I have a different perspective. I don't modify my Referrer header. I want to let the websites I'm using where I came from. A referrer by itself is innocuous - only when you combine it with other nefarious techniques it wreaks havoc on users privacy. But on it's own, in an anonymous browser environment that I tend to use, it's actually quite useful.
  - turbinerneiter 7y ago
    Sadly, the industry chose to abuse it to the detriment of the users. Enough reason to take it away.
- spiderfarmer 7y ago
  "something designed to violate user privacy" I fail to see why sending the referer is a privacy concern. Following that logic, every datapoint is a privacy concern. From screen resolution to mouse movement, everything can be abused to build profiles. Referer headers have a host of valid usecases but if you are opposed any data being shared you'll probably dismiss all of them.
  - rayiner 7y ago
    What’s a valid use case?
    - spiderfarmer 7y ago
      If my site is getting hammered by visitors I would like to be able to easily discern if it's because I'm featured on HN's frontpage or if I'm victim of a DDOS attack.
      - y0ghur7_xxx 7y ago
        The referrer header is in no way a tool to differentiate real users from a ddos attack.
        spiderfarmer 7y ago
        I disagree. A fake referer is easily checked: Is my link really on the frontpage? If so: all good. If not: it's getting suspicious.
        close04 7y ago
        A similar line of argumentation has been historically used to push every outrageous thing on innocent people since forever. You sell the "abuse" as defense for a shocking crime. Ok, you only said DDoS when the usual is terrorism and child abuse. But the bottom line is the same: I need to take something private from you to defend myself. What would you think if all stores took every measurement they could about you without disclosing it and eventually justified it by saying "how else would I know you're not a thief"?
- amarshall 7y ago
  Cross-origin sending of the Referer header can be disabled in Firefox with network.http.referer.XOriginPolicy, along with a variety of other Referer-related options [1]. I have it set to 1 (and XOriginTrimmingPolicy to 2) and haven’t experienced (m)any issues. [1] https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer
- dehrmann 7y ago
  It's not really "design"--the header name is even misspelled. This one always felt like, at the time in the early days of the web, it'd be interesting data to pass along. Since then, things like image hotlinking started to depend on it, and Google got better about hiding referrer data, so there wasn't the same motivation to fix it as implementing same-origin policy. If the web were invented today, yes, I doubt that this would be a thing.
  - stubish 7y ago
    It was how you did sessions before Cookies and JavaScript existed, and existed because it was a problem that needed solving. Converting forms to wizards and the first Internet shopping carts.
- commoner 7y ago
  If you're using Firefox, the Smart Referer add-on strips out the HTTP Referer and the value of document.referer (in JavaScript) from cross-domain requests. It includes a default whitelist, and is customizable. https://addons.mozilla.org/en-US/firefox/addon/smart-referer https://addons.mozilla.org/en-US/firefox/addon/smart-referer It's also open source. https://gitlab.com/smart-referer/smart-referer https://gitlab.com/smart-referer/smart-referer This extension is most effective if you also use an ad blocker (like uBlock Origin) and Firefox's first-party isolation feature, although Smart Referer will still help prevent tracking even if you don't. https://www.ghacks.net/2017/11/22/how-to-enable-first-party-isolation-in-firefox https://www.ghacks.net/2017/11/22/how-to-enable-first-party-...
  - jakejarvis 7y ago
    You can also set this directly in about:config under network.http.sendRefererHeader: 0 = never send the header 1 = send the header only when clicking on links and similar elements 2 = (default) send on all requests (e.g. images, links, etc.) If you want more granular control (like sending referrers but only the root of the domain) all of the various network.http.referer flags for Firefox are listed here: https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer Doesn't have a few of the features that your extension has, but it's done the trick for me!
    - copperx 7y ago
      Has the 0 setting broken anything in your experience?
    - commoner 7y ago
      I'm not the developer of the extension (just a user), but thanks for the about:config tip!
- ggg3 7y ago
  and I wanted to recall that google employees repeatedly removed chromium's project code to restrict or disable referrer headers. I personally was involved in 3 distinct times. And after that gave up chromium and the lie of google-independence completely. and so should you. If they tweak things to reach their profit goals, they will also do the same when any agency "asks" them to. it's a slippery slope, and they already crossed
andy_ppp 7y ago
If I type in the address bar a URL or click a bookmark rather than click a link, is the referrer still sent?
- dao- 7y ago
  No.
- deleted 7y ago
  [deleted]
- mobjack 7y ago
  If they don't see a referer, then they can assume that you typed in the URL or bookmarked the page. That could signal higher intent than someone clicking a random clickbait link to your site. Other events could prevent the referer from being sent too, but you can filter some of those out using other tracking methods and looking at user behavior.
  - dao- 7y ago
    > If they don't see a referer, then they can assume that you typed in the URL or bookmarked the page. ... or followed a link from an IM or some other source outside of the browser. Too many possibilities to really assume anything and draw conclusions.
- JohnFen 7y ago
  No, which is why years ago I developed the habit of not clicking links, but copying them and pasting them into a new browser instance. That also gives me the opportunity to delete the tracking parameters that are added to a lot of links.
- syrrim 7y ago
  You can also disable/spoof referer in about:config
abraae 7y ago
Is this Jeff Bezos's influence? Things I would never have imagined a big old newspaper having their IT team whip up: > The Zeus platform monitors contextual data such as what article a person is reading or watching, what position they have scrolled to on a page, what URL they have used to arrive there and what they’re clicking on. The publisher will then match that data to its existing audience data pools, which it has accumulated over the last four years, to create assumptions on what that news user’s consumption intent will be. The technology uses machine learning to decipher the patterns.
- KozmoNau7 7y ago
  Yet another extremely compelling reason to simply disable all javascript (and other active content) by default.
  - dvfjsdhgfv 7y ago
    For me it works like this: the default is disabled. When something doesn't work (actually The Washington Post works great, much better than with JS on), I esitmate the tradeoffs: if it's a really useful website with JS functionality that is actually useful to me (say, with JS doing the math notation rendering or an app I badly need), I enable JS. Otherwise, why bother? JS is like ads used to be: first they put it everywhere, then you get fed up and just switch it off.
    - KozmoNau7 7y ago
      Do you block all JS, including 1st party and inline scripts, or only 3rd party scripts and resources? I've used uBlock Origin to block all 3rd party scripts and frames for a while, but I'm seriously considering going full default-deny all scripts and other active content.
      - nathanaldensr 7y ago
        Not the GP, but I block all scripts by default with NoScript, then selectively enable them, starting with the first-party scripts. I've learned to identify likely tracking domains and have memorized several of the more widespread ones, so over time this technique has proven effective.
user17843 7y ago
All of this money and effort to create something that has never scientifically been proven to work: Super-targeted ads, instead of contextual ads. The context is already there. Each article on a newspaper already provides the context. What is the true purpose of this? The true purpose is psychological control and manipulation, as well as making additional money with the data beyond ads. Psychological manipulation gives the ability to actually create demand. And this is what this is about, because that's the only way to actually increase revenue in a meaningful way. If you can target a person everywhere on all channels, and all the time, you can do things that are not possible with simple contextual ads, and the profiles that are being created are for lots of different purposes, not for ads. I wait for the day some newspaper actually does an in-depth investigative study into the level of manipulation that drives sales in ad-tech, because I suspect that the entire system feeds off low-educated and poor people, for example lower-class stressed-out people who struggle to lose weight and are prone to manipulative ads. This is the target audience that you can manipulate into spending 500$ instead of 50$.
- avn2109 7y ago
  You’re waiting for newspapers to investigate why their own primary revenue stream is unethical?
  - untog 7y ago
    Newspapers get huge amounts of referral traffic from Facebook, it hasn't stopped them investigating Facebook's practises.
    - toasterlovin 7y ago
      Facebook is an adversary, though. Big difference.
  - ChrisSD 7y ago
    Technically the journalists should have editorial independence and a firewall between them and marketing. So they could in theory investigate their own paper's revenue stream. Although in this case they wouldn't have to frame it in such stark terms because ad tech is widely used.
ChrisSD 7y ago
It should be noted that the so-called "cookie law" is about more than just cookies. It's about all user data and who can access it and for what reason. If this more tightly controls who user data is given to then that is a big improvement. If it's just trying to find technical loopholes in the law... well EU law tends to take a dim view of that.
MayeulC 7y ago
Could Firefox's containers be extended, and include an option to resist fingerprinting? This would limit the information sent by the browser (maybe run everything in a lightweight VM with standardized performance, feature and settings), including the referrer used to open the containerized tab (which might be done already). The VM sounds complicated, but we already have qemu running in browsers. Reduce the timing granularity, randomize I/O slots, and lie about the RTC, and fingerprinting becomes much harder, unless I am missing something? Side note: I am against fingerprinting me across websites as an individual, but I am perfectly OK with fingerprinting me about my interests, provided everything is done in a stateless manner: if I spent more time on the technical section, which 80% people skimmed over, maybe offer me more technical articles at the bottom? But please, do not keep information about me. Tracking would be illegal under the GDPR provisions anyway, AFAIK, cookies or not.
- johnkpaul 7y ago
  If I understand it correctly, this is what tor browser does, in addition to using the tor network itself to as-close-to-anonymize you. Tor browser has warnings that encourage you to not-resize your browser because that could be used as fingerprinting data.
  - MayeulC 7y ago
    Well, I was thinking about enabling those on specific domains only (leveraging the container feature). An interesting (research) approach would be to taint the data that can be used as fingerprinting, and forbid its exfiltration, perhaps with different levels of aggressiveness. Example: a webGL game requires my wwindow width, GPU capabilities, etc? fine. But now, the thread that has this data cannot send anything to the other threads. It would require some adjustments, and tightening the side-channels (making available download bandwidth/timings/etc more granular, for once). I do not expect it to be completely fingerprinting-resistant, but it would go a long way.
- amarshall 7y ago
  Firefox has privacy.resistFingerprinting which takes a variety of steps to, well, resist fingerprinting. The functionality was ported from Tor Browser. However, some aspects may be frustrating to the user (set window dimensions, no zoom-level memory, etc.). There are, of course, many other privacy-related configs in Firefox. Relevant to the Referer header is settings under network.http.referer.* (see https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer).
rdtsc 7y ago
Once they have better tracking, wonder if they would use it to manipulate news items on a per-customer basis. That is show one news item to this person but not to that person. Or maybe change the tone or phrasing in the articles. > The Post plans to license the Zeus platform to publishers both domestically and internationally Does that imply data sharing as well?
- karmakaze 7y ago
  Seems to by this implication: > and reaches a combined 750 million unique users globally, according to the publisher. The theory is that in doing so, publishers can compete more effectively with the scale and data-targeting opportunities provided by Facebook and Google.
- mtberatwork 7y ago
  > That is show one news item to this person but not to that person. I imagine they do this to some extent already. Personalization is nothing new.
  - rdtsc 7y ago
    > Personalization is nothing new. It is for ads, and newspapers adjust their content for different regions. But I wonder if they intend to do what they do for ads for news stories. They may choose to hide some, bring some to the top or even reword them. So if I go to WaPo's front page, I'll see different "news" than what my co-worker next to me sees.
    - JohnFen 7y ago
      > But I wonder if they intend to do what they do for ads for news stories. I actually pay money to read the WaPo. If they started "personalizing" the news like that, I'd cancel my subscription and stop reading them at all. There are a lot of things that I think are made worse by personalization, and what news reports I get to see is toward the top of that list.
manishsharan 7y ago
WashingtonPost has been ahead of the curve on this for a while. Here is my anecdotal experience with their tracking. WashingtonPost allows a non subscriber to view a few articles per month and if you went over the limit it would require a login. I had been able to circumvent that by clearing out my cache, cookies and local storage or using the anonymous mode. But now that does not work anymore. I am able to work around this by disabling javascript. Your move WashingtonPost!
- spdionis 7y ago
  Well, the next move looks obvious to me.
- imglorp 7y ago
  Or use something like outline.com
yodon 7y ago
Total online ad spend works out to about $1/person/day in the US.[0] We have collectively sacrificed our privacy because we're collectively not willing to pay $1/day for what used to be called newspapers and magazines ($1/day is equivalent to subscribing to a daily paper or a couple magazines, as most people did in days of old). There is a cost to providing news. The industry made clear it preferred to sell subscriptions but consumers collectively said no I want free beer and laughed at newspapers and magazine publishers for being so stupid as to try to sell subscriptions. Having been told no I won't pay for subscriptions the industry was dragged forcibly from what was unquestionably its preferred subscription model into the ad tracking supported model we have today. All because costs people can see (subscriptions) are less palatable than far higher costs they can't see (ubiquitous tracking). [0] https://www.vox.com/recode/2019/6/24/18715421/internet-free-data-ads-cost https://www.vox.com/recode/2019/6/24/18715421/internet-free-...
- tinus_hn 7y ago
  Do you think the content owners wouldn’t take the marketeers $1 if you paid $1? You pay for a printed newspaper and it has ads as well.
  - notatoad 7y ago
    Exactly. The publication that is the content of this article is a paywalled, subscription-based site. This is not an either/or situation.
- aakilfernandes 7y ago
  While a fair point, cost is not value. It is the lower bound of value. It could be that targeted ads are creating $10 value per person but it only cost $1 per person, $9 of which goes to the advertiser/consumer.
  - yodon 7y ago
    The idea of 9x extra hidden value lurking in the system is a nice concept but unlikely to be present. It's unlikely to be present on the advertiser side because if advertisers were actually reaping 10x the value of their digital ad costs, ad prices would rise significantly because advertisers would be willing to pay significantly more than they do today. The excess positive value is unlikely to be present on the consumer side because as already commented the consumer is reaping a huge net negative hidden value as a result of the ubiquitous tracking it drives.
amluto 7y ago
I’m surprised WaPo isn’t trying something simpler and more disruptive: making a point of selling non-targeted ads. Targeted ads may be somewhat effective at selling a specific product, but they’re creepy and they don’t help build a brand. Non-targeted ads are not creepy and signal that a brand is legitimate. Of course, it’s much harder to apply metrics to this type of ad, since conversions aren’t the point. Daringfireball.net does this kind of non-targeted advertising. I would love to see a major publisher (other than TV) try it.
- OrwellianChild 7y ago
  I'll not say it would be impossible to run a general news website this way, but Gruber's website is basically pre-targeted already. Advertisers know pretty much exactly what they're getting with his audience - affluent, tech-focused Apple-aficionados with disposable income. It works great for him and his advertisers, but isn't a generalizable example.
OrwellianChild 7y ago
I admire steps taken to improve the privacy of ad-supported media ecosystems, so this effort by WaPo should be applauded on it's own. Their results, taken along with NYT's switch back to content-only ads in the EU [1] might help spread the word that all the creepy ad-tech isn't even necessary or beneficial! That said, I'd like to make a simple request of media outlets... Please build a rate plan which provides all of the benefits of subscription, adds the expected profit from advertising, and then let me buy it to experience your content ad- and tracking-free. Please! [1] https://digiday.com/media/gumgumtest-new-york-times-gdpr-cut-off-ad-exchanges-europe-ad-revenue/ https://digiday.com/media/gumgumtest-new-york-times-gdpr-cut...
- OrwellianChild 7y ago
  A case study in this: The New York Times In 2018, it made $202MM in revenue from digital display advertising. [1] Averaged across an annual reader base of 125MM worldwide, or 91MM in the U.S. alone [2], that averages out to just $1.62 or $2.22 per customer. Let us pay it to opt-out! Where is the harm? [1] https://s1.q4cdn.com/156149269/files/doc_financials/annual/2018/updated/2018-Annual-Report-(1).pdf https://s1.q4cdn.com/156149269/files/doc_financials/annual/2... [2] https://nytmediakit.com/digital https://nytmediakit.com/digital
JohnFen 7y ago
If I understand what they're proposing, this is a method of ad targeting that I don't actually object to. It doesn't involve spying on me, identifying me, or tracking me (either on or off the internet). It's closer to, but not completely, how ad targeting should be done -- based on the context the ad appears in rather than trying to figure out my own personal characteristics.
aussieguy1234 7y ago
Are there any ad networks out there that do not track users?

182 points by madspindel 7y ago

> what URL they have used to arrive there This is yet another example of why sending the Referrer header is insane. It's a massive privacy breach by design. Anything serious about protecting privacy needs to stop intentionally betraying the user's browsing path and simply remove the header from all HTTP requests. Anything that functionally relies on a valid referrer is at best an unfortunate but necessary casualty. However, I suspect that far too often this is simply a way to obfuscate the usual tracking. If you tie your functionality to something designed to violate user privacy, don't be surprised if that functionality breaks when the privacy leak is finally fixed.

mosselman 7y ago
I agree. There are some add-ons that spoof/disable this header for you, but as you said, this breaks some sites. I agree, as a consumer, that website that rely on the header are out of luck with regards to my business, but at work I don't always have a choice with regards to which online tools we use. But white listing the things that break is a fine solution in that case.
- pessimizer 7y ago
  I forge the referer as the root of the site, except in the case of news sites that allow referers from google news to bypass the paywall, in which case I always forge that. This very rarely breaks anything (one out of a million sites expect an external or specific referer.)
rubinelli 7y ago
There are very goods reasons for the Referrer header to be used. If you see a lot of traffic going to a URL with a typo, you will want to know where that typo is. If someone hotlinks to a large file in your domain, you will want to know who it is and block it. Any alternative would be much more intrusive.
- pdkl95 7y ago
  > you will want to know where that typo is ... you will want to know who it I know you want to know those things. Find another way to handle those issues. To be a "good reason", you need to show why your reason is worth paying the high price of betraying every user's browsing path to every server. Worrying about hotlinks and typos... "ain't the same fuckin' ballpark, it ain't the same league, it ain't even the same fuckin' sport". > Any alternative would be much more intrusive. Did you consider only serving that "large file" only when accompanied with a proper session cookie created when they loaded the HTML file? There are many solutions to those problems, including some that are sever-side-only.
  - spiderfarmer 7y ago
    Find another way to handle those issues. If there's another way, it would lead to the same privacy concerns. why your reason is worth paying the high price of betraying every user's browsing path to every server First explain why it's a) betrayal b) a high price. a proper session cookie This again could lead to privacy concerns.
  - dvfjsdhgfv 7y ago
    I understand your concerns very well, but I have a different perspective. I don't modify my Referrer header. I want to let the websites I'm using where I came from. A referrer by itself is innocuous - only when you combine it with other nefarious techniques it wreaks havoc on users privacy. But on it's own, in an anonymous browser environment that I tend to use, it's actually quite useful.
- turbinerneiter 7y ago
  Sadly, the industry chose to abuse it to the detriment of the users. Enough reason to take it away.
spiderfarmer 7y ago
"something designed to violate user privacy" I fail to see why sending the referer is a privacy concern. Following that logic, every datapoint is a privacy concern. From screen resolution to mouse movement, everything can be abused to build profiles. Referer headers have a host of valid usecases but if you are opposed any data being shared you'll probably dismiss all of them.
- rayiner 7y ago
  What’s a valid use case?
  - spiderfarmer 7y ago
    If my site is getting hammered by visitors I would like to be able to easily discern if it's because I'm featured on HN's frontpage or if I'm victim of a DDOS attack.
    - y0ghur7_xxx 7y ago
      The referrer header is in no way a tool to differentiate real users from a ddos attack.
      - spiderfarmer 7y ago
        I disagree. A fake referer is easily checked: Is my link really on the frontpage? If so: all good. If not: it's getting suspicious.
        close04 7y ago
        A similar line of argumentation has been historically used to push every outrageous thing on innocent people since forever. You sell the "abuse" as defense for a shocking crime. Ok, you only said DDoS when the usual is terrorism and child abuse. But the bottom line is the same: I need to take something private from you to defend myself. What would you think if all stores took every measurement they could about you without disclosing it and eventually justified it by saying "how else would I know you're not a thief"?
amarshall 7y ago
Cross-origin sending of the Referer header can be disabled in Firefox with network.http.referer.XOriginPolicy, along with a variety of other Referer-related options [1]. I have it set to 1 (and XOriginTrimmingPolicy to 2) and haven’t experienced (m)any issues. [1] https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer
dehrmann 7y ago
It's not really "design"--the header name is even misspelled. This one always felt like, at the time in the early days of the web, it'd be interesting data to pass along. Since then, things like image hotlinking started to depend on it, and Google got better about hiding referrer data, so there wasn't the same motivation to fix it as implementing same-origin policy. If the web were invented today, yes, I doubt that this would be a thing.
- stubish 7y ago
  It was how you did sessions before Cookies and JavaScript existed, and existed because it was a problem that needed solving. Converting forms to wizards and the first Internet shopping carts.
commoner 7y ago
If you're using Firefox, the Smart Referer add-on strips out the HTTP Referer and the value of document.referer (in JavaScript) from cross-domain requests. It includes a default whitelist, and is customizable. https://addons.mozilla.org/en-US/firefox/addon/smart-referer https://addons.mozilla.org/en-US/firefox/addon/smart-referer It's also open source. https://gitlab.com/smart-referer/smart-referer https://gitlab.com/smart-referer/smart-referer This extension is most effective if you also use an ad blocker (like uBlock Origin) and Firefox's first-party isolation feature, although Smart Referer will still help prevent tracking even if you don't. https://www.ghacks.net/2017/11/22/how-to-enable-first-party-isolation-in-firefox https://www.ghacks.net/2017/11/22/how-to-enable-first-party-...
- jakejarvis 7y ago
  You can also set this directly in about:config under network.http.sendRefererHeader: 0 = never send the header 1 = send the header only when clicking on links and similar elements 2 = (default) send on all requests (e.g. images, links, etc.) If you want more granular control (like sending referrers but only the root of the domain) all of the various network.http.referer flags for Firefox are listed here: https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer Doesn't have a few of the features that your extension has, but it's done the trick for me!
  - copperx 7y ago
    Has the 0 setting broken anything in your experience?
  - commoner 7y ago
    I'm not the developer of the extension (just a user), but thanks for the about:config tip!
ggg3 7y ago
and I wanted to recall that google employees repeatedly removed chromium's project code to restrict or disable referrer headers. I personally was involved in 3 distinct times. And after that gave up chromium and the lie of google-independence completely. and so should you. If they tweak things to reach their profit goals, they will also do the same when any agency "asks" them to. it's a slippery slope, and they already crossed

andy_ppp 7y ago

If I type in the address bar a URL or click a bookmark rather than click a link, is the referrer still sent?

dao- 7y ago
No.
deleted 7y ago
[deleted]
mobjack 7y ago
If they don't see a referer, then they can assume that you typed in the URL or bookmarked the page. That could signal higher intent than someone clicking a random clickbait link to your site. Other events could prevent the referer from being sent too, but you can filter some of those out using other tracking methods and looking at user behavior.
- dao- 7y ago
  > If they don't see a referer, then they can assume that you typed in the URL or bookmarked the page. ... or followed a link from an IM or some other source outside of the browser. Too many possibilities to really assume anything and draw conclusions.
JohnFen 7y ago
No, which is why years ago I developed the habit of not clicking links, but copying them and pasting them into a new browser instance. That also gives me the opportunity to delete the tracking parameters that are added to a lot of links.
syrrim 7y ago
You can also disable/spoof referer in about:config

abraae 7y ago

Is this Jeff Bezos's influence? Things I would never have imagined a big old newspaper having their IT team whip up: > The Zeus platform monitors contextual data such as what article a person is reading or watching, what position they have scrolled to on a page, what URL they have used to arrive there and what they’re clicking on. The publisher will then match that data to its existing audience data pools, which it has accumulated over the last four years, to create assumptions on what that news user’s consumption intent will be. The technology uses machine learning to decipher the patterns.

KozmoNau7 7y ago
Yet another extremely compelling reason to simply disable all javascript (and other active content) by default.
- dvfjsdhgfv 7y ago
  For me it works like this: the default is disabled. When something doesn't work (actually The Washington Post works great, much better than with JS on), I esitmate the tradeoffs: if it's a really useful website with JS functionality that is actually useful to me (say, with JS doing the math notation rendering or an app I badly need), I enable JS. Otherwise, why bother? JS is like ads used to be: first they put it everywhere, then you get fed up and just switch it off.
  - KozmoNau7 7y ago
    Do you block all JS, including 1st party and inline scripts, or only 3rd party scripts and resources? I've used uBlock Origin to block all 3rd party scripts and frames for a while, but I'm seriously considering going full default-deny all scripts and other active content.
    - nathanaldensr 7y ago
      Not the GP, but I block all scripts by default with NoScript, then selectively enable them, starting with the first-party scripts. I've learned to identify likely tracking domains and have memorized several of the more widespread ones, so over time this technique has proven effective.

user17843 7y ago

All of this money and effort to create something that has never scientifically been proven to work: Super-targeted ads, instead of contextual ads. The context is already there. Each article on a newspaper already provides the context. What is the true purpose of this? The true purpose is psychological control and manipulation, as well as making additional money with the data beyond ads. Psychological manipulation gives the ability to actually create demand. And this is what this is about, because that's the only way to actually increase revenue in a meaningful way. If you can target a person everywhere on all channels, and all the time, you can do things that are not possible with simple contextual ads, and the profiles that are being created are for lots of different purposes, not for ads. I wait for the day some newspaper actually does an in-depth investigative study into the level of manipulation that drives sales in ad-tech, because I suspect that the entire system feeds off low-educated and poor people, for example lower-class stressed-out people who struggle to lose weight and are prone to manipulative ads. This is the target audience that you can manipulate into spending 500$ instead of 50$.

avn2109 7y ago
You’re waiting for newspapers to investigate why their own primary revenue stream is unethical?
- untog 7y ago
  Newspapers get huge amounts of referral traffic from Facebook, it hasn't stopped them investigating Facebook's practises.
  - toasterlovin 7y ago
    Facebook is an adversary, though. Big difference.
- ChrisSD 7y ago
  Technically the journalists should have editorial independence and a firewall between them and marketing. So they could in theory investigate their own paper's revenue stream. Although in this case they wouldn't have to frame it in such stark terms because ad tech is widely used.

ChrisSD 7y ago

It should be noted that the so-called "cookie law" is about more than just cookies. It's about all user data and who can access it and for what reason. If this more tightly controls who user data is given to then that is a big improvement. If it's just trying to find technical loopholes in the law... well EU law tends to take a dim view of that.

MayeulC 7y ago

Could Firefox's containers be extended, and include an option to resist fingerprinting? This would limit the information sent by the browser (maybe run everything in a lightweight VM with standardized performance, feature and settings), including the referrer used to open the containerized tab (which might be done already). The VM sounds complicated, but we already have qemu running in browsers. Reduce the timing granularity, randomize I/O slots, and lie about the RTC, and fingerprinting becomes much harder, unless I am missing something? Side note: I am against fingerprinting me across websites as an individual, but I am perfectly OK with fingerprinting me about my interests, provided everything is done in a stateless manner: if I spent more time on the technical section, which 80% people skimmed over, maybe offer me more technical articles at the bottom? But please, do not keep information about me. Tracking would be illegal under the GDPR provisions anyway, AFAIK, cookies or not.

johnkpaul 7y ago
If I understand it correctly, this is what tor browser does, in addition to using the tor network itself to as-close-to-anonymize you. Tor browser has warnings that encourage you to not-resize your browser because that could be used as fingerprinting data.
- MayeulC 7y ago
  Well, I was thinking about enabling those on specific domains only (leveraging the container feature). An interesting (research) approach would be to taint the data that can be used as fingerprinting, and forbid its exfiltration, perhaps with different levels of aggressiveness. Example: a webGL game requires my wwindow width, GPU capabilities, etc? fine. But now, the thread that has this data cannot send anything to the other threads. It would require some adjustments, and tightening the side-channels (making available download bandwidth/timings/etc more granular, for once). I do not expect it to be completely fingerprinting-resistant, but it would go a long way.
amarshall 7y ago
Firefox has privacy.resistFingerprinting which takes a variety of steps to, well, resist fingerprinting. The functionality was ported from Tor Browser. However, some aspects may be frustrating to the user (set window dimensions, no zoom-level memory, etc.). There are, of course, many other privacy-related configs in Firefox. Relevant to the Referer header is settings under network.http.referer.* (see https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer).

rdtsc 7y ago

Once they have better tracking, wonder if they would use it to manipulate news items on a per-customer basis. That is show one news item to this person but not to that person. Or maybe change the tone or phrasing in the articles. > The Post plans to license the Zeus platform to publishers both domestically and internationally Does that imply data sharing as well?

karmakaze 7y ago
Seems to by this implication: > and reaches a combined 750 million unique users globally, according to the publisher. The theory is that in doing so, publishers can compete more effectively with the scale and data-targeting opportunities provided by Facebook and Google.
mtberatwork 7y ago
> That is show one news item to this person but not to that person. I imagine they do this to some extent already. Personalization is nothing new.
- rdtsc 7y ago
  > Personalization is nothing new. It is for ads, and newspapers adjust their content for different regions. But I wonder if they intend to do what they do for ads for news stories. They may choose to hide some, bring some to the top or even reword them. So if I go to WaPo's front page, I'll see different "news" than what my co-worker next to me sees.
  - JohnFen 7y ago
    > But I wonder if they intend to do what they do for ads for news stories. I actually pay money to read the WaPo. If they started "personalizing" the news like that, I'd cancel my subscription and stop reading them at all. There are a lot of things that I think are made worse by personalization, and what news reports I get to see is toward the top of that list.

manishsharan 7y ago

WashingtonPost has been ahead of the curve on this for a while. Here is my anecdotal experience with their tracking. WashingtonPost allows a non subscriber to view a few articles per month and if you went over the limit it would require a login. I had been able to circumvent that by clearing out my cache, cookies and local storage or using the anonymous mode. But now that does not work anymore. I am able to work around this by disabling javascript. Your move WashingtonPost!

spdionis 7y ago
Well, the next move looks obvious to me.
imglorp 7y ago
Or use something like outline.com

yodon 7y ago

Total online ad spend works out to about $1/person/day in the US.[0] We have collectively sacrificed our privacy because we're collectively not willing to pay $1/day for what used to be called newspapers and magazines ($1/day is equivalent to subscribing to a daily paper or a couple magazines, as most people did in days of old). There is a cost to providing news. The industry made clear it preferred to sell subscriptions but consumers collectively said no I want free beer and laughed at newspapers and magazine publishers for being so stupid as to try to sell subscriptions. Having been told no I won't pay for subscriptions the industry was dragged forcibly from what was unquestionably its preferred subscription model into the ad tracking supported model we have today. All because costs people can see (subscriptions) are less palatable than far higher costs they can't see (ubiquitous tracking). [0] https://www.vox.com/recode/2019/6/24/18715421/internet-free-data-ads-cost https://www.vox.com/recode/2019/6/24/18715421/internet-free-...

tinus_hn 7y ago
Do you think the content owners wouldn’t take the marketeers $1 if you paid $1? You pay for a printed newspaper and it has ads as well.
- notatoad 7y ago
  Exactly. The publication that is the content of this article is a paywalled, subscription-based site. This is not an either/or situation.
aakilfernandes 7y ago
While a fair point, cost is not value. It is the lower bound of value. It could be that targeted ads are creating $10 value per person but it only cost $1 per person, $9 of which goes to the advertiser/consumer.
- yodon 7y ago
  The idea of 9x extra hidden value lurking in the system is a nice concept but unlikely to be present. It's unlikely to be present on the advertiser side because if advertisers were actually reaping 10x the value of their digital ad costs, ad prices would rise significantly because advertisers would be willing to pay significantly more than they do today. The excess positive value is unlikely to be present on the consumer side because as already commented the consumer is reaping a huge net negative hidden value as a result of the ubiquitous tracking it drives.

amluto 7y ago

I’m surprised WaPo isn’t trying something simpler and more disruptive: making a point of selling non-targeted ads. Targeted ads may be somewhat effective at selling a specific product, but they’re creepy and they don’t help build a brand. Non-targeted ads are not creepy and signal that a brand is legitimate. Of course, it’s much harder to apply metrics to this type of ad, since conversions aren’t the point. Daringfireball.net does this kind of non-targeted advertising. I would love to see a major publisher (other than TV) try it.

OrwellianChild 7y ago
I'll not say it would be impossible to run a general news website this way, but Gruber's website is basically pre-targeted already. Advertisers know pretty much exactly what they're getting with his audience - affluent, tech-focused Apple-aficionados with disposable income. It works great for him and his advertisers, but isn't a generalizable example.

OrwellianChild 7y ago

I admire steps taken to improve the privacy of ad-supported media ecosystems, so this effort by WaPo should be applauded on it's own. Their results, taken along with NYT's switch back to content-only ads in the EU [1] might help spread the word that all the creepy ad-tech isn't even necessary or beneficial! That said, I'd like to make a simple request of media outlets... Please build a rate plan which provides all of the benefits of subscription, adds the expected profit from advertising, and then let me buy it to experience your content ad- and tracking-free. Please! [1] https://digiday.com/media/gumgumtest-new-york-times-gdpr-cut-off-ad-exchanges-europe-ad-revenue/ https://digiday.com/media/gumgumtest-new-york-times-gdpr-cut...

OrwellianChild 7y ago
A case study in this: The New York Times In 2018, it made $202MM in revenue from digital display advertising. [1] Averaged across an annual reader base of 125MM worldwide, or 91MM in the U.S. alone [2], that averages out to just $1.62 or $2.22 per customer. Let us pay it to opt-out! Where is the harm? [1] https://s1.q4cdn.com/156149269/files/doc_financials/annual/2018/updated/2018-Annual-Report-(1).pdf https://s1.q4cdn.com/156149269/files/doc_financials/annual/2... [2] https://nytmediakit.com/digital https://nytmediakit.com/digital

JohnFen 7y ago

If I understand what they're proposing, this is a method of ad targeting that I don't actually object to. It doesn't involve spying on me, identifying me, or tracking me (either on or off the internet). It's closer to, but not completely, how ad targeting should be done -- based on the context the ad appears in rather than trying to figure out my own personal characteristics.

aussieguy1234 7y ago

Are there any ad networks out there that do not track users?