4 ms·

Heya. I work for an analytics company, and this kind of thing is pretty easy to detect and mitigate. It’d take a pretty huge scale to work at all, which is mayb

Heya. I work for an analytics company, and this kind of thing is pretty easy to detect and mitigate. It’d take a pretty huge scale to work at all, which is maybe what you’re suggesting. At scale, I'm pretty sure the companies you most likely associate with unethical tracking would be able to mitigate it, but smaller companies would suffer, only further embedding the established giants.

rdtsc 7y ago
> Heya. I work for an analytics company, and this kind of thing is pretty easy to detect and mitigate. Already happens. I don't see nearly as many clicks accumulated in AdNauseum as I used to a few years ago. Google tried to ban the extension https://adnauseam.io/free-adnauseam.html https://adnauseam.io/free-adnauseam.html, but they've probably been reminded about the Streisand effect and just fixed their code to check for it and ignore it.
ignoramous 7y ago
If it isn't a trade secret, can you pls outline how it is detected and mitigated? Thanks.
- codezero 7y ago
  Heap is pretty small compared to Google, so I think that what I’d describe would be too elementary. For us, the client has some state that is hard (not impossible) to imitate, and we have a good sense for what “real” activity looks like. Someone hitting an analytics endpoint blindly will not look natural so is easier to detect. The classic heuristic is to just ignore outdated browser versions since most headless rigs that are naive aren’t on the most up to date user agent or lie about it in a haphazard way. There are a lot more sophisticated techniques that people trying to game ad networks use.
  - danShumway 7y ago
    Really appreciate the info you've given here so far. Followup question off of GP's: if networks know to filter click-fraud out based on metrics as simple as browser version, then aren't those same metrics exploitable to avoid tracking? Firefox's resist fingerprinting setting locks the reported browser version to the latest ERS. If I have that turned on, will every ad click I make be ignored? Keep in mind, the big goal I have with misinformation is to confuse user profiles; not to generate fake clicks or waste money -- it's to make is so that my actual data profile is either unreliable or outright ignored. If this kind of filtering is so ubiquitous, then would it be feasible defense to get user browsers to act like bots instead of getting bots to act like users? How bot-like would I need to be before advertisers started assuming the data they collected from me was untrustworthy?
    - codezero 7y ago
      Nothing is perfect, but ultimately everything comes down to aggregates. Most systems don’t care about you or your profile (it’s all automated), and generating noise will make your profile quirky for sure, and your ads will match who ever else has accumulated a similar aggregate behavior. I’m not in the ad business so what I’m saying is only based on my proximity to it, so take it with a grain of salt. One thing that ultimately breaks through the noise isn’t what ads you see or click on, but what you actually buy. If you buy things and aren’t completely blocking every ad network, you’ll massively boost the signal. Also any real browsing routines will still be in the data, and I am assuming a lot of ad networks are informed by out of band data they purchase and things like ISP data they buy. Ultimately the proof is in the pudding. You should experiment with various approaches and then see if you are served relevant ads, if you aren’t, you’re winning :) FWIW I get a ton of irrelevant ads because of retargeting. I visit a lot of my customer’s websites in doing my job and they’re not usually sites I’d go to, so most of the ads I see on FB and Twitter are based on retargeting from those sites.

rdtsc 7y ago

> Heya. I work for an analytics company, and this kind of thing is pretty easy to detect and mitigate. Already happens. I don't see nearly as many clicks accumulated in AdNauseum as I used to a few years ago. Google tried to ban the extension https://adnauseam.io/free-adnauseam.html https://adnauseam.io/free-adnauseam.html, but they've probably been reminded about the Streisand effect and just fixed their code to check for it and ignore it.

ignoramous 7y ago

If it isn't a trade secret, can you pls outline how it is detected and mitigated? Thanks.

codezero 7y ago
Heap is pretty small compared to Google, so I think that what I’d describe would be too elementary. For us, the client has some state that is hard (not impossible) to imitate, and we have a good sense for what “real” activity looks like. Someone hitting an analytics endpoint blindly will not look natural so is easier to detect. The classic heuristic is to just ignore outdated browser versions since most headless rigs that are naive aren’t on the most up to date user agent or lie about it in a haphazard way. There are a lot more sophisticated techniques that people trying to game ad networks use.
- danShumway 7y ago
  Really appreciate the info you've given here so far. Followup question off of GP's: if networks know to filter click-fraud out based on metrics as simple as browser version, then aren't those same metrics exploitable to avoid tracking? Firefox's resist fingerprinting setting locks the reported browser version to the latest ERS. If I have that turned on, will every ad click I make be ignored? Keep in mind, the big goal I have with misinformation is to confuse user profiles; not to generate fake clicks or waste money -- it's to make is so that my actual data profile is either unreliable or outright ignored. If this kind of filtering is so ubiquitous, then would it be feasible defense to get user browsers to act like bots instead of getting bots to act like users? How bot-like would I need to be before advertisers started assuming the data they collected from me was untrustworthy?
  - codezero 7y ago
    Nothing is perfect, but ultimately everything comes down to aggregates. Most systems don’t care about you or your profile (it’s all automated), and generating noise will make your profile quirky for sure, and your ads will match who ever else has accumulated a similar aggregate behavior. I’m not in the ad business so what I’m saying is only based on my proximity to it, so take it with a grain of salt. One thing that ultimately breaks through the noise isn’t what ads you see or click on, but what you actually buy. If you buy things and aren’t completely blocking every ad network, you’ll massively boost the signal. Also any real browsing routines will still be in the data, and I am assuming a lot of ad networks are informed by out of band data they purchase and things like ISP data they buy. Ultimately the proof is in the pudding. You should experiment with various approaches and then see if you are served relevant ads, if you aren’t, you’re winning :) FWIW I get a ton of irrelevant ads because of retargeting. I visit a lot of my customer’s websites in doing my job and they’re not usually sites I’d go to, so most of the ads I see on FB and Twitter are based on retargeting from those sites.