6 ms·

Yes this will have a great negative impact for Google's adtech competitors who unlike Google do not have other means to spy on users such as Chrome, search engi

by negus 7y ago

Yes this will have a great negative impact for Google's adtech competitors who unlike Google do not have other means to spy on users such as Chrome, search engine, Accelerated Mobile Pages, Gmail, voice assistant and so on. But Google really has no choice here due to aggressive campaign by Mozilla, Apple and Microsoft who boast with their Intelligent Tracking Prevention ( https://webkit.org/blog/8828/intelligent-tracking-prevention-2-2/ https://webkit.org/blog/8828/intelligent-tracking-prevention... ) implementation blaming Google as a company which does not value users privacy. Google would lose privacy-conscious users otherwise. But it is clear for me how all this anti-thirdparty cookies situation will go further: server side third party ad trackers -- this will bypass Same Origin Policy and will pose a privacy and security threat for users and websites even more than todays third party frontend ad trackers.

dylz 7y ago
> Google would lose privacy-conscious users otherwise. Would these users be using Chrome in the first place?
- negus 7y ago
  Why not? Privacy is not the only goal even for paranoids. It is all about compromise. Otherwise you would use lynx or wget -- truly private web clients. Or at least turn off JS.
  - unknown2374 7y ago
    Why are you speaking as if there are no better alternatives than Chrome? Other than a few organizations who decided that only supporting Chrome as a browser is enough for their sites and some extensions, there are viable web browser alternatives from companies which don't make their money off of user's data.
rpastuszak 7y ago
I find their "removing 3rd party cookies will incentivise businesses to rely on fingerprinting" discourse dangerous. It implies that other browser vendors (Mozilla, Safari/WebKit, new Edge) are in fact making the Web a more dangerous place. I believe it's dangerous because it creates a harmful, unproductive PR narrative—people might just assume this is a true statement, without learning about both sides of the problem. I'm not trying to strip anyone of agency, I just don't think most of my friends would have time to research this topic and might decide to follow the main opinion instead. The answer I'd like to hear: Yes, it does push some actors towards fingerprinting, but preventing fingerprinting should be dealt with regardless. Changes should happen both on legislative and browser-vendor level. > But it is clear for me how all this anti-thirdparty cookies situation will go further: server side third party ad trackers -- this will bypass Same Origin Policy and will pose a privacy and security threat for users and websites even more than todays third party frontend ad trackers. Server-side as well as white-labelled (subdomain) integrations already exist. Lotame (DMP) has at least one product of this kind, afaik.
- sroussey 7y ago
  15-20 years ago, we found that people that were aggressive online and harassing people often cleared their cookies too. That constant clearing of cookies had us look into using flash to hold cookies, since that data didn't really get deleted when you cleared your cookies in the browser. So there is something to be said about that issue. That said, Apple/Mozilla/etc know this and so they are simultaneously trying to make fingerprinting more difficult. If they were not, I would agree with Google's stance. But since they are, it is really more of a footnote.
  - SilasX 7y ago
    I remember in the days of MSN gaming zone (zone.com, c. 1999), I was a vicious troll, and I'm pretty sure MS used their control of the OS to enforce a machine ban, as every attempt to use it from my home desktop was blocked. Also, somewhere in the Windows system registry I found a list of all the screen names I used.
  - qbaqbaqba 7y ago
    > 15-20 years ago, we found that people that were aggressive online and harassing people often cleared their cookies too. You forgot to mention them abusing children and planing terror attacks.
    - sroussey 7y ago
      Acting like children, sure. No terror stuff, but plenty of anti-Semitic material.
  - eitland 7y ago
    > 15-20 years ago, we found that people that were aggressive online and harassing people often cleared their cookies too. This might very well be true for what I know, but the general idea that optional privacy leads to more hostile environments seems to have been conclusively destroyed by HN and certain other forums, especially when compared to Facebook.
    - 7y ago
air7 7y ago
The issue with server side 3rd party ads is that the advertiser has no way to assure the impressions are real.
- marcosdumay 7y ago
  How relevant is this information? AFAIK, all that matters is how many conversions you get from $ spent. Both of those are perfectly visible, no tracking needed.
  - lern_too_spel 7y ago
    How would you know that a conversion came from an impression?
    - johannes1234321 7y ago
      How do you know the highway billboard or TV commercial lead to conversions? Maybe it helps society to go back to such models over destroying privacy. (And as answer to the question: Statistical methods by comparing areas/times with no ads vs. with ads etc.)
      - halflings 7y ago
        That ship already sailed. People are not going back to blind ad investment most of which has incredibly low ROI. As much as many HN readers would love to see ads and even the most benign forms of tracking to disappear, if you're aiming for something realistic (e.g that would still allow ads to exist and be a minimum profitable for all involved) you cannot just go back to the dark ages, and show the same ads to everyone.
        DennisP 7y ago
        Strangely, I still see plenty of billboards and TV commercials.
koruptshun 7y ago
Google created Chrome, and bribed Mozilla with billions, to keep ad blocking from becoming a standard browser feature. The Google search engine could be run for some small number of billions per year (or less) but Google extracts tens of billions per year from our pockets. It's a leech on society in the same way that Wall Street is. They successfully propagandized the idea that "relevant ads are good" when it's patently obvious that relevant search results are what you want from a search engine. There's no need for ads at all.
- MarioMan 7y ago
  >Google created Chrome, and bribed Mozilla with billions, to keep ad blocking from becoming a standard browser feature. This caught my attention, as I haven't heard anything about this before. Do you have a source with more details on it specifically? All I see is that Google pays Mozilla to make Google Search the default search engine and pays Adblock Plus to whitelist their ads. I'm not seeing any sources indicating that Google paid Mozilla any money to keep ad blocking out of their standard feature set.
Koremat6666 7y ago
Privacy is one side of the coin. Other side of the coin is that web adverts help web remain open, it helps independent and anti-establishment institutions to have an audience in a profitable manner. Remember, free speech does not exist unless that speech is also economically sustainable. Arguably gun owners, strip clubs and porn magazines have fought for free speech more than facebook and google combined. I am happy to willingly share my personal data with your advertisers if that helps you keep profitable (NYT, Reason, Cato, Vice, Pornhub etc.) you need to figure out how to achieve that without acting like jerks.
- JohnFen 7y ago
  This is why tracking should be opt-in. Then you can allow it to support the things that you value without my privacy being invaded.
  - Koremat6666 7y ago
    For that we need to somehow agree that tracking is not just a legitimate business practice but also a desirable one (as long as the individual has consented). But these discussions will soon go into "how easy it should be to opt in?". Should it be a pop up like "allow location" or something more complex as enabling CORS.
3xblah 7y ago
"... this will bypass Same Origin Policy..." Same Origin Policy does not seem to provide any protection against DNS-based tracking. For example, putting a series of links to resources in a page and making conclusions from the series of DNS requests made automatically by "modern" browsers like Chrome, Safari, Firefox, Edge, Opera, etc.^1,2 To be fair, this sort of tracking is arguably brittle, e.g., if user has auto-loading of images disabled or is not using a cache that randomises the ordering of IP addresses within a response packet like BIND. It can also be easily avoided by user control over her client automatically making DNS requests for any resource^3 and user control over her own source of authoritative DNS data. For example, using a client that does not automatically load resources and using a local source of DNS data like a HOSTS file or a zone file served from a logging authoritative server on localhost like tinydns. 1. https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-4_Klein_paper.pdf https://www.ndss-symposium.org/wp-content/uploads/2019/02/nd... 2. http://dnscookie.com http://dnscookie.com 3. Not just images or third party scripts
- ma2rten 7y ago
  I think there are currently more reliable ways of fingerprinting.
  - 3xblah 7y ago
    Most of them rely on Javascript or some other "modern" browser feature. Not very reliable when user disables it or uses client that does not support it. HTTP headers are malleable yet I still see the big tech companies appearing to treat them as reliably identifying a program/device. A new user-agent string or set of HTTP headers is not necessarily a new program/device.

by negus 7y ago

dylz 7y ago

> Google would lose privacy-conscious users otherwise. Would these users be using Chrome in the first place?

negus 7y ago
Why not? Privacy is not the only goal even for paranoids. It is all about compromise. Otherwise you would use lynx or wget -- truly private web clients. Or at least turn off JS.
- unknown2374 7y ago
  Why are you speaking as if there are no better alternatives than Chrome? Other than a few organizations who decided that only supporting Chrome as a browser is enough for their sites and some extensions, there are viable web browser alternatives from companies which don't make their money off of user's data.

rpastuszak 7y ago

I find their "removing 3rd party cookies will incentivise businesses to rely on fingerprinting" discourse dangerous. It implies that other browser vendors (Mozilla, Safari/WebKit, new Edge) are in fact making the Web a more dangerous place. I believe it's dangerous because it creates a harmful, unproductive PR narrative—people might just assume this is a true statement, without learning about both sides of the problem. I'm not trying to strip anyone of agency, I just don't think most of my friends would have time to research this topic and might decide to follow the main opinion instead. The answer I'd like to hear: Yes, it does push some actors towards fingerprinting, but preventing fingerprinting should be dealt with regardless. Changes should happen both on legislative and browser-vendor level. > But it is clear for me how all this anti-thirdparty cookies situation will go further: server side third party ad trackers -- this will bypass Same Origin Policy and will pose a privacy and security threat for users and websites even more than todays third party frontend ad trackers. Server-side as well as white-labelled (subdomain) integrations already exist. Lotame (DMP) has at least one product of this kind, afaik.

sroussey 7y ago
15-20 years ago, we found that people that were aggressive online and harassing people often cleared their cookies too. That constant clearing of cookies had us look into using flash to hold cookies, since that data didn't really get deleted when you cleared your cookies in the browser. So there is something to be said about that issue. That said, Apple/Mozilla/etc know this and so they are simultaneously trying to make fingerprinting more difficult. If they were not, I would agree with Google's stance. But since they are, it is really more of a footnote.
- SilasX 7y ago
  I remember in the days of MSN gaming zone (zone.com, c. 1999), I was a vicious troll, and I'm pretty sure MS used their control of the OS to enforce a machine ban, as every attempt to use it from my home desktop was blocked. Also, somewhere in the Windows system registry I found a list of all the screen names I used.
- qbaqbaqba 7y ago
  > 15-20 years ago, we found that people that were aggressive online and harassing people often cleared their cookies too. You forgot to mention them abusing children and planing terror attacks.
  - sroussey 7y ago
    Acting like children, sure. No terror stuff, but plenty of anti-Semitic material.
- eitland 7y ago
  > 15-20 years ago, we found that people that were aggressive online and harassing people often cleared their cookies too. This might very well be true for what I know, but the general idea that optional privacy leads to more hostile environments seems to have been conclusively destroyed by HN and certain other forums, especially when compared to Facebook.
  - 7y ago

air7 7y ago

The issue with server side 3rd party ads is that the advertiser has no way to assure the impressions are real.

marcosdumay 7y ago
How relevant is this information? AFAIK, all that matters is how many conversions you get from $ spent. Both of those are perfectly visible, no tracking needed.
- lern_too_spel 7y ago
  How would you know that a conversion came from an impression?
  - johannes1234321 7y ago
    How do you know the highway billboard or TV commercial lead to conversions? Maybe it helps society to go back to such models over destroying privacy. (And as answer to the question: Statistical methods by comparing areas/times with no ads vs. with ads etc.)
    - halflings 7y ago
      That ship already sailed. People are not going back to blind ad investment most of which has incredibly low ROI. As much as many HN readers would love to see ads and even the most benign forms of tracking to disappear, if you're aiming for something realistic (e.g that would still allow ads to exist and be a minimum profitable for all involved) you cannot just go back to the dark ages, and show the same ads to everyone.
      - DennisP 7y ago
        Strangely, I still see plenty of billboards and TV commercials.

koruptshun 7y ago

Google created Chrome, and bribed Mozilla with billions, to keep ad blocking from becoming a standard browser feature. The Google search engine could be run for some small number of billions per year (or less) but Google extracts tens of billions per year from our pockets. It's a leech on society in the same way that Wall Street is. They successfully propagandized the idea that "relevant ads are good" when it's patently obvious that relevant search results are what you want from a search engine. There's no need for ads at all.

MarioMan 7y ago
>Google created Chrome, and bribed Mozilla with billions, to keep ad blocking from becoming a standard browser feature. This caught my attention, as I haven't heard anything about this before. Do you have a source with more details on it specifically? All I see is that Google pays Mozilla to make Google Search the default search engine and pays Adblock Plus to whitelist their ads. I'm not seeing any sources indicating that Google paid Mozilla any money to keep ad blocking out of their standard feature set.

Koremat6666 7y ago

Privacy is one side of the coin. Other side of the coin is that web adverts help web remain open, it helps independent and anti-establishment institutions to have an audience in a profitable manner. Remember, free speech does not exist unless that speech is also economically sustainable. Arguably gun owners, strip clubs and porn magazines have fought for free speech more than facebook and google combined. I am happy to willingly share my personal data with your advertisers if that helps you keep profitable (NYT, Reason, Cato, Vice, Pornhub etc.) you need to figure out how to achieve that without acting like jerks.

JohnFen 7y ago
This is why tracking should be opt-in. Then you can allow it to support the things that you value without my privacy being invaded.
- Koremat6666 7y ago
  For that we need to somehow agree that tracking is not just a legitimate business practice but also a desirable one (as long as the individual has consented). But these discussions will soon go into "how easy it should be to opt in?". Should it be a pop up like "allow location" or something more complex as enabling CORS.

3xblah 7y ago

"... this will bypass Same Origin Policy..." Same Origin Policy does not seem to provide any protection against DNS-based tracking. For example, putting a series of links to resources in a page and making conclusions from the series of DNS requests made automatically by "modern" browsers like Chrome, Safari, Firefox, Edge, Opera, etc.^1,2 To be fair, this sort of tracking is arguably brittle, e.g., if user has auto-loading of images disabled or is not using a cache that randomises the ordering of IP addresses within a response packet like BIND. It can also be easily avoided by user control over her client automatically making DNS requests for any resource^3 and user control over her own source of authoritative DNS data. For example, using a client that does not automatically load resources and using a local source of DNS data like a HOSTS file or a zone file served from a logging authoritative server on localhost like tinydns. 1. https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-4_Klein_paper.pdf https://www.ndss-symposium.org/wp-content/uploads/2019/02/nd... 2. http://dnscookie.com http://dnscookie.com 3. Not just images or third party scripts

ma2rten 7y ago
I think there are currently more reliable ways of fingerprinting.
- 3xblah 7y ago
  Most of them rely on Javascript or some other "modern" browser feature. Not very reliable when user disables it or uses client that does not support it. HTTP headers are malleable yet I still see the big tech companies appearing to treat them as reliably identifying a program/device. A new user-agent string or set of HTTP headers is not necessarily a new program/device.