4 ms·

The whole multiple-users-on-one-ipv4 thing always feels like it distracts from what a tracker's goal really is. It is definitely beyond sufficient identificatio

The whole multiple-users-on-one-ipv4 thing always feels like it distracts from what a tracker's goal really is. It is definitely beyond sufficient identification and more than needed for a tracker to start targeting you with ads and what not. In some ways the fact that IP only tracking is lossy but still good enough is something to be afraid of. It is easy to 'taint' an IP and your households behind-the-scenes profile over a google search by your guest using your wifi.

annoyingnoob 7y ago
Advertising that is relevant to my wife probably isn't relevant to me, using IP is not good enough. The title and focus here is on user tracking, which is the goal I'm commenting about. Its quite common to have multiple users behind the same IP, those users and their actions may or may not be related (I have no idea what my co-workers might be doing for example but we share a static IP). I honestly didn't follow your Google search/wifi example.
- pm_me_ur_fullz 7y ago
  "It's listening to me!" and your spouse's typed in search queries and your playstation and your smart coffee machine and alexa actually is thats all without getting me started on the analytics networks in other apps sharing with the same data brokers between apps
- virgilp 7y ago
  > using IP is not good enough Define "not good enough"(for who is it not good enough? for advertisers?). I used to work on a project linking cookies together in anonymous profiles (for advertising), initially the plan was to separate household/individual profiles using different heuristics, but I think eventually it turned out that nobody cares that much - the advertisers just wanted a rough cross-device profile, not perfect accuracy. I mean sure, for marketing purposes (as well as engineering/ "performance" reasons) you needed figures to brag about accuracy and whatnot. But it's really really hard to get those figures right, and ultimately the thing that will convince advertisers is "using cross-device profile improved conversion rate by 10%"; everything else is a detail in comparison.
  - annoyingnoob 7y ago
    The title and focus here is on user tracking, which is the goal I'm commenting about.
    - virgilp 7y ago
      I have no idea what you mean by user tracking, can you explain?
      - annoyingnoob 7y ago
        A user is usually defined as a human being. I'm a human being and I did not come with a network connection. The world, generally, does not assign IP addresses to human beings - thus an IP address cannot track me as a human, a human computer user. The paper/study here used a combination of IP address and a UUID to track 'users' which are presumably but not necessarily individual humans. It was the use of this UUID that allowed the authors to draw conclusions about how often a given user is seen at the same IP address. The IP address by itself did not provide enough tracking to draw the conclusions in the paper. Is IP address identification 'good enough' for advertising, maybe. But IP is no where near definitive for identifying individual humans. The paper does not say how often they found multiple 'users' using the same IP address. The paper focuses on individual reuse of IPs. How often did they find different users using the same IP in their study? In internet advertising no one expects every ad to trigger a sale. Since there is some amount of acceptable waste in the system this paper has decided that IP is 'good enough' for targeting - because its okay if we are throwing away 20% or more of the ads (we didn't expect any traction from them anyway seems to be the thinking). And the authors admit that a larger or different dataset might show different results.
        virgilp 7y ago
        I was replying to your claim: > Advertising that is relevant to my wife probably isn't relevant to me, using IP is not good enough. Advertisers do not care about what you as a human do in the same way that e.g. some government agencies might. Both the paper and you talked about "user tracking" in the context of advertising. My claim is that "IP address identification is actually 'good enough' for advertising" (for some kinds of advertising, at least, but the discussion here is complex and I really don't want to get into it - on short, the problem is not so much with the 'tracking'/building the profile, but with being confident enough that you're not targeting the wrong person/household member during the delivery of the more sensitive ads; and with not spooking/startling the user with "how the hell do they know this about me" - sometimes the user needs to be e.g. logged in so that he understands why he received an ad). In particular, there are large swaths of companies that don't care whether it's you, your wife or your child - Disney e.g. will happily serve you ads based on activity performed by your children or wife, and will make no effort to figure out if it was you or them because it doesn't matter.
- icedchai 7y ago
  It's "good enough" because it's still better than ads that are not-targeted at all.
- kube-system 7y ago
  An IP address wouldn't be good enough to perform identification, but it would likely be good enough to perform reidentification. Most people on a network are not clearing their browser caches at the same exact time. The real power here is in using IP addresses in combination with other fingerprinting techniques.
  - annoyingnoob 7y ago
    > The real power here is in using IP addresses in combination with other fingerprinting techniques. I didn't think that was anything new. It also sounds like a possible path for exploit, kind of like not requiring a password when you call voicemail from your own phone (one could spoof your number as the caller id and access your voicemail without a password).
    - sixothree 7y ago
      This sounds like circular FUD to me.
      - annoyingnoob 7y ago
        How so?
- parhamn 7y ago
  > I honestly didn't follow your Google search/wifi example. Sorry, wasn't clear there. I generally don't think the 'match' thresholds need to be that high for effective (in terms of dollars earned vs spent) targeted ads. In the google example: if a friend comes over a searches for designer watches odds are the whole IP/home is a decent enough target for designer watches.

annoyingnoob 7y ago

Advertising that is relevant to my wife probably isn't relevant to me, using IP is not good enough. The title and focus here is on user tracking, which is the goal I'm commenting about. Its quite common to have multiple users behind the same IP, those users and their actions may or may not be related (I have no idea what my co-workers might be doing for example but we share a static IP). I honestly didn't follow your Google search/wifi example.

pm_me_ur_fullz 7y ago
"It's listening to me!" and your spouse's typed in search queries and your playstation and your smart coffee machine and alexa actually is thats all without getting me started on the analytics networks in other apps sharing with the same data brokers between apps
virgilp 7y ago
> using IP is not good enough Define "not good enough"(for who is it not good enough? for advertisers?). I used to work on a project linking cookies together in anonymous profiles (for advertising), initially the plan was to separate household/individual profiles using different heuristics, but I think eventually it turned out that nobody cares that much - the advertisers just wanted a rough cross-device profile, not perfect accuracy. I mean sure, for marketing purposes (as well as engineering/ "performance" reasons) you needed figures to brag about accuracy and whatnot. But it's really really hard to get those figures right, and ultimately the thing that will convince advertisers is "using cross-device profile improved conversion rate by 10%"; everything else is a detail in comparison.
- annoyingnoob 7y ago
  The title and focus here is on user tracking, which is the goal I'm commenting about.
  - virgilp 7y ago
    I have no idea what you mean by user tracking, can you explain?
    - annoyingnoob 7y ago
      A user is usually defined as a human being. I'm a human being and I did not come with a network connection. The world, generally, does not assign IP addresses to human beings - thus an IP address cannot track me as a human, a human computer user. The paper/study here used a combination of IP address and a UUID to track 'users' which are presumably but not necessarily individual humans. It was the use of this UUID that allowed the authors to draw conclusions about how often a given user is seen at the same IP address. The IP address by itself did not provide enough tracking to draw the conclusions in the paper. Is IP address identification 'good enough' for advertising, maybe. But IP is no where near definitive for identifying individual humans. The paper does not say how often they found multiple 'users' using the same IP address. The paper focuses on individual reuse of IPs. How often did they find different users using the same IP in their study? In internet advertising no one expects every ad to trigger a sale. Since there is some amount of acceptable waste in the system this paper has decided that IP is 'good enough' for targeting - because its okay if we are throwing away 20% or more of the ads (we didn't expect any traction from them anyway seems to be the thinking). And the authors admit that a larger or different dataset might show different results.
      - virgilp 7y ago
        I was replying to your claim: > Advertising that is relevant to my wife probably isn't relevant to me, using IP is not good enough. Advertisers do not care about what you as a human do in the same way that e.g. some government agencies might. Both the paper and you talked about "user tracking" in the context of advertising. My claim is that "IP address identification is actually 'good enough' for advertising" (for some kinds of advertising, at least, but the discussion here is complex and I really don't want to get into it - on short, the problem is not so much with the 'tracking'/building the profile, but with being confident enough that you're not targeting the wrong person/household member during the delivery of the more sensitive ads; and with not spooking/startling the user with "how the hell do they know this about me" - sometimes the user needs to be e.g. logged in so that he understands why he received an ad). In particular, there are large swaths of companies that don't care whether it's you, your wife or your child - Disney e.g. will happily serve you ads based on activity performed by your children or wife, and will make no effort to figure out if it was you or them because it doesn't matter.
icedchai 7y ago
It's "good enough" because it's still better than ads that are not-targeted at all.
kube-system 7y ago
An IP address wouldn't be good enough to perform identification, but it would likely be good enough to perform reidentification. Most people on a network are not clearing their browser caches at the same exact time. The real power here is in using IP addresses in combination with other fingerprinting techniques.
- annoyingnoob 7y ago
  > The real power here is in using IP addresses in combination with other fingerprinting techniques. I didn't think that was anything new. It also sounds like a possible path for exploit, kind of like not requiring a password when you call voicemail from your own phone (one could spoof your number as the caller id and access your voicemail without a password).
  - sixothree 7y ago
    This sounds like circular FUD to me.
    - annoyingnoob 7y ago
      How so?
parhamn 7y ago
> I honestly didn't follow your Google search/wifi example. Sorry, wasn't clear there. I generally don't think the 'match' thresholds need to be that high for effective (in terms of dollars earned vs spent) targeted ads. In the google example: if a friend comes over a searches for designer watches odds are the whole IP/home is a decent enough target for designer watches.