11 ms·

Google starts testing its replacement for third-party cookies

138 points by kiyanwang 6y ago

mikro2nd 6y ago
"Trust tokens are meant to foster user trust across sites" Can anyone shed light on what exactly this "trust token" mechanism is? It sounds to me like some sort of cryptographic identifier that will enable Google to track our every move (to the limited extent we use Chrome and Google's websites) but this would be contradictory to their claim of non-identifying privacy.
- JPLeRouzic 6y ago
  https://github.com/WICG/trust-token-api#overview https://github.com/WICG/trust-token-api#overview For what I understand, a provider who trust a user, stores in her browser a set of kind of certificates, that basically declare "I "provider NNN", states that this user has been authenticated by me". Another party will ask for one trusted token, verifies that it is really signed by provider NNN, and can trust that each time this token is resent, it is the same user. The privacy is respected on the user side has the third party has no idea who is this user. The trusted tokens could even have a short life. Third parties therefore should have great trust in the trust token provider. It is as if Google authorized other parties to use its own cookies. Indeed this means that other parties trust "provider NNN". I guess that Google wants to become a more central identity provider than today, where it has to share this role with Facebook and a few other companies.
  - ocdtrekkie 6y ago
    Sounds like something I still will expect my privacy-respecting browser to block in its entirety. It's not meant to benefit me, it's designed to prevent "ad fraud".
    - anoncareer0212 6y ago
      Choosing to be militantly ignorant in service of dogma over math has consequences all the time, not just when you're the Feds trying to get 'child porn' laws passed to make Apple break encryption.
      - foota 6y ago
        What?
    - gruez 6y ago
      >Sounds like something I still will expect my privacy-respecting browser to block in its entirety prepared to get penalized by recaptcha for not having it enabled.
      - ocdtrekkie 6y ago
        Yeah, I strongly suspect this will be the result on a much scale than the edge cases we see today. We need to start punishing companies using reCaptcha. Stop doing business with them.
        cpeterso 6y ago
        What is a good alternative to reCaptcha that sites should use instead?
        Semaphor 6y ago
        I’ve been seeing hCaptcha more often ever since the Cloudflare announcement. Unlike with ReCaptcha, it doesn’t send me into an infinite loop.
        Drdrdrq 6y ago
        Thank you, totally missed this alternative, will check it out! Link for the lazy / curious: https://www.hcaptcha.com/ https://www.hcaptcha.com/
        isoos 6y ago
        If you browse through tor, hcaptcha can and will send you to infinite loop. Depends on the site though, not sure why...
        kemonocode 6y ago
        hCaptcha is an alternative I have seen popping up as of late. (I am completely unaffiliated with them, and I can't really even verify whether or not hCaptcha is any good, although it did seem like it was rather decent to me and no more difficult not easier than the average reCAPTCHA)
    - kevin_thibedeau 6y ago
      Prepare for a lot of Captcha challenges for daring to opt out of their invasive tracking graph.
      - ehsankia 6y ago
        How else do you propose sites combat spam and bots? As someone who has had many of my free services completely ruined by spammers, Captcha was the only way I could save them.
        ocdtrekkie 6y ago
        I've found Captcha is an overkill strategy that also demonstrates poor customer service as you are both annoying your user and selling their data to Google. Often site-specific form validation is more than adequate to prevent bot registrations. Until you hit the level of "people are scripting for your site specifically" level, rudimentary data validation will catch almost every bot.
        ehsankia 6y ago
        > customer service Well honestly, "1-person hobby project" doesn't really have "customer service". Though I work hard to help anyone with honest feature requests and issues, there's still no SLO on any of this. I have unfortunately hit people scripting for my site directly, which is where I had to rely on Captcha. It's unfortunate but bad actors have honestly ruined so much of the internet...
  - gruez 6y ago
    >Another party will ask for one trusted token, verifies that it is really signed by provider NNN, and can trust that each time this token is resent, it is the same user. how is this useful when it comes advertising, and how does it relate to third party cookies? Isn't third party cookies used for cross-site tracking? Apparently advertising networks use it to authenticate users as well?
    - notatoad 6y ago
      Cross-site tracking is used to build a profile on you to determine that you're a "real" user and your browsing habits don't match the browsing habits of a bot. With this profile built, recaptcha and others can avoid showing you an actual caaptcha. Without it, they need to show you a captcha every time they need to verify you're human. Trust tokens are a way to do that verification in a way that doesn't also enable cross site tracking for the advertising purposes. They aren't supposed to help advertisers track you
  - greyface- 6y ago
    The WICG spec doesn't mention this at all, but it seems like Google plans to restrict the set of allowed issuers. From <https://www.chromium.org/updates/trust-token> https://www.chromium.org/updates/trust-token>: > Process for registering as an issuer: https://docs.google.com/document/d/1cvUdAmcstH6khLL7OrLde4TnaPaMF1qPp3i-2XR46kU/ https://docs.google.com/document/d/1cvUdAmcstH6khLL7OrLde4Tn... which says: To apply for an Issuer (and its key commitments) to be included within Chrome, the Issuer’s operator must file a new bug on the Chromium Issue Tracker, and provide: * Issuer Name - Human readable name representing the Issuer. * The origin that is used for the issuing service (scheme, host, port). The scheme must be HTTPS. * An email or email alias that is monitored by the Issuer’s operator for issues regarding the Issuer. * A public HTTPS endpoint that responds to key commitment requests. * A description of the Issuer, describing its intended purpose.
  - raxxorrax 6y ago
    But it also means that if someone challenges the token, the token creator responsible for answering said challenge gets information about services used by the user. So it isn't really a privacy preserving solution.
  - mikro2nd 6y ago
    It sounds like the provider knows everything, though... knows who it provided the tokens to, knows who consumed them. So where's the privacy shielding between me and the token provider? If that provider is likely to be Google (as I'm sure they plan), then there's no trust there to begin with. (Apologies if I should go and read the fine docs -- and in truth I probably should -- but I lack enough hours in the day for something that is a bit peripheral to my interests, so must rely on my co-HNers to condense/explain these things. Upvoted with gratitude.)
- gumby 6y ago
  You can tell from the name: it represents that you trust google with your identity, trust they will immediately betray by passing on to third parties. But the cool thing is your cookie restrictions won’t affect it!
- jedimastert 6y ago
  I believe that the idea is that you have a bunch of tokens that can be verified that were signed by a provider but cannot be associated to the owner of the tokens.
- dwaite 6y ago
  It is a one-time-use token with a limited amount of data (somewhere between 0 and 64 bits from the implementations I've heard about). You go through a process to get either one token or a 'batch' of tokens issued, then they are one-time-use redeemed to indicate authorization. Because they use a blind signature method, the server which issued them can't recognize them when they are redeemed. There is also a zero-knowledge proof used to make sure the server isn't trying to get additional bits of state by using different public keys per user. So they are not meant to track a user, but rather indicate that some process happened - that you previously solved a captcha, that you saw an ad, etc. 64 bits is way too much information IMHO, but the implementations are still very early.
  - jefftk 6y ago
    > somewhere between 0 and 64 bits from the implementations I've heard about ... 64 bits is way too much information I think maybe you're confusing this some other API? Here are the trust token docs: https://github.com/WICG/trust-token-api#overview https://github.com/WICG/trust-token-api#overview
8organicbits 6y ago
> the company hoped to phase out third-party cookies in Chrome once it could meet the needs of both users and advertisers. Chrome, the browser, can't change how web servers are implemented. Users needs are met as long as web servers behave as they should. I've disabled 3rd party cookies and haven't seen any issues (I'd suggest others try it as well). I suspect mostly advertisers are affected at this point. If this becomes a thing, I'll block it in my browser.
- michaelt 6y ago
  I do the same - there are a number of Google properties that get broken. Usually because they try to provide named-users-only access to user-generated content, then exile user-generated content to other domains (like googleusercontent.com ) and one can't be logged in on the other domain without cookies. I've filed bugs with Google about this behaviour, and had them accepted as valid, but they don't seem in a hurry to fix them - I assume because third-party tracking is google's core business.
0xy 6y ago
So this will be used entirely for invasive tracking by Google's advertising arms. Calling it a "trust token" is gaslighting, since the data being collected and distributed to advertising companies is not properly disclosed nor easy to disable. Google has a habit of obscuring such practices, like the hard-coded "X-Client-Data" tracking backdoor header they send to DoubleClick and is impossible to disable, and never disclosed to anyone. If they'll do "X-Client-Data", you can be sure this backdoor will be even larger.
- 8organicbits 6y ago
  Wow, I didn't see that before. https://vpnoverview.com/news/google-backpedals-on-claim-that-x-client-data-doesnt-contain-pi-information/ https://vpnoverview.com/news/google-backpedals-on-claim-that...
- dehrmann 6y ago
  Calling it a "trust token" is almost as deceptive as calling it a cookie. "Accept cookies. Um, yes? Me want cookie."
- pm90 6y ago
  Google’s existence is based on tracking user behavior. There is 0 chance they will let go of that ability.
- joshuamorton 6y ago
  So I think we've had this conversation before, but what do you believe that header is used for? Are you claiming that Google uses it for things beyond what they claim to and that Google is lying when it claims to not be using the header for ad tracking?
  - 0xy 6y ago
    Without repeating the same arguments, it's possible that Google is using it for tracking purposes because their public statements were ambiguous. That aside though, this behavior is never disclosed to users and is impossible to disable. Do you think the average user knows that Chrome is sending unique identifiers to DoubleClick? Of course not, it was never disclosed and they were never given the option to disable it.
sunsetSamurai 6y ago
will I be forced into this even if I use firefox?
- pm90 6y ago
  Probably not since this is chrome specific. If it becomes a standard and publishers start blocking/restricting browsers that don’t support it well, that would be a different story.
  - SheinhardtWigCo 6y ago
    That is the only logical endgame, otherwise why bother pushing this?
  - AnonHP 6y ago
    Thank goodness there’s Safari on iOS to act as a counterweight, which Firefox alone cannot do.
- jefftk 6y ago
  In the Intent to Implement [1] I see: Firefox: No public signals Edge: No public signals Safari: Public support. General support for the idea during TPAC 2019 discussion. https://mozilla.github.io/standards-positions/ https://mozilla.github.io/standards-positions/ says they're not sure yet: "This API depends on the Privacy Pass protocol, for which we have deferred our position statement." [1] https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/X9sF2uLe9rA/1xV5KEn2DgAJ https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...
zozin 6y ago
This, like AMP, looks like a blatant attempt by Google to lock in users/advertisers into the Google ecosystem. If you're going to leverage your monopoly to harm end users, then the time for lax government regulations is over.
- echelon 6y ago
  Google needs to be stripped of its ad business. They need to lose Chrome and Android. They can't embrace, extend, extinguish the Internet. They're seriously harming the web with Chrome, AMP, and other initiatives. Apple needs to be strictly hardware or software. They can't continue to run an exclusive app store and tax 30%. When you buy the device, it's yours. You should be able to upgrade and change the software. Facebook can't be allowed to acquire any more social media companies. They need to be mandated to provide account data export, and they can't create shadow profiles without consent. Amazon can't be allowed to compete with its sellers. Every act of espionage needs to be confirmed and awarded $100M or more. Out of all the companies, their behavior is the most gut-wrenchingly evil and steps on the upstarts. Call your representatives and demand this. Microsoft, surprisingly, is acting like a trillion dollar company that isn't run like a monopoly. Their tools and ecosystem play nice with others.
  - an_opabinia 6y ago
    What is the consistent set of rules here? The status quo is you must raise prices for consumers to be antitrust. Can you think of a more socially positive alternative? The status quo is not to find economically positive outcomes because that is (1) incommensurable with policy enforced by law always and generally (2) likely unknowable.
    - ocdtrekkie 6y ago
      Google raised its prices multiple times, you just have to stop evaluating prices in fiat currency. Google provides services in exchange for your personal data. So each time they take more data, they raised the price. Merging DoubleClick data with Google accounts was a huge price hike. Starting to store your web and app activity centrally, was a price hike. Mining your Gmail receipts to populate a "purchases" tab in your account? Price hike. Auto-logging your Chrome in when you logged into Gmail, holy price hikes, Batman. You get the idea.
Animats 6y ago
And, let me guess, you can't block "trust tokens" in Chrome.
- rasz 6y ago
  You cant disable service workers either (except using hack with uBO)
alextheparrot 6y ago
From https://github.com/WICG/trust-token-api https://github.com/WICG/trust-token-api > Token Exhaustion Attack > Issuers issue many tokens at once, so users have a large supply of tokens. > When the issuer detects a site is attacking its trust token supply, it can fail redemption (before the token is revealed) based on the referring origin, and prevent browsers from spending tokens there. I think there’s an interesting trade-off between attack surface and specificity of the token here. A token meaning “This user has only accessed 6 sites in this network” is meaningful only if there’s a single token, as the next access can cause the token to be inconsistent with reality (It states a falsity now). At the same time, it states the issuer can block redemption based on the referrer. I think that’ll be interesting, as an allow list format will lead to only “big players” being able to use this API (As they are the only ones who they trust to not adversarially redeem tokens) whereas a deny list you’re playing a game of whack-a-mole where new domains can be popped up for this purpose. edit: added the last part of the quote for completeness
Markoff 6y ago
So how do I block this in uBlock?
kelnos 6y ago
I'm really confused. I'm reading the spec[0], which seems to explicitly state that it's not possible (modulo some possible vulnerabilities with mitigations that they later list) to track a user across the web using these tokens. Yet many of the comments I read here are talking about this being a way for websites to track users? This spec document also doesn't really list use cases for this. Why would I want this? The linked article seems to suggest it's so Google can reduce ad fraud, which of course I don't give a damn about, and don't want my user agent doing anything that helps advertisers, ever. Hopefully Firefox does not implement this, and hopefully if they don't, websites don't somehow penalize browsers that don't support it. [0] https://github.com/WICG/trust-token-api#overview https://github.com/WICG/trust-token-api#overview
- jsnell 6y ago
  I don’t even think this is for Google’s benefit. They don’t need these tokens, since the vast majority of their ad revenue is first party. But do you know what happens the moment Chrome disables third party cookie support? People will start complaining that it’s an anti competitive move against businesses with a stronger need third party cookies.
- KenanSulayman 6y ago
  Google does not need any cookies for Google properties because Google Chrome sends an `x-client-data` header to them.
  - jefftk 6y ago
    The x-clint-data header is for experiments, not personalization: Additionally, a subset of low entropy variations are included in network requests sent to Google. The combined state of these variations is non-identifying, since it is based on a 13-bit low entropy value (see above). These are transmitted using the "X-Client-Data" HTTP header, which contains a list of active variations. On Android, this header may include a limited set of external server-side experiments, which may affect the Chrome installation. This header is used to evaluate the effect on Google servers - for example, a networking change may affect YouTube video load speed or an Omnibox ranking update may result in more helpful Google Search results. https://www.google.com/chrome/privacy/whitepaper.html#variations https://www.google.com/chrome/privacy/whitepaper.html#variat... (Disclosure: I work for Google, speaking only for myself)
yuhong 6y ago
For some history, see my Wikipedia article: https://en.wikipedia.org/wiki/Draft:Effects_of_the_2007-2008_financial_crisis_on_Google https://en.wikipedia.org/wiki/Draft:Effects_of_the_2007-2008...
speedgoose 6y ago
Well, how can we tell Google that they shouldn't have a say on this topic?
- encom 6y ago
  Stop using the invasive malware that is Chrome.
  - speedgoose 6y ago
    That will do nothing I'm afraid. I already don't use Chrome, and even if I spend all my free time asking people to stop using Chrome for weird technical reasons from their point of view, I'm afraid that will do nothing compared to the advertising power of Google.
    - danaris 6y ago
      Indeed: it is far past the time when individual action would make a difference to Google. The only way to actually get them to listen is going to be to consistently vote for people who a) have a reasonable chance of winning their election, and b) support modernizing and enforcing our antitrust regime. (It is likely that this will need to be done incrementally, and it may require first replacing (b) with increasing levels of support for getting corporate money out of politics.)
    - bryan_w 6y ago
      You could create a Google ad to get the word out.
SquareWheel 6y ago
Much better article: https://www.zdnet.com/article/google-launches-chrome-extension-for-ad-transparency-trust-token-api/ https://www.zdnet.com/article/google-launches-chrome-extensi... Trust Token Github page: https://github.com/WICG/trust-token-api https://github.com/WICG/trust-token-api I'm glad to see it uses Privacy Pass as a basic mechanism.
itissid 6y ago
Is there a good article/video explaining how third party cookies work and then how the ad fraud itself works in this context? I would like to send it to someone with very little knowledge of this world and what problem this feature intends to solve.
Havoc 6y ago
Google leading this effort is completely ridiculous. Whatever comes out of it is bound to either not be great for privacy or it will be an improvement but hit the smaller players. ie everyone not google. eg take away Cookies to prevent tracking. Leaving them the only one company with sight of near everything (google analytics & Adsense & Chrome). And we already know from recent revelations that google isn’t above peeking under the hood of data sources they shouldn’t. Whole thing seems insanely monopolistic to me.
- mda 6y ago
  Do you have any actual technical counterpoints?
  - imglorp 6y ago
    I think the problem is the hens are watching the fox design the coop. They've been invited to participate, but the fox has unlimited resources at its disposal for research and planning while the hens are of meager means. So yes, it may be unkind to prejudge the fox, but based on years of prior malice towards all poultry in the yard, and without fully understanding its plans, we have to assume it won't turn out well for us chickens. Cluck.
  - Havoc 6y ago
    No because I wasn't commenting on the technical aspect. A proposal can be both technically sound and wildly monopolistic at the same time. Not everything is a pure engineering problem.
  - speedgoose 6y ago
    Personally I didn't even bothered to read the proposal. No need for technical counterpoints, it's made by Google.
  - dumbneurologist 6y ago
    Why are social and economic arguments against it invalid?
- lopis 6y ago
jwilk 6y ago
Archived copy without GDPR nag screen: https://archive.md/U4axx https://archive.md/U4axx
- sveme 6y ago
  Thanks, doing the gods' work here.
sveme 6y ago
They must have the most atrocious, darkest, GDPR confirmation dialog. It's absolutely impossible to understand what you opt-in to.

138 points by kiyanwang 6y ago

"Trust tokens are meant to foster user trust across sites" Can anyone shed light on what exactly this "trust token" mechanism is? It sounds to me like some sort of cryptographic identifier that will enable Google to track our every move (to the limited extent we use Chrome and Google's websites) but this would be contradictory to their claim of non-identifying privacy.

JPLeRouzic 6y ago
https://github.com/WICG/trust-token-api#overview https://github.com/WICG/trust-token-api#overview For what I understand, a provider who trust a user, stores in her browser a set of kind of certificates, that basically declare "I "provider NNN", states that this user has been authenticated by me". Another party will ask for one trusted token, verifies that it is really signed by provider NNN, and can trust that each time this token is resent, it is the same user. The privacy is respected on the user side has the third party has no idea who is this user. The trusted tokens could even have a short life. Third parties therefore should have great trust in the trust token provider. It is as if Google authorized other parties to use its own cookies. Indeed this means that other parties trust "provider NNN". I guess that Google wants to become a more central identity provider than today, where it has to share this role with Facebook and a few other companies.
- ocdtrekkie 6y ago
  Sounds like something I still will expect my privacy-respecting browser to block in its entirety. It's not meant to benefit me, it's designed to prevent "ad fraud".
  - anoncareer0212 6y ago
    Choosing to be militantly ignorant in service of dogma over math has consequences all the time, not just when you're the Feds trying to get 'child porn' laws passed to make Apple break encryption.
    - foota 6y ago
      What?
  - gruez 6y ago
    >Sounds like something I still will expect my privacy-respecting browser to block in its entirety prepared to get penalized by recaptcha for not having it enabled.
    - ocdtrekkie 6y ago
      Yeah, I strongly suspect this will be the result on a much scale than the edge cases we see today. We need to start punishing companies using reCaptcha. Stop doing business with them.
      - cpeterso 6y ago
        What is a good alternative to reCaptcha that sites should use instead?
        Semaphor 6y ago
        I’ve been seeing hCaptcha more often ever since the Cloudflare announcement. Unlike with ReCaptcha, it doesn’t send me into an infinite loop.
        Drdrdrq 6y ago
        Thank you, totally missed this alternative, will check it out! Link for the lazy / curious: https://www.hcaptcha.com/ https://www.hcaptcha.com/
        isoos 6y ago
        If you browse through tor, hcaptcha can and will send you to infinite loop. Depends on the site though, not sure why...
        kemonocode 6y ago
        hCaptcha is an alternative I have seen popping up as of late. (I am completely unaffiliated with them, and I can't really even verify whether or not hCaptcha is any good, although it did seem like it was rather decent to me and no more difficult not easier than the average reCAPTCHA)
  - kevin_thibedeau 6y ago
    Prepare for a lot of Captcha challenges for daring to opt out of their invasive tracking graph.
    - ehsankia 6y ago
      How else do you propose sites combat spam and bots? As someone who has had many of my free services completely ruined by spammers, Captcha was the only way I could save them.
      - ocdtrekkie 6y ago
        I've found Captcha is an overkill strategy that also demonstrates poor customer service as you are both annoying your user and selling their data to Google. Often site-specific form validation is more than adequate to prevent bot registrations. Until you hit the level of "people are scripting for your site specifically" level, rudimentary data validation will catch almost every bot.
        ehsankia 6y ago
        > customer service Well honestly, "1-person hobby project" doesn't really have "customer service". Though I work hard to help anyone with honest feature requests and issues, there's still no SLO on any of this. I have unfortunately hit people scripting for my site directly, which is where I had to rely on Captcha. It's unfortunate but bad actors have honestly ruined so much of the internet...
- gruez 6y ago
  >Another party will ask for one trusted token, verifies that it is really signed by provider NNN, and can trust that each time this token is resent, it is the same user. how is this useful when it comes advertising, and how does it relate to third party cookies? Isn't third party cookies used for cross-site tracking? Apparently advertising networks use it to authenticate users as well?
  - notatoad 6y ago
    Cross-site tracking is used to build a profile on you to determine that you're a "real" user and your browsing habits don't match the browsing habits of a bot. With this profile built, recaptcha and others can avoid showing you an actual caaptcha. Without it, they need to show you a captcha every time they need to verify you're human. Trust tokens are a way to do that verification in a way that doesn't also enable cross site tracking for the advertising purposes. They aren't supposed to help advertisers track you
- greyface- 6y ago
  The WICG spec doesn't mention this at all, but it seems like Google plans to restrict the set of allowed issuers. From <https://www.chromium.org/updates/trust-token> https://www.chromium.org/updates/trust-token>: > Process for registering as an issuer: https://docs.google.com/document/d/1cvUdAmcstH6khLL7OrLde4TnaPaMF1qPp3i-2XR46kU/ https://docs.google.com/document/d/1cvUdAmcstH6khLL7OrLde4Tn... which says: To apply for an Issuer (and its key commitments) to be included within Chrome, the Issuer’s operator must file a new bug on the Chromium Issue Tracker, and provide: * Issuer Name - Human readable name representing the Issuer. * The origin that is used for the issuing service (scheme, host, port). The scheme must be HTTPS. * An email or email alias that is monitored by the Issuer’s operator for issues regarding the Issuer. * A public HTTPS endpoint that responds to key commitment requests. * A description of the Issuer, describing its intended purpose.
- raxxorrax 6y ago
  But it also means that if someone challenges the token, the token creator responsible for answering said challenge gets information about services used by the user. So it isn't really a privacy preserving solution.
- mikro2nd 6y ago
  It sounds like the provider knows everything, though... knows who it provided the tokens to, knows who consumed them. So where's the privacy shielding between me and the token provider? If that provider is likely to be Google (as I'm sure they plan), then there's no trust there to begin with. (Apologies if I should go and read the fine docs -- and in truth I probably should -- but I lack enough hours in the day for something that is a bit peripheral to my interests, so must rely on my co-HNers to condense/explain these things. Upvoted with gratitude.)
gumby 6y ago
You can tell from the name: it represents that you trust google with your identity, trust they will immediately betray by passing on to third parties. But the cool thing is your cookie restrictions won’t affect it!
jedimastert 6y ago
I believe that the idea is that you have a bunch of tokens that can be verified that were signed by a provider but cannot be associated to the owner of the tokens.
dwaite 6y ago
It is a one-time-use token with a limited amount of data (somewhere between 0 and 64 bits from the implementations I've heard about). You go through a process to get either one token or a 'batch' of tokens issued, then they are one-time-use redeemed to indicate authorization. Because they use a blind signature method, the server which issued them can't recognize them when they are redeemed. There is also a zero-knowledge proof used to make sure the server isn't trying to get additional bits of state by using different public keys per user. So they are not meant to track a user, but rather indicate that some process happened - that you previously solved a captcha, that you saw an ad, etc. 64 bits is way too much information IMHO, but the implementations are still very early.
- jefftk 6y ago
  > somewhere between 0 and 64 bits from the implementations I've heard about ... 64 bits is way too much information I think maybe you're confusing this some other API? Here are the trust token docs: https://github.com/WICG/trust-token-api#overview https://github.com/WICG/trust-token-api#overview

8organicbits 6y ago

> the company hoped to phase out third-party cookies in Chrome once it could meet the needs of both users and advertisers. Chrome, the browser, can't change how web servers are implemented. Users needs are met as long as web servers behave as they should. I've disabled 3rd party cookies and haven't seen any issues (I'd suggest others try it as well). I suspect mostly advertisers are affected at this point. If this becomes a thing, I'll block it in my browser.

michaelt 6y ago
I do the same - there are a number of Google properties that get broken. Usually because they try to provide named-users-only access to user-generated content, then exile user-generated content to other domains (like googleusercontent.com ) and one can't be logged in on the other domain without cookies. I've filed bugs with Google about this behaviour, and had them accepted as valid, but they don't seem in a hurry to fix them - I assume because third-party tracking is google's core business.

0xy 6y ago

So this will be used entirely for invasive tracking by Google's advertising arms. Calling it a "trust token" is gaslighting, since the data being collected and distributed to advertising companies is not properly disclosed nor easy to disable. Google has a habit of obscuring such practices, like the hard-coded "X-Client-Data" tracking backdoor header they send to DoubleClick and is impossible to disable, and never disclosed to anyone. If they'll do "X-Client-Data", you can be sure this backdoor will be even larger.

8organicbits 6y ago
Wow, I didn't see that before. https://vpnoverview.com/news/google-backpedals-on-claim-that-x-client-data-doesnt-contain-pi-information/ https://vpnoverview.com/news/google-backpedals-on-claim-that...
dehrmann 6y ago
Calling it a "trust token" is almost as deceptive as calling it a cookie. "Accept cookies. Um, yes? Me want cookie."
pm90 6y ago
Google’s existence is based on tracking user behavior. There is 0 chance they will let go of that ability.
joshuamorton 6y ago
So I think we've had this conversation before, but what do you believe that header is used for? Are you claiming that Google uses it for things beyond what they claim to and that Google is lying when it claims to not be using the header for ad tracking?
- 0xy 6y ago
  Without repeating the same arguments, it's possible that Google is using it for tracking purposes because their public statements were ambiguous. That aside though, this behavior is never disclosed to users and is impossible to disable. Do you think the average user knows that Chrome is sending unique identifiers to DoubleClick? Of course not, it was never disclosed and they were never given the option to disable it.

sunsetSamurai 6y ago

will I be forced into this even if I use firefox?

pm90 6y ago
Probably not since this is chrome specific. If it becomes a standard and publishers start blocking/restricting browsers that don’t support it well, that would be a different story.
- SheinhardtWigCo 6y ago
  That is the only logical endgame, otherwise why bother pushing this?
- AnonHP 6y ago
  Thank goodness there’s Safari on iOS to act as a counterweight, which Firefox alone cannot do.
jefftk 6y ago
In the Intent to Implement [1] I see: Firefox: No public signals Edge: No public signals Safari: Public support. General support for the idea during TPAC 2019 discussion. https://mozilla.github.io/standards-positions/ https://mozilla.github.io/standards-positions/ says they're not sure yet: "This API depends on the Privacy Pass protocol, for which we have deferred our position statement." [1] https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/X9sF2uLe9rA/1xV5KEn2DgAJ https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...

zozin 6y ago

This, like AMP, looks like a blatant attempt by Google to lock in users/advertisers into the Google ecosystem. If you're going to leverage your monopoly to harm end users, then the time for lax government regulations is over.

echelon 6y ago
Google needs to be stripped of its ad business. They need to lose Chrome and Android. They can't embrace, extend, extinguish the Internet. They're seriously harming the web with Chrome, AMP, and other initiatives. Apple needs to be strictly hardware or software. They can't continue to run an exclusive app store and tax 30%. When you buy the device, it's yours. You should be able to upgrade and change the software. Facebook can't be allowed to acquire any more social media companies. They need to be mandated to provide account data export, and they can't create shadow profiles without consent. Amazon can't be allowed to compete with its sellers. Every act of espionage needs to be confirmed and awarded $100M or more. Out of all the companies, their behavior is the most gut-wrenchingly evil and steps on the upstarts. Call your representatives and demand this. Microsoft, surprisingly, is acting like a trillion dollar company that isn't run like a monopoly. Their tools and ecosystem play nice with others.
- an_opabinia 6y ago
  What is the consistent set of rules here? The status quo is you must raise prices for consumers to be antitrust. Can you think of a more socially positive alternative? The status quo is not to find economically positive outcomes because that is (1) incommensurable with policy enforced by law always and generally (2) likely unknowable.
  - ocdtrekkie 6y ago
    Google raised its prices multiple times, you just have to stop evaluating prices in fiat currency. Google provides services in exchange for your personal data. So each time they take more data, they raised the price. Merging DoubleClick data with Google accounts was a huge price hike. Starting to store your web and app activity centrally, was a price hike. Mining your Gmail receipts to populate a "purchases" tab in your account? Price hike. Auto-logging your Chrome in when you logged into Gmail, holy price hikes, Batman. You get the idea.

Animats 6y ago

And, let me guess, you can't block "trust tokens" in Chrome.

rasz 6y ago
You cant disable service workers either (except using hack with uBO)

alextheparrot 6y ago

From https://github.com/WICG/trust-token-api https://github.com/WICG/trust-token-api > Token Exhaustion Attack > Issuers issue many tokens at once, so users have a large supply of tokens. > When the issuer detects a site is attacking its trust token supply, it can fail redemption (before the token is revealed) based on the referring origin, and prevent browsers from spending tokens there. I think there’s an interesting trade-off between attack surface and specificity of the token here. A token meaning “This user has only accessed 6 sites in this network” is meaningful only if there’s a single token, as the next access can cause the token to be inconsistent with reality (It states a falsity now). At the same time, it states the issuer can block redemption based on the referrer. I think that’ll be interesting, as an allow list format will lead to only “big players” being able to use this API (As they are the only ones who they trust to not adversarially redeem tokens) whereas a deny list you’re playing a game of whack-a-mole where new domains can be popped up for this purpose. edit: added the last part of the quote for completeness

Markoff 6y ago

So how do I block this in uBlock?

kelnos 6y ago

I'm really confused. I'm reading the spec[0], which seems to explicitly state that it's not possible (modulo some possible vulnerabilities with mitigations that they later list) to track a user across the web using these tokens. Yet many of the comments I read here are talking about this being a way for websites to track users? This spec document also doesn't really list use cases for this. Why would I want this? The linked article seems to suggest it's so Google can reduce ad fraud, which of course I don't give a damn about, and don't want my user agent doing anything that helps advertisers, ever. Hopefully Firefox does not implement this, and hopefully if they don't, websites don't somehow penalize browsers that don't support it. [0] https://github.com/WICG/trust-token-api#overview https://github.com/WICG/trust-token-api#overview

jsnell 6y ago
I don’t even think this is for Google’s benefit. They don’t need these tokens, since the vast majority of their ad revenue is first party. But do you know what happens the moment Chrome disables third party cookie support? People will start complaining that it’s an anti competitive move against businesses with a stronger need third party cookies.
KenanSulayman 6y ago
Google does not need any cookies for Google properties because Google Chrome sends an `x-client-data` header to them.
- jefftk 6y ago
  The x-clint-data header is for experiments, not personalization: Additionally, a subset of low entropy variations are included in network requests sent to Google. The combined state of these variations is non-identifying, since it is based on a 13-bit low entropy value (see above). These are transmitted using the "X-Client-Data" HTTP header, which contains a list of active variations. On Android, this header may include a limited set of external server-side experiments, which may affect the Chrome installation. This header is used to evaluate the effect on Google servers - for example, a networking change may affect YouTube video load speed or an Omnibox ranking update may result in more helpful Google Search results. https://www.google.com/chrome/privacy/whitepaper.html#variations https://www.google.com/chrome/privacy/whitepaper.html#variat... (Disclosure: I work for Google, speaking only for myself)

yuhong 6y ago

For some history, see my Wikipedia article: https://en.wikipedia.org/wiki/Draft:Effects_of_the_2007-2008_financial_crisis_on_Google https://en.wikipedia.org/wiki/Draft:Effects_of_the_2007-2008...

speedgoose 6y ago

Well, how can we tell Google that they shouldn't have a say on this topic?

encom 6y ago
Stop using the invasive malware that is Chrome.
- speedgoose 6y ago
  That will do nothing I'm afraid. I already don't use Chrome, and even if I spend all my free time asking people to stop using Chrome for weird technical reasons from their point of view, I'm afraid that will do nothing compared to the advertising power of Google.
  - danaris 6y ago
    Indeed: it is far past the time when individual action would make a difference to Google. The only way to actually get them to listen is going to be to consistently vote for people who a) have a reasonable chance of winning their election, and b) support modernizing and enforcing our antitrust regime. (It is likely that this will need to be done incrementally, and it may require first replacing (b) with increasing levels of support for getting corporate money out of politics.)
  - bryan_w 6y ago
    You could create a Google ad to get the word out.

SquareWheel 6y ago

Much better article: https://www.zdnet.com/article/google-launches-chrome-extension-for-ad-transparency-trust-token-api/ https://www.zdnet.com/article/google-launches-chrome-extensi... Trust Token Github page: https://github.com/WICG/trust-token-api https://github.com/WICG/trust-token-api I'm glad to see it uses Privacy Pass as a basic mechanism.

itissid 6y ago

Is there a good article/video explaining how third party cookies work and then how the ad fraud itself works in this context? I would like to send it to someone with very little knowledge of this world and what problem this feature intends to solve.

Havoc 6y ago

Google leading this effort is completely ridiculous. Whatever comes out of it is bound to either not be great for privacy or it will be an improvement but hit the smaller players. ie everyone not google. eg take away Cookies to prevent tracking. Leaving them the only one company with sight of near everything (google analytics & Adsense & Chrome). And we already know from recent revelations that google isn’t above peeking under the hood of data sources they shouldn’t. Whole thing seems insanely monopolistic to me.

mda 6y ago
Do you have any actual technical counterpoints?
- imglorp 6y ago
  I think the problem is the hens are watching the fox design the coop. They've been invited to participate, but the fox has unlimited resources at its disposal for research and planning while the hens are of meager means. So yes, it may be unkind to prejudge the fox, but based on years of prior malice towards all poultry in the yard, and without fully understanding its plans, we have to assume it won't turn out well for us chickens. Cluck.
- Havoc 6y ago
  No because I wasn't commenting on the technical aspect. A proposal can be both technically sound and wildly monopolistic at the same time. Not everything is a pure engineering problem.
- speedgoose 6y ago
  Personally I didn't even bothered to read the proposal. No need for technical counterpoints, it's made by Google.
- dumbneurologist 6y ago
  Why are social and economic arguments against it invalid?
lopis 6y ago

jwilk 6y ago

Archived copy without GDPR nag screen: https://archive.md/U4axx https://archive.md/U4axx

sveme 6y ago
Thanks, doing the gods' work here.

sveme 6y ago

They must have the most atrocious, darkest, GDPR confirmation dialog. It's absolutely impossible to understand what you opt-in to.