5 ms·

"Trust tokens are meant to foster user trust across sites" Can anyone shed light on what exactly this "trust token" mechanism is? It sounds to me like some sor

"Trust tokens are meant to foster user trust across sites" Can anyone shed light on what exactly this "trust token" mechanism is? It sounds to me like some sort of cryptographic identifier that will enable Google to track our every move (to the limited extent we use Chrome and Google's websites) but this would be contradictory to their claim of non-identifying privacy.

JPLeRouzic 6y ago
https://github.com/WICG/trust-token-api#overview https://github.com/WICG/trust-token-api#overview For what I understand, a provider who trust a user, stores in her browser a set of kind of certificates, that basically declare "I "provider NNN", states that this user has been authenticated by me". Another party will ask for one trusted token, verifies that it is really signed by provider NNN, and can trust that each time this token is resent, it is the same user. The privacy is respected on the user side has the third party has no idea who is this user. The trusted tokens could even have a short life. Third parties therefore should have great trust in the trust token provider. It is as if Google authorized other parties to use its own cookies. Indeed this means that other parties trust "provider NNN". I guess that Google wants to become a more central identity provider than today, where it has to share this role with Facebook and a few other companies.
- ocdtrekkie 6y ago
  Sounds like something I still will expect my privacy-respecting browser to block in its entirety. It's not meant to benefit me, it's designed to prevent "ad fraud".
  - anoncareer0212 6y ago
    Choosing to be militantly ignorant in service of dogma over math has consequences all the time, not just when you're the Feds trying to get 'child porn' laws passed to make Apple break encryption.
    - foota 6y ago
      What?
  - gruez 6y ago
    >Sounds like something I still will expect my privacy-respecting browser to block in its entirety prepared to get penalized by recaptcha for not having it enabled.
    - ocdtrekkie 6y ago
      Yeah, I strongly suspect this will be the result on a much scale than the edge cases we see today. We need to start punishing companies using reCaptcha. Stop doing business with them.
      - cpeterso 6y ago
        What is a good alternative to reCaptcha that sites should use instead?
        Semaphor 6y ago
        I’ve been seeing hCaptcha more often ever since the Cloudflare announcement. Unlike with ReCaptcha, it doesn’t send me into an infinite loop.
        Drdrdrq 6y ago
        Thank you, totally missed this alternative, will check it out! Link for the lazy / curious: https://www.hcaptcha.com/ https://www.hcaptcha.com/
        isoos 6y ago
        If you browse through tor, hcaptcha can and will send you to infinite loop. Depends on the site though, not sure why...
        kemonocode 6y ago
        hCaptcha is an alternative I have seen popping up as of late. (I am completely unaffiliated with them, and I can't really even verify whether or not hCaptcha is any good, although it did seem like it was rather decent to me and no more difficult not easier than the average reCAPTCHA)
  - kevin_thibedeau 6y ago
    Prepare for a lot of Captcha challenges for daring to opt out of their invasive tracking graph.
    - ehsankia 6y ago
      How else do you propose sites combat spam and bots? As someone who has had many of my free services completely ruined by spammers, Captcha was the only way I could save them.
      - ocdtrekkie 6y ago
        I've found Captcha is an overkill strategy that also demonstrates poor customer service as you are both annoying your user and selling their data to Google. Often site-specific form validation is more than adequate to prevent bot registrations. Until you hit the level of "people are scripting for your site specifically" level, rudimentary data validation will catch almost every bot.
        ehsankia 6y ago
        > customer service Well honestly, "1-person hobby project" doesn't really have "customer service". Though I work hard to help anyone with honest feature requests and issues, there's still no SLO on any of this. I have unfortunately hit people scripting for my site directly, which is where I had to rely on Captcha. It's unfortunate but bad actors have honestly ruined so much of the internet...
- gruez 6y ago
  >Another party will ask for one trusted token, verifies that it is really signed by provider NNN, and can trust that each time this token is resent, it is the same user. how is this useful when it comes advertising, and how does it relate to third party cookies? Isn't third party cookies used for cross-site tracking? Apparently advertising networks use it to authenticate users as well?
  - notatoad 6y ago
    Cross-site tracking is used to build a profile on you to determine that you're a "real" user and your browsing habits don't match the browsing habits of a bot. With this profile built, recaptcha and others can avoid showing you an actual caaptcha. Without it, they need to show you a captcha every time they need to verify you're human. Trust tokens are a way to do that verification in a way that doesn't also enable cross site tracking for the advertising purposes. They aren't supposed to help advertisers track you
- greyface- 6y ago
  The WICG spec doesn't mention this at all, but it seems like Google plans to restrict the set of allowed issuers. From <https://www.chromium.org/updates/trust-token> https://www.chromium.org/updates/trust-token>: > Process for registering as an issuer: https://docs.google.com/document/d/1cvUdAmcstH6khLL7OrLde4TnaPaMF1qPp3i-2XR46kU/ https://docs.google.com/document/d/1cvUdAmcstH6khLL7OrLde4Tn... which says: To apply for an Issuer (and its key commitments) to be included within Chrome, the Issuer’s operator must file a new bug on the Chromium Issue Tracker, and provide: * Issuer Name - Human readable name representing the Issuer. * The origin that is used for the issuing service (scheme, host, port). The scheme must be HTTPS. * An email or email alias that is monitored by the Issuer’s operator for issues regarding the Issuer. * A public HTTPS endpoint that responds to key commitment requests. * A description of the Issuer, describing its intended purpose.
- raxxorrax 6y ago
  But it also means that if someone challenges the token, the token creator responsible for answering said challenge gets information about services used by the user. So it isn't really a privacy preserving solution.
- mikro2nd 6y ago
  It sounds like the provider knows everything, though... knows who it provided the tokens to, knows who consumed them. So where's the privacy shielding between me and the token provider? If that provider is likely to be Google (as I'm sure they plan), then there's no trust there to begin with. (Apologies if I should go and read the fine docs -- and in truth I probably should -- but I lack enough hours in the day for something that is a bit peripheral to my interests, so must rely on my co-HNers to condense/explain these things. Upvoted with gratitude.)
gumby 6y ago
You can tell from the name: it represents that you trust google with your identity, trust they will immediately betray by passing on to third parties. But the cool thing is your cookie restrictions won’t affect it!
jedimastert 6y ago
I believe that the idea is that you have a bunch of tokens that can be verified that were signed by a provider but cannot be associated to the owner of the tokens.
dwaite 6y ago
It is a one-time-use token with a limited amount of data (somewhere between 0 and 64 bits from the implementations I've heard about). You go through a process to get either one token or a 'batch' of tokens issued, then they are one-time-use redeemed to indicate authorization. Because they use a blind signature method, the server which issued them can't recognize them when they are redeemed. There is also a zero-knowledge proof used to make sure the server isn't trying to get additional bits of state by using different public keys per user. So they are not meant to track a user, but rather indicate that some process happened - that you previously solved a captcha, that you saw an ad, etc. 64 bits is way too much information IMHO, but the implementations are still very early.
- jefftk 6y ago
  > somewhere between 0 and 64 bits from the implementations I've heard about ... 64 bits is way too much information I think maybe you're confusing this some other API? Here are the trust token docs: https://github.com/WICG/trust-token-api#overview https://github.com/WICG/trust-token-api#overview

JPLeRouzic 6y ago

https://github.com/WICG/trust-token-api#overview https://github.com/WICG/trust-token-api#overview For what I understand, a provider who trust a user, stores in her browser a set of kind of certificates, that basically declare "I "provider NNN", states that this user has been authenticated by me". Another party will ask for one trusted token, verifies that it is really signed by provider NNN, and can trust that each time this token is resent, it is the same user. The privacy is respected on the user side has the third party has no idea who is this user. The trusted tokens could even have a short life. Third parties therefore should have great trust in the trust token provider. It is as if Google authorized other parties to use its own cookies. Indeed this means that other parties trust "provider NNN". I guess that Google wants to become a more central identity provider than today, where it has to share this role with Facebook and a few other companies.

ocdtrekkie 6y ago
Sounds like something I still will expect my privacy-respecting browser to block in its entirety. It's not meant to benefit me, it's designed to prevent "ad fraud".
- anoncareer0212 6y ago
  Choosing to be militantly ignorant in service of dogma over math has consequences all the time, not just when you're the Feds trying to get 'child porn' laws passed to make Apple break encryption.
  - foota 6y ago
    What?
- gruez 6y ago
  >Sounds like something I still will expect my privacy-respecting browser to block in its entirety prepared to get penalized by recaptcha for not having it enabled.
  - ocdtrekkie 6y ago
    Yeah, I strongly suspect this will be the result on a much scale than the edge cases we see today. We need to start punishing companies using reCaptcha. Stop doing business with them.
    - cpeterso 6y ago
      What is a good alternative to reCaptcha that sites should use instead?
      - Semaphor 6y ago
        I’ve been seeing hCaptcha more often ever since the Cloudflare announcement. Unlike with ReCaptcha, it doesn’t send me into an infinite loop.
        Drdrdrq 6y ago
        Thank you, totally missed this alternative, will check it out! Link for the lazy / curious: https://www.hcaptcha.com/ https://www.hcaptcha.com/
        isoos 6y ago
        If you browse through tor, hcaptcha can and will send you to infinite loop. Depends on the site though, not sure why...
      - kemonocode 6y ago
        hCaptcha is an alternative I have seen popping up as of late. (I am completely unaffiliated with them, and I can't really even verify whether or not hCaptcha is any good, although it did seem like it was rather decent to me and no more difficult not easier than the average reCAPTCHA)
- kevin_thibedeau 6y ago
  Prepare for a lot of Captcha challenges for daring to opt out of their invasive tracking graph.
  - ehsankia 6y ago
    How else do you propose sites combat spam and bots? As someone who has had many of my free services completely ruined by spammers, Captcha was the only way I could save them.
    - ocdtrekkie 6y ago
      I've found Captcha is an overkill strategy that also demonstrates poor customer service as you are both annoying your user and selling their data to Google. Often site-specific form validation is more than adequate to prevent bot registrations. Until you hit the level of "people are scripting for your site specifically" level, rudimentary data validation will catch almost every bot.
      - ehsankia 6y ago
        > customer service Well honestly, "1-person hobby project" doesn't really have "customer service". Though I work hard to help anyone with honest feature requests and issues, there's still no SLO on any of this. I have unfortunately hit people scripting for my site directly, which is where I had to rely on Captcha. It's unfortunate but bad actors have honestly ruined so much of the internet...
gruez 6y ago
>Another party will ask for one trusted token, verifies that it is really signed by provider NNN, and can trust that each time this token is resent, it is the same user. how is this useful when it comes advertising, and how does it relate to third party cookies? Isn't third party cookies used for cross-site tracking? Apparently advertising networks use it to authenticate users as well?
- notatoad 6y ago
  Cross-site tracking is used to build a profile on you to determine that you're a "real" user and your browsing habits don't match the browsing habits of a bot. With this profile built, recaptcha and others can avoid showing you an actual caaptcha. Without it, they need to show you a captcha every time they need to verify you're human. Trust tokens are a way to do that verification in a way that doesn't also enable cross site tracking for the advertising purposes. They aren't supposed to help advertisers track you
greyface- 6y ago
The WICG spec doesn't mention this at all, but it seems like Google plans to restrict the set of allowed issuers. From <https://www.chromium.org/updates/trust-token> https://www.chromium.org/updates/trust-token>: > Process for registering as an issuer: https://docs.google.com/document/d/1cvUdAmcstH6khLL7OrLde4TnaPaMF1qPp3i-2XR46kU/ https://docs.google.com/document/d/1cvUdAmcstH6khLL7OrLde4Tn... which says: To apply for an Issuer (and its key commitments) to be included within Chrome, the Issuer’s operator must file a new bug on the Chromium Issue Tracker, and provide: * Issuer Name - Human readable name representing the Issuer. * The origin that is used for the issuing service (scheme, host, port). The scheme must be HTTPS. * An email or email alias that is monitored by the Issuer’s operator for issues regarding the Issuer. * A public HTTPS endpoint that responds to key commitment requests. * A description of the Issuer, describing its intended purpose.
raxxorrax 6y ago
But it also means that if someone challenges the token, the token creator responsible for answering said challenge gets information about services used by the user. So it isn't really a privacy preserving solution.
mikro2nd 6y ago
It sounds like the provider knows everything, though... knows who it provided the tokens to, knows who consumed them. So where's the privacy shielding between me and the token provider? If that provider is likely to be Google (as I'm sure they plan), then there's no trust there to begin with. (Apologies if I should go and read the fine docs -- and in truth I probably should -- but I lack enough hours in the day for something that is a bit peripheral to my interests, so must rely on my co-HNers to condense/explain these things. Upvoted with gratitude.)

gumby 6y ago

You can tell from the name: it represents that you trust google with your identity, trust they will immediately betray by passing on to third parties. But the cool thing is your cookie restrictions won’t affect it!

jedimastert 6y ago

I believe that the idea is that you have a bunch of tokens that can be verified that were signed by a provider but cannot be associated to the owner of the tokens.

dwaite 6y ago

It is a one-time-use token with a limited amount of data (somewhere between 0 and 64 bits from the implementations I've heard about). You go through a process to get either one token or a 'batch' of tokens issued, then they are one-time-use redeemed to indicate authorization. Because they use a blind signature method, the server which issued them can't recognize them when they are redeemed. There is also a zero-knowledge proof used to make sure the server isn't trying to get additional bits of state by using different public keys per user. So they are not meant to track a user, but rather indicate that some process happened - that you previously solved a captcha, that you saw an ad, etc. 64 bits is way too much information IMHO, but the implementations are still very early.

jefftk 6y ago
> somewhere between 0 and 64 bits from the implementations I've heard about ... 64 bits is way too much information I think maybe you're confusing this some other API? Here are the trust token docs: https://github.com/WICG/trust-token-api#overview https://github.com/WICG/trust-token-api#overview