5 ms·

What malicious code are first-party ad networks running on your computer?

mikestew 6y ago
That's a hell of a qualifier you just slapped on there. I'll answer as soon as I can track down a website that's not running a third-party ad network, which I'm sure you're aware is but a teensy percentage of web sites that run ads.
dheera 6y ago
0. The vast majority of websites are running third-party ad networks, not first-party. 1. Even first-party ad networks often track and fingerprint users without consent, and may even share the data they have with other websites. This has personally happened to me, specifically in which eBay and Amazon serve their own first-party ads, but shared data about my searches, purchases, and clicks with other platforms. Even though it may have been a part of their ToS to do that, I consider that type of cross-business sharing of user data, without a clear opt-in/opt-out option presented to the user, to be a malicious term and effectively user bullying by monopolies in e-commerce.
- jamiequint 6y ago
  1. They have consent, it's called the terms of service.
  - dheera 6y ago
    For eBay and Amazon, I consider that consent to be a malicious term, especially for these websites which are near monopolies. Even though I hit "agree" to their attempt to collect data, I still will instruct my devices to not actually give certain data to them, and instruct my devices to not display ads that are targeted based on cross-business shared data. And of course there are the million other sites you don't need to agree to any ToS to use.
    - jamiequint 6y ago
      I mostly agree with you on sites with no ToS or sites where you're not a registered user. I think that the concept that a ToS is considered by you to be malicious, yet you agree with it anyway in order to receive services is where the problem lies. That seems intentionally deceptive to me. If you disagree with the ToS why still use the site?
      - dheera 6y ago
        > If you disagree with the ToS why still use the site? Because I still need to buy stuff? eBay is a monopoly in online auctions and secondhand goods from non-local locations. I don't have a choice. This isn't 1980 where you probably had a lot of options for auctions that didn't track your user data. Those auctions are largely gone. Amazon is a near monopoly in e-commerce in that there are lots of things I buy that are more or less only available on Amazon, or perhaps Walmart which also a similarly malicious ToS. Either way, I actually buy stuff from these websites. Probably upwards of $10K in purchases per year, at least. It makes zero sense for them to kick me off for thwarting their user tracking and data sharing attempts. It would be a lose-lose for them to do that. There are a lot of things a ToS can reasonably require, for example, setting limits on how much you are allowed to use the service, and limits on how you may use data obtained in the course of using the service. I respect those. But when it comes to how my data is shared externally with other companies, I think it crosses the line for a ToS to require that of a user to use the service. In fact, I think there should be legislation requiring it to be a clear opt-in on part of the user, and I would go so far as to say that a default opt-in setting should be illegal.
        jamiequint 6y ago
        > It makes zero sense for them to kick me off for thwarting their user tracking and data sharing attempts. It would be a lose-lose for them to do that Sure, but presumably that should be their decision as the service provider, not yours.
        dheera 6y ago
  - duskwuff 6y ago
    The terms of service for a web page the user just visited? They haven't even seen anything to suggest that the ToS exists at that point -- they haven't consented to anything.
chillwaves 6y ago
It's dishonest to pretend that ads are not a significant and relevant attack vector.
- jamiequint 6y ago
  First-party ads are not an attack vector in any way, shape, or form.
  - chillwaves 6y ago
    How is that a meaningful distinction from the end-user point of view?
vel0city 6y ago
On mobile, I've encountered ads which create redirects away from the site I was originally on, triggered by ads. This has happened on many large sites, not just small ones (think: CNN, Bloomberg, etc.). It used to happen a lot more, but I've still encountered it within the last six months or so. Using the mobile web is near impossible without running an adblocker, unless I'm willing to shell out a grand for the next generation phone to run the horrendous amounts of javascript for ads. https://www.wired.com/story/pop-up-mobile-ads-surge-as-sites-scramble-to-stop-them/ https://www.wired.com/story/pop-up-mobile-ads-surge-as-sites... EDIT: Oh, I see you're massively limiting this scope to first party ad networks. I guess I have never really experienced issues with first party ad networks, as I practically never experience them. If they're truly first party ads, then they probably won't be blocked the ad blockers I run, because they'll be served by the same site I'm trying to access being first party and all.

That's a hell of a qualifier you just slapped on there. I'll answer as soon as I can track down a website that's not running a third-party ad network, which I'm sure you're aware is but a teensy percentage of web sites that run ads.

dheera 6y ago

0. The vast majority of websites are running third-party ad networks, not first-party. 1. Even first-party ad networks often track and fingerprint users without consent, and may even share the data they have with other websites. This has personally happened to me, specifically in which eBay and Amazon serve their own first-party ads, but shared data about my searches, purchases, and clicks with other platforms. Even though it may have been a part of their ToS to do that, I consider that type of cross-business sharing of user data, without a clear opt-in/opt-out option presented to the user, to be a malicious term and effectively user bullying by monopolies in e-commerce.

jamiequint 6y ago
1. They have consent, it's called the terms of service.
- dheera 6y ago
  For eBay and Amazon, I consider that consent to be a malicious term, especially for these websites which are near monopolies. Even though I hit "agree" to their attempt to collect data, I still will instruct my devices to not actually give certain data to them, and instruct my devices to not display ads that are targeted based on cross-business shared data. And of course there are the million other sites you don't need to agree to any ToS to use.
  - jamiequint 6y ago
    I mostly agree with you on sites with no ToS or sites where you're not a registered user. I think that the concept that a ToS is considered by you to be malicious, yet you agree with it anyway in order to receive services is where the problem lies. That seems intentionally deceptive to me. If you disagree with the ToS why still use the site?
    - dheera 6y ago
      > If you disagree with the ToS why still use the site? Because I still need to buy stuff? eBay is a monopoly in online auctions and secondhand goods from non-local locations. I don't have a choice. This isn't 1980 where you probably had a lot of options for auctions that didn't track your user data. Those auctions are largely gone. Amazon is a near monopoly in e-commerce in that there are lots of things I buy that are more or less only available on Amazon, or perhaps Walmart which also a similarly malicious ToS. Either way, I actually buy stuff from these websites. Probably upwards of $10K in purchases per year, at least. It makes zero sense for them to kick me off for thwarting their user tracking and data sharing attempts. It would be a lose-lose for them to do that. There are a lot of things a ToS can reasonably require, for example, setting limits on how much you are allowed to use the service, and limits on how you may use data obtained in the course of using the service. I respect those. But when it comes to how my data is shared externally with other companies, I think it crosses the line for a ToS to require that of a user to use the service. In fact, I think there should be legislation requiring it to be a clear opt-in on part of the user, and I would go so far as to say that a default opt-in setting should be illegal.
      - jamiequint 6y ago
        > It makes zero sense for them to kick me off for thwarting their user tracking and data sharing attempts. It would be a lose-lose for them to do that Sure, but presumably that should be their decision as the service provider, not yours.
        dheera 6y ago
- duskwuff 6y ago
  The terms of service for a web page the user just visited? They haven't even seen anything to suggest that the ToS exists at that point -- they haven't consented to anything.

chillwaves 6y ago

It's dishonest to pretend that ads are not a significant and relevant attack vector.

jamiequint 6y ago
First-party ads are not an attack vector in any way, shape, or form.
- chillwaves 6y ago
  How is that a meaningful distinction from the end-user point of view?

vel0city 6y ago

On mobile, I've encountered ads which create redirects away from the site I was originally on, triggered by ads. This has happened on many large sites, not just small ones (think: CNN, Bloomberg, etc.). It used to happen a lot more, but I've still encountered it within the last six months or so. Using the mobile web is near impossible without running an adblocker, unless I'm willing to shell out a grand for the next generation phone to run the horrendous amounts of javascript for ads. https://www.wired.com/story/pop-up-mobile-ads-surge-as-sites-scramble-to-stop-them/ https://www.wired.com/story/pop-up-mobile-ads-surge-as-sites... EDIT: Oh, I see you're massively limiting this scope to first party ad networks. I guess I have never really experienced issues with first party ad networks, as I practically never experience them. If they're truly first party ads, then they probably won't be blocked the ad blockers I run, because they'll be served by the same site I'm trying to access being first party and all.