6 ms·

That's not what the GP is saying. They're saying that only Facebook and the like have the resources to catch fraud, and smaller players won't. Yes, it's harder,

That's not what the GP is saying. They're saying that only Facebook and the like have the resources to catch fraud, and smaller players won't. Yes, it's harder, but that hardness is almost an irrelevance to Facebook and other FAANG-alikes, whereas it could be much more of a problem for smaller businesses who will struggle to bear the costs both of fraud, and to develop anti-fraud solutions (or pay for anti-fraud services). Maybe that opens up some opportunities as well, but that's not necessarily particularly appetising for businesses that aren't focussed around those areas of opportunity.

dkdk8283 6y ago
Market will catch up. I used Apache beam and we got really creative. As with all things it’s an arms race.
- sammm 6y ago
  Did not expect to see Apache Beam mentioned as part of this conversation. Mind me asking what you mean?
  - dkdk8283 6y ago
    Apache beam is the underlying engine we use for fraud detection. Based on proprietary heuristics we can provide the application with a confidence score the user is legit. Its up to the sec/product teams to determine when specific actions need additional verification like one time token via email or captcha. Just two examples.
wil421 6y ago
Can you explain how Apple’s anti tracking measures are going to hurt small business and make fraud easier?
- jefftk 6y ago
  Most of the time, privacy and fraud both benefit from the same changes. To prevent tracking online, you want your device to look just like everybody else's devices. To prevent fraud, you want devices to look different so you can tell when a device does not represent a real user. At the extreme, imagine if every person has a unique identifier that was automatically sent whenever they used any device: preventing ad fraud would be really easy, and you would have essentially zero privacy. At the other extreme, imagine if every device looked exactly the same, with no user agent, no IP, no cookies, no way to tell my traffic from yours. In that situation, people would have pretty strong privacy, but if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users. As the GGP says, removing IDFA shifts the balance toward both privacy and fraud. See https://blog.cloudflare.com/cloudflare-supports-privacy-pass/ https://blog.cloudflare.com/cloudflare-supports-privacy-pass... and https://web.dev/trust-tokens/ https://web.dev/trust-tokens/ for attempts to separate these. (Disclosure: I work on ads at Google, speaking only for myself.)
  - michaelt 6y ago
    > To prevent fraud, you want devices to look different To me, if your system relies on being able to tell most internet users apart, that sounds extremely close to processing personally identifiable information.
    - isignal 6y ago
      It doesn’t need to tell them apart individually, just high level demographics or geography are already useful. If your website suddenly got 99% of traffic from Tibet (random example), you would probably discount those impressions/clicks.
  - Nextgrid 6y ago
    > if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users This seems like a problem with the current model of ads being paid for by impression/click, and switching to a model where ads are being paid for the time they're being displayed (pay X to have your ad appear here for Y time) the problem goes away. Furthermore, the current advertiisng model also suffers from this problem even beyond malicious intent. Is it fraud if a real user "looks" at the ad but actually looks away from their screen? If they mute the sound? If they don't speak the language the ad is in? Etc.
- malandrew 6y ago
  The cost of a phone becomes a barrier to scaling fraud because once you use a phone for fraud it can be blacklisted. Advertiser fraud is hardly the only type of fraud. It happens with services you directly pay for like ridesharing and food delivery as well. The cost of fraud becomes another cost for a service provider and prices for all users need to be raised to offset losses from fraud. For smaller businesses without the brain power to combat fraud, their margins will be greatly hurt by fraud, making it harder to compete. I'm in favor of what Apple is doing myself, but it's definitely a legitimate unintended consequence of this measure. What would be useful is if Apple became the gatekeeper for tracking fraud and companies could report ephemeral identifiers for fraud that only Apple can de-anonymize and then Apple provides fraud scores for ephemeral identifiers on account signup.

dkdk8283 6y ago

Market will catch up. I used Apache beam and we got really creative. As with all things it’s an arms race.

sammm 6y ago
Did not expect to see Apache Beam mentioned as part of this conversation. Mind me asking what you mean?
- dkdk8283 6y ago
  Apache beam is the underlying engine we use for fraud detection. Based on proprietary heuristics we can provide the application with a confidence score the user is legit. Its up to the sec/product teams to determine when specific actions need additional verification like one time token via email or captcha. Just two examples.

wil421 6y ago

Can you explain how Apple’s anti tracking measures are going to hurt small business and make fraud easier?

jefftk 6y ago
Most of the time, privacy and fraud both benefit from the same changes. To prevent tracking online, you want your device to look just like everybody else's devices. To prevent fraud, you want devices to look different so you can tell when a device does not represent a real user. At the extreme, imagine if every person has a unique identifier that was automatically sent whenever they used any device: preventing ad fraud would be really easy, and you would have essentially zero privacy. At the other extreme, imagine if every device looked exactly the same, with no user agent, no IP, no cookies, no way to tell my traffic from yours. In that situation, people would have pretty strong privacy, but if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users. As the GGP says, removing IDFA shifts the balance toward both privacy and fraud. See https://blog.cloudflare.com/cloudflare-supports-privacy-pass/ https://blog.cloudflare.com/cloudflare-supports-privacy-pass... and https://web.dev/trust-tokens/ https://web.dev/trust-tokens/ for attempts to separate these. (Disclosure: I work on ads at Google, speaking only for myself.)
- michaelt 6y ago
  > To prevent fraud, you want devices to look different To me, if your system relies on being able to tell most internet users apart, that sounds extremely close to processing personally identifiable information.
  - isignal 6y ago
    It doesn’t need to tell them apart individually, just high level demographics or geography are already useful. If your website suddenly got 99% of traffic from Tibet (random example), you would probably discount those impressions/clicks.
- Nextgrid 6y ago
  > if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users This seems like a problem with the current model of ads being paid for by impression/click, and switching to a model where ads are being paid for the time they're being displayed (pay X to have your ad appear here for Y time) the problem goes away. Furthermore, the current advertiisng model also suffers from this problem even beyond malicious intent. Is it fraud if a real user "looks" at the ad but actually looks away from their screen? If they mute the sound? If they don't speak the language the ad is in? Etc.
malandrew 6y ago
The cost of a phone becomes a barrier to scaling fraud because once you use a phone for fraud it can be blacklisted. Advertiser fraud is hardly the only type of fraud. It happens with services you directly pay for like ridesharing and food delivery as well. The cost of fraud becomes another cost for a service provider and prices for all users need to be raised to offset losses from fraud. For smaller businesses without the brain power to combat fraud, their margins will be greatly hurt by fraud, making it harder to compete. I'm in favor of what Apple is doing myself, but it's definitely a legitimate unintended consequence of this measure. What would be useful is if Apple became the gatekeeper for tracking fraud and companies could report ephemeral identifiers for fraud that only Apple can de-anonymize and then Apple provides fraud scores for ephemeral identifiers on account signup.