16 ms·
Plus, if each cohort is a “group of [merely] thousands of people [any the worldwide internet population]”, the advertiser could probably narrow your identity pr
by cpeterso 6y ago
Plus, if each cohort is a “group of [merely] thousands of people [any the worldwide internet population]”, the advertiser could probably narrow your identity pretty well using passive fingerprinting of cohort(s) + IP address + Chrome version + OS + OS version and maybe HTTP headers for languages locale and time zone, though those are probably strongly correlated with the client IP address.
- jahewson 6y agoAccording to the specs, the requests are made without user agent headers, leaving only IP address. Targeting ads based on IP address isn't particularly valuable to ad networks if they can't correlate it with anything other than the sandboxed cohort data.
- mike_d 6y agoIf you give me a demographic group (age, sex, income, etc) of a thousand people, and give me the IP address I can uniquely identify the individual within that group using outside data sources like Experian.
- jefftk 6y ago> and give me the IP address The Chrome proposal is that it won't: https://github.com/bslassey/ip-blindness https://github.com/bslassey/ip-blindness
- mike_d 6y agoWhat insane ramblings is this? Every site will be forced to use an approved CDN? Adding forced MitM to every connection is the opposite of what we should be trying to implement.
- jefftk 6y agoIf you want to prevent fingerprinting, you need to look at where the identifying bits are coming from. (ex: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/) The IP address provides enough bits to uniquely identify many users, and when combined with just a few more bits, to identify almost anyone. TOR is one solution here, which you could potentially also describe as "adding forced MitM to every connection". The proposals in https://github.com/bslassey/ip-blindness/blob/master/near_path_nat.md https://github.com/bslassey/ip-blindness/blob/master/near_pa... and https://github.com/bslassey/ip-blindness/blob/master/willful_ip_blindness.md https://github.com/bslassey/ip-blindness/blob/master/willful... have different tradeoffs than TOR, with the "TOR is painfully slow" problem being a big one. If you have better ideas, though, I would be very interested in reading them!
- jefftk 6y agoCombining those would definitely be a problem. https://www.chromium.org/Home/chromium-privacy/privacy-sandbox/covert-tracking https://www.chromium.org/Home/chromium-privacy/privacy-sandb... describes removing/limiting those fingerprinting vectors, including IP. (Disclosure: I work for Google, speaking only for myself.)
- fumar 6y ago> Browsers would need a way to form clusters that are both useful and private >The browser uses machine learning algorithms to develop a cohort based on the sites that an individual visits. How would FLoC audience targeting work in non-chrome browsers? DV360 users deliver ads on all browsers, no?
- jefftk 6y agoFLoC is a proposal for a web standard, which other browsers could implement. Today, in browsers where third party cookies were removed without replacement, companies like Google that aren't willing to fingerprint have pretty limited user targeting capabilities.
- fumar 6y agoDoes that mean advertisers using DV360 will have the option to target using known identifiers or FloC? Chrome market share in the US is 50%. FloC covers 50% of the total US market. Advertisers want all the scale. https://www.statista.com/statistics/276738/worldwide-and-us-market-share-of-leading-internet-browsers/ https://www.statista.com/statistics/276738/worldwide-and-us-...