10 ms·
Google's way of leveraging their browser dominance to use 3rd party cookies as a way to gain competitive advantage: Step 1: Implement a whole new browser funct
by ogre_codes 6y ago
Google's way of leveraging their browser dominance to use 3rd party cookies as a way to gain competitive advantage:
Step 1: Implement a whole new browser functionality where Google alone can track people.
Step 2: Eliminate 3rd party cookies so Google's competitors have to create increasingly unethical and invasive fingerprinting techniques to remain competitive.
Step 3: Increase advertising rates since they are the only company able to effectively target adverts on the web. (Profit)
Did I miss anything?
Google in their enthusiasm to prevent Microsoft from dominating the web has become worse than Microsoft was in its heyday.
- adriancr 6y ago> increasingly unethical and invasive fingerprinting techniques to remain competitive. ... or serve cookies via first-party subdomain ... Also, hasn't Safari already killed third party cookies?
- jay_kyburz 6y agoThen the advertisers need to trust the first parties.
- adriancr 6y agoor the subdomain goes to an advertiser server.
- hashkb 6y agoYeah... we're all too lazy to relay our data through our own backends. I recommend this to clients but there's always some killer analytics feature that requires the JS integration.
- jay_kyburz 6y agoOh, I didn't realize a subdomain was not considered 3rd party. So soon we'll see adnetwork.mydomain.com and www.mydomain.com. I think we should just make cookies only work when the domain matches exactly.
- devlopr 6y agoYou would see mydomain.com/adnetwork then.
- jay_kyburz 6y agoCan browsers look up a different server addresses to send requests to that way? I didn't think that's how DNS worked but I'm no expert. Advertisers can't trust content people to forward requests because it would be too easy to fake them.
- mikeiz404 6y agoNo I don’t think so. DNS only works on the domain part of the url. However a server like nginx can be set up to proxy requests matching a specific url pattern to another server. This would be a bit more work than adding a DNS entry and referencing that though.
- adriancr 6y agoOr setup cdn to redirect certain paths to the adserver and mark those paths as nocache
- kmeisthax 6y agoThe reason why subdomains work is that you can make the root domain go to your own site, while the subdomain goes to your ad provider. If you use a CNAME it's literally just a matter of publishing another DNS recod and you're done. Moving to a subdirectory requires setting up a reverse proxy on your existing infrastructure, and keeping it up to date every time your ad network switches domains. Hell, on a lot of platforms you don't even have the ability to reconfigure the server in such a way as to proxy through an entire ad network, so you'll have to use a platform or technology specific plugin if available. That's why the ad industry used third-party domains in the first place, BTW - it's a zero-setup solution. Subdomains are minimal-setup; subdirectories are a huge hassle.
- 6y ago
- Animats 6y agoI haven't had third party cookies enabled in Firefox for a decade. Google is coming late to this.
- deleted 6y ago[deleted]
- aqfamnzc 6y agoI hear this argument a lot. Yes, you can turn off third party cookies, and I have as well, but the power to control the default behavior is very important. What we should be asking ourselves is "Does the average user turn off third party cookies?" This is the same reason Facebook is throwing such a fit over apple's new prompt. It makes it easy and likely for the average user to disable something without having to dig through settings.
- beagle3 6y agoHow do advertisers reconcile cloaked first party subdomains? It requires fingerprinting, or the first party to tell the real 3rd party (cloaked as a first party) things like email or real name, that can be cross referenced, no?
- dwaite 6y agoYes, that is generally how they resolve it. Apple has started to reduce the effectiveness of CNAME cloaking. The goal is that advertisers will eventually be far better off working with a system like Private Click Measurement (in Safari betas now and set to be in next releases) than insecure things like CNAME cloaking.
- ogre_codes 6y agoYup. Google is lagging everyone else on this issue because it'll hit their advertising income.
- lmkg 6y agoGoogle's identity signal that they have given themselves access to works across cross-domain and cross-device. First-party cookies do neither. I would strongly prefer that everyone restrict themselves to the capabilities of first-party cookies. But it's still true that Google is not holding themselves to the same restrictions that they're trying to enforce on other parties.
- nr2x 6y agoThe things people don't know about third-party Javascript and "first-party" cookies...
- aabhay 6y agoHow would third party JavaScript fingerprint users? Only if there’s a backend data broker aggregating identities based on a universal token (e.g. email). Or one of those super shady tech wizardry techniques like timing OpenGL calls.
- judge2020 6y agoYou missed that Google isn't the only one that can track people under the Privacy Sandbox model - but it’s still advantageous for them since they can out-run their competitors on implementation speed and quality like they have with Chrome to capture more market share. https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb...
- 0xy 6y agoThis is a good time to remind everyone that Google has planted a hard-coded "X-Client-Data" telemetry backdoor that is sent to DoubleClick domains, is never disclosed to users and is impossible to disable. The header, which is not available to any of their competitors, contains unique information about the install that could allow them to track people better than anyone.
- deleted 6y ago[deleted]
- danudey 6y agoGoogle's response to this allegation: https://9to5google.com/2020/02/06/google-chrome-x-client-data-tracking/ https://9to5google.com/2020/02/06/google-chrome-x-client-dat... TL;DR, they claim that this header is sent to all Google-owned domains, and describes the feature flags that your browser has enabled, and it doesn't contain any PII. Oh wait They backpedalled on this by removing from the whitepaper their claim that the X-Client-Data field doesn't contain PII: https://vpnoverview.com/news/google-backpedals-on-claim-that-x-client-data-doesnt-contain-pi-information/ https://vpnoverview.com/news/google-backpedals-on-claim-that... Sigh. I guess the closest thing to a defence to your argument one could mount is "That's not true, Chrome sends it to all Google-owned domains!" which is... not a defence.
- ttt0 6y ago> it doesn't contain any PII. Even if that was the case, this is a bullshit argument. They don't need any PII, it's just more fingerprinting. They already have all the personal information they'll ever need by using all the other means.
- ElvisTrout 6y agoSurely fingerprinting is PII? It allows for mosaic identification.
- ttt0 6y ago
- Triv888 6y agoAnd Google is probably paying Mozilla so that they block those cookies too... I think that they might have paid them for other things too... like for blocking 99% of extensions on Firefox mobile (those are speculations, that are very probable).
- esperent 6y agoI still use Firefox 68 on Android since that's the last version to support extensions. It works well, for now.
- SubiculumCode 6y agoI have extensions on Firefox nightly for android.
- gcblkjaidfj 6y agoYou have 20 extensions that were "approved" by mozilla more than a year ago! All the others are banned forever. You can install uBlock, but not uMatrix. Many many extensions are banned just because they reviewed ONE extension that they preferred for a certain usecase. For example, for OLED phone night reading, there's the most installed at the time extension "Dark Background and Light text" that offered many customizations and worked on reader mode, and more importantly redish text/links. But too bad, because Mozilla picked the one with NO settings, but a nicer icon (which is literally disney's darth vader, but who cares) called "dark reader" which only have bright blue links and white text (and despite the name do not work on reader mode), and because there is already one extension with "dark mode" they will never whitelist the others, or even provide a setting to enable it on your own.
- dralley 6y ago> You have 20 extensions that were "approved" by mozilla more than a year ago! All the others are banned forever. This is a ridiculous lie, Mozilla has said repeatedly that more extensions are being enabled as support for more extension APIs are added, and it has been true. Several of my extensions which were previously disabled have come back online after updates.
- JMTQp8lwXL 6y agoDoesn't the rollout of IPv6 largely replace the cookie as a useful identifier of sorts?
- gcblkjaidfj 6y agoNot really. ipv6 has nothing to do with any of this.
- SulfurHexaFluri 6y agoYes it does. Users now have a unique IP address that is now static. Yes you can rotate your exact IP inside your block but you still keep the same subnet.
- gcblkjaidfj 6y agoThat is the promise they sold it on. But, point me to a single ISP that gives a cable subscriber more than one IPv6 address. or a /48 as initially everyone was hopping. ISP profit from NAT. They will never get rid of it. Even if you get a /54 /64 the ad networks will just learn to assign /54 as they do today. But, another point, ipv4 today is barred from being used to form your advertising profile under current legislation.
- ArchOversight 6y agoComcast gives you a /60 block that you can assign multiple /64's out of. My computer rotates out IPv6 addresses every 30 minutes using SLAAC with privacy addresses. While you can identify the /64, there is no guarantee that it is a single user, just like in IPv4 because of NAT there is no guarantee it is a single user. It'll identity a household, but that's it.
- gcblkjaidfj 6y ago> just like in IPv4 is the key concept I am talking about here and everyone keep saying it is not. Just like ipv4 is what matter and why ISP will never kill NAT. They profit from it, somehow. and it is not just saving money on ipv4 address space.
- summerlight 6y ago> so Google's competitors have to create increasingly unethical and invasive fingerprinting techniques to remain competitive. Why would Google let their competitors to take advantages from fingerprinting if they can control the browser? In fact, Chrome explicitly mentioned anti-fingerprinting measures in their plan for 3rd party cookie deprecation, which is now called privacy budget. https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html https://blog.chromium.org/2020/01/building-more-private-web-... https://github.com/bslassey/privacy-budget https://github.com/bslassey/privacy-budget
- jefftk 6y ago> Step 1: Implement a whole new browser functionality where Google alone can track people. Have a look at the concrete proposals: https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb... It's all proposed web standards, none of which privilege Google ad serving. (Disclosure: I work on ads at Google, speaking only for myself.)