6 ms·

If the browser is supposed to send the information, what are they going to do with those of US who do not use Chrome? Are there plans to force firefox to follow

If the browser is supposed to send the information, what are they going to do with those of US who do not use Chrome? Are there plans to force firefox to follow the plan, and how will they prevent others from, say, making an extension to mess with the cohort numbers?

contravariant 6y ago
Presumably people would just block the ads instead? Either way I reckon it's the same thing stopping people from just sending random data over google-analytics. So, not a whole lot, other than whatever anti-spam mechanisms google bothered to put in place.
- sandworm101 6y ago
  >> just sending random data over google-analytics. Back when I was in the security field, I heard discussions about this sort of thing as a form of attack. The question was whether a computer that sent false or incorrect information was either engaging in a DOS attack or was violating the CFAA in that it was using false information to access a service. The DOS attack would be on the tracking system rather than a website resource, false information to degrade the effectiveness of the tracking system overall. The CFAA angle would be that participation in ads/tacking was part of the contract for accessing the 'free' service, that by blocking ads or sending false info the user is using a false credential to access the service. At the time, many thought that by using an ad-blocker that users were failing to pay, passively stealing website content. Those who sent false information were engaged in active theft.
  - michaelmrose 6y ago
    This is approximately the time when you go from passively not agreeing to be tracked or have your attention stolen or your computer compromised by ad networks to collaborating with your fellow citizens to destroy the business of the ad networks by making it difficult to impossible to operate. In truth if every free ad supported service ceased to exist the internet would go on none the less.
  - contravariant 6y ago
    I'll grant that sending fake data is more active than merely not loading ads, but I personally consider not loading ads about as malicious as failing to read a billboard, or failing to subscribe when a webpage says 'Subscribe now'. I don't think I'll ever quite understand the idea that the user is under any obligation to do whatever. Just because their user-agent might have some default behaviour doesn't mean that the user-agent should be expected to act in the interest of the server. Though there's an argument to be made that sending lots of false data in response to a request to post personal information to google-analytics is a bit like manipulating a public survey by sending in silly answers. I'm not sure to what extent that is illegal but I'll grant that it's not exactly ethically correct.
    - sandworm101 6y ago
      >> not loading ads about as malicious as failing to read a billboard Because, at this time, ad blocking tools are relatively benign. But what if we think of them more as content-blocking or content-management tools? What if I have a tool that blocks only right-wing advertisements or content? What if I have a tool that blocks all images of women showing too much skin? Block images of black people? Such not-neutral tools would radically change public perceptions. Legislation might follow. There was a comical toll out there that would replace the text "Trump" with "The idiot" on viewed websites. That's the thin edge of this wedge.
      - contravariant 6y ago
        Just because something is evidence of objectionable political view doesn't mean it should be forbidden.
  - btown 6y ago
    I'm deeply interested in these issues as well - the criminal aspect of the CFAA being disconnected from actual harm caused to people is insane to me. There does seem to be momentum towards a narrow reading of the CFAA when it comes to providing false information against terms of service, though, as per these 2013 analyses... though they fall short of actually giving any guarantees. https://www.whiteandwilliams.com/media/alert/247_Coverage%20Inkwell%2010.11.13.pdf https://www.whiteandwilliams.com/media/alert/247_Coverage%20... http://tsi.brooklaw.edu/cases/matot-v-ch http://tsi.brooklaw.edu/cases/matot-v-ch On the other hand, a denial of a motion to dismiss in Ticketmaster v. Prestige from 2018 seems to have drawn a distinction between breaching terms of service alone, and being told in a cease-and-desist not to breach those terms; the latter more clearly outlines what would be considered exceeding authorized levels of access. https://casetext.com/case/ticketmaster-llc-v-prestige-entmt-w-inc https://casetext.com/case/ticketmaster-llc-v-prestige-entmt-... Where does false information end and privilege escalation begin? Can that question depend on whether your privilege escalation is something as simple as "I'm now able to avoid the fine-print contract that I need to watch certain types and customizations of ads in order to access the service?" What constitutes sufficient notice to a user that certain actions are explicitly forbidden, if a C&D does but terms of service do not? All questions that, as far as I can tell, haven't been fully answered. (Obligatory: Not a lawyer, the above is not legal advice.)
  - TeMPOraL 6y ago
    > The CFAA angle would be that participation in ads/tacking was part of the contract for accessing the 'free' service, that by blocking ads or sending false info the user is using a false credential to access the service. I'm horrified whenever I see people having this perception of the issue, and worried that it'll get accepted by the legal system as the correct view. From my POV, the only contract that exists between me and a random ad-loaded website is the one negotiated between my computer and their server - that is, the HTTP protocol, which clearly stipulates that I can render any reply you send me in whatever way I like. This contract provides many tools for expressing the intent of gating content behind some requirements (like payment, or receiving different content first), but the common rule is: you don't send the content you're gating before the client proves they've met the requirements. And honestly, I'd consider mixing ads into content to be borderline CFAA (the ads themselves being abusive and often fraudlent, and sometimes malware) - and sending software intending to compromise my user agent (like trackers, or ad-blocking busters) to be crossing the CFAA line. Unfortunately, I don't think the lawyers would agree with me :(.
    - sandworm101 6y ago
      Are you horrified when a movie theatre doesn't want people sneaking in their own food and drink? Some consider that trespass in that you have broken the contract you agreed to when buying the ticket. They can call the cops and have you arrested for accessing the theatre in contravention of the rule. I could see an equivalent for websites that adopt a "no ad blocking" rule.
      - TeMPOraL 6y ago
        I'd expect such websites to communicate it, though, and do the minimum of work to prevent me from entering with ad blocker on. I'm fine with paywalls, and even "disable your ad blocker" walls - they're up-front, and in agreement with spirit of the HTTP protocol. Much like cinemas. If I try to bring in food I didn't bought at the cinema store, I will be stopped at ticket check and refused entry. Also, the cinema doesn't require me to buy food as a condition for watching the movie. If they did, I'd consider it the price of entry. What current ad-loaded websites are doing is the equivalent of letting you in to watch a movie, and then having someone come to you as you're watching, and poke you and yell at you because you didn't buy anything at the store. > They can call the cops and have you arrested for accessing the theatre in contravention of the rule. I've never heard of a cinema calling cops on people who snuck in food into the theatre. Is that US-specific?
darren_ 6y ago
I think the expectation is other browsers will implement by default - the intention incidentally is that FLoC isn’t a google specific tech, it enables private targeting by any ad vendor. The proposal seems to mostly to be by googlers but the association is with WICG which seems to have people from all over. As I noted in my original message - yes, its client side, you can do whatever. (‘Whether the browser sends a real FLoC or a random one is user controllable’ https://github.com/WICG/floc https://github.com/WICG/floc)
- curryst 6y ago
  The user controllability is genius, that neatly ties up their problem. They have a legitimate option to get out of being targeted, which they know almost no one will ever use. They could probably even add a setup prompt on install that says something like "Let us know which of these categories apply to you, so we can tailor your browsing to your interests" and get people to fill out half of it for them so they don't have to guess.
  - ogre_codes 6y ago
    > "Let us know which of these categories apply to you, so we can tailor your browsing to your interests" This prompt will never happen. The last thing Google wants is any additional association between their brand and advertising. Google's mode of operation has always been to sneak in the back door and count how many boxes of cereal you have while you are looking at underwear. Knocking on the front door and to ask if they can come in would likely never occur to them. There is no mention of Chrome being an ad supported product anywhere when you install it. They want that association completely out of people's heads.
    - GrifMD 6y ago
      This is a misunderstanding of what these cohorts are. If you read the [FLEDGE readme](https://github.com/WICG/turtledove/blob/master/FLEDGE.md https://github.com/WICG/turtledove/blob/master/FLEDGE.md) you can see that there are multiple types of owners of cohorts that fall into 3 categories: 1. Advertisers - who would add you to a cohort they own, so say "Nike - womens-running-shoes" 2. Publishers - who'd want these cohorts to better allow for advertisers to advertiser on their site, so "NYTimes - business-section-reader" 3. Third party ad-tech companies looking to create audiences for advertisers who work with them, so "Example Agency - mens-formal-wear". They'd partner with publishers so that when you go to somewhere like GQ or Man of Many and read an article on tuxedos then you'd get added to the cohort. So you are right, you'd never see a prompt to add in your interests, but this isn't because Google doesn't want to associate with specific brands, it's that Google isn't necessarily an owner of a cohort (though they totally could create their own under any 3 of those categories).
ogre_codes 6y ago
> If the browser is supposed to send the information, what are they going to do with those of US who do not use Chrome? What would stop them from implementing FLoC in the cloud for non-Chrome users? Fundamentally, where the data is stored is meaningless. So long as they are pushing everything through this same "FLoC" model, they are claiming they won't be tracking individuals. So on Chrome, FLoC is local—your own browser working against you—for Safari and FireFox, FLoC is cloud based. So long as the web sites in question are running Google Analytics, they still have the software on your system on a huge number of sites.
- jefftk 6y ago
  > for Safari and FireFox, FLoC is cloud based This would require being to identify a user when they are on many different sites (cross-site tracking), which all the major browsers intend to prevent. (Disclosure: I work at Google, speaking only for myself)
  - ogre_codes 6y ago
    First, you have to understand that Google as a company has lost all credibility in much of the community. There have been too many issues like this one where Google gives you the impression they are turning off tracking... but doesn’t actually stop tracking you. https://www.independent.co.uk/life-style/gadgets-and-tech/news/google-secret-tracking-location-services-disable-privacy-apps-a8068961.html https://www.independent.co.uk/life-style/gadgets-and-tech/ne... There was also the Do not Track setting, which Google ignored. So in my book (and I’m not alone here), anything coming from Google is taken with a huge grain of salt. For some time, there has been a sort of cat and mouse game between advertisers and browser makers. Do you know Google isn’t using fingerprinting to identify us? Or just IP or some other means?
    - jefftk 6y ago
      > Google as a company has lost all credibility in much of the community What I'm saying is Safari [1], Firefox [2], and Chrome [3] are planning technical mitigations that would prevent anyone from implementing a cloud-based FLoC. Even if you don't believe Chrome, it wouldn't be possible in Safari or Firefox. > Do you know Google isn’t using fingerprinting to identify us? Or just IP or some other means? https://blog.google/products/ads-commerce/a-more-privacy-first-web/ https://blog.google/products/ads-commerce/a-more-privacy-fir... has "once third-party cookies are phased out, we will not build alternate identifiers to track individuals as they browse across the web, nor will we use them in our products" and "our web products will be powered by privacy-preserving APIs which prevent individual tracking while still delivering results for advertisers and publishers" which seem pretty clear to me? Additionally, I work in client-side ads infra, and I'm pretty sure I would know if Google were fingerprinting users to target ads. [1] https://webkit.org/tracking-prevention-policy/ https://webkit.org/tracking-prevention-policy/ [2] https://wiki.mozilla.org/Security/Anti_tracking_policy#1._Cross-site_tracking https://wiki.mozilla.org/Security/Anti_tracking_policy#1._Cr... [3] https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb...
rattray 6y ago
I might imagine that Google Inc could sell a product to Mozilla Inc which they could embed in their Firefox browser, enabling them to sell FLoC data to Google. For example.
graphide21 6y ago
Chrome isn’t critically important to Google’s advertising and data initiatives. It’s important for a lot of other things, but that’s beside the point. Google doesn’t really need much more that what it has. It has third-party big data, Gmail, Google Search and a very recent optimized cache of everything important that it’s crawlers can get and more. People get so caught up in the minutia; Google is big, like category 100 Hurricane big, where people laugh and say there is no category 100; but that’s what it is- classification system aside. Anti-trust and pro-privacy are distractions that Alphabet, Google, etc. can put their left-fielder on while they run the bases, because they play both teams.
- kevin_thibedeau 6y ago
  They need a crippled browser that can't be used to bypass their revenue stream. Controlling the most popular browser gives them an important moat.
- deleted 6y ago
  [deleted]

contravariant 6y ago

Presumably people would just block the ads instead? Either way I reckon it's the same thing stopping people from just sending random data over google-analytics. So, not a whole lot, other than whatever anti-spam mechanisms google bothered to put in place.

sandworm101 6y ago
>> just sending random data over google-analytics. Back when I was in the security field, I heard discussions about this sort of thing as a form of attack. The question was whether a computer that sent false or incorrect information was either engaging in a DOS attack or was violating the CFAA in that it was using false information to access a service. The DOS attack would be on the tracking system rather than a website resource, false information to degrade the effectiveness of the tracking system overall. The CFAA angle would be that participation in ads/tacking was part of the contract for accessing the 'free' service, that by blocking ads or sending false info the user is using a false credential to access the service. At the time, many thought that by using an ad-blocker that users were failing to pay, passively stealing website content. Those who sent false information were engaged in active theft.
- michaelmrose 6y ago
  This is approximately the time when you go from passively not agreeing to be tracked or have your attention stolen or your computer compromised by ad networks to collaborating with your fellow citizens to destroy the business of the ad networks by making it difficult to impossible to operate. In truth if every free ad supported service ceased to exist the internet would go on none the less.
- contravariant 6y ago
  I'll grant that sending fake data is more active than merely not loading ads, but I personally consider not loading ads about as malicious as failing to read a billboard, or failing to subscribe when a webpage says 'Subscribe now'. I don't think I'll ever quite understand the idea that the user is under any obligation to do whatever. Just because their user-agent might have some default behaviour doesn't mean that the user-agent should be expected to act in the interest of the server. Though there's an argument to be made that sending lots of false data in response to a request to post personal information to google-analytics is a bit like manipulating a public survey by sending in silly answers. I'm not sure to what extent that is illegal but I'll grant that it's not exactly ethically correct.
  - sandworm101 6y ago
    >> not loading ads about as malicious as failing to read a billboard Because, at this time, ad blocking tools are relatively benign. But what if we think of them more as content-blocking or content-management tools? What if I have a tool that blocks only right-wing advertisements or content? What if I have a tool that blocks all images of women showing too much skin? Block images of black people? Such not-neutral tools would radically change public perceptions. Legislation might follow. There was a comical toll out there that would replace the text "Trump" with "The idiot" on viewed websites. That's the thin edge of this wedge.
    - contravariant 6y ago
      Just because something is evidence of objectionable political view doesn't mean it should be forbidden.
- btown 6y ago
  I'm deeply interested in these issues as well - the criminal aspect of the CFAA being disconnected from actual harm caused to people is insane to me. There does seem to be momentum towards a narrow reading of the CFAA when it comes to providing false information against terms of service, though, as per these 2013 analyses... though they fall short of actually giving any guarantees. https://www.whiteandwilliams.com/media/alert/247_Coverage%20Inkwell%2010.11.13.pdf https://www.whiteandwilliams.com/media/alert/247_Coverage%20... http://tsi.brooklaw.edu/cases/matot-v-ch http://tsi.brooklaw.edu/cases/matot-v-ch On the other hand, a denial of a motion to dismiss in Ticketmaster v. Prestige from 2018 seems to have drawn a distinction between breaching terms of service alone, and being told in a cease-and-desist not to breach those terms; the latter more clearly outlines what would be considered exceeding authorized levels of access. https://casetext.com/case/ticketmaster-llc-v-prestige-entmt-w-inc https://casetext.com/case/ticketmaster-llc-v-prestige-entmt-... Where does false information end and privilege escalation begin? Can that question depend on whether your privilege escalation is something as simple as "I'm now able to avoid the fine-print contract that I need to watch certain types and customizations of ads in order to access the service?" What constitutes sufficient notice to a user that certain actions are explicitly forbidden, if a C&D does but terms of service do not? All questions that, as far as I can tell, haven't been fully answered. (Obligatory: Not a lawyer, the above is not legal advice.)
- TeMPOraL 6y ago
  > The CFAA angle would be that participation in ads/tacking was part of the contract for accessing the 'free' service, that by blocking ads or sending false info the user is using a false credential to access the service. I'm horrified whenever I see people having this perception of the issue, and worried that it'll get accepted by the legal system as the correct view. From my POV, the only contract that exists between me and a random ad-loaded website is the one negotiated between my computer and their server - that is, the HTTP protocol, which clearly stipulates that I can render any reply you send me in whatever way I like. This contract provides many tools for expressing the intent of gating content behind some requirements (like payment, or receiving different content first), but the common rule is: you don't send the content you're gating before the client proves they've met the requirements. And honestly, I'd consider mixing ads into content to be borderline CFAA (the ads themselves being abusive and often fraudlent, and sometimes malware) - and sending software intending to compromise my user agent (like trackers, or ad-blocking busters) to be crossing the CFAA line. Unfortunately, I don't think the lawyers would agree with me :(.
  - sandworm101 6y ago
    Are you horrified when a movie theatre doesn't want people sneaking in their own food and drink? Some consider that trespass in that you have broken the contract you agreed to when buying the ticket. They can call the cops and have you arrested for accessing the theatre in contravention of the rule. I could see an equivalent for websites that adopt a "no ad blocking" rule.
    - TeMPOraL 6y ago
      I'd expect such websites to communicate it, though, and do the minimum of work to prevent me from entering with ad blocker on. I'm fine with paywalls, and even "disable your ad blocker" walls - they're up-front, and in agreement with spirit of the HTTP protocol. Much like cinemas. If I try to bring in food I didn't bought at the cinema store, I will be stopped at ticket check and refused entry. Also, the cinema doesn't require me to buy food as a condition for watching the movie. If they did, I'd consider it the price of entry. What current ad-loaded websites are doing is the equivalent of letting you in to watch a movie, and then having someone come to you as you're watching, and poke you and yell at you because you didn't buy anything at the store. > They can call the cops and have you arrested for accessing the theatre in contravention of the rule. I've never heard of a cinema calling cops on people who snuck in food into the theatre. Is that US-specific?

darren_ 6y ago

I think the expectation is other browsers will implement by default - the intention incidentally is that FLoC isn’t a google specific tech, it enables private targeting by any ad vendor. The proposal seems to mostly to be by googlers but the association is with WICG which seems to have people from all over. As I noted in my original message - yes, its client side, you can do whatever. (‘Whether the browser sends a real FLoC or a random one is user controllable’ https://github.com/WICG/floc https://github.com/WICG/floc)

curryst 6y ago
The user controllability is genius, that neatly ties up their problem. They have a legitimate option to get out of being targeted, which they know almost no one will ever use. They could probably even add a setup prompt on install that says something like "Let us know which of these categories apply to you, so we can tailor your browsing to your interests" and get people to fill out half of it for them so they don't have to guess.
- ogre_codes 6y ago
  > "Let us know which of these categories apply to you, so we can tailor your browsing to your interests" This prompt will never happen. The last thing Google wants is any additional association between their brand and advertising. Google's mode of operation has always been to sneak in the back door and count how many boxes of cereal you have while you are looking at underwear. Knocking on the front door and to ask if they can come in would likely never occur to them. There is no mention of Chrome being an ad supported product anywhere when you install it. They want that association completely out of people's heads.
  - GrifMD 6y ago
    This is a misunderstanding of what these cohorts are. If you read the [FLEDGE readme](https://github.com/WICG/turtledove/blob/master/FLEDGE.md https://github.com/WICG/turtledove/blob/master/FLEDGE.md) you can see that there are multiple types of owners of cohorts that fall into 3 categories: 1. Advertisers - who would add you to a cohort they own, so say "Nike - womens-running-shoes" 2. Publishers - who'd want these cohorts to better allow for advertisers to advertiser on their site, so "NYTimes - business-section-reader" 3. Third party ad-tech companies looking to create audiences for advertisers who work with them, so "Example Agency - mens-formal-wear". They'd partner with publishers so that when you go to somewhere like GQ or Man of Many and read an article on tuxedos then you'd get added to the cohort. So you are right, you'd never see a prompt to add in your interests, but this isn't because Google doesn't want to associate with specific brands, it's that Google isn't necessarily an owner of a cohort (though they totally could create their own under any 3 of those categories).

ogre_codes 6y ago

> If the browser is supposed to send the information, what are they going to do with those of US who do not use Chrome? What would stop them from implementing FLoC in the cloud for non-Chrome users? Fundamentally, where the data is stored is meaningless. So long as they are pushing everything through this same "FLoC" model, they are claiming they won't be tracking individuals. So on Chrome, FLoC is local—your own browser working against you—for Safari and FireFox, FLoC is cloud based. So long as the web sites in question are running Google Analytics, they still have the software on your system on a huge number of sites.

jefftk 6y ago
> for Safari and FireFox, FLoC is cloud based This would require being to identify a user when they are on many different sites (cross-site tracking), which all the major browsers intend to prevent. (Disclosure: I work at Google, speaking only for myself)
- ogre_codes 6y ago
  First, you have to understand that Google as a company has lost all credibility in much of the community. There have been too many issues like this one where Google gives you the impression they are turning off tracking... but doesn’t actually stop tracking you. https://www.independent.co.uk/life-style/gadgets-and-tech/news/google-secret-tracking-location-services-disable-privacy-apps-a8068961.html https://www.independent.co.uk/life-style/gadgets-and-tech/ne... There was also the Do not Track setting, which Google ignored. So in my book (and I’m not alone here), anything coming from Google is taken with a huge grain of salt. For some time, there has been a sort of cat and mouse game between advertisers and browser makers. Do you know Google isn’t using fingerprinting to identify us? Or just IP or some other means?
  - jefftk 6y ago
    > Google as a company has lost all credibility in much of the community What I'm saying is Safari [1], Firefox [2], and Chrome [3] are planning technical mitigations that would prevent anyone from implementing a cloud-based FLoC. Even if you don't believe Chrome, it wouldn't be possible in Safari or Firefox. > Do you know Google isn’t using fingerprinting to identify us? Or just IP or some other means? https://blog.google/products/ads-commerce/a-more-privacy-first-web/ https://blog.google/products/ads-commerce/a-more-privacy-fir... has "once third-party cookies are phased out, we will not build alternate identifiers to track individuals as they browse across the web, nor will we use them in our products" and "our web products will be powered by privacy-preserving APIs which prevent individual tracking while still delivering results for advertisers and publishers" which seem pretty clear to me? Additionally, I work in client-side ads infra, and I'm pretty sure I would know if Google were fingerprinting users to target ads. [1] https://webkit.org/tracking-prevention-policy/ https://webkit.org/tracking-prevention-policy/ [2] https://wiki.mozilla.org/Security/Anti_tracking_policy#1._Cross-site_tracking https://wiki.mozilla.org/Security/Anti_tracking_policy#1._Cr... [3] https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb...

rattray 6y ago

I might imagine that Google Inc could sell a product to Mozilla Inc which they could embed in their Firefox browser, enabling them to sell FLoC data to Google. For example.

graphide21 6y ago

Chrome isn’t critically important to Google’s advertising and data initiatives. It’s important for a lot of other things, but that’s beside the point. Google doesn’t really need much more that what it has. It has third-party big data, Gmail, Google Search and a very recent optimized cache of everything important that it’s crawlers can get and more. People get so caught up in the minutia; Google is big, like category 100 Hurricane big, where people laugh and say there is no category 100; but that’s what it is- classification system aside. Anti-trust and pro-privacy are distractions that Alphabet, Google, etc. can put their left-fielder on while they run the bases, because they play both teams.

kevin_thibedeau 6y ago
They need a crippled browser that can't be used to bypass their revenue stream. Controlling the most popular browser gives them an important moat.
deleted 6y ago
[deleted]