28 ms·
Google’s FLoC Is a Terrible Idea
- dleslie 6y agoThis captures my feelings on the issue: > That framing is based on a false premise that we have to choose between “old tracking” and “new tracking.” It’s not either-or. Instead of re-inventing the tracking wheel, we should imagine a better world without the myriad problems of targeted ads. I don't want to be tracked. I never have wanted to be tracked. I shouldn't have to aggressively opt-out of tracking; it should be a service one must opt-in to receive. And it's not something we can trust industry to correct properly. This is precisely the role that privacy-protecting legislation should be undertaking. Stop spying on us, please.
- izacus 6y agoWhat's tracking in your definition here? Is counting display of an ad tracking? Load of an image on page? Is logging nginx entry for your page load tracking? Is responding with correct image for your browser user-agent tracking? I'm sometimes confused what is covered under this term and I'd kinda like to know where the line here is drawn. What exactly are we talking about here?
- dleslie 6y agoWhen site A and site B are able to communicate to each other that I am a unique individual who has a particular session or sessions open.
- michaelbuckbee 6y agoMy understanding of FLOC is that it would meet that standard. That it would independently identify you to Site A and Site B as a person in a particular cohort.
- dleslie 6y agoThat's enough information to begin to uniquely identify me, along with other commonly available factors; like GeoIP and so forth.
- deleted 6y ago[deleted]
- ChrisLomont 6y agoAnswering any packet request from your end is enough to uniquely identify you. How do you propose TCP/IP would work without unique addresses?
- dleslie 6y agoFrom my original comment: > This is precisely the role that privacy-protecting legislation should be undertaking.
- smolder 6y agoIn many cases yes, but broadly, IP address is not a basis for determining an individual. It's difficult to know it's not some other NAT'd user or dynamically assigned.
- ehsankia 6y ago
- probably_wrong 6y agoI fear that your questions reduce the problem to the point where no answer is possible. Loading the Y Combinator logo in here is almost certainly not tracking, but loading an invisible, 1px-by-1px gif in an email almost certainly counts. It's missing the forest for the trees. The simplest definition of tracking I can come up with is "collect data about me that can (and often, is) used to build a profile of me and my behavior". The NGinx log could or could not be tracking, depending on whether you use it to diagnose issues ("we should optimize this picture, it's loading too slow for too many people") or to profile me ("ID 12345 uses a 56K modem, let's sell him a new one"). But no perfect definition exists because everyone has different thresholds of what they are okay with.
- izacus 6y agoIf I understand FloC correctly though, it sends your profile/tags/interesting topics from your owned client software. So this basically means that if you have a browser like Firefox, it could send a preset cohort set to server that doesn't build your tracking profile and gives you things you're interested in. To me this seems like a win? It allows you as a person to control how your ad profile is built (and if it's sent at all) and doesn't send your data to servers anymore? (Please correct me if I misunderstood the technology.)
- sodality2 6y agoIf this doesn't get taken advantage of by google, this would be awesome. I bet if a random open source project of the same kind were released, it would probably be pointed at as a reason why Google is evil ('see there are good alternatives!'). But because Google is doing it, people are (rightly) wary and (definitely not rightly) calling it evil without doing research.
- bogwog 6y ago> But because Google is doing it, people are (rightly) wary and (definitely not rightly) calling it evil without doing research. That's what happens when no one trusts you. It's human nature, and logical arguments aren't going to change that. If anything, it's a good thing for society if Google burns despite trying to do something genuinely good (not that FLoC is good), because it shows others that there are real consequences to betraying the trust of your customers. We lose one untrustworthy company today, and gain many trustworthy companies in the future. That's a net positive for society!
- sofixa 6y agoDo you use Web Monetisation ( as in, pay)? If you don't, and don't want to be tracked for ads, how do you propose things work?
- chipgap98 6y agoI would much rather pay than be tracked. Unfortunately many sites don't give me that choice.
- sofixa 6y agoIndeed, because for many of them the only option is ads, because almost nobody uses any alternatives ( the only one i know of is Web Monetization). Until it's massively used, few site owners will make the effort.
- spoonjim 6y agoThis will never happen because the people who would pay the most to avoid targeted ad tracking are the ones who are the most valuable to advertisers (essentially, people able and willing to spend money). So when you see Facebook making $20 per user or whatever and think “I’d pay $20 to avoid being tracked,” it’s actually Facebook making nothing from a ton of users, a little from a bunch of them, and a huge amount from their “whales,” and the people willing to pay to avoid being tracked are most likely in the “whales.”
- 6y ago
- an_opabinia 6y ago> I don't want to be tracked. I never have wanted to be tracked. Maybe just use Tor. > Stop spying on us, please. It was probably a mistake to equivocate the kind of data gathering that ad-tech companies do with the kind that oppressive governments do.
- dleslie 6y agoEven services that I _pay for_ block the use of VPNs and Tor; most of the common web services have begun using DroneBL or similar.
- reaperducer 6y agoMaybe just use Tor. Why should I have to jump through hoops and disguise myself? Why can't Google et.al. just respect the basic human right to privacy?
- prophesi 6y agoBut it's totally cool if we develop and sell the same tech to oppressive governments.
- AlexandrB 6y agoMeanwhile, in the "Company Gives Oppressive Government Access to User Data" thread: > Well of course $company gives $oppressive_regime access to data they collect on their users. They have to comply with local laws!
- dTal 6y ago> Maybe just use Tor. That's like diving into a conversation about CCTV proliferation with "just wear a ski mask". It's inconvenient, hinders daily activities, makes you look like a criminal, and might not even help. It's unreasonable. >It was probably a mistake to equivocate the kind of data gathering that ad-tech companies do with the kind that oppressive governments do. Given that oppressive governments can obtain the data from the ad-tech companies... no, not really.
- evrydayhustling 6y agoIt seems like FLoC could make it easier to opt out centrally rather than going through a mess of specific (dis)approvals for the specific trackers on every site. Maybe it could even be a good place for a dial - "I'll expose a 4-bit cohort, but nothing more specific." It also seems like FLoC could make it more politically viable to crack down non-consensual tracking. Publishers wouldn't be able to say "we have no choice but to deal with this [third party tracker] scum" but could continue to gate content by subscription or (consensual) FLoC as necessary for their business model. Pushing publishing and advertising towards proactive consent about targeting puts them into a dialog with the market about what's ok, instead of letting them hide behind a bunch of shifting tracker businesses.
- dleslie 6y agoIt still coerces consent with a bad default. Sites will refuse to operate unless the FLoC is enabled, or will become obnoxious to use with it disabled. However, if FLoC were disabled by default then sites would be less likely to provide an obnoxiously bad service to those with it disabled. The best default is not to track at all.
- judge2020 6y agoA lot of sites already break (sometimes in non obvious ways) with an ad blocker, so I don’t see how this changes anything.
- dleslie 6y agoBy dramatically changing the available defaults. If most browsers aggressively blocked ads then more sites would test to see if blocking ads breaks the site.
- Spivak 6y agoIf more people block ads then more effort is also devoted to circumventing ad blockers. Ad supported sites typically don’t care about the experience of viewers who aren’t revenue generating.
- freebuju 6y agoCan you go a day without the Internet? How about two days? Sadly without this tracking, the engines of the ad economy come to a stop. We have royally ducked up the ecosystem to the point where there's no fixing it. Ever. Even laws such as GDRP won't cut it, Facebook & co. are happy to flout the rules since paying the fines is worth the cost of breaking the rules. In the case of Google ad money vs Content marketing economy, it really is a case where the chicken came before the egg.
- kibwen 6y agoThis seems to imply that without ad revenue, the internet would not exist. But plenty of sites existed and still exist without the support of ad revenue. The price to host a static site is lower than it's ever been (and for sites that provide free hosting, the cost of providing that service is lower than it's ever been). If something like YouTube couldn't exist without ads, then so be it: let them move to a subscription model. There is nothing that says that we must be forced to tolerate ads in exchange for the internet, let alone ads that intentionally obliterate the human right to privacy.
- freebuju 6y agoOkay. Allow me to rephrase it. Knowing what you know about these products, can you live without Google, Youtube, Gmail for a day? This is what I refer to above when I say 'the Internet'. I reckon most people can't go a week.
- matkoniecz 6y ago> can you live without Google, Youtube, Gmail for a day? Without bug problems. Migrating away from Gmail would allow me to de it indefinitely.
- freebuju 6y agoI'm also locked in Gmail, among a couple other useful not so easily replaceable products from Google.
- grishka 6y agoAny new feature that is added to the user agent should serve or empower said user — not any other parties, including the browser maker and the advertisers. That simple.
- anoncake 6y agoAnd that's why an ad company should not be allowed to also make browsers.
- fartcannon 6y agoWe can all stop using Chrome. That'd help.
- grishka 6y agoThis kind of strategy has never ever worked because the majority of the world's population just accepts whatever is thrown at them without questioning.
- anoncake 6y agoSure. So would divine intervention. Regulation is more realistic.
- contravariant 6y agoSome well designed regulation would be nice. But just on the off chance we should probably also try frying tofu and sending it to the mozilla foundation, because we might need some divine intervention after all.
- xxpor 6y agoThat's the thing: Chrome did empower users, that's why everyone uses it! Users just want things to work, and Chrome worked better than IE and FF at the time. FF didn't get multi-process support for a decade after Chrome had it. Did this also serve Google's purposes? Of course. But that's how life works. It's a win-win for Google. Everyone complains about the evils of Google, but revealed preferences show that focusing on what people actually care about has substantial value. It's like no one follows what people say about cookie popups. Does your average non-tech user praise the EU for adding the popups and allowing opt outs? Of course not. They complain about these stupid fucking popups they have to click through on every site now!
- 1vuio0pswjnm7 6y ago<sarcasm>But what about a "free and open web".</sarcasm> These constant references to "the web" when discussing certain companies is annoying. The www does not belong to any incorporated middleman. I do not care how much traffic they are curently in control of. The www is a medium not a small, privileged group of messengers. How is this company even contemplating something like this. Answer: Because a majority of users choose a browser controlled by an advertising company. WTF. This company will no doubt exert influence/control over the "standards" process and next thing we know, every developer working on a browser will feel obligated to "implement FLoC". Maybe this is an either-or question. Who is the www for: users or advertisers. The middleman needs both. Advertisers need the middleman and users. But users do not need advertisers. And, truly, they do not need the middleman. Users are creating the content. The middleman just sits in between, spying on everything. Maybe there needs to be more than one www. Maybe there needs to be a non-commercial www for smart people.
- C19is20 6y agoDemocracy would work if I were in charge.
- frashelaw 6y agoAs long as it remains massively profitable to collect every ounce of data from us, tech corporations are going to keep doing this. Even with some existing laws, the profits are enough that they are willing to flagrantly violate these laws and simply pay meager fines. It's also unlikely that we will ever get significant legislation to protect us from this either, because all these tech profits allow big tech to buy our government, because policy is heavily swayed by corporations.
- feralimal 6y agoI absolutely agree! But, the reality we need to accept and work from is that with vested corporate interests aligning so well with intrusive governmental and military interests, nothing is going to change. Don't hold your breath for privacy protection legislation.
- charcircuit 6y agoYour browser recording history of web pages you've been and saving it locally is not someone else tracking you. Your perspective is seriously warped. Even if they were tracking you, they are doing so to give people better ads to make the world a better place.
- centimeter 6y ago> to give people better ads to make the world a better place If you say shit like this unironically, you can't ever accuse someone else of having a "warped perspective".
- charcircuit 6y agoUnrelevant ads are a waste of time and resources for all parties. Getting rid of these waste benefits all parties. It's a win-win-win situation. I believe making society more efficient makes the world a better place.
- dleslie 6y agoThe word you're looking for is "irrelevant". The technique is designed to encourage consumption. This does not necessarily make society more efficient; having frequent nags to consume product one does not need is wasteful. It's more than likely that targeted ads make humanity less efficient, due to the widespread coercion to consume products and services that are not necessary for a healthy and happy life.
- AshWolfy 6y agoAds are a waste of time and resources
- dleslie 6y ago> Even if they were tracking you, they are doing so to give people better ads to make the world a better place. They're doing it to improve their ability to coerce me to purchase products and services; not to make the world a better place. Rampant consumerism has not made the world a better place, not by a long shot.
- jszymborski 6y agoThe cookie dialogue was dumb, but a FLoC dialogue that only triggered on browsers that implemented it would be an actual deterrent that made a difference for privacy.
- asdfasgasdgasdg 6y agoI think they're going to need to state their case in a way that allows Google to still make money and be competitive in the market place. It's not a simple matter of doing it and not doing it. It's a matter of doing it, and making more money or not doing it and making less. Google seems willing to move in the direction of privacy, but it's not going to do so in a way that sabotages the bottom line. It's unrealistic to expect any entity to voluntarily sacrifice its own values for the values of another.
- tehlike 6y agoGoogle has started ramping up their subscription products - googleone in particular.
- faichai 6y agoThis is the transition that needs to happen. People just need to get used to the idea of paying for software. Software providers can then focus on making their products better rather than finding streams to tangentially monetise their offerings by invading user’s privacy.
- sofixa 6y agoNobody will pay for every small blog, recipe/repair tutorial/gardening tips website/YouTube channel. How much value do they bring to you ? How much would you pay for them? How would you know they're worth it without using them first, and why would they allow you to use them for free, when most users would be one-shot? Please support Web Monetization.
- freeone3000 6y agoI remember back when people put stuff on the internet for free because it was fun and they enjoyed sharing. I suppose the need for compensation has truly destroyed every good thing.
- 6y ago
- musicale 6y agoAre CCPA (privacy act, not credit protection act) (and California's data broker law) and GDPR having any affect on data brokers and credit bureaus? edit: apparently credit bureaus are exempt from CCPA
- richardwhiuk 6y agoI don't think GDPR has really tested it's legal teeth yet.
- M2Ys4U 6y agoThe UK's ICO knows that the adtech industry is breaking the law. They've purposely done nothing about it. They've even bragged on their blog and in their annual statement that they've done nothing about it :(
- beermonster 6y agoCitations?
- oytis 6y ago"Legitimate interest"
- karmakaze 6y ago> Federated Learning of Cohorts (FLoC) I hate the use of new/uncommon acronyms/initialisms without immediate clarification, a form of clickbait. So many paragraphs down to see what it's called. Expected more from EFF.
- ncann 6y agoCome here to say the same, I actually had to click on the github link to learn what it meant first. Should've explained it the first time it's brought up instead.
- jcrawfordor 6y agoIn the case of reverse-engineered acronyms like this one, I think there's a judgment call that you need to make: in some cases it is simply not useful to expand the term. They explain what FLoC means very early on, but the expansion of the acronym conveys very little information since it is technical, somewhat nonspecific, and it's clear that the acronym was designed before its meaning. Consider, for example, that it's uncommon to expand military program acronyms because their meaning is often less useful than saying "it's just a word."
- inopinatus 6y agoThe EFF is also milking the super creepy feeling from Google naming their technology for labeling humans, after the group noun for sheep.
- cyphers 6y agoHello! Author here. thank you for raising that, this was an oversight (due to moving text around in the editing process) that has been fixed. Totally agree that acronyms should be defined on first use.
- beervirus 6y agoAll modern adtech is a terrible idea. Let's go back to banner ads that are "targeted" based on what type of website you're looking at, rather than based on vacuuming up as much private info as possible about users.
- Shared404 6y agoThis is also the conclusion I came to. Ban advertising targeted by tracking, and you remove the incentive to track in the first place.
- sodality2 6y agoYeah, revenue for that is pennies to the dollar compared to tracking. I am not defending it but it is not a simple switch to stop being evil and everything is fine. Hundreds of thousands of services would shut down that relied on ads to function. Which, again, they are relying on a predatory business model, but still.
- kibwen 6y ago> Hundreds of thousands of services would shut down that relied on ads to function. Which, again, they are relying on a predatory business model, but still. You appear to understand the situation, so I'm not sure why you bring this up as a problem. If a business is utterly incapable of operating without resorting to an unethical business model, then the solution is to shut down the business rather than abandon ethics.
- sodality2 6y agoWell, some people don't understand the scope of it. I for the most part think it would be a good move, but it certainly would throw off the web for a good while. >You appear to understand the situation, so I'm not sure why you bring this up as a problem. It is a problem, just not one that I think is more important than the benefits it comes with. >If a business is utterly incapable of operating without resorting to an unethical business model, then the solution is to shut down the business rather than abandon ethics. I agree, but weigh the impact of other industries that rely on that business as well. It would be a very unpopular move, and given the lobbying in the US, it's unlikely to pass here. And if it passes in the EU that might have other negative impacts in partitioning the web even more. It's a balancing act, and the solution is not as clear cut as "ban tracking in advertising". Knowing lawmakers, do you think this would differentiate between a paid service keeping a user logged in and, say, google ads? I bet the paid service would have an option in the subscription menu to upgrade, is that tracking in advertising? Probably not to 99% of sane people, but can lawmakers (or anyone for that matter) express what they want out of such a law in a concise enough manner to not be misconstrued in a major way?
- kall 6y agoIf this actually goes anywhere, I'm kind of excited about it from the perspective of a product developer. Being able to do content recommendation for fresh visitors without any tracking effort of your own would be pretty cool. It will probably come with a dialog, so users will likely opt out often for ads or on page load, but not if they just clicked "show me movie recommendations" in your app.
- nmeofthestate 6y ago> It will probably come with a dialog Oh Christ I hope not. Any replacement for the current setup has to get rid of that blight. Should be a single opt in/out decision when you start using the browser.
- kall 6y agoIt would be a browser level dialog, so good browsers can give you that option, like safari does for other permissions.
- coffeefirst 6y agoWon't work. The proposed designs never expose segments (err, cohorts, whatever) to the page. This machine works for managing targeted advertising in Chrome, and... that's it.
- jrochkind1 6y agoThe OP says: > The draft specification states that a user’s cohort ID will be available via Javascript, but it’s unclear whether there will be any restrictions on who can access it, or whether the ID will be shared in any other ways. Is this incorrect?
- deleted 6y ago[deleted]
- kall 6y agoNo, they explicitly do. > cohort = await document.interestCohort() I mean it‘s a proposal. I‘ll believe it when I can use it, but maybe actually look at the proposal.
- ttt0 6y agoWill I be able to opt out from this?
- esperent 6y agoI guess we'll find out in a few weeks when testing starts. My guess is that it'll be hidden deep in about:config somewhere.
- 0xy 6y agoGiven Google's other tracking practices (X-Client-Data and leaky modern APIs like AudioContext), very unlikely. X-Client-Data cannot be disabled (it's hard-coded) and ships telemetry to DoubleClick without disclosure. Google Chrome is the DoubleClick browser. Why else would DoubleClick be hardcoded into the source as a place to send telemetry?
- izacus 6y agoI'd assume that you can use a browser that doesn't send this data?
- kibwen 6y agoUntil Google sites start deliberately breaking if you don't send this data (or your browser is known to implement any other feature intended to circumvent it), thereby destroying the market share of any browser that dares to do so.
- oytis 6y agoYou can send bogus data in this case.
- kibwen 6y agoI mention this. If Firefox were to come out and say "we're going to start spoofing this data", Google servers would start rejecting Firefox users within the week. No major browser would dare do it, not even Safari and Edge, because plenty of people are forced to use Google services for work. At best, you would have a small number of people using minor browsers and passing around patches for major browsers to spoof the data discreetly.
- data_spy 6y agoIf it's terrible, look at the other suggested solutions. Some are ultra terrible and will slow down the web
- querez 6y ago> That framing is based on a false premise that we have to choose between “old tracking” and “new tracking.” It’s not either-or. Instead of re-inventing the tracking wheel, we should imagine a better world without the myriad problems of targeted ads. This seems backwards to me: the alternative to "targeted ads" are "untargeted ads", aka Spam. Who would rather have spam than targeted ads. Sure, spam might be easier to ignore, but it's also not effective from the company's perspective: showing the ad only to people who might be willing to spend money seems like a good thing to me. It's certainly economical. Which is why I feel like targeted ads are not something we can get rid of.
- Hard_Space 6y ago> Who would rather have spam than targeted ads I would, because the targeting creeps me out entirely. Instagram were so good at it that I deleted the app. In the old days, you stuck luxury advertising in rich neighborhoods and used demographics for broadcast and other media. That'll do.
- querez 6y agoWhy should that do when you can do better? Why stop there? That would be like saying "post everything programming related on r/programming, that'll do. Let's ignore that there are more focused venues for my content". Don't get me wrong, I'm not keen on getting tracked, either. But I can totally see that from a company's perspective, if you can make sure that only people who are interested in your product actually see the ad, that's better. You don't annoy people who aren't interested (not everyone in a rich neighborhood cares about a BMW ad, some already have a Tesla) and you increase effectiveness.
- 1propionyl 6y ago> Why should that do when you can do better? Because "better [for advertisers]" is a euphemism for "worse for advertisees". > Why stop there? Because it's deeply unethical.
- Hard_Space 6y ago
- bentona 6y agoInteresting take from another market leader: https://www.thetradedesk.com/us/knowledge-center/googles-move-is-great-news-for-the-open-internet https://www.thetradedesk.com/us/knowledge-center/googles-mov...
- jrochkind1 6y agoWhat do you mean by "market leader"? "another"? Are you calling the EFF a "market leader"?
- unabridged 6y ago99.9% of the interactions with the internet should be read-only and could be delivered via something like IPFS. Make browsers read-only by default and closely monitor when information is sent out.
- Noughmad 6y agoI really don't understand the problem here. It looks like FLoC will entirely depend on the browser (which Google controls if it's Chrome). So the browser will analyze your browsing history (and since it's Google, it will probably connect to everything else Google knows about you) to request targeted ads. But, what about the people who don't use Chrome? I would hope that most people who know what EFF is already don't. Firefox will surely come with a way to disable it, or you'll configure it to always send "my little pony" or something like this. In the end, this seems to really be about Google (with a browser) competing against Facebook and other ad providers (who don't have a browser).
- jdlshore 6y agoThe big problem with FLoC, as I see it, is that it makes fingerprinting vastly easier. Your FLoC bucket narrows you down to one of several thousand users, rather than one of several million, and that's before fingerprinting applies. Ironically, it seems that FLoC makes user tracking easier, not harder. I see no upside in FLoC for me as a user, and plenty of potential downside. I'm glad I use Firefox.
- jackson1442 6y agoWithout making any drastic changes to my browser to intentionally inhibit fingerprinting, I already have a unique fingerprint according to https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/, so this honestly doesn't signal a change to me at all. I just run uBlock Origin to block trackers/ads.
- magicalhippo 6y agoI have the same. And the majority of what makes me unique, at least according to the EFF website, is absolutely not needed for 99.99% of the websites I visit.
- EMM_386 6y ago> Firefox will surely come with a way to disable it What's interesting is that since these "FLoC cohort" identifiers are generated by the browser itself, it's even easier than "disabling" it. They just won't implement it in the first place.
- max-ibel 6y agoI find it ironic that Google's 'sign in with Google' and oAuth methods only work if you allow third party cookies. At least, I have not figured out how to use it without enabling 3rd party cookies.
- brofallon 6y agoI'm wondering how hard it would be to reverse-engineer the FLoC algorithm that assigns ids based on browsing history.. could one just have a bunch of headless browsers randomly visit sites, and compute the FLoC ids periodically to see what types of sites end up producing which ids? This seems important since being assigned a group ID that includes a bunch of people might not be so bad, but (as the article suggests) if its well known which web sites are included in the group, that's a more disturbing story
- DreadY2K 6y agoIf you run an advertising company, you could probably just pay people a small amount of money to get their browsing history and their FLoC id, and enough people would take you up on that offer that you'd get that data (and maybe also demographics), without having to do any work to reverse-engineer.
- tarkin2 6y agoI failed to see how flocks (cohorts) change the dangers of tracking or targeting. Cambridge Analytica didn't want to target a person. They wanted to track people. Flocks of people.
- fshbbdssbbgdd 6y agoI think the average person that cares about tracking worries about the privacy implications if someone can look at their individual actions/conversations, but not so much about being marketed to as part of a group. The actions of Cambridge Analytica-type groups are an important issue, but I don’t think FLoC is trying to solve that.
- tarkin2 6y agoBy being part of a group, or likely groups, their individual actions can be ascertained.
- m0llusk 6y agoSaying please do not seems like a weak strategy for containing this. Financial pressure to target advertising is huge. There will have to be ways of defeating or at least detecting this.
- frashelaw 6y agoAs long as it remains massively profitable to collect every ounce of data from us, tech corporations are going to keep doing this. Even with some existing laws, the profits are enough that they are willing to flagrantly violate these laws and simply pay meager fines. It's also unlikely that we will ever get significant legislation to protect us from this either, because all these tech profits allow big tech to buy our government, because policy is heavily swayed by corporations.
- msg 6y agoI'm intrigued by the idea that users will be able to solve this problem on the client side. Perhaps not on the underlying data directly, but running an adversarial browser agent clicking its way purposefully through the internet, in a tab you never look at.
- tgragnato 6y agoOr an “adversarial browser extension” clicking its way through the internet. https://adnauseam.io/ https://adnauseam.io/ I tried this, but after some time your IP just gets flagged for click fraud. It's interesting because you won't see ads anymore, but you also won't be able to pollute more datasets. Overall it’s been a “meh”
- berkes 6y agoIf it is calculated client side, what keeps my browser (or a plugin) from always returning 42 as my ID? That would hide me rather well, especially if implemented by a large browser like safari or Firefox.
- mycologos 6y agoOne of my pet meta-theories about Hacker News is that the frustration expressed over several apparently different stories really has a single source: Hacker News likes the internet of 10-20 years ago a lot more than the average person. One place this shows up is a frequently-expressed sentiment that the internet is a less magical, less weird, and more corporate place than it was 10-20 years ago. Part of this may be because SEO has diluted the voices of individual creators. But part of it is also because way more average, everyday, tech-unsavvy people are on the internet now. Another example is the periodic highlighting of somewhat garish HTML-based websites. I like these too! My own personal website falls in this category! But as far as I know, the generic internet user likes the generic slick-graphics-and-whitespace style, and so go the websites that want to attract them. More relevant to the topic at hand, many comments in this thread argue that targeted ads are unnecessary for a functional internet, since the internet of 20 years ago seemed to work just fine without targeted ads. But, again, it's less clear to me that general internet users -- that is, mostly people who never experienced the internet of 20 years ago -- have the same preference. It's funny, because I'm to a large extent on HN's side on this one. But my enthusiasm is tempered by my sneaking suspicion that the other side is a lot bigger, and my side is actually powered by more elitism and nostalgia than I thought.
- AshWolfy 6y agoI have no nostalgia for the internet of old, the internet for me growing up with facebook, reddit, and newgrounds, i just dont want my privacy violated
- ErikVandeWater 6y agoI would say that the average HN user isn't so much opposed to targetted ads as they are opposed to organizations that are unaccountable to them storing their personal information in an insecure way. And Google, Facebook, Twitter, etc. all provided information to the NSA so it could illegally spy on almost every American with access to the internet.
- vaidhy 6y agoThis also seems to be a tech-elite/libertarian mindset and borders on paranoia. Does the average voter care enough to vote one way or other for it? I would suspect not.. they have bigger problems to deal with and they seem ok with government knowing something about them.
- karmakaze 6y agoHere's the part of how does this work that's my TL;DR. > A browser with FLoC enabled would collect information about its user’s browsing habits, then use that information to assign its user to a “cohort” or group. Users with similar browsing habits—for some definition of “similar”—would be grouped into the same cohort. Each user’s browser will share a cohort ID, indicating which group they belong to, with websites and advertisers. According to the proposal, at least a few thousand users should belong to each cohort (though that’s not a guarantee). > If that sounds dense, think of it this way: your FLoC ID will be like a succinct summary of your recent activity on the Web. > Google’s proof of concept used the domains of the sites that each user visited as the basis for grouping people together. It then used an algorithm called SimHash to create the groups. SimHash[0] can be computed locally on each user’s machine, so there’s no need for a central server to collect behavioral data. However, a central administrator could have a role in enforcing privacy guarantees. In order to prevent any cohort from being too small (i.e. too identifying), Google proposes that a central actor could count the number of users assigned each cohort. If any are too small, they can be combined with other, similar cohorts until enough users are represented in each one. [0] https://en.wikipedia.org/wiki/SimHash https://en.wikipedia.org/wiki/SimHash > In computer science, SimHash is a technique for quickly estimating how similar two sets are. The algorithm is used by the Google Crawler to find near duplicate pages. It was created by Moses Charikar. So...in addition, Google can use all the users' CPUs instead of their own.
- poundofshrimp 6y agoThe major flaw here, as pointed out in the article, is that third-party websites can tie authenticated users to their FLoC ids. This is much worse for privacy than the status quo. On the flip side, if opting out of FLoC is a single switch that turns off all third party tracking, then it makes opting out a breeze (compared with ad blockers now).
- jojobas 6y agoCan't imagine why anyone would think it's a good idea. A browser leaking browsing history was considered an outright bug (https://blog.mozilla.org/security/2010/03/31/plugging-the-css-history-leak/ https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...). One could standardize a list of things people would want to fill out about themselves (i.e. please put in your age and sex or else we can't guarantee you won't be hassled with ads of things completely irrelevant to you), but your software inferring things about you and snitching to the world is outright malware.
- alfiedotwtf 6y agoFeels like URL rewriting in some form (maybe in the form of XHR pings) will come back into fashion to skirt any future cookie laws or browser mitigations
- srswtf123 6y agoThere is no scenario in which Google should be trusted. They’ve squandered that trust over the years. Frankly they should be broken up.
- inakarmacoma 6y agoGenuine, honest question. Are posts like this written by bot or bought propaganda? Nonspecific, knee-jerk overreaching generalizations, inspiring fear, uncertainty, and doubt. Who aims to gain, if it's the case? It's that incentive enough to warrant a smear campaign. I can't prove it. It just feels off. That's my hunch.
- popcorncowboy 6y agoEven if it is astroturfing (my hunch is no), it taps into a genuine, honest zeitgeist that gets plenty of air on HN. Google is practically a cliche for bad-faith acting these days, and the apostasy of abandoning its nobler founding sentiments (the "don't be evil" hypocrisy) rankles many. Knee-jerk it may be, but it's closer to war-mongering within a sympathetic circle than it is to smear-campaigning.
- srswtf123 6y agoI'm reasonably certain I'm not a bot, and I'm 100% certain no one is paying me for my unpopular opinions. So: who aims to gain from my comment? Well, if Google were to be broken up, and some amount of privacy restored to all of us, I'd say society would gain. No one needs to mount a smear campaign against Google. Their own actions are damning enough. Perhaps if you existed outside your karma coma, you'd see it. Perhaps if I existed outside the anger and rage that makes me comment as "srswtf123", I'd take your point of view. But I doubt it. That's my hunch.
- perryizgr8 6y ago> A browser with FLoC enabled would collect information about its user’s browsing habits, then use that information to assign its user to a “cohort” or group. > Each user’s browser will share a cohort ID, indicating which group they belong to, with websites and advertisers. Sorry, I'm out. My browser is my agent. I don't want it to analyse my browsing data and send the resultant classification to random machines over the internet. Why is this even a thing? Browser's job is to display websites, not spy on the user. If advertisers want to track me, they can create their own software and entice me to install it. Oh wait, that's exactly what Google did with Chrome :(
- roody15 6y agoWhy do we need user tracking at all. Advertisers can operate based on the sites that are relevant. For example let’s say a magazine website cpumagazine.com is popular. Advertisers for computer parts, computer services etc can pay to be ads on this site. The point is the individual user doesn’t need to be tracked for advertising to work. It’s a false choice thinking we need 3rd party cookies or a. special browser based UUID ad profile. The truth is we don’t need either and advertising can still be effective.
- Ronsenshi 6y agoWhat you're describing used to be called contextual advertising which worked perfectly fine based on the content of the page user views. It just wasn't bringing all the excess profits that advertising corporations wanted. So, enter the fingerprinting and tracking. Like a stalker following you around the web, gathering data on what you are and what you might want to buy.
- throway4234324 6y ago> Google has promised that the vast majority of FLoC cohorts will comprise thousands of users each, so a cohort ID alone shouldn’t distinguish you from a few thousand other people like you. However, that still gives fingerprinters a massive head start. This is far fewer bits than one's IP address (> 32), unless you're using a VPN or have some weird ISP doing NAT for its users.
- dathinab 6y ago> ISP doing NAT for its Or your IP address changing frequently, a properly not really applying to FLoC.
- ericholscher 6y agoThis is exactly why we're building EthicalAds. It's an ad network that only targets based on the content of sites, doesn't allow any third-party media, and is currently only focused on a developer audience: https://www.ethicalads.io/advertising-vision/ https://www.ethicalads.io/advertising-vision/ We had the same choice on Read the Docs, but didn't really have any other way to make money but advertising. We decided to build ethical advertising, so that we could be proud of the ads we show, knowing we weren't adding to massive pool of data out there. I talked a bit more about it here: https://www.ericholscher.com/blog/2016/aug/31/funding-oss-marketing-money/ https://www.ericholscher.com/blog/2016/aug/31/funding-oss-ma...
- finchisko 6y agoHow will browser behave, when you combine no-store and no-cache in a single header?
- ttiurani 6y agoFully agree with EFF here, and what's most frustrating is that Google could actually be on the side of banning tracking, and win big over Facebook. Google had a fully working, very lucrative business model in search term based ads. You search for "office rent Arizona", and Google shows you ads about offices in Arizona. No privacy violations. There was no other problem with search term based ads except that Google wanted to pump up shareholder value faster than what that could give them.
- danShumway 6y agoI agree with a lot of this. Last time FLoC came up, I commented that the idea of FLoC missed the point of why we oppose tracking: https://news.ycombinator.com/item?id=25906791 https://news.ycombinator.com/item?id=25906791 The EFF writes: > The power to target is the power to discriminate. I would extend on this point: the power to target information that the user is not choosing to share is the power to discriminate. Part of recognizing people's agency online is giving them the ability to choose how they present themselves and to choose what they share. It's not inherently wrong to say that someone might want to signal something about themselves that they find important or even just convenient to share. But that should always be their choice, it should not be a top down decision about what information is "safe" or "dangerous". FLoC has some benefits (although they won't matter once every website decides to use FLoC as a fingerprinting vector), but even saying that FLoC has benefits, it is still based on the idea that users should not be in charge of their identities. It's got to be automated, it's got to happen in the background, it's got to use machine learning and be something that users can't inspect. I oppose the philosophy behind both current tracking systems and proposals like FLoC. Last time this came up I also theorized about what a privacy-respecting version of FLoC could look like for people who do want to see ads or who do want personalized content online -- what a version of FLoC could be that I would be more supportive of: https://news.ycombinator.com/item?id=25907079 https://news.ycombinator.com/item?id=25907079 None of those ideas are fleshed out, but they try to get at the heart of what the fundamental difference is between allowing a user to easily signal that they want to see personalized content about shoes, and trying to intuit behind a user's back that they will buy shoes if you show them a particular ad.
- nexthash 6y agoI mean... what do you expect from Google, or any internet advertiser for that matter? If 90% of your revenue comes from advertising, getting rid of tracking is like pulling the chair out from under your bum. Having a committee of advertisers sitting on a board governing advertising & tracking in the W3C is going to go about as well as you expect. Conflict of interest: massive. Their only concern is maximizing their revenue in any way possible, because otherwise they will cease being competitive and go out of business. Ergo this lovely new "Privacy Sandbox" that provides advertisers with a standardized, direct way to get to you. As long as Google or any other advertiser has sway over Internet standards, there will be a fox guarding the henhouse type situation. Moral of the story: don't use Chrome.
- supermatt 6y agoI am still not sure how and what google are doing to generate these cohorts or label a browser accordingly. This article talks about simhash. My understanding is that simhash does NOT perform any such analysis but generates a fingerprint based on the content that is comparable to those of similar content - for example, a checksum of my HN homepage is different to yours, as it contains user-specific information. Simhash, however, gives us a comparable "fingerprint". In short, this only works for identifying pages of similar content - by itself i cant see how it could be used for cohort analysis unless there is either a client-side ML model involved, or millions of simhashes are shipped with the browser. I raised this question the other day, and a googler pointed me to the "code". That code contained no reference to an ML model, its construction, or datasets. The code also contained no pool of simhashes. To me, that means that there is no way to label the browser with cohorts. Furthermore, the code appears to generate these simhashes, and then sync them to google via (the account identifiable) chrome sync. It is there that analysis is performed. Maybe this is why it's called "Federated LEARNING", instead of "Federated INFERENCE"? Is this truly what we can expect from this? That instead of google tracking our behaviour from ONLY their analytics and advertising partners, they will now be secretly collecting a hash of EVERY page we visit and sending it to google directly? How is this private? The whole point of a simhash is to establish similarity between pages - and google has a huge rainbow table of simhashes for their search. I got downvoted for raising this concern before. I would appreciate if someone would tell me what I have wrong instead of piling on the downvotes. Noone seems to be talking about this.
- jokoon 6y agoWhat made advertisers thrive is now going away. I guess it was time.
- leotaku 6y agoThis signals to me that Google thinks that Chrome either has, or will soon have, a significant enough market share where it is realistic and useful to move their invasive tracking methodology from the web into the browser. Maybe they also realize that any sensible browser vendor which is not also an ad giant should already be blocking web-based tracking technologies. So why even try to make them compatible. Honestly, as long as Firefox is still compatible with most sites, this won't hugely impact me. After that, I don't know.
- yholio 6y agoSo the floc is supposed to change one week over the next, but it most likely will remain correlated to previous values. It will provide something like 10-15 bits of entropy. You then have the geolocation from your IP provider, another good 10-15 bits. And then of course you have the browser fingerprinting, even my Brave leaks 18 bits. It seems trivial to write a machine learning model that can correlate slowly drifting flocs with the other information. And this is especially true if one already knows the sites that the old floc has been visiting, for example via Analytics data, so you can predict the direction of the floc drift and uniquely identify the majority of web users. Essentially, Google is not proposing limiting tracking, it proposes raising the entry bar into tracking so that a centrally placed company that can correlate all this data has a massive advantage. I wonder why. And for the punchline, they call it... democratization!
- zimmen 6y agoSo after years of profiting from the dark practices cookies allowed they decided to replace them with something new, better, more powerful, and potentially harder to block (when they decide to make it mandatory or burry it so deep that the average person can’t find the off switch). Are we supposed to be grateful now? Are we expected to celebrate this as a “huge win for the end user”? This looks like a typical case of “fighting symptoms, not the cause”.
- lovemenot 6y agoIf FLoC is what I have understood it to be then, I support it. Two things in FLoC's favour: The algorithm is open-source and it's client-side. It would be trivial for developers of ad-blockers to provide tools for anyone who cares about privacy to inject poisoned data into their stream. And for those who don't care, well it's a market and they are free to choose to partipate or not.
- fartcanister 6y agoSo, big companies have big appetites. This article should end at line: "multi-billion dollar advertising-surveillance industry on the Web"
- minusSeven 6y agoIt is bad idea for one company(whatever it maybe) to be gatekeeper of the web. Thing is in today's world it is more a question of when rather than if. And it seems like there is nothing we can do about it except not be part of it. Even that won't work if everyone is part of it. We are progressing more towards a dystopian reality where nothing is really in our control.
- pull_my_finger 6y agoSomething I didn't know was a thing, that I really shouldn't be surprised about, is that website owners actually jump through some hoops to further sell out the users privacy. FB has the "Conversion API" where they enable website owners to basically "manually" track you by attaching an ID to users and sending "events" to FB via their API, in lieu of try to do so with a tracking pixel. Literally, it's an API to subvert people trying _NOT_ to be tracked with ad blockers and hostfiles etc. FB isn't even the only company that has an API like this, apparently, it's pretty established and developers/site owners are more than happy to narc you out if it means they can extend their advertising reach a little.
- yasinaydin 6y agoTo block all these ads and tracking, I am already using DNS over TLS/HTTP, NextDNS with custom DNS block lists (including almost all CDN's, Google Services, fonts etc), ADblock Plus with custom lists, Ublock Origin, Firefox, extensive browser settings (blocking cookies or JavaScript unless whitelisted, blocking almost anything except images), isolating websites in Firefox containers, custom privacy settings for each website I have an account at, DuckDuckGo, iOS with only necessary apps and very strict settings, Arch Linux with custom settings, etc etc... Yet there are still ads or tracking. And it doesn't look like it's getting any better or easier to opt out.