4 ms·

It's not the same as third party cookies! Third party cookies works only if: a) every site you visit loads some Google/Facebook/whatever JavaScript to track yo

It's not the same as third party cookies! Third party cookies works only if: a) every site you visit loads some Google/Facebook/whatever JavaScript to track you. That are not all sites. b) you didn't disable these scripts with extensions like UBlock (that to me is essentials these days) or use a browser that value your privacy (like Firefox) that blocks them by default. This system not only is deeply integrated in the browser and thus impossible to block with extensions (without modifying the source code of the browser, that in case of a proprietary browser like Google Chrome you can't), but also track all your browsing history, meaning that they catch even sites that doesn't include Google trackers inside. Another bad thing about this system is that is integrated inside the browser, meaning that for a closed source browser like Chrome only Google knows how it works and what exactly it does. While classical tracker scripts that uses third party cookies are implemented in JavaScript, minified and obfuscated, but still you can in theory read the source code and understand what they do. This is far worse for privacy than how things are now!

joshuamorton 6y ago
> a) every site you visit loads some Google/Facebook/whatever JavaScript to track you. That are not all sites. Right, but it is, to a first approximation, all of the sites that are going to be showing you personalized ads. > Another bad thing about this system is that is integrated inside the browser, meaning that for a closed source browser like Chrome only Google knows how it works and what exactly it does. While classical tracker scripts that uses third party cookies are implemented in JavaScript, minified and obfuscated, but still you can in theory read the source code and understand what they do. I'm not quite sure what you're getting at here. The setting and reading of a cookie by a client, yes, will be written in JS. That doesn't mean that you can know what its doing (there are likely cookies on your system that contain encrypted payloads that you can't read). The system that "actually" reads those cookies is hidden behind an API, so you don't have access to even the binary code. From that perspective, FloC is no worse, and is usually better, as the payload itself is generated and managed on your machine. Tangentially, FloC is similar to but probably more privacy preserving than the way Brave Browser does advertising today, and that was heralded by many on HN as a huge privacy improvement.
- tmottabr 6y ago
  yes, but i can have addon that will clean that cookie everytime i leave that sit and that cookie is only relevant for that site that set it.. i also can disable third party cookie at all so a site cannot see cookies for other sites.. and they can only track what sites you go that have their ad or their social media buttons.. afaik you cannot disable floc with an addon and you do not have any control over the floc id is assigned to you.. the floc id is calculated once a week based on the sites you visit on the previous 1 week.. so it leak information of what sites you have being visiting if anyone is able to reverse the sites that generated that floc id even if the site does not have adds or social media button on then or you use add blockers.. and i bet all the major tracking players will have farms calculating all possible floc ids from all the popular sites.. maybe do an addon that load randon stuff from randon domains in the background to taint the floc id so it makes harder to reverse the actual sites you are visiting.. or just use an browser that does not have it.. but beside floc, browser fingerprinting already allow tracker to identify people almost uniquely even without using cookies, there is already work on how to fingerprint someone without using either cookies or client side scripts, just by analyzing the timing when accessing several random subdomains using hundreds of redirects.. floc is just one more info they will have on you with no added benefit..

joshuamorton 6y ago

> a) every site you visit loads some Google/Facebook/whatever JavaScript to track you. That are not all sites. Right, but it is, to a first approximation, all of the sites that are going to be showing you personalized ads. > Another bad thing about this system is that is integrated inside the browser, meaning that for a closed source browser like Chrome only Google knows how it works and what exactly it does. While classical tracker scripts that uses third party cookies are implemented in JavaScript, minified and obfuscated, but still you can in theory read the source code and understand what they do. I'm not quite sure what you're getting at here. The setting and reading of a cookie by a client, yes, will be written in JS. That doesn't mean that you can know what its doing (there are likely cookies on your system that contain encrypted payloads that you can't read). The system that "actually" reads those cookies is hidden behind an API, so you don't have access to even the binary code. From that perspective, FloC is no worse, and is usually better, as the payload itself is generated and managed on your machine. Tangentially, FloC is similar to but probably more privacy preserving than the way Brave Browser does advertising today, and that was heralded by many on HN as a huge privacy improvement.

tmottabr 6y ago
yes, but i can have addon that will clean that cookie everytime i leave that sit and that cookie is only relevant for that site that set it.. i also can disable third party cookie at all so a site cannot see cookies for other sites.. and they can only track what sites you go that have their ad or their social media buttons.. afaik you cannot disable floc with an addon and you do not have any control over the floc id is assigned to you.. the floc id is calculated once a week based on the sites you visit on the previous 1 week.. so it leak information of what sites you have being visiting if anyone is able to reverse the sites that generated that floc id even if the site does not have adds or social media button on then or you use add blockers.. and i bet all the major tracking players will have farms calculating all possible floc ids from all the popular sites.. maybe do an addon that load randon stuff from randon domains in the background to taint the floc id so it makes harder to reverse the actual sites you are visiting.. or just use an browser that does not have it.. but beside floc, browser fingerprinting already allow tracker to identify people almost uniquely even without using cookies, there is already work on how to fingerprint someone without using either cookies or client side scripts, just by analyzing the timing when accessing several random subdomains using hundreds of redirects.. floc is just one more info they will have on you with no added benefit..