4 ms·

The idea that FLoC is a more privacy-friendly alternative to third-party cookies is deeply flawed, please read [this](https://github.com/WICG/floc/issues/100 ht

by livre 6y ago

The idea that FLoC is a more privacy-friendly alternative to third-party cookies is deeply flawed, please read [this](https://github.com/WICG/floc/issues/100 https://github.com/WICG/floc/issues/100).

xnx 6y ago
Thanks. Good thread. Sounds like FloC is definitely more anonymous than third party cookies that are already in use today. There might are some hypothetical situations with FLoC where some information might be able to be inferred given sufficient data, but this is not trivial/direct like it is today.
- z77dj3kl 6y ago
  No, that attack is trivial and direct, that's the problem.
- livre 6y ago
  I have my doubts about the "more anonymous" part, mainly because 3p cookies are constrained to a single browser on a single device and can be easily erased or blocked, but your browsing habits that will land you on a certain cohort will remain the same across devices so you could technically be tracked cross-device even if you don't sync your browsing history or cookies (if I am reading right the way FLoC works). Quick edit: you are certainly right that it will be less direct and more effort than cookies.
  - ljm 6y ago
    Not to mention that this only really makes it more difficult for businesses who haven't already infected the web with things like social media buttons, widgets, or analytics scripts. Neither Facebook nor Google require third party cookies to function, and I doubt FLoC would make any difference when they can already slurp up so much data that is voluntarily provided by other people without your consent (your address book, for example). Google even goes one step further by connecting your Google account directly to the browser, but there's also a reason why your Facebook login will never expire unless you force it to. This whole thing feels like paying lip-service to privacy to keep people distracted from the reality that a cadre of 90s/00s tech giants have essentially usurped the web. Most people on the internet use a web browser developed by a search engine company that evolved into a faceless advertising giant, after all.
    - manquer 6y ago
      Facebook ads and Google ads do not need third party cookies ? How are they serving contextual ads if they don't know what you are doing on different websites if the myriad of trackers they offer to content websites do not track you by third party cookies ?
      - cratermoon 6y ago
        there are several ways. ETags for one, another is to have all the various sites that use an ad network to send the relevant visitor fingerprint data to a central broker that correlates the information and attempts to determine that entity A and entity B are really the same person because a bunch of attributes match.
- GeekyBear 6y ago
  > Sounds like FloC is definitely more anonymous than third party cookies that are already in use today. Not at all. My browser deletes cookies from any website (by default) as soon as I close the last tab for a given open site. If the browser itself starts tracking me, my privacy is reduced, not enhanced.
  - Thorrez 6y ago
    I would think that whenever the "clear cookies" command is given to a browser, it also clears the FloC ids. Is that not the case?
    - freebuju 6y ago
      You just might be right. If you clear the history, the FLoC machine will have to calculate the cohort ID afresh. There are other use cases for this as this form of identification can be manipulated. Don't want to see cat ads anymore, google more dog memes next week.

by livre 6y ago

The idea that FLoC is a more privacy-friendly alternative to third-party cookies is deeply flawed, please read [this](https://github.com/WICG/floc/issues/100 https://github.com/WICG/floc/issues/100).

xnx 6y ago

Thanks. Good thread. Sounds like FloC is definitely more anonymous than third party cookies that are already in use today. There might are some hypothetical situations with FLoC where some information might be able to be inferred given sufficient data, but this is not trivial/direct like it is today.

z77dj3kl 6y ago
No, that attack is trivial and direct, that's the problem.
livre 6y ago
I have my doubts about the "more anonymous" part, mainly because 3p cookies are constrained to a single browser on a single device and can be easily erased or blocked, but your browsing habits that will land you on a certain cohort will remain the same across devices so you could technically be tracked cross-device even if you don't sync your browsing history or cookies (if I am reading right the way FLoC works). Quick edit: you are certainly right that it will be less direct and more effort than cookies.
- ljm 6y ago
  Not to mention that this only really makes it more difficult for businesses who haven't already infected the web with things like social media buttons, widgets, or analytics scripts. Neither Facebook nor Google require third party cookies to function, and I doubt FLoC would make any difference when they can already slurp up so much data that is voluntarily provided by other people without your consent (your address book, for example). Google even goes one step further by connecting your Google account directly to the browser, but there's also a reason why your Facebook login will never expire unless you force it to. This whole thing feels like paying lip-service to privacy to keep people distracted from the reality that a cadre of 90s/00s tech giants have essentially usurped the web. Most people on the internet use a web browser developed by a search engine company that evolved into a faceless advertising giant, after all.
  - manquer 6y ago
    Facebook ads and Google ads do not need third party cookies ? How are they serving contextual ads if they don't know what you are doing on different websites if the myriad of trackers they offer to content websites do not track you by third party cookies ?
    - cratermoon 6y ago
      there are several ways. ETags for one, another is to have all the various sites that use an ad network to send the relevant visitor fingerprint data to a central broker that correlates the information and attempts to determine that entity A and entity B are really the same person because a bunch of attributes match.
GeekyBear 6y ago
> Sounds like FloC is definitely more anonymous than third party cookies that are already in use today. Not at all. My browser deletes cookies from any website (by default) as soon as I close the last tab for a given open site. If the browser itself starts tracking me, my privacy is reduced, not enhanced.
- Thorrez 6y ago
  I would think that whenever the "clear cookies" command is given to a browser, it also clears the FloC ids. Is that not the case?
  - freebuju 6y ago
    You just might be right. If you clear the history, the FLoC machine will have to calculate the cohort ID afresh. There are other use cases for this as this form of identification can be manipulated. Don't want to see cat ads anymore, google more dog memes next week.