17 ms·

> Why is this bad? As the Electronic Frontier Foundation explains in their post “Google’s FLoC is a terrible idea“, placing people in groups based on their brow

by slver 6y ago

> Why is this bad? As the Electronic Frontier Foundation explains in their post “Google’s FLoC is a terrible idea“, placing people in groups based on their browsing habits is likely to facilitate employment, housing and other types of discrimination, as well as predatory targeting of unsophisticated consumers. All of this has been happening with tracking cookies, fingerprint tracking, pixel tracking and so on. And will continue to happen. I find it so bizarre it took Google to talk about phasing out 3rd party cookies and replacing it with a much lesser technology in the face of FLoC, for people to suddenly be all up in arms about it.

jffry 6y ago
Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out. And a long phase out is not something around which you can form a singular rallying cry. FLoC is a new thing which is just being rolled out, so it's a lot easier for people to resist adding a new thing that makes the internet more crappy and less private. I think it's unnecessarily fatalist to say that all of this will continue to happen so what's the point of resisting it. Public awareness and negative opinion of the pervasiveness and creepiness of internet tracking continues to grow, and advocacy against tracking mechanisms helps create the type of groundswell which could actually shift public policy to forbid such tracking. Google specifically is catching some heat for potential antitrust problems, so raising a ruckus about Google abusing its dominant browser position to cram FLoC into the internet is more likely to have positive effect than ever before.
- slver 6y ago
  If you have figured out a way to eliminate tracking, be my guest. Mozilla would like to know, Apple would like to know. Until then FLoC attracts attention because it's new, yes, this explains our reaction. It's still an irrational reaction. Also what's this "predatory targeting of unsophisticated consumers" about? You don't need targeting for this. Heck you don't need anything for this. The way it's usually carried out is you hack some sites and redirect them to you landing page about "this one magic trick to riches, banks hate her".
  - salawat 6y ago
    So you're the one who keeps doing that, or is it a group thing? Just curious. It undoubtedly works, but I've always wondered why it's so pervasive.
    - slver 6y ago
      Congratulations, you win a free iPhone.
  - jffry 6y ago
    Mozilla at least has done plenty of things to reduce the effectiveness and scope of tracking on the web. Just because we can't create an ironclad solution doesn't mean that there isn't real value in reducing the usable surface area for profiling and tracking users across the web. FLoC is an additional means of tracking users that is presently being pushed by a giant corporation who controls a significant web browser, of course anybody who is pro-user-privacy would rail against its rollout. It's ridiculous to call that an irrational reaction.
  - om2 6y ago
    Apple is doing just fine on greatly reducing tracking, and we don’t think FLoC or anything much like it is necessary. Safari already blocks 3P cookies by default and has done so for a year.
- throw4592745 6y ago
  I have 3rd party cookies off. The only thing I have seen requiring 3rd party cookies in the last year is Microsoft when I had to use teams.
- tomxor 6y ago
  > Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out. Not true, FireFox and Safari have had them off by default for over a year now. Additionally Chrome had planned to turn them off last year but then cried "covid" which for some reason = delay... because... think of the adverts! i mean covid! Anyway, I'm pretty sure any large websites relying on 3rd party cookies for functionality will have already experienced users blocking issues. We have and have already been forced to change, we don't do ads, but our use case is a bit esoteric in that it needed 3rd party cookies for sessions.
  - hirsin 6y ago
    Care to reach out? This username at Microsoft. We're working to understand what legitimate use cases are broken without 3p cookies so we can work with Google to backfill them. FLOC helps ad trackers track but doesn't help with any of the legitimate uses of 3p cookies like auth.
    - pabs3 6y ago
      Auth should be doable with just redirects though right? Isn't that how OAuth and OpenID connect work?
      - catlifeonmars 6y ago
        Same thought. I’m curious to know what other kinds of authentication protocols require third-party cookies to operate. Within OIDC, even more obscure/advanced features such as session management and global logout require only 1st party (the IdPs) cookies in order to function. I guess the tradeoff being made here is just leaning into our reliance on the certificate authority system. Whereas before, with third party cookies, you might have had more flexibility with how you structure your domains.
        hirsin 6y ago
        The implicit grant, while deprecated, is still used across the ecosystem. Further, embedded apps (eg you have a portal that iframes Salesforce and Salesforce needs to be authenticated) can't redirect to the login page or open that iframe for cookies. Front channel logout is also broken, part of the OIDC spec. It opens iframes to sites, but the sites don't get their cookies and can't write them.
- rtpg 6y ago
  Another thing is that third-party cookies can actually offer real functionality that has nothing to do with advertising (for example platforms like Salesforce let you integrate your own offering into a Salesforce users' system, and third-party cookies can be a pretty straightforward way of accomplishing that). I don't see really any non-tracking reason for FLoC
- izacus 6y ago
  > FLoC is a new thing which is just being rolled out, so it's a lot easier for people to resist adding a new thing that makes the internet more crappy and less private. What exactly about FLoC is making the internet less private though? Every time I see the technology it seems that it's deliberately built to keep private data in your Chrome browser and leak significantly less than anything else Ad related right now. Also, why is WordPress allowing so many ad and anlytics tracking plugins and not considering those as security issues?
cratermoon 6y ago
The issue really is: Google isn't phasing our 3rd party cookies out of charity. They are clearly looking for a way to keep doing all the things third-party cookies enable after they go away. Here we find people saying (through legislative and regulatory action) that they want to end the use of 3rd party cookies because the bad behaviors they enable, and they are rightly outraged at the efforts to comply with the letter of the law while running roughshod over the intent of the laws.
- oh_sigh 6y ago
  Why is firefox phasing out 3rd party cookies? Is it out of charity?
  - cratermoon 6y ago
    Firefox is not a product of the 800lb gorilla of targeted ad revenue. The Mozilla foundation could live without the ad revenue tied 3rd party cookies. They feel pressure from their users (people like us) who want to not be tracked everywhere, and ending the use of 3rd party cookies is one technical step. At some point in the past year it seems the privacy concerns reached a critical mass. The Mozilla foundation is responding in ways to keep its browser share relevant.
  - drewgross 6y ago
    Yes. Mozilla is a non-profit, pretty much everything they do is out of charity.
    - cratermoon 6y ago
      Sort of true. To know what a non-profit's motivations are, look at the biggest donors and donations. Some of the Mozilla Foundation's money comes from the Mozilla Corporation, which does get a lot of money from the big tech companies.
1vuio0pswjnm7 6y ago
One difference between third party cookies and FLoC is that with FLoC it is being explained to the public how browsing history is being used. The third parties who send Set-Cookie headers do not write up documentation attempting to explain to the public what they are doing and why it is not a threat to privacy. As other comments point out, it would be more difficult for people to "be all up in arms" about third party cookies because third party cookies is not an issue that is easily attributable to one entity nor one set of documentation.
- millsmob 6y ago
  “attempting to explain to the public what they are doing” The idea that you can explain FLoC, third party cookies or any other digital advertising technology to the public is crazy talk. Ad tech is extremely complex and constantly evolving - “the public” includes children, the intellectually disabled, the mentally ill, the elderly and the illiterate. No amount of documentation is going to help these people reach a point where they could actually be considered as giving “informed consent” to their “use” of an ad-tech stack that often involves dozens of different legal entities and software components. ##### “why it is not a threat to privacy” The entire purpose of FLoC is to maximise profit for Google by minimising my privacy.
  - 1vuio0pswjnm7 6y ago
    Agreed 100%. Only me, but I actually find the docs insulting for the reasons you stated.
krick 6y ago
As far as I'm concerned, it is just great that something made it for people to be "all up in arms about it". And "why" is not very important and neither is it surprising, really. I mean, how could have people been all up in arms about well-established technology all web is built upon, when 10 years ago google was, allegedly, "the good corporation", all people were like "I have nothing to hide", avoiding FB because of privacy concerns was just "being paranoid" and people telling stories confirmed by Snowden shortly after were "schizophrenic"? It is literally like 3-5 years (right before Cambridge Analytica scandal, I guess) since being "concerned" about your web-presence became somewhat mainstream. And FLoC is... well, it's new.
- deleted 6y ago
  [deleted]
swiley 6y ago
People don't want more things like 3rd party cookies.
- slver 6y ago
  The idea is that this is the bare minimum the industry needs in order to stop needing 3rd party cookies (and other tracking strategies). It's not pretty but on the other end... ads do serve a function. And not all ads are bad. The focus should be on getting rid of the scammy ones, and not tracking won't help much with that.
  - freeone3000 6y ago
    Fuck the industry. The entire point is to get you to spend more money on stuff. I will do nothing to assist with the brainwashing of humanity, and will continually fight against it.
  - om2 6y ago
    Tracking is used pervasively by the ad ecosystem today, but that doesn’t mean tracking is needed for ads to exist. Contextual ads are a thing. FLoC isn’t even replacing the most important use of tracking, which is measurement, not targeting.
  - feanaro 6y ago
    I think a sufficiently large number of people is saying they effectively do not care about the surveillance-based ad industry and want it dismantled.
  - millsmob 6y ago
    Ads serve capital, they do not serve me.
FuckButtons 6y ago
I think many people would disagree with the conclusion to your second paragraph. If you don’t take it as given that something must come and replace cookies then FLoC appears to be an attempt to rebuild that which was just cast into the bin of history.
freeone3000 6y ago
Third-party cookies can be blocked by technological means. Heck, cookies can be blocked. There's even a toggle in Chrome to disable them, no extension needed. And yet, here we are, attempting to preserve the bucketing of humanity despite what anybody using the browser actually wants.
feanaro 6y ago
I think the cause and effect is a bit mixed up in your reasoning. What's actually happening is threefold: 1. People are starting to get fed up with tracking of all kinds (including third-party cookies). This is happening gradually, but is increasing. A consequence of this can also be seen from the legal side in the form of GDPR. 2. Google sees the tides on tracking are turning and tries to preempt by proposing a superficially less problematic alternative (FLoC) that will be least detrimental to their tracking business. 3. People dislike FLoC because it is not sufficiently lessened in this new normal and is therefore also unacceptable.

by slver 6y ago

jffry 6y ago

Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out. And a long phase out is not something around which you can form a singular rallying cry. FLoC is a new thing which is just being rolled out, so it's a lot easier for people to resist adding a new thing that makes the internet more crappy and less private. I think it's unnecessarily fatalist to say that all of this will continue to happen so what's the point of resisting it. Public awareness and negative opinion of the pervasiveness and creepiness of internet tracking continues to grow, and advocacy against tracking mechanisms helps create the type of groundswell which could actually shift public policy to forbid such tracking. Google specifically is catching some heat for potential antitrust problems, so raising a ruckus about Google abusing its dominant browser position to cram FLoC into the internet is more likely to have positive effect than ever before.

slver 6y ago
If you have figured out a way to eliminate tracking, be my guest. Mozilla would like to know, Apple would like to know. Until then FLoC attracts attention because it's new, yes, this explains our reaction. It's still an irrational reaction. Also what's this "predatory targeting of unsophisticated consumers" about? You don't need targeting for this. Heck you don't need anything for this. The way it's usually carried out is you hack some sites and redirect them to you landing page about "this one magic trick to riches, banks hate her".
- salawat 6y ago
  So you're the one who keeps doing that, or is it a group thing? Just curious. It undoubtedly works, but I've always wondered why it's so pervasive.
  - slver 6y ago
    Congratulations, you win a free iPhone.
- jffry 6y ago
  Mozilla at least has done plenty of things to reduce the effectiveness and scope of tracking on the web. Just because we can't create an ironclad solution doesn't mean that there isn't real value in reducing the usable surface area for profiling and tracking users across the web. FLoC is an additional means of tracking users that is presently being pushed by a giant corporation who controls a significant web browser, of course anybody who is pro-user-privacy would rail against its rollout. It's ridiculous to call that an irrational reaction.
- om2 6y ago
  Apple is doing just fine on greatly reducing tracking, and we don’t think FLoC or anything much like it is necessary. Safari already blocks 3P cookies by default and has done so for a year.
throw4592745 6y ago
I have 3rd party cookies off. The only thing I have seen requiring 3rd party cookies in the last year is Microsoft when I had to use teams.
tomxor 6y ago
> Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out. Not true, FireFox and Safari have had them off by default for over a year now. Additionally Chrome had planned to turn them off last year but then cried "covid" which for some reason = delay... because... think of the adverts! i mean covid! Anyway, I'm pretty sure any large websites relying on 3rd party cookies for functionality will have already experienced users blocking issues. We have and have already been forced to change, we don't do ads, but our use case is a bit esoteric in that it needed 3rd party cookies for sessions.
- hirsin 6y ago
  Care to reach out? This username at Microsoft. We're working to understand what legitimate use cases are broken without 3p cookies so we can work with Google to backfill them. FLOC helps ad trackers track but doesn't help with any of the legitimate uses of 3p cookies like auth.
  - pabs3 6y ago
    Auth should be doable with just redirects though right? Isn't that how OAuth and OpenID connect work?
    - catlifeonmars 6y ago
      Same thought. I’m curious to know what other kinds of authentication protocols require third-party cookies to operate. Within OIDC, even more obscure/advanced features such as session management and global logout require only 1st party (the IdPs) cookies in order to function. I guess the tradeoff being made here is just leaning into our reliance on the certificate authority system. Whereas before, with third party cookies, you might have had more flexibility with how you structure your domains.
      - hirsin 6y ago
        The implicit grant, while deprecated, is still used across the ecosystem. Further, embedded apps (eg you have a portal that iframes Salesforce and Salesforce needs to be authenticated) can't redirect to the login page or open that iframe for cookies. Front channel logout is also broken, part of the OIDC spec. It opens iframes to sites, but the sites don't get their cookies and can't write them.
rtpg 6y ago
Another thing is that third-party cookies can actually offer real functionality that has nothing to do with advertising (for example platforms like Salesforce let you integrate your own offering into a Salesforce users' system, and third-party cookies can be a pretty straightforward way of accomplishing that). I don't see really any non-tracking reason for FLoC
izacus 6y ago
> FLoC is a new thing which is just being rolled out, so it's a lot easier for people to resist adding a new thing that makes the internet more crappy and less private. What exactly about FLoC is making the internet less private though? Every time I see the technology it seems that it's deliberately built to keep private data in your Chrome browser and leak significantly less than anything else Ad related right now. Also, why is WordPress allowing so many ad and anlytics tracking plugins and not considering those as security issues?

cratermoon 6y ago

The issue really is: Google isn't phasing our 3rd party cookies out of charity. They are clearly looking for a way to keep doing all the things third-party cookies enable after they go away. Here we find people saying (through legislative and regulatory action) that they want to end the use of 3rd party cookies because the bad behaviors they enable, and they are rightly outraged at the efforts to comply with the letter of the law while running roughshod over the intent of the laws.

oh_sigh 6y ago
Why is firefox phasing out 3rd party cookies? Is it out of charity?
- cratermoon 6y ago
  Firefox is not a product of the 800lb gorilla of targeted ad revenue. The Mozilla foundation could live without the ad revenue tied 3rd party cookies. They feel pressure from their users (people like us) who want to not be tracked everywhere, and ending the use of 3rd party cookies is one technical step. At some point in the past year it seems the privacy concerns reached a critical mass. The Mozilla foundation is responding in ways to keep its browser share relevant.
- drewgross 6y ago
  Yes. Mozilla is a non-profit, pretty much everything they do is out of charity.
  - cratermoon 6y ago
    Sort of true. To know what a non-profit's motivations are, look at the biggest donors and donations. Some of the Mozilla Foundation's money comes from the Mozilla Corporation, which does get a lot of money from the big tech companies.

1vuio0pswjnm7 6y ago

One difference between third party cookies and FLoC is that with FLoC it is being explained to the public how browsing history is being used. The third parties who send Set-Cookie headers do not write up documentation attempting to explain to the public what they are doing and why it is not a threat to privacy. As other comments point out, it would be more difficult for people to "be all up in arms" about third party cookies because third party cookies is not an issue that is easily attributable to one entity nor one set of documentation.

millsmob 6y ago
“attempting to explain to the public what they are doing” The idea that you can explain FLoC, third party cookies or any other digital advertising technology to the public is crazy talk. Ad tech is extremely complex and constantly evolving - “the public” includes children, the intellectually disabled, the mentally ill, the elderly and the illiterate. No amount of documentation is going to help these people reach a point where they could actually be considered as giving “informed consent” to their “use” of an ad-tech stack that often involves dozens of different legal entities and software components. ##### “why it is not a threat to privacy” The entire purpose of FLoC is to maximise profit for Google by minimising my privacy.
- 1vuio0pswjnm7 6y ago
  Agreed 100%. Only me, but I actually find the docs insulting for the reasons you stated.

krick 6y ago

As far as I'm concerned, it is just great that something made it for people to be "all up in arms about it". And "why" is not very important and neither is it surprising, really. I mean, how could have people been all up in arms about well-established technology all web is built upon, when 10 years ago google was, allegedly, "the good corporation", all people were like "I have nothing to hide", avoiding FB because of privacy concerns was just "being paranoid" and people telling stories confirmed by Snowden shortly after were "schizophrenic"? It is literally like 3-5 years (right before Cambridge Analytica scandal, I guess) since being "concerned" about your web-presence became somewhat mainstream. And FLoC is... well, it's new.

deleted 6y ago
[deleted]

swiley 6y ago

People don't want more things like 3rd party cookies.

slver 6y ago
The idea is that this is the bare minimum the industry needs in order to stop needing 3rd party cookies (and other tracking strategies). It's not pretty but on the other end... ads do serve a function. And not all ads are bad. The focus should be on getting rid of the scammy ones, and not tracking won't help much with that.
- freeone3000 6y ago
  Fuck the industry. The entire point is to get you to spend more money on stuff. I will do nothing to assist with the brainwashing of humanity, and will continually fight against it.
- om2 6y ago
  Tracking is used pervasively by the ad ecosystem today, but that doesn’t mean tracking is needed for ads to exist. Contextual ads are a thing. FLoC isn’t even replacing the most important use of tracking, which is measurement, not targeting.
- feanaro 6y ago
  I think a sufficiently large number of people is saying they effectively do not care about the surveillance-based ad industry and want it dismantled.
- millsmob 6y ago
  Ads serve capital, they do not serve me.

FuckButtons 6y ago

I think many people would disagree with the conclusion to your second paragraph. If you don’t take it as given that something must come and replace cookies then FLoC appears to be an attempt to rebuild that which was just cast into the bin of history.

freeone3000 6y ago

Third-party cookies can be blocked by technological means. Heck, cookies can be blocked. There's even a toggle in Chrome to disable them, no extension needed. And yet, here we are, attempting to preserve the bucketing of humanity despite what anybody using the browser actually wants.

feanaro 6y ago

I think the cause and effect is a bit mixed up in your reasoning. What's actually happening is threefold: 1. People are starting to get fed up with tracking of all kinds (including third-party cookies). This is happening gradually, but is increasing. A consequence of this can also be seen from the legal side in the form of GDPR. 2. Google sees the tides on tracking are turning and tries to preempt by proposing a superficially less problematic alternative (FLoC) that will be least detrimental to their tracking business. 3. People dislike FLoC because it is not sufficiently lessened in this new normal and is therefore also unacceptable.