4 ms·

> Wikipedia does not need to take any action to disable FLoC [...] If you call document.interestCohort() to get a FLoC id for a user It is still a problem for

by cesarb 6y ago

> Wikipedia does not need to take any action to disable FLoC [...] If you call document.interestCohort() to get a FLoC id for a user It is still a problem for Wikipedia, because the global Javascript for each language is editable by a subset of the editors for that language (https://en.wikipedia.org/wiki/MediaWiki:Common.js https://en.wikipedia.org/wiki/MediaWiki:Common.js for instance), unlike the HTTP headers which can only be changed by the Wikimedia sysadmins.

jefftk 6y ago
If someone can execute arbitrary JS they can already exfiltrate any information they want with userid attached, in addition to impersonating users etc. This is a far bigger risk than that they might add a call to document.interestCohort() and opt that page into FLoC?
- vineyardmike 6y ago
  Does Google Analytics do this?
  - jefftk 6y ago
    Sorry, what are you asking?
    - vineyardmike 6y ago
      Google Analytics is arbitrary JS and JS can turn on floc... so using GA is a potential point to add you to floc. Obviously its probably a small overlap of "doesn't trust floc" and "still trusts GA" but still a Trojan horse. PS. Wow kudos for being so responsive, especially/despite less than stellar comments regarding your openness about working for G-Ads.
      - jefftk 6y ago
        It doesn't look like Google Analytics does this today: $ curl -sS https://www.google-analytics.com/analytics.js \ | grep interestCohort [no results] On the other hand, I could imagine them or other analytics services adding it since sites installing analytics services generally want to be able to slice their traffic by as many dimensions as possible. I would hope that any service considering reading FLoC implements it as opt-in, however, since sites probably didn't consider whether their pages are sensitive in choosing whether to add analytics (though perhaps they should have!) (Still speaking only for myself)

by cesarb 6y ago

jefftk 6y ago

If someone can execute arbitrary JS they can already exfiltrate any information they want with userid attached, in addition to impersonating users etc. This is a far bigger risk than that they might add a call to document.interestCohort() and opt that page into FLoC?

vineyardmike 6y ago
Does Google Analytics do this?
- jefftk 6y ago
  Sorry, what are you asking?
  - vineyardmike 6y ago
    Google Analytics is arbitrary JS and JS can turn on floc... so using GA is a potential point to add you to floc. Obviously its probably a small overlap of "doesn't trust floc" and "still trusts GA" but still a Trojan horse. PS. Wow kudos for being so responsive, especially/despite less than stellar comments regarding your openness about working for G-Ads.
    - jefftk 6y ago
      It doesn't look like Google Analytics does this today: $ curl -sS https://www.google-analytics.com/analytics.js \ | grep interestCohort [no results] On the other hand, I could imagine them or other analytics services adding it since sites installing analytics services generally want to be able to slice their traffic by as many dimensions as possible. I would hope that any service considering reading FLoC implements it as opt-in, however, since sites probably didn't consider whether their pages are sensitive in choosing whether to add analytics (though perhaps they should have!) (Still speaking only for myself)