7 ms·

But this can't be, people assured me that FLoC was an improvement to privacy, and that it would provide an alternative to persistent identifiers and profiles, a

But this can't be, people assured me that FLoC was an improvement to privacy, and that it would provide an alternative to persistent identifiers and profiles, and that it would help end the arms race on fingerprinting. You mean to tell me that FLoC will be used for fingerprinting anyway, and it changes nothing about advertiser's strategies and tracking techniques, and they won't self-regulate, and that it doesn't work to throw them bones of extra data and hope that they'll willingly stop their abusive behavior if we meet them halfway? This is a shocking development. The only consolation is that Google's next privacy compromise with the ad industry definitely won't suffer from exactly the same problems. The best thing for us to do now is to assume that this is a completely random, one-time fluke that doesn't reflect anything on the industry's character. No need to change the way we engage with the advertising industry on privacy issues because of it. We should keep offering them compromises that make it easier for them to track users, and keep assuming that they'll in good faith regulate themselves.

______- 5y ago
> End the arms race on fingerprinting Google is known to fingerprint you on their sites[0] and this practice will continue unless some sort of political action is taken to make fingerprinting illegal. WebGL is not the only heuristic used to reliably determine it's a specific device accessing a site, but a whole slew of techniques can be used to reliably determine it is 'you' who is on a site (you can even detect if a browser is running in a virtual machine, among many other techniques to fingerprint). To mitigate this, I do most of my browsing with JS disabled by default, and if I really need JS turned on (for a site I trust like my bank), then I temporarily turn it on for that specific site. Also you can just disable WebGL in Firefox in about:config but keep in mind, there are many other techniques Google and `ADTech` in general can use to fingerprint you. [0] https://jonatron.github.io/webgl-fingerprinting/ https://jonatron.github.io/webgl-fingerprinting/
- jffry 5y ago
  Even the fact that WebGL is disabled contributes some entropy that can be used to identify you.
  - ______- 5y ago
    You can't detect if WebGL's turned on/off if JS is turned off. You need JS turned on to detect WebGL's presence
- approxim8ion 5y ago
  Google turn every result on their search result page into a tracking URL if you have JS disabled. The solution is to allow JavaScript and install the Google Search Link Fix add-on, until they break that too I guess. Or use another search engine.
- soared 5y ago
  Fingerprinting on your own sites is pointless since only third party cookies are being removed. First party cookies still work like normal.
  - tpxl 5y ago
    It gives you the ground truth with which you then correlate fingerprints from non-first-party domains.
  - tedivm 5y ago
    The whole point of it is to correlate it to other data using the same fingerprinting method. Google is often a first party and a third party, so they need a way to line all that data up.
- danShumway 5y ago
  This is a complete sidenote, but I don't understand why Firefox's Canvas controls don't affect WebGL. Firefox has per-site settings for whether the canvas should be accessible which are very useful, but they don't have per-site settings for WebGL, it's either on or off for the entire profile. Which kind of defeats the point of Canvas blocking since (at least last time I checked) WebGL fingerprinting is possible regardless of whether Canvas can be read from. I'm sure there's some technical reason, but it really seems like turning Canvas reads off for a site should also turn off WebGL.
  - cpeterso 5y ago
    Here is a Firefox bug report suggesting a per-site permission for WebGL: https://bugzilla.mozilla.org/show_bug.cgi?id=1694456 https://bugzilla.mozilla.org/show_bug.cgi?id=1694456 There's been no Mozilla comments on the bug yet. Perhaps so many sites use WebGL that the user would be pestered with too many permission prompts?
- lima 5y ago
  > Google is known to fingerprint you on their sites[0] To my understanding, Google (and many other sites) use WebGL and other fingerprinting techniques to distinguish real users from bots. This does not mean they use it to track individual users (if that were even legal in Europe under GDPR).
  - Nextgrid 5y ago
    Google's tracking consent flow is already in breach of the GDPR, so it's not a problem for them.
- hkai 5y ago
  Why do you want to disable it? Isn't it nice to see ads that are interesting and useful to you rather than looking at some useless ads you're not interested in?
  - chaosite 5y ago
    Seeing ads isn't nice.
  - Spivak 5y ago
    The issue is buried in the premise of the question. “If you’re going to see an ad regardless, would you rather it be relevant to you or not?” The answer is and always has been “I don’t want to see an ad in the first place, I don’t want you collecting any information about me under any circumstances, and anything that makes ads spots worth less is a positive.” You know the cheeky “you won’t see fewer ads, they’ll just be leas relevant” line? The only long term solution to actually see fewer ads is to drive their value down to nothing. The fact that you can pay to remove ads on a lot of services kinda gives the game away that they’re a net negative. Why would you ever want them gone if they’re so useful and helpful? AdTech is such a garbage industry — drunk on their own delusions of facilitating commerce and helping businesses reach customers while being so annoying and vile that the only way their products to function is to insert themselves into every facet of life because nobody would ever seek them out on their own. Bleh.
    - doomslice 5y ago
      There's two sides to the equation though (I work on Supply Side ad tech). There's a huge amount of content that people are just not willing to pay for, but would gladly view ads. You may be willing to pay for Youtube Premium and Twitch Plus or whatever, but the vast majority of people do not. Do I feel like I'm a horrible person because I help make websites more money so they can stay in business? Heck no. It's the only reason 90% of these sites are able to exist in the first place.
      - Spivak 5y ago
        I feel like gladly is overstating it a bit but I take your point. Users will put up with ads with a lot less resistance than a paywall. But that logic still doesn't really follow unless you think that businesses making money by literally any means they can get away with is an end unto itself. If you have a service like YouTube that provides so much value and is such an economic multuplier that we can't possibly imagine society existing without it then why don't we just pay for it? The fact that we have no system to fund public goods that aren't ads and taxes is a huge failing. You're basically just describing a tax system that is paid in consumerism which sucks because it's inherently regressive. If you have a product which is genuinely useful to hundreds of millions of people but that the value only materializes when it's available for 'free' to everyone then we should have ways of getting you funded that isn't attention or convincing individuals to pay you a subscription fee. You're hitting on an important economic function that ads are currently doing but then twisting it around and saying that there's possibility for anything but ads to perform that function.
- SiebenHeaven 5y ago
  Won't turning js off make you one of the few people in the world that do this and hence easier to fingerprint?
  - ______- 5y ago
    You're just added to a (very large pool) of people who browse with JS turned off. Turning JS off as a default is a common thing.
    - leesalminen 5y ago
      Amongst the top 1% of tech savvy users, maybe. In all my years of supporting 100,000s of “regular” users I’ve never encountered anyone with JS disabled.
  - 1vuio0pswjnm7 5y ago
    I have seen this type of reasoning before in HN comments but from a user's perspective it does not make sense. Imagine every user is sending a maximum amount of information, which we can see keeps increasing over time, via HTTP headers (including cookies), browser capabilities, hardware capabilities, etc. This "run with the herd" reasoning seems to suggest the best way to avoid fingerprinting is to send the maximum amount of information, "like everyone else". That only results in ever more information being sent to the online advertising industry. The probability they can distinguish one user fingerprint from another goes up as the amount of information sent increases. The objective of the online advertising services company is to gather as much information as possible from users. The objective for the user should be to send as little information as possible. If a fingerprint shows the user is not running JS and is providing only a very minimal, generic set of information, how much value is there is trying to serve ads to that user. Users who want better privacy should be trying to reduce the amount of information they send. Maybe the first movers in that effort are "fingerprinted" as being privacy-conscious, tech-savvy, etc. That is probably going to result in less ads served to them, not more. Eventually, when most users, "the herd", is sending the minimal amount of information, the fingerprints all look similar. Think it through. Advertisers do not care about users who will not indiscriminantly run JS. They go for the low-hanging fruit.
granzymes 5y ago
> people assured me that FLoC was an improvement to privacy It is an improvement to privacy. Cookies uniquely identify me with no other information required. FLoC does not uniquely identify me with no other information required. The opt-out is similar too: block cookies in the browser or block FLoC in the browser.
- CivBase 5y ago
  You're talking about FLoC as an alternative to third party cookies, but major browsers had already done away with those before the rollout of FLoC. If getting rid of third party cookies was two steps forward, FLoC is one step back. We're technically further ahead than where we started, but that certainly wasn't thanks to FLoC. Without it we'd be even further ahead, so that's what we should be advocating for.
  - judge2020 5y ago
    It was created so that well-behaved adtech companies could target based on FLOC alone, without having to resort to fingerprinting. Just as before, less-reputable adtech will continue to fingerprint to try to advertise to people with third party cookies turned off. As chrome continues to implement fingerprint resistance technologies, these techniques will continue to be less useful for people trying to advertise not based on FLOC alone. Basically, it’s a way for google to implement fingerprint resistance in chrome and default to blocking third party cookies without killing their own funding source.
    - DasIch 5y ago
      If you care about privacy, "well-behaved adtech companies" is an oxymoron.
    - thomasahle 5y ago
      > It was created so that well-behaved adtech companies could target based on FLOC alone, without having to resort to fingerprinting. I think this is a pretty good take. With floc there is a possible storry to tell companies that want to target/customize, but only in the amount tolerated by the users. Once thats established, it's much easier to go after shutting down businesses using less ethical means.
hkai 5y ago
As a solution, I propose a popup on each website that forces the user to accept FLoCs.
- function_seven 5y ago
  I have a suggestion to improve your idea: Allow the user to deny the FLoC if they wish, by redirecting them to a byzantine "Preferences" page with 2 dozen options to opt in or out of. Promise to apply the user's choices within 7 business days.
  - teeray 5y ago
    Bonus points if you make the preferences page a dungeon that users have to navigate with twisted meanings and options that work counter to the user's actual preferences.
    - Topgamer7 5y ago
      Critical hit if the preferences page has toggles that actually don't toggle, and just remain "on". This tracking data sent to a third part is certainly crucial in development of a website.
      - zeptonix 5y ago
        The preferences page itself should have a modal popup requiring the user to accept the website's terms prior to using the preferences page.
        zentiggr 5y ago
        And after going to the site, and being forced to toggle every opt-out option individually before saving... if you return to the site later none of your opt-outs are shown and you have to redo everything each time.
        5y ago

______- 5y ago

> End the arms race on fingerprinting Google is known to fingerprint you on their sites[0] and this practice will continue unless some sort of political action is taken to make fingerprinting illegal. WebGL is not the only heuristic used to reliably determine it's a specific device accessing a site, but a whole slew of techniques can be used to reliably determine it is 'you' who is on a site (you can even detect if a browser is running in a virtual machine, among many other techniques to fingerprint). To mitigate this, I do most of my browsing with JS disabled by default, and if I really need JS turned on (for a site I trust like my bank), then I temporarily turn it on for that specific site. Also you can just disable WebGL in Firefox in about:config but keep in mind, there are many other techniques Google and `ADTech` in general can use to fingerprint you. [0] https://jonatron.github.io/webgl-fingerprinting/ https://jonatron.github.io/webgl-fingerprinting/

jffry 5y ago
Even the fact that WebGL is disabled contributes some entropy that can be used to identify you.
- ______- 5y ago
  You can't detect if WebGL's turned on/off if JS is turned off. You need JS turned on to detect WebGL's presence
approxim8ion 5y ago
Google turn every result on their search result page into a tracking URL if you have JS disabled. The solution is to allow JavaScript and install the Google Search Link Fix add-on, until they break that too I guess. Or use another search engine.
soared 5y ago
Fingerprinting on your own sites is pointless since only third party cookies are being removed. First party cookies still work like normal.
- tpxl 5y ago
  It gives you the ground truth with which you then correlate fingerprints from non-first-party domains.
- tedivm 5y ago
  The whole point of it is to correlate it to other data using the same fingerprinting method. Google is often a first party and a third party, so they need a way to line all that data up.
danShumway 5y ago
This is a complete sidenote, but I don't understand why Firefox's Canvas controls don't affect WebGL. Firefox has per-site settings for whether the canvas should be accessible which are very useful, but they don't have per-site settings for WebGL, it's either on or off for the entire profile. Which kind of defeats the point of Canvas blocking since (at least last time I checked) WebGL fingerprinting is possible regardless of whether Canvas can be read from. I'm sure there's some technical reason, but it really seems like turning Canvas reads off for a site should also turn off WebGL.
- cpeterso 5y ago
  Here is a Firefox bug report suggesting a per-site permission for WebGL: https://bugzilla.mozilla.org/show_bug.cgi?id=1694456 https://bugzilla.mozilla.org/show_bug.cgi?id=1694456 There's been no Mozilla comments on the bug yet. Perhaps so many sites use WebGL that the user would be pestered with too many permission prompts?
lima 5y ago
> Google is known to fingerprint you on their sites[0] To my understanding, Google (and many other sites) use WebGL and other fingerprinting techniques to distinguish real users from bots. This does not mean they use it to track individual users (if that were even legal in Europe under GDPR).
- Nextgrid 5y ago
  Google's tracking consent flow is already in breach of the GDPR, so it's not a problem for them.
hkai 5y ago
Why do you want to disable it? Isn't it nice to see ads that are interesting and useful to you rather than looking at some useless ads you're not interested in?
- chaosite 5y ago
  Seeing ads isn't nice.
- Spivak 5y ago
  The issue is buried in the premise of the question. “If you’re going to see an ad regardless, would you rather it be relevant to you or not?” The answer is and always has been “I don’t want to see an ad in the first place, I don’t want you collecting any information about me under any circumstances, and anything that makes ads spots worth less is a positive.” You know the cheeky “you won’t see fewer ads, they’ll just be leas relevant” line? The only long term solution to actually see fewer ads is to drive their value down to nothing. The fact that you can pay to remove ads on a lot of services kinda gives the game away that they’re a net negative. Why would you ever want them gone if they’re so useful and helpful? AdTech is such a garbage industry — drunk on their own delusions of facilitating commerce and helping businesses reach customers while being so annoying and vile that the only way their products to function is to insert themselves into every facet of life because nobody would ever seek them out on their own. Bleh.
  - doomslice 5y ago
    There's two sides to the equation though (I work on Supply Side ad tech). There's a huge amount of content that people are just not willing to pay for, but would gladly view ads. You may be willing to pay for Youtube Premium and Twitch Plus or whatever, but the vast majority of people do not. Do I feel like I'm a horrible person because I help make websites more money so they can stay in business? Heck no. It's the only reason 90% of these sites are able to exist in the first place.
    - Spivak 5y ago
      I feel like gladly is overstating it a bit but I take your point. Users will put up with ads with a lot less resistance than a paywall. But that logic still doesn't really follow unless you think that businesses making money by literally any means they can get away with is an end unto itself. If you have a service like YouTube that provides so much value and is such an economic multuplier that we can't possibly imagine society existing without it then why don't we just pay for it? The fact that we have no system to fund public goods that aren't ads and taxes is a huge failing. You're basically just describing a tax system that is paid in consumerism which sucks because it's inherently regressive. If you have a product which is genuinely useful to hundreds of millions of people but that the value only materializes when it's available for 'free' to everyone then we should have ways of getting you funded that isn't attention or convincing individuals to pay you a subscription fee. You're hitting on an important economic function that ads are currently doing but then twisting it around and saying that there's possibility for anything but ads to perform that function.
SiebenHeaven 5y ago
Won't turning js off make you one of the few people in the world that do this and hence easier to fingerprint?
- ______- 5y ago
  You're just added to a (very large pool) of people who browse with JS turned off. Turning JS off as a default is a common thing.
  - leesalminen 5y ago
    Amongst the top 1% of tech savvy users, maybe. In all my years of supporting 100,000s of “regular” users I’ve never encountered anyone with JS disabled.
- 1vuio0pswjnm7 5y ago
  I have seen this type of reasoning before in HN comments but from a user's perspective it does not make sense. Imagine every user is sending a maximum amount of information, which we can see keeps increasing over time, via HTTP headers (including cookies), browser capabilities, hardware capabilities, etc. This "run with the herd" reasoning seems to suggest the best way to avoid fingerprinting is to send the maximum amount of information, "like everyone else". That only results in ever more information being sent to the online advertising industry. The probability they can distinguish one user fingerprint from another goes up as the amount of information sent increases. The objective of the online advertising services company is to gather as much information as possible from users. The objective for the user should be to send as little information as possible. If a fingerprint shows the user is not running JS and is providing only a very minimal, generic set of information, how much value is there is trying to serve ads to that user. Users who want better privacy should be trying to reduce the amount of information they send. Maybe the first movers in that effort are "fingerprinted" as being privacy-conscious, tech-savvy, etc. That is probably going to result in less ads served to them, not more. Eventually, when most users, "the herd", is sending the minimal amount of information, the fingerprints all look similar. Think it through. Advertisers do not care about users who will not indiscriminantly run JS. They go for the low-hanging fruit.

granzymes 5y ago

> people assured me that FLoC was an improvement to privacy It is an improvement to privacy. Cookies uniquely identify me with no other information required. FLoC does not uniquely identify me with no other information required. The opt-out is similar too: block cookies in the browser or block FLoC in the browser.

CivBase 5y ago
You're talking about FLoC as an alternative to third party cookies, but major browsers had already done away with those before the rollout of FLoC. If getting rid of third party cookies was two steps forward, FLoC is one step back. We're technically further ahead than where we started, but that certainly wasn't thanks to FLoC. Without it we'd be even further ahead, so that's what we should be advocating for.
- judge2020 5y ago
  It was created so that well-behaved adtech companies could target based on FLOC alone, without having to resort to fingerprinting. Just as before, less-reputable adtech will continue to fingerprint to try to advertise to people with third party cookies turned off. As chrome continues to implement fingerprint resistance technologies, these techniques will continue to be less useful for people trying to advertise not based on FLOC alone. Basically, it’s a way for google to implement fingerprint resistance in chrome and default to blocking third party cookies without killing their own funding source.
  - DasIch 5y ago
    If you care about privacy, "well-behaved adtech companies" is an oxymoron.
  - thomasahle 5y ago
    > It was created so that well-behaved adtech companies could target based on FLOC alone, without having to resort to fingerprinting. I think this is a pretty good take. With floc there is a possible storry to tell companies that want to target/customize, but only in the amount tolerated by the users. Once thats established, it's much easier to go after shutting down businesses using less ethical means.

hkai 5y ago

As a solution, I propose a popup on each website that forces the user to accept FLoCs.

function_seven 5y ago
I have a suggestion to improve your idea: Allow the user to deny the FLoC if they wish, by redirecting them to a byzantine "Preferences" page with 2 dozen options to opt in or out of. Promise to apply the user's choices within 7 business days.
- teeray 5y ago
  Bonus points if you make the preferences page a dungeon that users have to navigate with twisted meanings and options that work counter to the user's actual preferences.
  - Topgamer7 5y ago
    Critical hit if the preferences page has toggles that actually don't toggle, and just remain "on". This tracking data sent to a third part is certainly crucial in development of a website.
    - zeptonix 5y ago
      The preferences page itself should have a modal popup requiring the user to accept the website's terms prior to using the preferences page.
      - zentiggr 5y ago
        And after going to the site, and being forced to toggle every opt-out option individually before saving... if you return to the site later none of your opt-outs are shown and you have to redo everything each time.
        5y ago