3 ms·

I didn’t understand that the browser would make FLOC cohorts directly available to anyone running JavaScript in my browser. Unless Google also solves fingerprin

I didn’t understand that the browser would make FLOC cohorts directly available to anyone running JavaScript in my browser. Unless Google also solves fingerprinting (not to mention that I identify myself on many websites), I’m not sure I understand how this is viable. It seems even worse than the old criticism that Google was selling my data. It never did that, but now it’s giving away my data for free!

vineyardmike 5y ago
> it’s giving away my data for free It shows that google no longer things owning data is a competitive advantage. This seems like it should be bigger news.
jefftk 5y ago
> Unless Google also solves fingerprinting FLoC is one of a collection of proposals, which does include preventing fingerprinting: https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb... If you're not going to prevent fingerprinting, why even get rid of third-party cookies? Fingerprinting is a step backwards from cookies, since, for example, closing and reopening a private browsing window gives you a new cookie jar but the same fingerprint. (Disclosure: I work for Google, speaking only for myself)
- shuckles 5y ago
  Interesting. The next question is how you inform the user that by identifying yourself to a website, you are also associating all your FLOC interests with your identity, which you may or may not care to do. That used to be a question between you and Google, but now it’s between you and every website that has your identity. That sounds exhausting. I’m skeptical that fingerprinting can be “solved”, but let’s suspended disbelief.
  - danShumway 5y ago
    +1 to an answer for this, it's a good question. Let's say fingerprinting is completely solved. The browser's still going to be sending your FLoC data to Facebook/Reddit/Twitter/Amazon when you log in -- and it's not clear you'll even be able to tell what information that FLoC payload reveals about you. Solving fingerprinting is one thing, but there are a ton of situations online where users will be revealing their real identity to service providers, regardless of the fingerprinting protections. What FLoC data will be sent to those providers?
- danShumway 5y ago
  > If you're not going to prevent fingerprinting, why even get rid of third-party cookies? FLoC greatly increases the potential abuses that can come from fingerprinting, particularly from smaller sites. So is Google committed to completely eliminating fingerprinting from the browser before it launches FLoC? Because it would really stink for everyone if the privacy sandbox doesn't completely block fingerprinting, and then the sites that manage to fingerprint users suddenly have a huge amount of extra data about them. What will happen if the privacy sandbox comes out and people are still fingerprinting through other invasive means, or if a hard-to-fix exploit is found, or if a research paper demonstrates that the privacy sandbox is insufficient? Will Google commit to disabling FLoC if that happens?

vineyardmike 5y ago

> it’s giving away my data for free It shows that google no longer things owning data is a competitive advantage. This seems like it should be bigger news.

jefftk 5y ago

> Unless Google also solves fingerprinting FLoC is one of a collection of proposals, which does include preventing fingerprinting: https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb... If you're not going to prevent fingerprinting, why even get rid of third-party cookies? Fingerprinting is a step backwards from cookies, since, for example, closing and reopening a private browsing window gives you a new cookie jar but the same fingerprint. (Disclosure: I work for Google, speaking only for myself)

shuckles 5y ago
Interesting. The next question is how you inform the user that by identifying yourself to a website, you are also associating all your FLOC interests with your identity, which you may or may not care to do. That used to be a question between you and Google, but now it’s between you and every website that has your identity. That sounds exhausting. I’m skeptical that fingerprinting can be “solved”, but let’s suspended disbelief.
- danShumway 5y ago
  +1 to an answer for this, it's a good question. Let's say fingerprinting is completely solved. The browser's still going to be sending your FLoC data to Facebook/Reddit/Twitter/Amazon when you log in -- and it's not clear you'll even be able to tell what information that FLoC payload reveals about you. Solving fingerprinting is one thing, but there are a ton of situations online where users will be revealing their real identity to service providers, regardless of the fingerprinting protections. What FLoC data will be sent to those providers?
danShumway 5y ago
> If you're not going to prevent fingerprinting, why even get rid of third-party cookies? FLoC greatly increases the potential abuses that can come from fingerprinting, particularly from smaller sites. So is Google committed to completely eliminating fingerprinting from the browser before it launches FLoC? Because it would really stink for everyone if the privacy sandbox doesn't completely block fingerprinting, and then the sites that manage to fingerprint users suddenly have a huge amount of extra data about them. What will happen if the privacy sandbox comes out and people are still fingerprinting through other invasive means, or if a hard-to-fix exploit is found, or if a research paper demonstrates that the privacy sandbox is insufficient? Will Google commit to disabling FLoC if that happens?