6 ms·

I don't know how this shit works. But earlier this month I was showing my girlfriend a Halloween costume I googled on my phone. I visited the website for maybe

by extr 5y ago

I don't know how this shit works. But earlier this month I was showing my girlfriend a Halloween costume I googled on my phone. I visited the website for maybe 10 seconds, I did not log in or create an account. A few days later I got an email from PayPal offering me a $5 coupon for that website. WTFFFF. It made me want to go full-nuclear on the privacy front.

Fordec 5y ago
10 seconds is plenty of time to record IP addresses, do pixel tracking etc. Combine with data from a data broker and you probably have contact detail attribution. heck, the payment processor plugin probably on that costume's site that's all they needed considering the email came from Paypal, which I assume you have an account with. an IP address lookup table internal to Paypal would do it alone.
nerdponx 5y ago
Companies give Google and friends free unfettered access to your highly specific usage data that can be used to uniquely identify you, all without your consent or knowledge, and no way to opt out. In exchange, said companies get metrics on how well their ads are doing. It's ingenious. The incentives are set up entirely against you. The people who know and care the least about privacy decide what to do with your data, and they are enticed to hand it over by the promise of tracking ad spend, i.e. the promise of making their jobs easier and of making their success quantifiable.
- kangaroozach 5y ago
  How could this be combatted? I assume just through legislation and possibly some type of random audit or bounty system to catch violators? Or could it be beaten by high privacy browsers like Brave and a system of shuffling through and sharing random anonymous online identities with strangers like Tor does with IP? Just to confuse the hell out of the ad platforms… What would the legislation even be though?
  - yjftsjthsd-h 5y ago
    https://adnauseam.io/ https://adnauseam.io/ is meant to screw with data collection, albeit only at a personal level; one could imagine more sophisticated tools that did things like randomly run Google searches for arbitrary topics to confuse things further, but I'm not aware of any implementations
mgraczyk 5y ago
Serious question, why is this bad? As far as email advertisements go, is this worse than untargeted Viagra and porn? fyi I work at Google but not on Ads.
- firecall 5y ago
  Well, even if we cant describe why it is 'bad', we can observe that it is a form of anti-social behaviour by these companies. People don't like it - people don't like that form of targeting. It may not be clear why they have issues with it, but they do. At my kids school, if someone is repeatedly doing something to you that you don't like, then it is classed as a form of bullying.
  - mgraczyk 5y ago
    That's a good analogy, but it illustrates the problem. Just because you don't like something, does not by itself make it antisocial. If someone at your kid's school told you that the teacher repeatedly made them do homework, would that be bullying? Of course not. Just because some people don't like targeted ads does not make it antisocial. You just don't like it, which is fine. Don't read the email.
    - harryvederci 5y ago
      Yes. Ads good, privacy bad. Keep working at Google. By the way, I may or may not have placed a bunch of hidden cameras in your house. What's that, antisocial? No, no. I swear it's going to be convenient for you. You may get a disturbing email from a company I sell the footage to at some point, by the way. Just don't read that email, ok?
      - mgraczyk 5y ago
        This one is pretty easy though. Forget the camera, we have a pervasive norm that you can't be in my house without my permission. With or without cameras, you've violated the norm, and in this case also the law. I'm not arguing that all data collection is ok. I'm just arguing against the point that all data collection is not ok.
ssss11 5y ago
I’ve had this general experience many times. It’s so bad. How can they claim this tracking crap actually helps increase sales! It just infuriates people
- luckylion 5y ago
  It infuriates some people. Others will say "oh neat, I was thinking about buying a costume from that site and now I can save $5" and buy it. This stuff is done because it works.
  - TeMPOraL 5y ago
    Yeah, and some of those others will later discover they didn't actually save $5. > This stuff is done because it works. Yes. Annoying some people is only an externality. It's cheaper to apply those techniques to everyone, even if the actual target is a small subset of people vulnerable to being exploited. But, as always, just because you can, doesn't mean you should. Just because it works, doesn't mean it's right.
cm2012 5y ago
Likely a Gmail retargeting ad that looks like an email in the promotions tab
tsjq 5y ago
Obligatory. from 2012 "How Target Figured Out A Teen Girl Was Pregnant Before Her Father Did " https://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/ https://www.forbes.com/sites/kashmirhill/2012/02/16/how-targ...
pjmlp 5y ago
Just by accessing an Web site for the first time, it has access to all HTTP headers used to build all requests required for the page, your IP address and a couple of other metadata. That can be combined with other sources that the Web site vendors have contract with, including so called knowledge databases, that can correlate such information. People that keep arguing for native being less secure than Web, just because they can use telemetry, have no idea to what extent marketing engines are able to extract information from each HTTP request.
- 3r8Oltr0ziouVDM 5y ago
  As long as you don't have a unique IP address, this data doesn't seem enough to uniquely identify you. HTTP headers reveal your OS and browser, but not much more than that, and they should be mostly the same for all people with the same OS/browser.
  - pjmlp 5y ago
    Depends how much you interact with the site. Additionally, if you ever log in, correlation can be made with older stored logs, thus even if surf anonymously afterwards, the same IP range can be mapped to you, even if it isn't guaranteed to be correct.
3r8Oltr0ziouVDM 5y ago
But does your browser block third-party cookies? If it doesn't, then ad networks are able to easily track all your online activity and connect it to your identity because most of the websites on the web have tracking scripts like Google Analytics.

by extr 5y ago

Fordec 5y ago

10 seconds is plenty of time to record IP addresses, do pixel tracking etc. Combine with data from a data broker and you probably have contact detail attribution. heck, the payment processor plugin probably on that costume's site that's all they needed considering the email came from Paypal, which I assume you have an account with. an IP address lookup table internal to Paypal would do it alone.

nerdponx 5y ago

Companies give Google and friends free unfettered access to your highly specific usage data that can be used to uniquely identify you, all without your consent or knowledge, and no way to opt out. In exchange, said companies get metrics on how well their ads are doing. It's ingenious. The incentives are set up entirely against you. The people who know and care the least about privacy decide what to do with your data, and they are enticed to hand it over by the promise of tracking ad spend, i.e. the promise of making their jobs easier and of making their success quantifiable.

kangaroozach 5y ago
How could this be combatted? I assume just through legislation and possibly some type of random audit or bounty system to catch violators? Or could it be beaten by high privacy browsers like Brave and a system of shuffling through and sharing random anonymous online identities with strangers like Tor does with IP? Just to confuse the hell out of the ad platforms… What would the legislation even be though?
- yjftsjthsd-h 5y ago
  https://adnauseam.io/ https://adnauseam.io/ is meant to screw with data collection, albeit only at a personal level; one could imagine more sophisticated tools that did things like randomly run Google searches for arbitrary topics to confuse things further, but I'm not aware of any implementations

mgraczyk 5y ago

Serious question, why is this bad? As far as email advertisements go, is this worse than untargeted Viagra and porn? fyi I work at Google but not on Ads.

firecall 5y ago
Well, even if we cant describe why it is 'bad', we can observe that it is a form of anti-social behaviour by these companies. People don't like it - people don't like that form of targeting. It may not be clear why they have issues with it, but they do. At my kids school, if someone is repeatedly doing something to you that you don't like, then it is classed as a form of bullying.
- mgraczyk 5y ago
  That's a good analogy, but it illustrates the problem. Just because you don't like something, does not by itself make it antisocial. If someone at your kid's school told you that the teacher repeatedly made them do homework, would that be bullying? Of course not. Just because some people don't like targeted ads does not make it antisocial. You just don't like it, which is fine. Don't read the email.
  - harryvederci 5y ago
    Yes. Ads good, privacy bad. Keep working at Google. By the way, I may or may not have placed a bunch of hidden cameras in your house. What's that, antisocial? No, no. I swear it's going to be convenient for you. You may get a disturbing email from a company I sell the footage to at some point, by the way. Just don't read that email, ok?
    - mgraczyk 5y ago
      This one is pretty easy though. Forget the camera, we have a pervasive norm that you can't be in my house without my permission. With or without cameras, you've violated the norm, and in this case also the law. I'm not arguing that all data collection is ok. I'm just arguing against the point that all data collection is not ok.

ssss11 5y ago

I’ve had this general experience many times. It’s so bad. How can they claim this tracking crap actually helps increase sales! It just infuriates people

luckylion 5y ago
It infuriates some people. Others will say "oh neat, I was thinking about buying a costume from that site and now I can save $5" and buy it. This stuff is done because it works.
- TeMPOraL 5y ago
  Yeah, and some of those others will later discover they didn't actually save $5. > This stuff is done because it works. Yes. Annoying some people is only an externality. It's cheaper to apply those techniques to everyone, even if the actual target is a small subset of people vulnerable to being exploited. But, as always, just because you can, doesn't mean you should. Just because it works, doesn't mean it's right.

cm2012 5y ago

Likely a Gmail retargeting ad that looks like an email in the promotions tab

tsjq 5y ago

Obligatory. from 2012 "How Target Figured Out A Teen Girl Was Pregnant Before Her Father Did " https://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/ https://www.forbes.com/sites/kashmirhill/2012/02/16/how-targ...

pjmlp 5y ago

Just by accessing an Web site for the first time, it has access to all HTTP headers used to build all requests required for the page, your IP address and a couple of other metadata. That can be combined with other sources that the Web site vendors have contract with, including so called knowledge databases, that can correlate such information. People that keep arguing for native being less secure than Web, just because they can use telemetry, have no idea to what extent marketing engines are able to extract information from each HTTP request.

3r8Oltr0ziouVDM 5y ago
As long as you don't have a unique IP address, this data doesn't seem enough to uniquely identify you. HTTP headers reveal your OS and browser, but not much more than that, and they should be mostly the same for all people with the same OS/browser.
- pjmlp 5y ago
  Depends how much you interact with the site. Additionally, if you ever log in, correlation can be made with older stored logs, thus even if surf anonymously afterwards, the same IP range can be mapped to you, even if it isn't guaranteed to be correct.

3r8Oltr0ziouVDM 5y ago

But does your browser block third-party cookies? If it doesn't, then ad networks are able to easily track all your online activity and connect it to your identity because most of the websites on the web have tracking scripts like Google Analytics.