4 ms·

As a non-English speaker, I find this pretty useless. I always want to get English version of any website, and not some poor translation, and honestly the finge

by mihaic 4y ago

As a non-English speaker, I find this pretty useless. I always want to get English version of any website, and not some poor translation, and honestly the fingerprinting entropy is negligible. This seems to be PR-driven development, just to score some points from the privacy aware community. Every time I see tech being proposed for privacy instead of legislation I wonder how the topic is kept so vague. There are a handful of companies that can track you across multiple websites, so any real solution has to start by enumerating and addressing those companies. It feels like were always discussing about curing "diseases" without explicitly saying that malaria, TB, etc are the targets.

jefftk 4y ago
> There are a handful of companies that can track you across multiple websites, so any real solution has to start by enumerating and addressing those companies. I think it's more like hundreds than handfuls. But they're all connecting your behavior across sites using the same few techniques: * Explicit methods: cookies, link decoration, and other browser-supported ways of adding entropy. Browsers are working on removing these, but if they move too aggressively here then adtech just moves to: * Fingerprinting: using existing browser entropy. Generally worse than explicit methods because the user doesn't have control (ex: shared fingerprint between successive private browsing sessions). Browsers are also working on reducing this, see the article, but it's very hard because the number of techniques is large and they generally use features users/sites depend on. * Timing attacks (pretty sure no one is doing this commercially yet) You might be interested in https://github.com/michaelkleber/privacy-model https://github.com/michaelkleber/privacy-model (Disclosure: I used to work on ads at Google)
- sam_lowry_ 4y ago
  I hope timing attacks will not be commercialized or we will see quite some performance degradation in Brave ;-)
- mihaic 4y ago
  > I think it's more like hundreds than handfuls. Could you be a bit more explicit here? I'd be curious how these entities coordinate themselves, since I don't have hundreds of cookies set by any website, so there must be few networks to correlate this data (FB, Google, some IAB groups, who else?). Going after those networks would seem like the obvious next step then. Thanks for the link. It seems like an honorable direction, but it's a bit nebulous on how browsers would be incentivized to implement with good intentions.
  - jefftk 4y ago
    > I don't have hundreds of cookies set by any website Are you sure? These are third-party cookies, and it's not easy to get a full list. One way to do it is to go to a major publisher (NYT, CNN, etc) with devtools open and networking enabled. Filter to third party requests and look for ones sending cookies. Trying this on the NYT front page I saw 3p requests with cookies to amazon-adsystem.com, doubleclick.net, prebid.media.net, rubiconproject.com, adnxs.com, 3lift.com, openx.net, google.com, scorecardresearch.com, casalemedia.com, pubmatic.com, bluekai.com, adsrvr.org, bing.com, twitter.com, everesttech.net, criteo.com, dotomi.com, bidswitch.net, mfadsrvr.com, agkn.com, pswec.com, adtdp.com, demdex.net, bidr.io, adition.com, brand-display.com, intentiq.com, w55c.net, pippio.com, rlcdn.com, and adsymptotic.com before I got bored and stopped counting. Some of these might not be for personalized advertising, but most of them look like it. > browsers would be incentivized to implement with good intentions. Browsers compete on privacy, and what they do is open source. So while their incentives aren't perfect, external groups (and competing browsers!) can help keep them honest by paying attention and calling attention to bad decisions. A great example of this was Mozilla's thorough and careful privacy analysis of FLoC (https://blog.mozilla.org/en/privacy-security/privacy-analysis-of-floc/ https://blog.mozilla.org/en/privacy-security/privacy-analysi...), and looking at Topics (https://github.com/patcg-individual-drafts/topics https://github.com/patcg-individual-drafts/topics) Chrome seems to have spent a lot of time addressing that feedback.
  - dtagames 4y ago
    The data from multiple sources is collected by aggregators. In theory, its "anonymous" because it doesn't have your name and address on it. But in reality it contains hundreds of data points including everything from your TV watching habits (from your smart TV and streaming services) to your credit card history (sold by the card companies and retailers) and much more. Customers who match the criteria selected by advertisers can be targeted for other ads -- on different websites, streaming channels, by mail, etc. So this is how advertisers have access to information about you which they, themselves, did not collect.
brokenkebab2 4y ago
Sometimes legal solutions is what you want, but... For starters, one can't legislate for the whole world. It means this kind of legislation will farther fragment the internet (unlike purely technical solutions). Legislation targeting particularly dynamic technical fields may not age well. Also, it is a product of various compromises which often produces a minefield of consequences.
- vman81 4y ago
  Counterpoint: https://en.wikipedia.org/wiki/Brussels_effect https://en.wikipedia.org/wiki/Brussels_effect If a market like the EU requires you to set-up specific capabilities to be GDPR compliant, like data export and opt-in flows for cookies, it is often cheaper just to treat everyone like EU citizens instead of trying to differentiate. Or, at least to build those capabilities to be able to use them where relevant. So while the EU can't make Apple use USB-C on all the products they sell around the world, they CAN make the alternative (having dual models for EU and other markets) undesirable.
  - brokenkebab2 4y ago
    I see what you mean, but I don't think GDPR is really a valid example, because data-protection became at that moment a global concern, so quite a lot of companies were ready for it, there was an expectation that many jurisdictions will folow the suit anyway, and generally it wouldn't be bon ton to resist it. There are lots of very visible cases when it doesn't work like that: search, app markets, availability of news sources, medical information - what you see is dependent on your location, and sometimes even on your passport color, and as I see it it's more often restricting you as a user, than protecting.
  - zarzavat 4y ago
    Apple previously made a dual SIM iPhone for the Chinese market. Depending on the regulation that eventually gets enacted, they will either make a port-less iPhone and force wireless charging, or make a special USB-C iPhone for the EU market.
    - 4y ago

by mihaic 4y ago

jefftk 4y ago

> There are a handful of companies that can track you across multiple websites, so any real solution has to start by enumerating and addressing those companies. I think it's more like hundreds than handfuls. But they're all connecting your behavior across sites using the same few techniques: * Explicit methods: cookies, link decoration, and other browser-supported ways of adding entropy. Browsers are working on removing these, but if they move too aggressively here then adtech just moves to: * Fingerprinting: using existing browser entropy. Generally worse than explicit methods because the user doesn't have control (ex: shared fingerprint between successive private browsing sessions). Browsers are also working on reducing this, see the article, but it's very hard because the number of techniques is large and they generally use features users/sites depend on. * Timing attacks (pretty sure no one is doing this commercially yet) You might be interested in https://github.com/michaelkleber/privacy-model https://github.com/michaelkleber/privacy-model (Disclosure: I used to work on ads at Google)

sam_lowry_ 4y ago
I hope timing attacks will not be commercialized or we will see quite some performance degradation in Brave ;-)
mihaic 4y ago
> I think it's more like hundreds than handfuls. Could you be a bit more explicit here? I'd be curious how these entities coordinate themselves, since I don't have hundreds of cookies set by any website, so there must be few networks to correlate this data (FB, Google, some IAB groups, who else?). Going after those networks would seem like the obvious next step then. Thanks for the link. It seems like an honorable direction, but it's a bit nebulous on how browsers would be incentivized to implement with good intentions.
- jefftk 4y ago
  > I don't have hundreds of cookies set by any website Are you sure? These are third-party cookies, and it's not easy to get a full list. One way to do it is to go to a major publisher (NYT, CNN, etc) with devtools open and networking enabled. Filter to third party requests and look for ones sending cookies. Trying this on the NYT front page I saw 3p requests with cookies to amazon-adsystem.com, doubleclick.net, prebid.media.net, rubiconproject.com, adnxs.com, 3lift.com, openx.net, google.com, scorecardresearch.com, casalemedia.com, pubmatic.com, bluekai.com, adsrvr.org, bing.com, twitter.com, everesttech.net, criteo.com, dotomi.com, bidswitch.net, mfadsrvr.com, agkn.com, pswec.com, adtdp.com, demdex.net, bidr.io, adition.com, brand-display.com, intentiq.com, w55c.net, pippio.com, rlcdn.com, and adsymptotic.com before I got bored and stopped counting. Some of these might not be for personalized advertising, but most of them look like it. > browsers would be incentivized to implement with good intentions. Browsers compete on privacy, and what they do is open source. So while their incentives aren't perfect, external groups (and competing browsers!) can help keep them honest by paying attention and calling attention to bad decisions. A great example of this was Mozilla's thorough and careful privacy analysis of FLoC (https://blog.mozilla.org/en/privacy-security/privacy-analysis-of-floc/ https://blog.mozilla.org/en/privacy-security/privacy-analysi...), and looking at Topics (https://github.com/patcg-individual-drafts/topics https://github.com/patcg-individual-drafts/topics) Chrome seems to have spent a lot of time addressing that feedback.
- dtagames 4y ago
  The data from multiple sources is collected by aggregators. In theory, its "anonymous" because it doesn't have your name and address on it. But in reality it contains hundreds of data points including everything from your TV watching habits (from your smart TV and streaming services) to your credit card history (sold by the card companies and retailers) and much more. Customers who match the criteria selected by advertisers can be targeted for other ads -- on different websites, streaming channels, by mail, etc. So this is how advertisers have access to information about you which they, themselves, did not collect.

brokenkebab2 4y ago

Sometimes legal solutions is what you want, but... For starters, one can't legislate for the whole world. It means this kind of legislation will farther fragment the internet (unlike purely technical solutions). Legislation targeting particularly dynamic technical fields may not age well. Also, it is a product of various compromises which often produces a minefield of consequences.

vman81 4y ago
Counterpoint: https://en.wikipedia.org/wiki/Brussels_effect https://en.wikipedia.org/wiki/Brussels_effect If a market like the EU requires you to set-up specific capabilities to be GDPR compliant, like data export and opt-in flows for cookies, it is often cheaper just to treat everyone like EU citizens instead of trying to differentiate. Or, at least to build those capabilities to be able to use them where relevant. So while the EU can't make Apple use USB-C on all the products they sell around the world, they CAN make the alternative (having dual models for EU and other markets) undesirable.
- brokenkebab2 4y ago
  I see what you mean, but I don't think GDPR is really a valid example, because data-protection became at that moment a global concern, so quite a lot of companies were ready for it, there was an expectation that many jurisdictions will folow the suit anyway, and generally it wouldn't be bon ton to resist it. There are lots of very visible cases when it doesn't work like that: search, app markets, availability of news sources, medical information - what you see is dependent on your location, and sometimes even on your passport color, and as I see it it's more often restricting you as a user, than protecting.
- zarzavat 4y ago
  Apple previously made a dual SIM iPhone for the Chinese market. Depending on the regulation that eventually gets enacted, they will either make a port-less iPhone and force wireless charging, or make a special USB-C iPhone for the EU market.
  - 4y ago