8 ms·

Ad tech firms test ways to connect Google’s FLoC to other data

327 points by EdwinHoksberg 5y ago

mavhc 5y ago
The article says they "could" do it, not that they are. "New thing not perfect!"
- wccrawford 5y ago
  No, the article says they are doing it. > As privacy and data ethics advocates warned, companies are starting to combine FLoC IDs with existing identifiable profile information, linking unique insights about people’s digital travels to what they already know about them, even before third-party cookie tracking could have revealed it. and > Advertising companies are already strategically gathering FLoC IDs and linking them to identifiable data or analyzing them in an attempt to uncover information about people that may not have been known before, mimicking how they have parsed what third-party cookies told them about people’s behaviors.
  - mavhc 5y ago
    "starting to" "in an attempt to" I see the submitted title has been altered anyway.
- yosamino 5y ago
  More like "New thing works exactly as .... advertized" There is a fundamental tension between me wanting to walk around the world as a free human individuum and a large group of people who for some reason or another want to know exactly what kind of fart I prefer so that they may match me with the correct kind of fart-cushion so that I might buy it. The idea that I might not want to have a fart cusion in the first place, and If I fancied the idea of getting one, I might go to the fart cusion store to find the perfect fart cushion does not seem to occur to these people - I am sure technically they have thought of the possibility, but they do not respect me or my boundaries. What this "new thing" does, is manage my suspected fart-cusion preferences inside my browser, instead of some "cloud" to then tell fart-cusion-selling-enthusiasts that indeed, I might be one of these people with an interest in fart-cusions. This "new thing" doesn't change anything about the fundamental issue that my thoughts and aspirations as a fart enthusiast are not the business of any moron who want's to market their newest fart-cushion invention to me.
  - ChrisMarshallNY 5y ago
    I just had to give you a +1 for that. Don't forget that there are people who want to find out if you are a fart enthusiast, so they can then use that to coerce you into "playing ball" with them. Sort of the digital equivalent of the "$5 wrench[0]." Social media and adtech have been a freaking goldmine for spies. [0] http://imgs.xkcd.com/comics/security.png http://imgs.xkcd.com/comics/security.png
newMediaMogul 5y ago
> presented by Liveramp
- deleted 5y ago
  [deleted]
- SwankyHank 5y ago
  Sorry, what is this referring to?
randomperson_24 5y ago
Why is it that all anti-Google posts just approach the first place on HN in such a short amount of time.
- Black101 5y ago
  36 points in 15 minutes is probably why... I have often noticed that the mods alter the ranking of posts, but I don't think that they did in this case (they admitted doing it in some cases). The content on HN is very much curated/controlled.
- canadianfella 5y ago
  Many people don’t like being spied on.
- Ensorceled 5y ago
  Advertising and privacy issues shoot to the top; whether Google, Apple, Facebook, what have you. Why do anti-google articles always have some one claiming unfairness or singling out as one of the first comments?
- ehnto 5y ago
  It's not anti-google, it's against a thing Google happens to be doing. Google holds an incredibly powerful position on the internet, so when they do something that could be bad it affects a lot of people. In this case, you could argue it affects pretty much everyone who uses the internet. You don't get to be the biggest entity on the internet and keep the cutesy hacker facade, they've got an enormous responsibility to the community now.
  - mavhc 5y ago
    Also sensationalist posts get more attention than nuanced non biased posts
- tjpnz 5y ago
  Same can be said for all manner of Google related posts. Not all of them are necessarily negative.
samizdis 5y ago
The EFF launched its site Am I FLoCed? [1] on April 9 for Chrome browser users to check whether they've been recruited/co-opted into Google's FLoC testing programme, started in March. Not sure how it works, but the EFF doesn't seem totally confident that it can detect those affected: "This page will try to detect whether you've been made a guinea pig in Google's ad-tech experiment." [1] https://amifloced.org/ https://amifloced.org/
- NilsIRL 5y ago
  FLoC has a well defined API like (all) standards: https://wicg.github.io/floc/ https://wicg.github.io/floc/ There's no reason why the website would not be reliable at detecting whether FLoC is enabled on your browser. You can also used https://floc.glitch.me/ https://floc.glitch.me/ which was linked in one of the blog posts from google.
  - stefan_ 5y ago
    In the sense that you can call "side channel for ill-specified data Google wants to leak" an "API".
FranchuFranchu 5y ago
> Nonetheless, the ad industry — which co-opted foundational internet technologies like the cookie and the IP address into means of identifying people online How can you have an Internet without using IP addresses? Do you just use Onion routing all the time?
- Ensorceled 5y ago
  You can't. That's why IP addresses are a "foundational internet technology".
  - deleted 5y ago
    [deleted]
- eli 5y ago
  Isn’t using Onion routing pretty much what Apple is proposing?
  - tgragnato 5y ago
    There are big differences. Private relay is secure as long as Apple and the third party do not cooperate, but end to end flow correlation is much easier because streams are not isolated. Onion routing is much more sophisticated than private relay: even end to end correlation is more difficult because of how virtual circuits are made.
- AndrewDucker 5y ago
  IP addresses identify computers. They only identify people when joined with other information.
- simias 5y ago
  VPNs (aka proxies) can also help. I think most ISPs (at least where I live) also use dynamic IPs which reduces the utility if IP for tracking somewhat. I think cookie + browser fingerprinting is a much better way to track people in this situation, because it removes the uncertainty associated with dynamic IPs and multiple users behind a NAT.
BeniBoy 5y ago
I might be missing something, but wasn't it part of the plan? Of course the goal was to offload the actual interpretation of the FLoC id to third-parties, as FLoC id themselves do not have any semantic signification. Not saying this is ok, but this was the plan from the beginning, being able to offload responsability far from Google. This article[1] actually shows what it's like for an advertiser. [1] :https://cafemedia.com/early-status-of-the-floc-origin-trials/ https://cafemedia.com/early-status-of-the-floc-origin-trials... EDIT: Did not finished the article before posting, they actually talk about cafemedia's work.
- Procedural 5y ago
  Yes, that was part of the plan.
- choppaface 5y ago
  Part of the plan but not part of Google’s consumer-oriented hype for it. Google has intentionally declined to state the fingerprint-joining and dollar impact to third parties because it would detract from the (already specious) message that FLoC improves privacy. Perhaps during some anti-trust hearings in the future we’ll see internal emails that detail how much $$ Google estimated that FLoC would take away from other advertisers as a function of what level of fingerprint joining they succeed at. FLoC is NOT proven to be incentive-compatible with consumers and how they value their privacy. The only guarantee is that users are (on average) harder to distinguish within a cohort. Google absolutely studied the possible economic consequences of FLoC prior to announcement and they are hiding that study. Either because the results are crappy, the Google Ads employees are less competent than they were a decade ago, or both.
  - Karrot_Kream 5y ago
    > FLoC is NOT proven to be incentive-compatible with consumers and how they value their privacy. The only guarantee is that users are (on average) harder to distinguish within a cohort. Google absolutely studied the possible economic consequences of FLoC prior to announcement and they are hiding that study. Either because the results are crappy, the Google Ads employees are less competent than they were a decade ago, or both. Could you walk through your ideas of the incentives here? I'm curious because while I like the idea of FLoC in general, Google is the last company I trust with this. Moreover there are a lot of details (such as cohort sizes) that could have the potential to mask identity and align incentives, but has been underspecified by Google so far.
gerbler 5y ago
> However, it is likely that the same FLoC IDs or range of IDs will be associated with someone. This seems all quite speculative. In the first paragraph they describe FLoc IDs as changing constantly - why would they assume new IDs are not being generated, and groups are not constantly being mixed?
- EMM_386 5y ago
  Further down it quotes ... > “If your behavior doesn’t change, the algorithm will keep assigning you in that same cohort, so some users will have a persistent FLoC ID associated with them — or could." When combined with other information that is already being used (such as canvas fingerprinting and other techniques), this looks like it can help narrow it down even further. > “We can use that as another signal to create a stable identifier for them.”
  - 3np 5y ago
    Arguably for advertisers it’s a benefit - if your behavior changes to that extent, likely you’d be better targeted by different ads.
    - twobitshifter 5y ago
      Right and floc was made for advertisers. They’re the customers here.
- hluska 5y ago
  It’s extremely speculative. While I’m allergic to ad tech, I’m even more allergic to poverty, so I have occasion to work with/around that side of the industry. The best way to explain it is that a lot of companies have been making significantly more money than their technology is worth. A number of initiatives have attacked the data-in side of the equation so the underlying tech is showing how questionable it really is. This type of research should be filed under “could be big” but at this point it’s closer to public relations for ad tech firms than “the sky is falling, become Amish.”
ece 5y ago
Honestly, who asked for FLoC and the MS alternative (edit: it's PARAKEET)? Why can't ad servers just follow my Do Not Track preferences? Serve me a random ad, or a context based ad if I have Do Not Track set... seems a lot simpler no? Those using ad-blockers are going to use them anyway, but some assurance that I won't be tracked would go a long way towards me turning off ad-blockers on the sites I don't frequent, and even those that I do if they don't have a ad-free subscription. Those wanting personalized ads, can set the Do Not Track preferences accordingly, possibly by site.
- mavhc 5y ago
  Do Not Track failed because a) the worst sites would just ignore it and b) Microsoft tried to use it as a weapon against Google by setting it as default
  - hypertele-Xii 5y ago
    Do Not Track failed because nothing actually enforced companies to respect it. It has to be law for any effect.
  - danShumway 5y ago
    Obligatory "Microsoft Did Nothing Wrong" post: Too busy to do a long post in detail, but short version is that advertiser's acceptance of DNT was entirely dependent on people not using it. If Microsoft had left it as opt-in but the majority of consumers had turned it on, we would have seen the same result. You can see the same principle to explain the response to iOS's privacy changes, which are not opt-in or opt-out; they force the user to make a choice. The ad industry is still furious about this. DNT could have only worked if no one used it, and that is not a privacy outcome that is worth pursuing or advocating for. It's not Microsoft's fault that DNT went away, Microsoft was just the excuse the advertising industry needed to avoid it. I don't think that DNT was ever anything other than an excuse the industry could use to keep tracking people and avoid legislation without changing anything. Microsoft didn't take it away from you, they just pulled back the curtain and showed you the truth about it. A privacy standard that fails as soon as it's turned on by default is almost worthless and it really shouldn't be advocated for in the first place. - https://news.ycombinator.com/item?id=26821972 https://news.ycombinator.com/item?id=26821972 - https://news.ycombinator.com/item?id=24294280 https://news.ycombinator.com/item?id=24294280 - https://news.ycombinator.com/item?id=24289186 https://news.ycombinator.com/item?id=24289186 - https://news.ycombinator.com/item?id=19483149 https://news.ycombinator.com/item?id=19483149
moomin 5y ago
No-one could have predicted this, he said with his eyes rolling back in his sockets.
pmurt7 5y ago
We need to collectively switch to Firefox and Brave.
- gigatexal 5y ago
  Been on FF for a few years now. FF89 is really nice.
- dvfjsdhgfv 5y ago
  I finally made the total switch to FF last year and it's fine; the stuff got imported from Chrome correctly. Containers are a good bonus. I keep a copy of Chrome at hand but I used it maybe once a month or two to test some random website, that's all. There is no single reason to remain on Chrome for me, I just regret it took me so long. No crashes, no noticeable performance differences, no quirks. I'm very grateful Firefox exists.
  - sixothree 5y ago
    Edge is a good alternative when you _need_ a chrome browser.
- ahmedalsudani 5y ago
  Correction: they never injected ads, but they do remove ads and replace them with "attention tokens", which is an opt-out system for publishers. See also https://tech.hindustantimes.com/tech/news/this-popular-browser-caught-injecting-affiliate-codes-in-crypto-urls-71591610043600.html https://tech.hindustantimes.com/tech/news/this-popular-brows.... In short, please look into the questionable aspects of Brave. Brave is perhaps the most ethically challenged browser out there. Hopefully they have stopped doing this, but they were injecting their own ads instead of what the publisher put on their website.
  - 3np 5y ago
    They never injected ads. If you enable Brave Rewards, you do get notification/pop over ads and rewarded a small amount of BAT, which can get redistributed to content creators or sites. If you don’t , all this is disabled.
colesantiago 5y ago
All Ad tech, spyware, and data collection firms/startups (and even startups collecting any PII data) with little care for the GDPR or the CCPA are extremely evil. No regards for privacy at all, this rampant data harvesting and spying must stop now.
deleted 5y ago
[deleted]
pengwing 5y ago
Oh, no! This means I might still get relevant ads that relate to my unique interests as an individual instead of some least common denominator cookie cutter garbage ad.
- Rygian 5y ago
  Personally, I prefer my ads to be as unrelated as possible to my unique interests. That way I can ignore the unwanted distraction more easily, or even be amused by it. Every time I see an ad that relates to my current unique interests I feel spied upon and concerned that my private life is leaking without my knowledge or control.
- beervirus 5y ago
  I personally love having my personal information taken without my permission, by code running on my device and wasting my battery, so that some company can show me ads I’m never going to click on.
- drcongo 5y ago
  This post is staggeringly under-informed. Just wait until you google for some ailment and your life insurance premium magically goes up.
magwa101 5y ago
"Only we have valuable specific timely data to accurately link it to the users general interests via the FLOC ID which is a gradual, general indication of users interests. This is how you beat your competitors." "Better than retargeting?" "For sure, because general interests combined with accuracy will bring the best performance." "Reup me please."
danShumway 5y ago
But this can't be, people assured me that FLoC was an improvement to privacy, and that it would provide an alternative to persistent identifiers and profiles, and that it would help end the arms race on fingerprinting. You mean to tell me that FLoC will be used for fingerprinting anyway, and it changes nothing about advertiser's strategies and tracking techniques, and they won't self-regulate, and that it doesn't work to throw them bones of extra data and hope that they'll willingly stop their abusive behavior if we meet them halfway? This is a shocking development. The only consolation is that Google's next privacy compromise with the ad industry definitely won't suffer from exactly the same problems. The best thing for us to do now is to assume that this is a completely random, one-time fluke that doesn't reflect anything on the industry's character. No need to change the way we engage with the advertising industry on privacy issues because of it. We should keep offering them compromises that make it easier for them to track users, and keep assuming that they'll in good faith regulate themselves.
- ______- 5y ago
  > End the arms race on fingerprinting Google is known to fingerprint you on their sites[0] and this practice will continue unless some sort of political action is taken to make fingerprinting illegal. WebGL is not the only heuristic used to reliably determine it's a specific device accessing a site, but a whole slew of techniques can be used to reliably determine it is 'you' who is on a site (you can even detect if a browser is running in a virtual machine, among many other techniques to fingerprint). To mitigate this, I do most of my browsing with JS disabled by default, and if I really need JS turned on (for a site I trust like my bank), then I temporarily turn it on for that specific site. Also you can just disable WebGL in Firefox in about:config but keep in mind, there are many other techniques Google and `ADTech` in general can use to fingerprint you. [0] https://jonatron.github.io/webgl-fingerprinting/ https://jonatron.github.io/webgl-fingerprinting/
  - jffry 5y ago
    Even the fact that WebGL is disabled contributes some entropy that can be used to identify you.
OhNoMyqueen 5y ago
This is exactly how FLoC is supposed to work, and this is exactly what privacy watchdogs have criticized about it. The proper headline should be "Ad tech films test FLoC".
twox2 5y ago
Am I missing something? Wasn't this the pitch for floc from day one?
dmarti 5y ago
FLoC as a source of fingerprinting bits has been an issue in W3C discussions of the project. https://github.com/WICG/floc/issues/69 https://github.com/WICG/floc/issues/69 As a fingerprinting surface FLoC has similar properties to the Battery Status API -- not stable for the same user over long intervals, but can be used to help match pageviews from different domains that were close in time. https://www.schneier.com/blog/archives/2016/11/firefox_removin.html https://www.schneier.com/blog/archives/2016/11/firefox_remov...
- Uristqwerty 5y ago
  Imagine sites like facebook, reddit, and google themselves who have more monthly users than the FLoC ID has bits to count. Imagine they store each result for a given user, and assume that, with high probability, when that value changes it is fairly adjacent to the old value. Now, you build a graph database of IDs and their relations. Finally, you link it all to users' profile metadata. You can build statistical distributions around each ID node based on users' gender, race, family status, interests, etc. and use those probabilities to guess at the precise interests of each new and unknown visitor. Also, those sites have a lot of outbound links. Now you can figure out that a particular ID has a high correlation with a particular domain, too. But only the big sites like google have enough users to birthday-paradox their way into a meaningful ID graph, so you're safe from that tiny ad startup that also happens to be threatening google's business model...
  - morelisp 5y ago
    Google, Reddit, and Facebook also have sufficient first-party traffic to just gather data, target, and sell ads the "old-fashioned" way. The independent and small sell-side is also hit hard by this.
tyingq 5y ago
I'm hoping for a sort of community revolt where most popular pieces of software that serve http, and most popular websites send back the "Permissions-Policy: interest-cohort=()" header as a default setting. I know Github did this, hoping others will follow.
- whoopdedo 5y ago
  Does that really do anything? The entire Permissions-Policy header confuses me. Isn't that telling the browser to lock the FLoC API for that domain. So no resources loaded from github.com won't be able to call the interest_cohort() function. But GitHub doesn't serve ads, so why would their scripts be using the function? And what's the point of declaring that scripts from your domain are not allowed to use the FLoC API (Or geolocation which is the only other policy I'm aware of.) versus just not putting the code in your scripts in the first place?
  - tyingq 5y ago
    The EFF summarizes it this way: "If you are a website owner, your site will automatically be included in FLoC calculations if it accesses the FLoC API or if Chrome detects that it serves ads." Personally, I don't trust Google that much. Chrome knows which websites I've been to, so it could easily (accidentally, or on purpose) just include any site. Google also has a history of starting conservatively, then rolling out stuff a little at a time. "Boiling Frogs". Rolling out the header everywhere seems like a good way to keep Google honest about it. Chrome can obviously still do whatever it wants, but it would be harder to explain for them if they shared info on an explicitly opted-out site visit. It's also just a sort of ceremonial way of expressing dissent with the idea in general. In a way that people could collect statistics on and track.
  - Seirdy 5y ago
    > Does that really do anything? It does very little; effort is better spent getting people off FLoCed browsers like Chrome. More info: https://seirdy.one/2021/04/16/permissions-policy-floc-misinfo.html https://seirdy.one/2021/04/16/permissions-policy-floc-misinf... This is what's really bad about FLoC; it's so hard to fight back on behalf of oblivious Chrome users who didn't opt out. For the uninformed, there's no winning move.
drcongo 5y ago
Guess that guy who works on ads at Google will be along shortly to assure us that everything is fine again.
doomslice 5y ago
Just as a reminder, Google is also planning to drastically improve privacy through a sandbox in Chrome: https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb... FLoC (and FLEDGE, and PARAKEET, and a million other bird proposals) is being used as a way to mitigate some of the loss that publishers and advertisers will see when those privacy measures are put into place.
- reaperducer 5y ago
  FLoC (and FLEDGE, and PARAKEET, and a million other bird proposals) is being used as a way to mitigate some of the loss that publishers and advertisers will see when those privacy measures are put into place. I think this illustrates that the whole bird-brained idea is to placate the advertisers so they won't run to congress, while continuing to allow Google to fingerprint people with its own, better, data, thus increasing its advertising advantage.
  - doomslice 5y ago
    That's one way to look at it, and certainly a view that many share -- but isn't that more likely to attract regulatory scrutiny instead of deflect it? I sit in on many of these W3C meetings (I'm not from Google) and the discussion is always "given that we want to achieve X definition of privacy (where X varies depending on the proposal), how can we mitigate some of the fallout that will happen". It's never "how can we defeat these privacy measures that are going to be put into place so we can keep the status quo". You can argue that advertising is a net negative for the web or that it's evil or whatever you want, but if you frame it as "how can we take steps to make things more private for end users without completely destroying the way business on the web make money" then I think the current path is a reasonable one.
    - Corazoor 5y ago
      You cannot separate the morality of an action from it's usefulness to business, thats putting the horse before the cart. Modifying your last sentence illustrates this nicely: You can argue that slavery is a net negative for the world or that it's evil or whatever you want, but if you frame it as "how can we take steps to make things better for slaves without completely destroying the way business on the world make money" then I think the current path is a reasonable one.
fmakunbound 5y ago
Google already knew this of course. There's been several papers over the years on uniquely identifying people using disparate sources. FLoC would be part of that.
jrochkind1 5y ago
I didn't realize FLOC was already in use. Looks like to disbable it in Chrome... you have to find a deeply nested config and then tell chrome you want to "disable privacy-preserving features". !?!? I can do this. But of course nobody else is, it's telling you are disabling privacy-preserving features! Its' making me kind of livid.
- stjohnswarts 5y ago
  by disabling it you're giving more uniquely identifying info to the fingerprinting backend apps lol
  - lurkerasdfh8 5y ago
    "the only wining move is not to play" really, if you are in a point where you hunt for hidden settings to disable in your browser? why not just use firefox?
    - jorvi 5y ago
      You can either obfuscate with stuff Like Canvasblocker and Brave, both which expose slightly randomized prints, or 'poison the well' with Ad Nauseum.
  - jrochkind1 5y ago
    what uniquely identifying info does the feature disable, in exchange for FLoC?
- sixothree 5y ago
  I'd hate to be that guy. But Chrome is not your friend when it comes to privacy. Chrome is the adversary.
- Farow 5y ago
  If you're using uBO, it's defused by default: https://github.com/gorhill/uBlock/releases/tag/1.35.0 https://github.com/gorhill/uBlock/releases/tag/1.35.0
DisjointedHunt 5y ago
For all the remarks here on how FLoC is bad for privacy here, i'm surprised that StackOverflow is missing the opportunity to discuss the larger issue of monetization methods in tech. Ads by themselves aren't bad and neither is personalization. These methods of monetizing content have led to the huge surge of interest, talent and capital into Software Engineering companies and has arguably funded some of the most remarkable technological advancements of the past two decades or longer if you consider all the things that have come out of research projects in companies with primarily an advertising business model. There are certainly valid criticisms of personalized advertising and personally, i believe there is too much concentration of power in the market. However, i'd love to hear intelligent peoples perspectives here on how we preserve this wildly successful business model while tackling the abusive parts? If tomorrow the consequences of these restrictions by platform owners such as Apple or Google end up concentrating more of the power within the walls of the largest players, we're simply trading one set of problems for a much larger set.
neonate 5y ago
https://archive.is/oKSDs https://archive.is/oKSDs
dang 5y ago
Ongoing related thread: Privacy Analysis of FLoC - https://news.ycombinator.com/item?id=27463794 https://news.ycombinator.com/item?id=27463794 - June 2021 (2 comments)

327 points by EdwinHoksberg 5y ago

mavhc 5y ago

The article says they "could" do it, not that they are. "New thing not perfect!"

wccrawford 5y ago
No, the article says they are doing it. > As privacy and data ethics advocates warned, companies are starting to combine FLoC IDs with existing identifiable profile information, linking unique insights about people’s digital travels to what they already know about them, even before third-party cookie tracking could have revealed it. and > Advertising companies are already strategically gathering FLoC IDs and linking them to identifiable data or analyzing them in an attempt to uncover information about people that may not have been known before, mimicking how they have parsed what third-party cookies told them about people’s behaviors.
- mavhc 5y ago
  "starting to" "in an attempt to" I see the submitted title has been altered anyway.
yosamino 5y ago
More like "New thing works exactly as .... advertized" There is a fundamental tension between me wanting to walk around the world as a free human individuum and a large group of people who for some reason or another want to know exactly what kind of fart I prefer so that they may match me with the correct kind of fart-cushion so that I might buy it. The idea that I might not want to have a fart cusion in the first place, and If I fancied the idea of getting one, I might go to the fart cusion store to find the perfect fart cushion does not seem to occur to these people - I am sure technically they have thought of the possibility, but they do not respect me or my boundaries. What this "new thing" does, is manage my suspected fart-cusion preferences inside my browser, instead of some "cloud" to then tell fart-cusion-selling-enthusiasts that indeed, I might be one of these people with an interest in fart-cusions. This "new thing" doesn't change anything about the fundamental issue that my thoughts and aspirations as a fart enthusiast are not the business of any moron who want's to market their newest fart-cushion invention to me.
- ChrisMarshallNY 5y ago
  I just had to give you a +1 for that. Don't forget that there are people who want to find out if you are a fart enthusiast, so they can then use that to coerce you into "playing ball" with them. Sort of the digital equivalent of the "$5 wrench[0]." Social media and adtech have been a freaking goldmine for spies. [0] http://imgs.xkcd.com/comics/security.png http://imgs.xkcd.com/comics/security.png

newMediaMogul 5y ago

> presented by Liveramp

deleted 5y ago
[deleted]
SwankyHank 5y ago
Sorry, what is this referring to?

randomperson_24 5y ago

Why is it that all anti-Google posts just approach the first place on HN in such a short amount of time.

Black101 5y ago
36 points in 15 minutes is probably why... I have often noticed that the mods alter the ranking of posts, but I don't think that they did in this case (they admitted doing it in some cases). The content on HN is very much curated/controlled.
canadianfella 5y ago
Many people don’t like being spied on.
Ensorceled 5y ago
Advertising and privacy issues shoot to the top; whether Google, Apple, Facebook, what have you. Why do anti-google articles always have some one claiming unfairness or singling out as one of the first comments?
ehnto 5y ago
It's not anti-google, it's against a thing Google happens to be doing. Google holds an incredibly powerful position on the internet, so when they do something that could be bad it affects a lot of people. In this case, you could argue it affects pretty much everyone who uses the internet. You don't get to be the biggest entity on the internet and keep the cutesy hacker facade, they've got an enormous responsibility to the community now.
- mavhc 5y ago
  Also sensationalist posts get more attention than nuanced non biased posts
tjpnz 5y ago
Same can be said for all manner of Google related posts. Not all of them are necessarily negative.

samizdis 5y ago

The EFF launched its site Am I FLoCed? [1] on April 9 for Chrome browser users to check whether they've been recruited/co-opted into Google's FLoC testing programme, started in March. Not sure how it works, but the EFF doesn't seem totally confident that it can detect those affected: "This page will try to detect whether you've been made a guinea pig in Google's ad-tech experiment." [1] https://amifloced.org/ https://amifloced.org/

NilsIRL 5y ago
FLoC has a well defined API like (all) standards: https://wicg.github.io/floc/ https://wicg.github.io/floc/ There's no reason why the website would not be reliable at detecting whether FLoC is enabled on your browser. You can also used https://floc.glitch.me/ https://floc.glitch.me/ which was linked in one of the blog posts from google.
- stefan_ 5y ago
  In the sense that you can call "side channel for ill-specified data Google wants to leak" an "API".

FranchuFranchu 5y ago

> Nonetheless, the ad industry — which co-opted foundational internet technologies like the cookie and the IP address into means of identifying people online How can you have an Internet without using IP addresses? Do you just use Onion routing all the time?

Ensorceled 5y ago
You can't. That's why IP addresses are a "foundational internet technology".
- deleted 5y ago
  [deleted]
eli 5y ago
Isn’t using Onion routing pretty much what Apple is proposing?
- tgragnato 5y ago
  There are big differences. Private relay is secure as long as Apple and the third party do not cooperate, but end to end flow correlation is much easier because streams are not isolated. Onion routing is much more sophisticated than private relay: even end to end correlation is more difficult because of how virtual circuits are made.
AndrewDucker 5y ago
IP addresses identify computers. They only identify people when joined with other information.
simias 5y ago
VPNs (aka proxies) can also help. I think most ISPs (at least where I live) also use dynamic IPs which reduces the utility if IP for tracking somewhat. I think cookie + browser fingerprinting is a much better way to track people in this situation, because it removes the uncertainty associated with dynamic IPs and multiple users behind a NAT.

BeniBoy 5y ago

I might be missing something, but wasn't it part of the plan? Of course the goal was to offload the actual interpretation of the FLoC id to third-parties, as FLoC id themselves do not have any semantic signification. Not saying this is ok, but this was the plan from the beginning, being able to offload responsability far from Google. This article[1] actually shows what it's like for an advertiser. [1] :https://cafemedia.com/early-status-of-the-floc-origin-trials/ https://cafemedia.com/early-status-of-the-floc-origin-trials... EDIT: Did not finished the article before posting, they actually talk about cafemedia's work.

Procedural 5y ago
Yes, that was part of the plan.
choppaface 5y ago
Part of the plan but not part of Google’s consumer-oriented hype for it. Google has intentionally declined to state the fingerprint-joining and dollar impact to third parties because it would detract from the (already specious) message that FLoC improves privacy. Perhaps during some anti-trust hearings in the future we’ll see internal emails that detail how much $$ Google estimated that FLoC would take away from other advertisers as a function of what level of fingerprint joining they succeed at. FLoC is NOT proven to be incentive-compatible with consumers and how they value their privacy. The only guarantee is that users are (on average) harder to distinguish within a cohort. Google absolutely studied the possible economic consequences of FLoC prior to announcement and they are hiding that study. Either because the results are crappy, the Google Ads employees are less competent than they were a decade ago, or both.
- Karrot_Kream 5y ago
  > FLoC is NOT proven to be incentive-compatible with consumers and how they value their privacy. The only guarantee is that users are (on average) harder to distinguish within a cohort. Google absolutely studied the possible economic consequences of FLoC prior to announcement and they are hiding that study. Either because the results are crappy, the Google Ads employees are less competent than they were a decade ago, or both. Could you walk through your ideas of the incentives here? I'm curious because while I like the idea of FLoC in general, Google is the last company I trust with this. Moreover there are a lot of details (such as cohort sizes) that could have the potential to mask identity and align incentives, but has been underspecified by Google so far.

gerbler 5y ago

> However, it is likely that the same FLoC IDs or range of IDs will be associated with someone. This seems all quite speculative. In the first paragraph they describe FLoc IDs as changing constantly - why would they assume new IDs are not being generated, and groups are not constantly being mixed?

EMM_386 5y ago
Further down it quotes ... > “If your behavior doesn’t change, the algorithm will keep assigning you in that same cohort, so some users will have a persistent FLoC ID associated with them — or could." When combined with other information that is already being used (such as canvas fingerprinting and other techniques), this looks like it can help narrow it down even further. > “We can use that as another signal to create a stable identifier for them.”
- 3np 5y ago
  Arguably for advertisers it’s a benefit - if your behavior changes to that extent, likely you’d be better targeted by different ads.
  - twobitshifter 5y ago
    Right and floc was made for advertisers. They’re the customers here.
hluska 5y ago
It’s extremely speculative. While I’m allergic to ad tech, I’m even more allergic to poverty, so I have occasion to work with/around that side of the industry. The best way to explain it is that a lot of companies have been making significantly more money than their technology is worth. A number of initiatives have attacked the data-in side of the equation so the underlying tech is showing how questionable it really is. This type of research should be filed under “could be big” but at this point it’s closer to public relations for ad tech firms than “the sky is falling, become Amish.”

ece 5y ago

Honestly, who asked for FLoC and the MS alternative (edit: it's PARAKEET)? Why can't ad servers just follow my Do Not Track preferences? Serve me a random ad, or a context based ad if I have Do Not Track set... seems a lot simpler no? Those using ad-blockers are going to use them anyway, but some assurance that I won't be tracked would go a long way towards me turning off ad-blockers on the sites I don't frequent, and even those that I do if they don't have a ad-free subscription. Those wanting personalized ads, can set the Do Not Track preferences accordingly, possibly by site.

mavhc 5y ago
Do Not Track failed because a) the worst sites would just ignore it and b) Microsoft tried to use it as a weapon against Google by setting it as default
- hypertele-Xii 5y ago
  Do Not Track failed because nothing actually enforced companies to respect it. It has to be law for any effect.
- danShumway 5y ago
  Obligatory "Microsoft Did Nothing Wrong" post: Too busy to do a long post in detail, but short version is that advertiser's acceptance of DNT was entirely dependent on people not using it. If Microsoft had left it as opt-in but the majority of consumers had turned it on, we would have seen the same result. You can see the same principle to explain the response to iOS's privacy changes, which are not opt-in or opt-out; they force the user to make a choice. The ad industry is still furious about this. DNT could have only worked if no one used it, and that is not a privacy outcome that is worth pursuing or advocating for. It's not Microsoft's fault that DNT went away, Microsoft was just the excuse the advertising industry needed to avoid it. I don't think that DNT was ever anything other than an excuse the industry could use to keep tracking people and avoid legislation without changing anything. Microsoft didn't take it away from you, they just pulled back the curtain and showed you the truth about it. A privacy standard that fails as soon as it's turned on by default is almost worthless and it really shouldn't be advocated for in the first place. - https://news.ycombinator.com/item?id=26821972 https://news.ycombinator.com/item?id=26821972 - https://news.ycombinator.com/item?id=24294280 https://news.ycombinator.com/item?id=24294280 - https://news.ycombinator.com/item?id=24289186 https://news.ycombinator.com/item?id=24289186 - https://news.ycombinator.com/item?id=19483149 https://news.ycombinator.com/item?id=19483149

moomin 5y ago

No-one could have predicted this, he said with his eyes rolling back in his sockets.

pmurt7 5y ago

We need to collectively switch to Firefox and Brave.

gigatexal 5y ago
Been on FF for a few years now. FF89 is really nice.
dvfjsdhgfv 5y ago
I finally made the total switch to FF last year and it's fine; the stuff got imported from Chrome correctly. Containers are a good bonus. I keep a copy of Chrome at hand but I used it maybe once a month or two to test some random website, that's all. There is no single reason to remain on Chrome for me, I just regret it took me so long. No crashes, no noticeable performance differences, no quirks. I'm very grateful Firefox exists.
- sixothree 5y ago
  Edge is a good alternative when you _need_ a chrome browser.
ahmedalsudani 5y ago
Correction: they never injected ads, but they do remove ads and replace them with "attention tokens", which is an opt-out system for publishers. See also https://tech.hindustantimes.com/tech/news/this-popular-browser-caught-injecting-affiliate-codes-in-crypto-urls-71591610043600.html https://tech.hindustantimes.com/tech/news/this-popular-brows.... In short, please look into the questionable aspects of Brave. Brave is perhaps the most ethically challenged browser out there. Hopefully they have stopped doing this, but they were injecting their own ads instead of what the publisher put on their website.
- 3np 5y ago
  They never injected ads. If you enable Brave Rewards, you do get notification/pop over ads and rewarded a small amount of BAT, which can get redistributed to content creators or sites. If you don’t , all this is disabled.

colesantiago 5y ago

All Ad tech, spyware, and data collection firms/startups (and even startups collecting any PII data) with little care for the GDPR or the CCPA are extremely evil. No regards for privacy at all, this rampant data harvesting and spying must stop now.

deleted 5y ago

[deleted]

pengwing 5y ago

Oh, no! This means I might still get relevant ads that relate to my unique interests as an individual instead of some least common denominator cookie cutter garbage ad.

Rygian 5y ago
Personally, I prefer my ads to be as unrelated as possible to my unique interests. That way I can ignore the unwanted distraction more easily, or even be amused by it. Every time I see an ad that relates to my current unique interests I feel spied upon and concerned that my private life is leaking without my knowledge or control.
beervirus 5y ago
I personally love having my personal information taken without my permission, by code running on my device and wasting my battery, so that some company can show me ads I’m never going to click on.
drcongo 5y ago
This post is staggeringly under-informed. Just wait until you google for some ailment and your life insurance premium magically goes up.

magwa101 5y ago

"Only we have valuable specific timely data to accurately link it to the users general interests via the FLOC ID which is a gradual, general indication of users interests. This is how you beat your competitors." "Better than retargeting?" "For sure, because general interests combined with accuracy will bring the best performance." "Reup me please."

danShumway 5y ago

But this can't be, people assured me that FLoC was an improvement to privacy, and that it would provide an alternative to persistent identifiers and profiles, and that it would help end the arms race on fingerprinting. You mean to tell me that FLoC will be used for fingerprinting anyway, and it changes nothing about advertiser's strategies and tracking techniques, and they won't self-regulate, and that it doesn't work to throw them bones of extra data and hope that they'll willingly stop their abusive behavior if we meet them halfway? This is a shocking development. The only consolation is that Google's next privacy compromise with the ad industry definitely won't suffer from exactly the same problems. The best thing for us to do now is to assume that this is a completely random, one-time fluke that doesn't reflect anything on the industry's character. No need to change the way we engage with the advertising industry on privacy issues because of it. We should keep offering them compromises that make it easier for them to track users, and keep assuming that they'll in good faith regulate themselves.

______- 5y ago
> End the arms race on fingerprinting Google is known to fingerprint you on their sites[0] and this practice will continue unless some sort of political action is taken to make fingerprinting illegal. WebGL is not the only heuristic used to reliably determine it's a specific device accessing a site, but a whole slew of techniques can be used to reliably determine it is 'you' who is on a site (you can even detect if a browser is running in a virtual machine, among many other techniques to fingerprint). To mitigate this, I do most of my browsing with JS disabled by default, and if I really need JS turned on (for a site I trust like my bank), then I temporarily turn it on for that specific site. Also you can just disable WebGL in Firefox in about:config but keep in mind, there are many other techniques Google and `ADTech` in general can use to fingerprint you. [0] https://jonatron.github.io/webgl-fingerprinting/ https://jonatron.github.io/webgl-fingerprinting/
- jffry 5y ago
  Even the fact that WebGL is disabled contributes some entropy that can be used to identify you.

OhNoMyqueen 5y ago

This is exactly how FLoC is supposed to work, and this is exactly what privacy watchdogs have criticized about it. The proper headline should be "Ad tech films test FLoC".

twox2 5y ago

Am I missing something? Wasn't this the pitch for floc from day one?

dmarti 5y ago

FLoC as a source of fingerprinting bits has been an issue in W3C discussions of the project. https://github.com/WICG/floc/issues/69 https://github.com/WICG/floc/issues/69 As a fingerprinting surface FLoC has similar properties to the Battery Status API -- not stable for the same user over long intervals, but can be used to help match pageviews from different domains that were close in time. https://www.schneier.com/blog/archives/2016/11/firefox_removin.html https://www.schneier.com/blog/archives/2016/11/firefox_remov...

Uristqwerty 5y ago
Imagine sites like facebook, reddit, and google themselves who have more monthly users than the FLoC ID has bits to count. Imagine they store each result for a given user, and assume that, with high probability, when that value changes it is fairly adjacent to the old value. Now, you build a graph database of IDs and their relations. Finally, you link it all to users' profile metadata. You can build statistical distributions around each ID node based on users' gender, race, family status, interests, etc. and use those probabilities to guess at the precise interests of each new and unknown visitor. Also, those sites have a lot of outbound links. Now you can figure out that a particular ID has a high correlation with a particular domain, too. But only the big sites like google have enough users to birthday-paradox their way into a meaningful ID graph, so you're safe from that tiny ad startup that also happens to be threatening google's business model...
- morelisp 5y ago
  Google, Reddit, and Facebook also have sufficient first-party traffic to just gather data, target, and sell ads the "old-fashioned" way. The independent and small sell-side is also hit hard by this.

tyingq 5y ago

I'm hoping for a sort of community revolt where most popular pieces of software that serve http, and most popular websites send back the "Permissions-Policy: interest-cohort=()" header as a default setting. I know Github did this, hoping others will follow.

whoopdedo 5y ago
Does that really do anything? The entire Permissions-Policy header confuses me. Isn't that telling the browser to lock the FLoC API for that domain. So no resources loaded from github.com won't be able to call the interest_cohort() function. But GitHub doesn't serve ads, so why would their scripts be using the function? And what's the point of declaring that scripts from your domain are not allowed to use the FLoC API (Or geolocation which is the only other policy I'm aware of.) versus just not putting the code in your scripts in the first place?
- tyingq 5y ago
  The EFF summarizes it this way: "If you are a website owner, your site will automatically be included in FLoC calculations if it accesses the FLoC API or if Chrome detects that it serves ads." Personally, I don't trust Google that much. Chrome knows which websites I've been to, so it could easily (accidentally, or on purpose) just include any site. Google also has a history of starting conservatively, then rolling out stuff a little at a time. "Boiling Frogs". Rolling out the header everywhere seems like a good way to keep Google honest about it. Chrome can obviously still do whatever it wants, but it would be harder to explain for them if they shared info on an explicitly opted-out site visit. It's also just a sort of ceremonial way of expressing dissent with the idea in general. In a way that people could collect statistics on and track.
- Seirdy 5y ago
  > Does that really do anything? It does very little; effort is better spent getting people off FLoCed browsers like Chrome. More info: https://seirdy.one/2021/04/16/permissions-policy-floc-misinfo.html https://seirdy.one/2021/04/16/permissions-policy-floc-misinf... This is what's really bad about FLoC; it's so hard to fight back on behalf of oblivious Chrome users who didn't opt out. For the uninformed, there's no winning move.

drcongo 5y ago

Guess that guy who works on ads at Google will be along shortly to assure us that everything is fine again.

doomslice 5y ago

Just as a reminder, Google is also planning to drastically improve privacy through a sandbox in Chrome: https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb... FLoC (and FLEDGE, and PARAKEET, and a million other bird proposals) is being used as a way to mitigate some of the loss that publishers and advertisers will see when those privacy measures are put into place.

reaperducer 5y ago
FLoC (and FLEDGE, and PARAKEET, and a million other bird proposals) is being used as a way to mitigate some of the loss that publishers and advertisers will see when those privacy measures are put into place. I think this illustrates that the whole bird-brained idea is to placate the advertisers so they won't run to congress, while continuing to allow Google to fingerprint people with its own, better, data, thus increasing its advertising advantage.
- doomslice 5y ago
  That's one way to look at it, and certainly a view that many share -- but isn't that more likely to attract regulatory scrutiny instead of deflect it? I sit in on many of these W3C meetings (I'm not from Google) and the discussion is always "given that we want to achieve X definition of privacy (where X varies depending on the proposal), how can we mitigate some of the fallout that will happen". It's never "how can we defeat these privacy measures that are going to be put into place so we can keep the status quo". You can argue that advertising is a net negative for the web or that it's evil or whatever you want, but if you frame it as "how can we take steps to make things more private for end users without completely destroying the way business on the web make money" then I think the current path is a reasonable one.
  - Corazoor 5y ago
    You cannot separate the morality of an action from it's usefulness to business, thats putting the horse before the cart. Modifying your last sentence illustrates this nicely: You can argue that slavery is a net negative for the world or that it's evil or whatever you want, but if you frame it as "how can we take steps to make things better for slaves without completely destroying the way business on the world make money" then I think the current path is a reasonable one.

fmakunbound 5y ago

Google already knew this of course. There's been several papers over the years on uniquely identifying people using disparate sources. FLoC would be part of that.

jrochkind1 5y ago

I didn't realize FLOC was already in use. Looks like to disbable it in Chrome... you have to find a deeply nested config and then tell chrome you want to "disable privacy-preserving features". !?!? I can do this. But of course nobody else is, it's telling you are disabling privacy-preserving features! Its' making me kind of livid.

stjohnswarts 5y ago
by disabling it you're giving more uniquely identifying info to the fingerprinting backend apps lol
- lurkerasdfh8 5y ago
  "the only wining move is not to play" really, if you are in a point where you hunt for hidden settings to disable in your browser? why not just use firefox?
  - jorvi 5y ago
    You can either obfuscate with stuff Like Canvasblocker and Brave, both which expose slightly randomized prints, or 'poison the well' with Ad Nauseum.
- jrochkind1 5y ago
  what uniquely identifying info does the feature disable, in exchange for FLoC?
sixothree 5y ago
I'd hate to be that guy. But Chrome is not your friend when it comes to privacy. Chrome is the adversary.
Farow 5y ago
If you're using uBO, it's defused by default: https://github.com/gorhill/uBlock/releases/tag/1.35.0 https://github.com/gorhill/uBlock/releases/tag/1.35.0

DisjointedHunt 5y ago

For all the remarks here on how FLoC is bad for privacy here, i'm surprised that StackOverflow is missing the opportunity to discuss the larger issue of monetization methods in tech. Ads by themselves aren't bad and neither is personalization. These methods of monetizing content have led to the huge surge of interest, talent and capital into Software Engineering companies and has arguably funded some of the most remarkable technological advancements of the past two decades or longer if you consider all the things that have come out of research projects in companies with primarily an advertising business model. There are certainly valid criticisms of personalized advertising and personally, i believe there is too much concentration of power in the market. However, i'd love to hear intelligent peoples perspectives here on how we preserve this wildly successful business model while tackling the abusive parts? If tomorrow the consequences of these restrictions by platform owners such as Apple or Google end up concentrating more of the power within the walls of the largest players, we're simply trading one set of problems for a much larger set.

neonate 5y ago

https://archive.is/oKSDs https://archive.is/oKSDs

dang 5y ago

Ongoing related thread: Privacy Analysis of FLoC - https://news.ycombinator.com/item?id=27463794 https://news.ycombinator.com/item?id=27463794 - June 2021 (2 comments)