Firefox browser will block the IAB's DigiTrust universal ID

https://digiday.com/media/firefox-browser-will-block-the-iabs-digitrust-universal-id/

by cpeterso • 7 years ago

206 115 7 years ago

zwaps• 7 years ago

> Mitchell said. “They believe no third party can be trusted. We take a different position: that trust should be established directly between consumers and the brands, and publishers they trust, and with the third parties that those brands and publishers trust.”

What the hell does this even mean?

deugtniet• 7 years ago

It means that they don't want tracking to stop. And you should _definitely_ trust them as well as all their partners.

Good on Mozilla for doing this. I want privacy when I'm on the internet, without having to resort to tor-like schemes

weinzierl• 7 years ago

Not good at all. I still trust Mozilla to a large degree but I definitely don't trust their partners. Mozilla needs money to operate, they need partners and they'll will have to give something to them in return for the money - that is all ok and just how things are. What is not ok is that associate so closely with shady operations like Cliqz for example.

int_• 7 years ago

Pretty much the old tobacco tactics.

chopin4• 7 years ago

Tor-like schemes won't help you much as the tracking is done on the device.

Timshel• 7 years ago

You might want to clarify that the quote is from Jordan Mitchell from IAB, not Mitchell Baker from Mozilla. I was quite perplexed at first :).

mikedilger• 7 years ago

Trust isn't transitive

clarification: this doesn't answer your question about what he means, this is a critique of what he said.

m7125• 7 years ago

It's a hard to parse sentence, which is intentionally vague. It's weasel wording, basically.

bouke• 7 years ago

It argues that you would _trust by proxy_. So: you trust the company (site) you're visiting, that company trusts third parties, and by proxy you trust those third parties.

The problem is that most people wouldn't trust those brands in the first place if they new what shady third parties they enlist.

chris_wot4• 7 years ago

I now exclusively use Firefox on MacOS. I refuse to use Chrome in any way now.

Andrew_nenakhov• 7 years ago

I also find it that Firefox syncs better between mobile and desktop than Chrome did. So yeah, no looking back.

a_imho2• 7 years ago

They only differ in marketing really. I use Firefox too but have no illusions about it, Moz://a is sponsored by the same Google ad money. None of the big browser providers are good guys, there is clear conflict of interest that no amount of PR can resolve.

chris_wot4• 7 years ago

There are lots of things that Firefox does to enhance privacy that Chrome does not do.

m7125• 7 years ago

This website has a very thorough Firefox de-bloat and anti-tracking guide: https://spyware.neocities.org/guides/firefox.html

I find that some of those options are excessive, but it's good for the privacy-minded in general. Just change the options based on your threat model.

m7125• 7 years ago

You should take the next step and switch to GNU/Linux. :o)

krageon• 7 years ago

Not if they enjoy having a well-integrated experience on a platform tailored to their hardware.

chris_wot4• 7 years ago

I would, but I own an iMac. Ironically, I run Virtualbox and use Linux that way :-)

draklor402• 7 years ago

I'd be willing to pay monthly for Firefox to make for the lost advertising revenue.

lowracle• 7 years ago

The only times I click on ads is to see what competing businesses are doing / offering. I am pretty sure they would actually save money by stopping showing me ads.

chris_wot4• 7 years ago

Setup a monthly donation?

https://donate.mozilla.org/en-US/

ComodoHacker4• 7 years ago

You should be paying content publishers. They are the ones who lose advertising revenue, not Mozilla.

draklor402• 7 years ago

Mozilla makes a big chunk of money (or did) by making Big G the default search engine. They have employees to pay and servers to maimtain.

Publishers online and offline have almost never made money without ads. The only diff. is tracking readers is easy online. And that is not probably going to change anytime soon. I don't trust publishers. I trust Mozilla.

edhelas• 7 years ago

David Kohl, CEO of ad tech company TrustX, a member of DigiTrust, said the entire cookie-based advertising infrastructure needs a rethink that involves prioritizing consumer interests, rather than ad tech’s commercial interests.

Or basically just stop tracking people online ? And find another way to sell your stuff ? #thinkoutsidethebox

dmortin• 7 years ago

We could also pay for all the sites we use (google, youtube, gmail, reddit, etc.), but it would be pretty pricey if you visit a lot of sites. Most people would choose tracking instead.

creato• 7 years ago

We know the price for youtube + google music: $10/mo. I wonder how many people are choosing that?

BiteCode_dev• 7 years ago

People would start to priorize. Not a bad thing.

Kaiyou• 7 years ago

..or not visiting sites anymore.

fock2• 7 years ago

it would be pricey if customers still have to pay for exorbitant salaries, payout of investors, exponential growth and moonshot-projects. That way you end up with the 10 USD Jimmy Wales is charging.

If you strip all this and just make an old-fashioned public service business, maybe operated by a lean, tech-led non-profit (looking at you Mozilla...) you are suddenly ending up with a pretty cheap (e.g. cents instead of $) service (at least compared to what classic media costs). Maybe you also have to cut corners on things like free xK-Upload, but I think most people (ie consumers) could live with some surcharge there.

wastedhours• 7 years ago

But there's also a middle ground of advertising without excessive tracking - YouTube and Reddit (and most major websites, including social media sites where you're actively following interests) already have enough information on your intent to show relevant ads for the content you're viewing, without tying that to you individually.

A lot of the inventory I buy is now on intent-based sites, and the passive profiles used for cross-site banner display for example, for us, tend to drive the lowest quality conversions.

Advertising can still have a place, but it requires effort to do well (like buying a sponsored post on a subreddit right now). Higher effort though I'd wager will lead to better conversions for all in the long run.

deltron3030• 7 years ago

Ultimately it comes down to how much free time you have to pursuit the things that interest you, or to discover new things. You may visit many sites, but how active are you on those sites or how deep are you involved in those topics?

There could be a free casual web, for people who just want to check things out or get a general overview, and offers for those with a deeper interest, who maybe spend a lot of time there and have very different demands. What doesn't work is gating casual information.

forgetfulusr• 7 years ago

I wished I could believe that I won't be tracked or I won't see ads if I paid. That is a myth that is easily busted. These guys raced to get big and now really have no clue how to be a tech company. The only innovations I've seen in the past ten years is how to make ads more annoying. Sorry this rant is not directed at you.

12xo2• 7 years ago

You'd have 12 people running a few servers, not 100k trying to scour your mind for intent and subconscious clicks... Think POF.com vs Match.com 3 guys and a few servers or 3000 people doing something...

12xo2• 7 years ago

Ad Tech is filled with superfluous middlemen/ middleware who take from the transaction, they do not add.

As a long time ad tech executive, I can state that there are maybe 3 companies that actually add value to the chain. And those companies are not even in ad tech... The entire market is a fraud based on obfuscation and lies and every single member of the IAB committees are nothing but shills and charlatans hoping for some career visibility and personal gain.

beezischillin• 7 years ago

Yeah, no. I don’t trust the ad industry. They’ve never been honest before, I doubt they would start now.

xg15• 7 years ago

I've found that most press statement that contain the term "we believe" go on with some utterly ridiculous mental gymnastics to justify shady behaviour. This one is no exception:

[IAB Tech LAB svp of Membership and Operations said:] “They believe no third party can be trusted. We take a different position: that trust should be established directly between consumers and the brands, and publishers they trust, and with the third parties that those brands and publishers trust.”

Question to that guy: What act specifically would establish that trust? My browser downloading JavaScript from half a dozen companies that I've never heard of?

Or is their position that by opening a link to some web page, I declared my boundless, irrevocable trust in that site, all third-parties that site delegates to, all third-parties those third-parties delegate to, etc etc as infinitum?

Where else in life do you get this understanding of "trust"?

tadzik_3• 7 years ago

I expect nothing less from someone from a company called "TrustX, a member of DigiTrust". Just like with any other scammer, when someone uses a word "trust" excessively, you know that you shouldn't.

Why is the company called TrustX instead of AdX, if that's what they're dealing with? Maybe so that they appear more innocent when they show up in your browser warnings or cookie alerts? That's the kind of "trust" they're hoping to exploit.

cocochanel• 7 years ago

Serious question: isn't that how SSL/TLS certificates work too, by chain of trust?

majewsky2• 7 years ago

Yes, but only because every other known solution is worse in practice.

pornel• 7 years ago

The infosec definition of trust is not really the same as the colloquial meaning of trust.

The infosec "trust" is not something earned or even verified, but an assumption that something is not malicious. Imagine a fortress: inside of the walls is called "trusted", outside of the walls is "untrusted". So a trusted CA merely means a certificate inside your fortress' walls that an attacker can't modify.

NohatCoder• 7 years ago

Relatively few companies can sign TLS certificates, and you have the security of the domain name as well. In order for an attacker to steal a TLS session they need to compromise both the certificate system and the dns lookup.

perlgeek• 7 years ago

The trust that browsers place in the TLS chain of trust is basically just the assertion that the holder of the TLS key is the one who owns the domain.

This doesn't imply anything about the contents that can be transferred over the TLS connection. Could be malware. The other side could leak your private data like crazy. That's outside the scope of the TLS chain of trust.

buboard2• 7 years ago

When you use your car, you trust 100 different manufacturers from all corners of the earth. When you go to the hospital, you trust 100 different machines, chemicals, gloves, needles etc. It's no different.

rpastuszak• 7 years ago

I'd argue that there's an obvious difference between buying a car or receiving medical care versus being targeted for advertising purposes.

gpm• 7 years ago

When I go to the hospital I trust the local doctors to make good decisions on products to buy, I don't trust the products themselves let alone the products manufacturers. Moreover it's not so much trust as resignation to the fact that I have no better option but to hope they don't do something stupid.

When I use a car I trust the combination of the manufacturer and the regulator to have used parts in a fashion such that they won't kill me. I don't know or trust the individual part manufacturers, that's the automakers job.

There is no equivalent to the doctor, or the automaker, or the regulator here. It is not at all similar.

rswail• 7 years ago

I trust that the hospital complies with medical regulations and standards and that the manufacturers do as well, with the appropriate inspections by a relatively disinterested regulator.

Similar for the car manufacture, plus there are negligence laws in place if either the hospital suppliers or car manufacturers fail.

briffle• 7 years ago

When I can file malpractice lawsuits against ad-tech companies for leaking my personal data, maybe then, after a few years of lawsuits causing their insurance rates to skyrocket, can we maybe talk about trusting them.

madenine• 7 years ago

When you go to the hospital, every machine, chemical, glove, needle has gone through an FDA approval process or has been manufactured to pass FDA standards.

There is no FDA or NHTSA for web technologies.

jordanmitchell2• 7 years ago

>Question to that guy: What act specifically would establish that trust?

I'm "that guy", and yeah I feel ya about "most press statements". Anyway, here's what we think would be a good start in establishing trust ... do you agree? 1. Consumer visits a website or app they like. 2. Website/app offers standardized privacy preferences/controls that are easy to understand, and apply globally. 3. Consumer indicates their preferences, realistically based on their inherent trust in the website/app ... could be anything from ghost mode ("no tracking at all") to limited ad targeting ("ok, you can retarget me for 3 days only, that's it") to measurement only ("count me as a distinct user, but no ad tracking, profiling, etc.") 4. those preferences are propagated to any/all downstream parties working on behalf of the website/app or the advertiser, all of whom have to submit system-level log file samples daily (a blood sample, if you will) to a central processing system NOT governed wholly by ad industry 5. ongoing data analysis, with data exhaust, provides for open accountability 6. oh, and consumer empirically sees that their preferences are being respected

We'd also love to see a significant reduction in the amount of JS and third-party requests. But these are all hard problems to solve while also maintaining an open web/ecosystem.

dsr_• 7 years ago

No, I don't agree. Here's what I want:

Entity visits a website. The website logs whatever they want, subject to GDPR-style rules. They never send the full logs to a third party, and never send individual information, anonymized or not, without a specific business reason that benefits the entity.

Entity creates an account on the website. Now the website gets to display a privacy policy that conforms to GDPR-style rules, and creates the account only with explicit informed consent from the entity. The website specifically notes the jurisdiction in which they operate and the contact method for complaints, inquiries, deletions, and so forth.

No central processing systems, no unified trackers, no cross-site data analysis.

chopin4• 7 years ago

If web sites are starting to track me via first-party cookies (which I allow for now) those will be banned aggressively as well. Currently I am somewhat lax on deleting them on browser close (I like to stay logged in for some sites). But this will change on a whim when this becomes mainstream.

tadzik_3• 7 years ago

Check out the Cookie AutoDelete addon – it can be configured to keep cookies from select, whitelisted domains, and delete everything else every time you close a tab. You can have the cake and eat it too :)

pmontra• 7 years ago

I'm always more certain that we're going to see ad based web sites rendering with webassembly in a full page canvas. Some sites will implement ways to let us copy and paste text, others won't.

n0rbwah• 7 years ago

Sounds like flash with extra steps :(

chopin4• 7 years ago

I will not use sites who are doing this.

m7125• 7 years ago

Heck, companies are already starting to use CNAME records to fool ad/content blockers. I don't think what you're describing is far from becoming reality.

chopin4• 7 years ago

This is extremely dangerous if you have session cookies and don't configure them carefully.

For now, I commonly allow javascript/cookies on the top-level domain (I am a lazy uMatrix user). This will presumably change in future...

markosaric• 7 years ago

I block all third-party cookies, accept all first-party cookies but delete them when Firefox closes except for few sites I'd like to keep being logged in. Those I approve in the "Manage Permissions" section of Firefox. There are plugins for this but this is a Firefox native way of doing it.

tomp2• 7 years ago

I applaud Mozilla for taking this stance, but I think that blocking is fundamentally misguided approach. We need to start faking! Let’s fake DigiTrust IDs, convince them that it’s not blocked, and leave them none the wiser! It’s the same approach Apple should have taken with (most) iOS permissions - the app shouldn’t be able to know that it cannot access e.g. user’s GPS location, it should just be faked (i.e. random).

cinquemb3• 7 years ago

I second this, but I doubt anyone would get the go ahead to pursue this fully (spoof canvas readouts, user agents, fonts installed, plugins installed, screen size, etc) in firefox (non addon). Would also be great if noscript functionality was built into servo/dom/netwerk modules (would be way more performant than the addon).

padenot• 7 years ago

Firefox already supports something like this if you go to about:config and flip `privacy.resistFingerprinting` to true.

It's not finished/perfect, but changes a lot of things.

ComodoHacker4• 7 years ago

Could you elaborate, what's the purpose of providing fake GPS data to an app requesting it?

Certhas• 7 years ago

Prevent the app from not working due to lack of GPS permission. Basically apps shouldn't have the ability to refuse to work without your data.

LandR• 7 years ago

For companies that want to track you and aggregate and sell your data if they know you are not sending them data then nothing much happens to them, they just lose some data. They can probably live with this.

However, if everyone sends them garbage datathen they don't really have anything valuable then. The whole business model falls down.

reaperducer2• 7 years ago

A lack of data is also data.

Fake data pollutes the stream.

einr2• 7 years ago

There is an interesting book discussing this approach:

https://mitpress.mit.edu/books/obfuscation

kgwxd• 7 years ago

I don't want to waste any CPU or network generating and sending anything. And it leaves a potential attack surface open to be abused.

bassman9000• 7 years ago

From an economic point of view, I understand the OP's point: it's a better deterrent to know know your data is bogus, than to be in the gray area where it may be right to use it or not.

If data is shit, approach dies, because it's not economically viable. If it's just unethical, it will never stop.

tomp2• 7 years ago

That's orthogonal. I don't want the app/website to know (and make decisions based on) whether or not it's being blocked or not... We can/should do IO/compute blocking in addition to faking input.

correct_horse• 7 years ago

You know you're wrong when you put scare quotes around "tracking", and instead choose to call it "anonymous audience recognition". Anonymous audience recognition ranks amoung the most useless, actively misleading jargon I've heard.

To be clear, this system neither recognizes an audience nor can anything of this sort be fully anonymized. A universal ID such as this would recognize every individual member of an audience, not an audience as a whole. Recognizing an audience would look like telling an amazon seller that their product is popular with people who also bought paper towels. Such recognition would be possible from a list of transactions i.e. (paper towels, sunglasses), (energy bar), (dish soap), (laptop, paper towels). In this system there is no knowledge who made what transaction, no universal ID. Any Universal ID can't be fully anonymous because your browsing history is you. You might search for something related to your current residence, your hometown, your workplace and the breed of your dog. These searches alone would be enough to uniquely identify you already, but it would be difficult. Luckily you make boatloads of searches a day, and combining all that data would make your identity much easier to discover. This all assumes your search provider bought in to this universal id system (use DuckDuckGo).

tialaramex• 7 years ago

Aha, the Interactive Advertising Bureau not the Internet Architecture Board.

It's always hard to tell whether people think their three letter name is so distinctive nobody could mistake them for anybody else or whether such confusion is instead desirable...

buboard2• 7 years ago

Firefox and others are good at blocking ads. But what's their replacement? What's the plan here, to starve everyone of the only viable source of income? (If you believe this is not true, try finding a way to accept micropayments to a website). The endgame here will be that sites start blocking firefox. At least Brave is trying something new.

obenn• 7 years ago

The aim of this is to block tracking. I don’t believe Mozilla or anyone else has much interest in blocking ethical, contextual ads.

sunshiney2• 7 years ago

The majority of site ads are affiliate ads. They are being blocked. The lower income folks have been hurt tremendously already. Analytics is suffering from blocks. Math runs business decisions re spending. No math equals bad decisions. Banner ads? Ineffective but why buy when good numbers are not available. The future online belongs to big tech and gorilla business as these good intentioned decisions kill the middle and lower class online. Me? Been running biz online for nearly 3 decades. The blood online is deep and getting bigger.

johnpowell• 7 years ago

Honestly.. I don't understand the details anymore. I just trust that Mozilla and gorhil are doing their best. And if they can't help me nobody can.

syshum• 7 years ago

Ofcourse, only CloudFlare gets to track FireFox users.

aleppe7766• 7 years ago

Sadly, it’s an industry that can’t regulate itself and has been overpromising to less and less gullible clients. Unfortunately advertising is still the main revenue source for publishers, good and bad. Google, Amazon and Facebook will find a way around any but the most extreme and impractical blocking, with logins and technology at a scale that isn’t remotely feasible for all the rest of the industry. So in a way this stance is only advancing their strength at the expense of that fainter and fainter competition that’s fed with the breadcrumbs falling from the tables of the big three. Not sure if in the end we’ll consider this battle as worth fighting as many of you presently think.

arkanciscan• 7 years ago

So their plan to reduce the number of tracking cookies is to introduce another tracking cookie? There's an XKCD comic about that.

handlewithcare• 7 years ago

You have a link for that comic?

713233eb• 7 years ago

Timeless masterpiece: https://xkcd.com/927/

joe5150• 7 years ago

"Meanwhile, Google is set to make an announcement in February about how it will treat third-party cookies in Chrome."

Google: our ad and analytics tracking cookies are first-party cookies if you're using chrome :)

sunshiney2• 7 years ago

I run online biz and have since 1993. Today, I am watching the death of small biz online, the under-employed no longer able to increase income from online biz builds, the death of affiliate income, the spike of subscription paywalls, the growth of big tech as a result, the growth of sites as info brochures for retail brick mortar, decrease in content,all melded with large increases in labor costs, labor benefit bookkeeping and tax expenses,taxes due to nearly 2000 US jurisdictions. In time, you will have few sources for content online and it will be concentrated in gorillas, direct mail will and is increasing, retail will be big guys only, and the biggest losers will be the small guys. But blocks won't be needed then as big guys will deploy the Cobra phenomena as they can afford it. Loser: the average guy. Winner: the big guys. Ah well. More poor people. Ah well.

Firefox browser will block the IAB's DigiTrust universal ID

Related Stories