Google’s FLoC Is a Terrible Idea

https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea

by wyldfire • 5 years ago

604 349 5 years ago

dleslie13• 5 years ago

This captures my feelings on the issue:

That framing is based on a false premise that we have to choose between “old tracking” and “new tracking.” It’s not either-or. Instead of re-inventing the tracking wheel, we should imagine a better world without the myriad problems of targeted ads.

I don't want to be tracked. I never have wanted to be tracked. I shouldn't have to aggressively opt-out of tracking; it should be a service one must opt-in to receive. And it's not something we can trust industry to correct properly. This is precisely the role that privacy-protecting legislation should be undertaking.

Stop spying on us, please.

izacus10• 5 years ago

What's tracking in your definition here? Is counting display of an ad tracking? Load of an image on page? Is logging nginx entry for your page load tracking? Is responding with correct image for your browser user-agent tracking?

I'm sometimes confused what is covered under this term and I'd kinda like to know where the line here is drawn. What exactly are we talking about here?

dleslie13• 5 years ago

When site A and site B are able to communicate to each other that I am a unique individual who has a particular session or sessions open.

probably_wrong• 5 years ago

I fear that your questions reduce the problem to the point where no answer is possible. Loading the Y Combinator logo in here is almost certainly not tracking, but loading an invisible, 1px-by-1px gif in an email almost certainly counts. It's missing the forest for the trees.

The simplest definition of tracking I can come up with is "collect data about me that can (and often, is) used to build a profile of me and my behavior". The NGinx log could or could not be tracking, depending on whether you use it to diagnose issues ("we should optimize this picture, it's loading too slow for too many people") or to profile me ("ID 12345 uses a 56K modem, let's sell him a new one"). But no perfect definition exists because everyone has different thresholds of what they are okay with.

sofixa10• 5 years ago

Do you use Web Monetisation ( as in, pay)? If you don't, and don't want to be tracked for ads, how do you propose things work?

chipgap98• 5 years ago

I would much rather pay than be tracked. Unfortunately many sites don't give me that choice.

shawkinaw• 5 years ago

You can have ads without tracking. Print, radio, TV all do this.

esperent3• 5 years ago

Do you mean this?

https://webmonetization.org/

It barely exists so far and is only implemented by a single browser that I'd never heard of (Puma). Hardly fair to demand if people are using it yet.

how do you propose things work?

We go back to advertising without tracking.

potta_coffee• 5 years ago

Most content is essentially worthless. I'd happily see most of it disappear.

Mediterraneo10• 5 years ago

If you don't, and don't want to be tracked for ads, how do you propose things work?

There are so many hobbies and interests where the rich, meaty information people can benefit from is found on old-school blogs and websites that their owners have maintained without expecting to make much money at all, besides the occasional click-through to an Amazon referral link.

However, those blogs and websites have now become hard to find because they have been pushed down in search results due to Google's changed algorithms and ad-supported websites heavy on SEO – sometimes those ad-supported websites are literal copies of earlier advertising-free blogs where a developing-world freelancer was paid to rewrite all the content just enough to avoid a DMCA takedown. Also, the advertising-supported world of mobile social-media apps has made people today less likely to step outside of their walled gardens and consider small third-party independent websites.

So, to a degree, things would work better in certain cases if targeted-advertising-supported websites disappeared; their decline would reveal a whole world of useful free content that was there the whole time.

reaperducer4• 5 years ago

don't want to be tracked for ads, how do you propose things work?

The way they've worked for the last 400 years. The ads are tailored to the content, not the individual reader.

seanhunter2• 5 years ago

If a highway robber stops you and demands "your money or your life" and you object, they can't justifiably say "well if you don't pay me, how do you propose things work?"

The responsibility isn't on the user to either consent to tracking or to come up with an alternative business model that allows people to monetize things. The responsibility for monetizing things falls on the people who want to do the monetizing. They have to figure out a business model that works and that users consent to.

an_opabinia• 5 years ago

I don't want to be tracked. I never have wanted to be tracked.

Maybe just use Tor.

Stop spying on us, please.

It was probably a mistake to equivocate the kind of data gathering that ad-tech companies do with the kind that oppressive governments do.

dleslie13• 5 years ago

Even services that I _pay for_ block the use of VPNs and Tor; most of the common web services have begun using DroneBL or similar.

reaperducer4• 5 years ago

Maybe just use Tor.

Why should I have to jump through hoops and disguise myself? Why can't Google et.al. just respect the basic human right to privacy?

prophesi• 5 years ago

But it's totally cool if we develop and sell the same tech to oppressive governments.

AlexandrB• 5 years ago

Meanwhile, in the "Company Gives Oppressive Government Access to User Data" thread:

Well of course $company gives $oppressive_regime access to data they collect on their users. They have to comply with local laws!

dTal• 5 years ago

Maybe just use Tor.

That's like diving into a conversation about CCTV proliferation with "just wear a ski mask". It's inconvenient, hinders daily activities, makes you look like a criminal, and might not even help. It's unreasonable.

It was probably a mistake to equivocate the kind of data gathering that ad-tech companies do with the kind that oppressive governments do.

Given that oppressive governments can obtain the data from the ad-tech companies... no, not really.

evrydayhustling2• 5 years ago

It seems like FLoC could make it easier to opt out centrally rather than going through a mess of specific (dis)approvals for the specific trackers on every site. Maybe it could even be a good place for a dial - "I'll expose a 4-bit cohort, but nothing more specific."

It also seems like FLoC could make it more politically viable to crack down non-consensual tracking. Publishers wouldn't be able to say "we have no choice but to deal with this [third party tracker] scum" but could continue to gate content by subscription or (consensual) FLoC as necessary for their business model.

Pushing publishing and advertising towards proactive consent about targeting puts them into a dialog with the market about what's ok, instead of letting them hide behind a bunch of shifting tracker businesses.

dleslie13• 5 years ago

It still coerces consent with a bad default. Sites will refuse to operate unless the FLoC is enabled, or will become obnoxious to use with it disabled. However, if FLoC were disabled by default then sites would be less likely to provide an obnoxiously bad service to those with it disabled.

The best default is not to track at all.

bmarquez• 5 years ago

No tracking is obviously the best choice.

But if FLoC requires the browser to do the tracking itself, would it be possible to fork Chromium, disable tracking, and have FLoC return fake or random data instead?

contravariant3• 5 years ago

Eh opting out of cookies is pretty easy, and opting out of any background fingerprinting is impossible in either scenario.

okl• 5 years ago

It seems like FLoC could make it easier to opt out centrally rather than going through a mess of specific (dis)approvals for the specific trackers on every site.

Wasn't this already the idea behind the DNT (Do Not Track) header?

nuker2• 5 years ago

"I'll expose a 4-bit cohort, but nothing more specific."

You're dreaming. You'll also expose to Google IP and website URL via Referer in requests for fonts and jsquery bundles, in Google cookies masqueraded as first-party via CNAME tricks, in Chrome identifier and so on. Chances are you're using Google DNS 8.8.8.8 too.

I wont trust a company to disable the data source for their main revenue. Just don't use any of Google software and services. Android included, sadly.

freebuju6• 5 years ago

Can you go a day without the Internet? How about two days?

Sadly without this tracking, the engines of the ad economy come to a stop. We have royally ducked up the ecosystem to the point where there's no fixing it. Ever. Even laws such as GDRP won't cut it, Facebook & co. are happy to flout the rules since paying the fines is worth the cost of breaking the rules.

In the case of Google ad money vs Content marketing economy, it really is a case where the chicken came before the egg.

kibwen5• 5 years ago

This seems to imply that without ad revenue, the internet would not exist. But plenty of sites existed and still exist without the support of ad revenue. The price to host a static site is lower than it's ever been (and for sites that provide free hosting, the cost of providing that service is lower than it's ever been). If something like YouTube couldn't exist without ads, then so be it: let them move to a subscription model. There is nothing that says that we must be forced to tolerate ads in exchange for the internet, let alone ads that intentionally obliterate the human right to privacy.

matkoniecz2• 5 years ago

Can you go a day without the Internet? How about two days?

Yes.

Sadly without this tracking, the engines of the ad economy come to a stop.

One more reason to eliminate tracking.

mixmastamyk• 5 years ago

Yes. All I really need are Wikipedia, HN, and Python.org and few other programming sites. I don't mind shelling out a few dollars to support them either.

JoshTriplett• 5 years ago

Sadly without this tracking, the engines of the ad economy come to a stop.

Good. The sooner that happens, the sooner people start building alternatives out of necessity.

alpaca128• 5 years ago

Sadly without this tracking, the engines of the ad economy come to a stop

Two for the price of one? No tracking, no ads? Sign me up.

grishka2• 5 years ago

Any new feature that is added to the user agent should serve or empower said user — not any other parties, including the browser maker and the advertisers. That simple.

anoncake2• 5 years ago

And that's why an ad company should not be allowed to also make browsers.

xxpor3• 5 years ago

That's the thing: Chrome did empower users, that's why everyone uses it! Users just want things to work, and Chrome worked better than IE and FF at the time. FF didn't get multi-process support for a decade after Chrome had it. Did this also serve Google's purposes? Of course. But that's how life works. It's a win-win for Google.

Everyone complains about the evils of Google, but revealed preferences show that focusing on what people actually care about has substantial value.

It's like no one follows what people say about cookie popups. Does your average non-tech user praise the EU for adding the popups and allowing opt outs? Of course not. They complain about these stupid fucking popups they have to click through on every site now!

1vuio0pswjnm7• 5 years ago

<sarcasm>But what about a "free and open web".</sarcasm>

These constant references to "the web" when discussing certain companies is annoying. The www does not belong to any incorporated middleman. I do not care how much traffic they are curently in control of. The www is a medium not a small, privileged group of messengers. How is this company even contemplating something like this. Answer: Because a majority of users choose a browser controlled by an advertising company. WTF.

This company will no doubt exert influence/control over the "standards" process and next thing we know, every developer working on a browser will feel obligated to "implement FLoC". Maybe this is an either-or question. Who is the www for: users or advertisers. The middleman needs both. Advertisers need the middleman and users. But users do not need advertisers. And, truly, they do not need the middleman. Users are creating the content. The middleman just sits in between, spying on everything.

Maybe there needs to be more than one www. Maybe there needs to be a non-commercial www for smart people.

C19is20• 5 years ago

Democracy would work if I were in charge.

frashelaw2• 5 years ago

As long as it remains massively profitable to collect every ounce of data from us, tech corporations are going to keep doing this.

Even with some existing laws, the profits are enough that they are willing to flagrantly violate these laws and simply pay meager fines.

It's also unlikely that we will ever get significant legislation to protect us from this either, because all these tech profits allow big tech to buy our government, because policy is heavily swayed by corporations.

feralimal• 5 years ago

I absolutely agree!

But, the reality we need to accept and work from is that with vested corporate interests aligning so well with intrusive governmental and military interests, nothing is going to change.

Don't hold your breath for privacy protection legislation.

charcircuit2• 5 years ago

Your browser recording history of web pages you've been and saving it locally is not someone else tracking you. Your perspective is seriously warped. Even if they were tracking you, they are doing so to give people better ads to make the world a better place.

centimeter• 5 years ago

to give people better ads to make the world a better place

If you say shit like this unironically, you can't ever accuse someone else of having a "warped perspective".

dleslie13• 5 years ago

Even if they were tracking you, they are doing so to give people better ads to make the world a better place.

They're doing it to improve their ability to coerce me to purchase products and services; not to make the world a better place.

Rampant consumerism has not made the world a better place, not by a long shot.

jszymborski• 5 years ago

The cookie dialogue was dumb, but a FLoC dialogue that only triggered on browsers that implemented it would be an actual deterrent that made a difference for privacy.

asdfasgasdgasdg• 5 years ago

I think they're going to need to state their case in a way that allows Google to still make money and be competitive in the market place. It's not a simple matter of doing it and not doing it. It's a matter of doing it, and making more money or not doing it and making less. Google seems willing to move in the direction of privacy, but it's not going to do so in a way that sabotages the bottom line. It's unrealistic to expect any entity to voluntarily sacrifice its own values for the values of another.

tehlike• 5 years ago

Google has started ramping up their subscription products - googleone in particular.

faichai2• 5 years ago

This is the transition that needs to happen. People just need to get used to the idea of paying for software. Software providers can then focus on making their products better rather than finding streams to tangentially monetise their offerings by invading user’s privacy.

dvfjsdhgfv• 5 years ago

I think they're going to need to state their case in a way that allows Google to still make money and be competitive in the market place.

I'm sorry but Google has no any competition. If you don't want to limit oneself to, say, Facebook users, you pretty much have to buy Google's ad services.

fitblipper2• 5 years ago

If their intent is to convince Google, then I agree. If the intent is to convince the public and policy makers, I don't think they need to re-frame it. I am okay letting a company (even a complete industry) fail if society has decided that the industry or business practices are parasitic.

Privacy is a freedom which has many parasites (state and private entity driven) attacking it and I welcome changes to perception, regulation, and law which places safeguards around it.

izacus10• 5 years ago

And do you consider a complete ban of 100B+ advertising industry and complete ban of tracking (happily used by governments) a likely outcome?

Even the mighty Apple still tracks analytics data and separates that into a separate switch from the ones limiting non-Apple tracking.

musicale• 5 years ago

Are CCPA (privacy act, not credit protection act) (and California's data broker law) and GDPR having any affect on data brokers and credit bureaus?

edit: apparently credit bureaus are exempt from CCPA

richardwhiuk• 5 years ago

I don't think GDPR has really tested it's legal teeth yet.

sofixa10• 5 years ago

https://www.enforcementtracker.com/

M2Ys4U• 5 years ago

The UK's ICO knows that the adtech industry is breaking the law.

They've purposely done nothing about it. They've even bragged on their blog and in their annual statement that they've done nothing about it :(

beermonster• 5 years ago

Citations?

oytis5• 5 years ago

"Legitimate interest"

karmakaze2• 5 years ago

Federated Learning of Cohorts (FLoC)

I hate the use of new/uncommon acronyms/initialisms without immediate clarification, a form of clickbait. So many paragraphs down to see what it's called. Expected more from EFF.

ncann• 5 years ago

Come here to say the same, I actually had to click on the github link to learn what it meant first. Should've explained it the first time it's brought up instead.

jcrawfordor• 5 years ago

In the case of reverse-engineered acronyms like this one, I think there's a judgment call that you need to make: in some cases it is simply not useful to expand the term. They explain what FLoC means very early on, but the expansion of the acronym conveys very little information since it is technical, somewhat nonspecific, and it's clear that the acronym was designed before its meaning.

Consider, for example, that it's uncommon to expand military program acronyms because their meaning is often less useful than saying "it's just a word."

inopinatus2• 5 years ago

The EFF is also milking the super creepy feeling from Google naming their technology for labeling humans, after the group noun for sheep.

cyphers• 5 years ago

Hello! Author here. thank you for raising that, this was an oversight (due to moving text around in the editing process) that has been fixed. Totally agree that acronyms should be defined on first use.

beervirus• 5 years ago

All modern adtech is a terrible idea.

Let's go back to banner ads that are "targeted" based on what type of website you're looking at, rather than based on vacuuming up as much private info as possible about users.

Shared4042• 5 years ago

This is also the conclusion I came to.

Ban advertising targeted by tracking, and you remove the incentive to track in the first place.

sodality23• 5 years ago

Yeah, revenue for that is pennies to the dollar compared to tracking. I am not defending it but it is not a simple switch to stop being evil and everything is fine. Hundreds of thousands of services would shut down that relied on ads to function. Which, again, they are relying on a predatory business model, but still.

kibwen5• 5 years ago

Hundreds of thousands of services would shut down that relied on ads to function. Which, again, they are relying on a predatory business model, but still.

You appear to understand the situation, so I'm not sure why you bring this up as a problem. If a business is utterly incapable of operating without resorting to an unethical business model, then the solution is to shut down the business rather than abandon ethics.

rileymat2• 5 years ago

Is the revenue for that pennies on the dollar because tracking exists, or is that what it is worth?

I have no expertise in this, but I don't see why anyone would pay for banner ads for more than pennies on the dollar if tracking is an option.

Wouldn't removing tracking change the economics?

jacinabox• 5 years ago

It seems to me that as long as advertisers have ingenuity they will find new privacy harming ways of tracking us -- it seems like Goggle is moving earth to use their ingenuity instead to make a tracking device that isn't 'too identifying,' and could reasonably form the basis of a 'truce' between users and advertisers -- maybe we should let them?

phnofive• 5 years ago

I agree, but mainly because I don’t know how much more valuable targeted ads based on past actions are than current site/intent.

Say, for example, an payday lender buys a banner on example.com/r/povertyfinance – could that not be construed as predatory in the same way as building a poverty FLoC based on browsing history?

thekyle• 5 years ago

Ironically some of the most profitable ads on the web (those that appear on search results pages) are almost completely contextual. So clearly targeting is not always necessary.

kall4• 5 years ago

If this actually goes anywhere, I'm kind of excited about it from the perspective of a product developer.

Being able to do content recommendation for fresh visitors without any tracking effort of your own would be pretty cool. It will probably come with a dialog, so users will likely opt out often for ads or on page load, but not if they just clicked "show me movie recommendations" in your app.

nmeofthestate• 5 years ago

It will probably come with a dialog

Oh Christ I hope not. Any replacement for the current setup has to get rid of that blight. Should be a single opt in/out decision when you start using the browser.

kall4• 5 years ago

It would be a browser level dialog, so good browsers can give you that option, like safari does for other permissions.

coffeefirst2• 5 years ago

Won't work.

The proposed designs never expose segments (err, cohorts, whatever) to the page. This machine works for managing targeted advertising in Chrome, and... that's it.

jrochkind12• 5 years ago

The OP says:

The draft specification states that a user’s cohort ID will be available via Javascript, but it’s unclear whether there will be any restrictions on who can access it, or whether the ID will be shared in any other ways.

Is this incorrect?

kall4• 5 years ago

No, they explicitly do.

cohort = await document.interestCohort()

I mean it‘s a proposal. I‘ll believe it when I can use it, but maybe actually look at the proposal.

ttt03• 5 years ago

Will I be able to opt out from this?

esperent3• 5 years ago

I guess we'll find out in a few weeks when testing starts. My guess is that it'll be hidden deep in about:config somewhere.

0xy• 5 years ago

Given Google's other tracking practices (X-Client-Data and leaky modern APIs like AudioContext), very unlikely.

X-Client-Data cannot be disabled (it's hard-coded) and ships telemetry to DoubleClick without disclosure.

Google Chrome is the DoubleClick browser. Why else would DoubleClick be hardcoded into the source as a place to send telemetry?

izacus10• 5 years ago

I'd assume that you can use a browser that doesn't send this data?

kibwen5• 5 years ago

Until Google sites start deliberately breaking if you don't send this data (or your browser is known to implement any other feature intended to circumvent it), thereby destroying the market share of any browser that dares to do so.

ttt03• 5 years ago

Too bad that almost all of them are Chromium based now.

I wonder if websites are going to block you out if you don't have this enabled. Like they do with adblockers.

darren_• 5 years ago

Yes: https://github.com/WICG/floc

"Whether the browser sends a real FLoC or a random one is user controllable."

FLoC stuff is client side. You can send nil FLoC IDs. You can randomize them on every request. You can swap them with your friends. Whatever.

Vanilla Chrome might not let you (my money would be on an off-switch but not anything fun) but that's hardly going to be a blocker.

(googler but works on something completely unrelated)

dathinab2• 5 years ago

That is until they combine it with DRM tech similar to the current web DRM plugins which "certify" that you use a google approved FLoC implementation which sends proper data or you will not be able to visit the site because you get spammed with endless CAPTCHAs

data_spy• 5 years ago

If it's terrible, look at the other suggested solutions. Some are ultra terrible and will slow down the web

querez2• 5 years ago

That framing is based on a false premise that we have to choose between “old tracking” and “new tracking.” It’s not either-or. Instead of re-inventing the tracking wheel, we should imagine a better world without the myriad problems of targeted ads.

This seems backwards to me: the alternative to "targeted ads" are "untargeted ads", aka Spam. Who would rather have spam than targeted ads. Sure, spam might be easier to ignore, but it's also not effective from the company's perspective: showing the ad only to people who might be willing to spend money seems like a good thing to me. It's certainly economical. Which is why I feel like targeted ads are not something we can get rid of.

Hard_Space3• 5 years ago

Who would rather have spam than targeted ads

I would, because the targeting creeps me out entirely. Instagram were so good at it that I deleted the app. In the old days, you stuck luxury advertising in rich neighborhoods and used demographics for broadcast and other media. That'll do.

querez2• 5 years ago

Why should that do when you can do better? Why stop there? That would be like saying "post everything programming related on r/programming, that'll do. Let's ignore that there are more focused venues for my content".

Don't get me wrong, I'm not keen on getting tracked, either. But I can totally see that from a company's perspective, if you can make sure that only people who are interested in your product actually see the ad, that's better. You don't annoy people who aren't interested (not everyone in a rich neighborhood cares about a BMW ad, some already have a Tesla) and you increase effectiveness.

MayeulC• 5 years ago

I place targeted advertising in the "creepy spam" category. It's still spam.

If I was to receive an unwanted phone call from a travel agency while I am browsing plane tickets on the net, that would be creepy and annoying to me: I prefer to make thoughtful decisions by myself, thank you.

I realize not everyone thinks the same way. But in my opinion, advertisement has a severe net negative impact on our society, and would like to get rid of it altogether.

I already pay for targeted advertisement that comes in the news articles I read, no need to force-feed me.

I've seen that fun video (in French [1]) where a person asks various advertisers their opinion on the role of advertising in the society, then asks them about an "electric knife" ad that was then running. The cognitive dissonance that follows is hilarious.

[1] (1990, no subs): https://www.dailymotion.com/video/x869qr

wott• 5 years ago

I've seen that fun video (in French [1]) where a person asks various advertisers their opinion on the role of advertising in the society, then asks them about an "electric knife" ad that was then running. The cognitive dissonance that follows is hilarious. (1990, no subs)

Beside Séguéla who dares asserting that advertising makes people more intelligent and is a public service for democracy, the angry one is now congressman (for the right-wing party of course, 20 years of mandate and counting) :-)

pornel• 5 years ago

This "it's either no privacy or you get spam" is another false premise. Google has built their empire on ads based on search keywords and topics of websites you visit. Personalized cross-site tracking is a relatively new and small addition.

bentona• 5 years ago

Interesting take from another market leader: https://www.thetradedesk.com/us/knowledge-center/googles-mov...

jrochkind12• 5 years ago

What do you mean by "market leader"? "another"? Are you calling the EFF a "market leader"?

unabridged• 5 years ago

99.9% of the interactions with the internet should be read-only and could be delivered via something like IPFS. Make browsers read-only by default and closely monitor when information is sent out.

Noughmad• 5 years ago

I really don't understand the problem here. It looks like FLoC will entirely depend on the browser (which Google controls if it's Chrome). So the browser will analyze your browsing history (and since it's Google, it will probably connect to everything else Google knows about you) to request targeted ads.

But, what about the people who don't use Chrome? I would hope that most people who know what EFF is already don't. Firefox will surely come with a way to disable it, or you'll configure it to always send "my little pony" or something like this.

In the end, this seems to really be about Google (with a browser) competing against Facebook and other ad providers (who don't have a browser).

jdlshore• 5 years ago

The big problem with FLoC, as I see it, is that it makes fingerprinting vastly easier. Your FLoC bucket narrows you down to one of several thousand users, rather than one of several million, and that's before fingerprinting applies.

Ironically, it seems that FLoC makes user tracking easier, not harder.

I see no upside in FLoC for me as a user, and plenty of potential downside. I'm glad I use Firefox.

jackson14422• 5 years ago

Without making any drastic changes to my browser to intentionally inhibit fingerprinting, I already have a unique fingerprint according to https://coveryourtracks.eff.org/, so this honestly doesn't signal a change to me at all. I just run uBlock Origin to block trackers/ads.

EMM_386• 5 years ago

Firefox will surely come with a way to disable it

What's interesting is that since these "FLoC cohort" identifiers are generated by the browser itself, it's even easier than "disabling" it.

They just won't implement it in the first place.

MaxBarraclough• 5 years ago

Just what I was thinking. The article doesn't clearly answer the question of what level of browser cooperation is necessary for FLoC. I use Firefox. When I'm not using Firefox, I'm using Safari. Does this mean FloC won't affect me?

FLoC is meant to be a new way to make your browser do the profiling that third-party trackers used to do themselves

This seems to hint that avoiding FLoC is just a matter of avoiding Chrome, with no 'arms race' of any sort.

max-ibel• 5 years ago

I find it ironic that Google's 'sign in with Google' and oAuth methods only work if you allow third party cookies.

At least, I have not figured out how to use it without enabling 3rd party cookies.

brofallon• 5 years ago

I'm wondering how hard it would be to reverse-engineer the FLoC algorithm that assigns ids based on browsing history.. could one just have a bunch of headless browsers randomly visit sites, and compute the FLoC ids periodically to see what types of sites end up producing which ids? This seems important since being assigned a group ID that includes a bunch of people might not be so bad, but (as the article suggests) if its well known which web sites are included in the group, that's a more disturbing story

DreadY2K• 5 years ago

If you run an advertising company, you could probably just pay people a small amount of money to get their browsing history and their FLoC id, and enough people would take you up on that offer that you'd get that data (and maybe also demographics), without having to do any work to reverse-engineer.

tarkin22• 5 years ago

I failed to see how flocks (cohorts) change the dangers of tracking or targeting.

Cambridge Analytica didn't want to target a person. They wanted to track people. Flocks of people.

fshbbdssbbgdd• 5 years ago

I think the average person that cares about tracking worries about the privacy implications if someone can look at their individual actions/conversations, but not so much about being marketed to as part of a group.

The actions of Cambridge Analytica-type groups are an important issue, but I don’t think FLoC is trying to solve that.

tarkin22• 5 years ago

By being part of a group, or likely groups, their individual actions can be ascertained.

m0llusk• 5 years ago

Saying please do not seems like a weak strategy for containing this. Financial pressure to target advertising is huge. There will have to be ways of defeating or at least detecting this.

frashelaw2• 5 years ago

As long as it remains massively profitable to collect every ounce of data from us, tech corporations are going to keep doing this.

Even with some existing laws, the profits are enough that they are willing to flagrantly violate these laws and simply pay meager fines.

msg• 5 years ago

I'm intrigued by the idea that users will be able to solve this problem on the client side. Perhaps not on the underlying data directly, but running an adversarial browser agent clicking its way purposefully through the internet, in a tab you never look at.

tgragnato• 5 years ago

Or an “adversarial browser extension” clicking its way through the internet.

https://adnauseam.io/

I tried this, but after some time your IP just gets flagged for click fraud.

It's interesting because you won't see ads anymore, but you also won't be able to pollute more datasets.

Overall it’s been a “meh”

berkes• 5 years ago

If it is calculated client side, what keeps my browser (or a plugin) from always returning 42 as my ID?

That would hide me rather well, especially if implemented by a large browser like safari or Firefox.

mycologos3• 5 years ago

One of my pet meta-theories about Hacker News is that the frustration expressed over several apparently different stories really has a single source: Hacker News likes the internet of 10-20 years ago a lot more than the average person.

One place this shows up is a frequently-expressed sentiment that the internet is a less magical, less weird, and more corporate place than it was 10-20 years ago. Part of this may be because SEO has diluted the voices of individual creators. But part of it is also because way more average, everyday, tech-unsavvy people are on the internet now.

Another example is the periodic highlighting of somewhat garish HTML-based websites. I like these too! My own personal website falls in this category! But as far as I know, the generic internet user likes the generic slick-graphics-and-whitespace style, and so go the websites that want to attract them.

More relevant to the topic at hand, many comments in this thread argue that targeted ads are unnecessary for a functional internet, since the internet of 20 years ago seemed to work just fine without targeted ads. But, again, it's less clear to me that general internet users -- that is, mostly people who never experienced the internet of 20 years ago -- have the same preference.

It's funny, because I'm to a large extent on HN's side on this one. But my enthusiasm is tempered by my sneaking suspicion that the other side is a lot bigger, and my side is actually powered by more elitism and nostalgia than I thought.

ErikVandeWater2• 5 years ago

I would say that the average HN user isn't so much opposed to targetted ads as they are opposed to organizations that are unaccountable to them storing their personal information in an insecure way. And Google, Facebook, Twitter, etc. all provided information to the NSA so it could illegally spy on almost every American with access to the internet.

vaidhy• 5 years ago

This also seems to be a tech-elite/libertarian mindset and borders on paranoia. Does the average voter care enough to vote one way or other for it? I would suspect not.. they have bigger problems to deal with and they seem ok with government knowing something about them.

jefftk3• 5 years ago

If that were the case, then wouldn't you expect the average HN user to like FLoC? Targeted ads, where the personal information is stored securely in your browser.

(Disclosure: I work on ads at Google, speaking only for myself)

nuker2• 5 years ago

they are opposed to organizations that are unaccountable to them storing their personal information in an insecure way.

.. unaccountable to them storing their personal information. Period.

guerrilla• 5 years ago

So basically you're saying it's like Eternal September spread everywhere. I don't hear normies liking tracking much though, quite the opposite.

__blockcipher__2• 5 years ago

I think one way to put it is that normies don't like a visible reminder of what the service/organization knows about them, but are otherwise perfectly content to not care about how the sausage is made. (Which is understandable since naturally a non-tech person isn't going to have a good mental model of what cookies, HTTP requests, tracking pixels etc are)

In other words, you can track the normies all you want as long as your app doesn't do something "creepy" that reveals how much it really does know about them

g_p3• 5 years ago

Indeed, there's a couple of data points suggesting that when users are asked for informed consent for tracking, only around 9% agree. That was true across both the UK information commissioner's website, as well as a small commercial shop website (from memory).

It strikes me that, as you say, even "normies" don't like tracking.

I think the problem is when sleek services obfuscate how they work and users don't understand what happens.

The average "normie" doesn't realise that, by default, a cloud service provider sees all their data in the clear. They assume it's somehow private, but haven't seen behind the veil to understand how services work. And the increasing complexity of the tech stack means understanding it becomes harder and harder every day that goes by.

kristofferR• 5 years ago

I don't torrent much anymore, but one of the things I really love about private torrent trackers are the forums.

They're stuck in the mid 2000s, in all the best ways.

Technologically they're ancient (usually HTML tables), the amount of users grow slowly (if at all) and are limited to maximum a few thousand (usually just a few hundred actively using the forums though). Users won't risk their treasured accounts by acting badly, and since very few join private trackers for the forums you get a wide specter of different people participating, in their different ways.

Some users are silly and post memes, others post long and thought through replies, often in the same thread. Everything is discussed, from politics to the latest movie. There's no "karma" to earn.

After a while you start recognizing the same people. I'm really glad I still have access to it, otherwise I would feel kinda lost in today's internet, where you need to find a new site/subreddit for every topic. No tracking either for that matter.

xenocyon• 5 years ago

I'll admit I like some aspects of the internet of 20 years ago more than today's. I don't like our current world of targeted ads, SEO, overlays, scripts, autoplay videos, and a thousand trackers. But I don't think this makes me that different from today's average internet user - just different from today's average marketer. Indeed, noxious marketing-friendly/user-hostile devices existed in some form 20 years ago as well (intrusive banner ads, popups etc).

ehsankia5• 5 years ago

Today's average user comes to the internet for Youtube, TikTok, Twitter, Twitch, and maybe more "useful" stuff like Maps, Translate, Docs, or information like news, recipes, guides, etc.

None of this would be possible without ads. No one is going to pay for all that.

tomc1985• 5 years ago

Does that make the HN side any less valid? Without resistance we let the forces that be do whatever they want. I don't find that to be acceptable, especially when so many of us are actually in a position to change things, if only our masters would let us

mrtksn3• 5 years ago

The "good" internet was run by rich people's money, we had a good run because someone paid for it without expectation to make the money back right away but to acquire " internet real estate". Now these people want their money back, they want to scoop the returns of their investments.

Google, Youtube, Facebook, Twitter, Reddit were all magical. Digg was also magical but it died out when tried to scoop returns in inelegant way.

Rich people did not become rich and don't stay rich by giving money away. When Youtube was advertiser unfriendly it was magical but it was also burning a billion $ a quarter, the same goes for all those "evil" companies. It all was a scheme to create and grow a market up until they run out of people. When they run out of people, it's time to make the money back out of it. Hmm, maybe I should remove the " " of "evil" but I am not sure. What was the alternative? The French "internet" maybe, but it died if in the face of capital fuelled frenzy of the American internet.

BTW, that's why I am an Apple fanboy, I like the idea of directly paid services. The relationship is simpler.

nr2x• 5 years ago

Oddly I’ve not yet heard the NSF described as “rich people”.

oytis5• 5 years ago

I'm probably too old, be "Google, Youtube, Facebook, Twitter, Reddit" are not "old internet" to me. I would rather think of a network of self-hosted web pages with unique and not marketing-driven content that people produced for fun. And yes, I feel a lot of nostalgia for that - I know such pages still exist but they are overshadowed by the "Web 2.0" which sets the rules, both directly and indirectly.

amelius• 5 years ago

BTW, that's why I am an Apple fanboy, I like the idea of directly paid services. The relationship is simpler.

Except you don't really own your hardware :(

fermienrico• 5 years ago

This is a weird take. Just because you're going meta, does not invalidate that the internet has turned into a steaming pile of shit since last 10 years.

It sounds pseudo-englightening without any substance. Ok, you've observed this meta aspect of HN. So, what?

mycologos3• 5 years ago

So, what?

I agree that it's not a very deep observation, or maybe even not true. But it 1) seems to explain several different reactions I see on Hacker News, and 2) it illustrates a trap that I, as a Hacker News user, find myself falling into without realizing: the belief that the thing I want is the thing that other people want. To me, it's good to be aware of that.

theodric• 5 years ago

I can't speak for anyone else, but I miss the early Web mainly because I was young, had my life ahead of me, and everything was an unknown frontier to be explored.

Do you remember how f'in hard it was to find stuff online back when a) there was less stuff online and b) you had to use a metasearch engine like Metafind or Dogpile to aggregate the terrible results from multiple engines into something remotely useful? Remember surfing because actively searching fog data was next to impossible? Remember 300ms-per-hop latency and being impressed by 6KB/sec downloads, taking a week to download a Linux distro and rarely upgrading your packages because it took forever? Remember that day in 1998 when the world changed because some Stanford project called 'Google' appeared? I do. I won't go back. I have a few PDP-8s and a PDP-11/03 and various 8-bit micros and some Teletypes and 80s-90s UNIX systems and Winboxen if I want to go back to the old days. They're not dead, they're still here and they still do exactly what little they did in the past. I don't love how dystopian tech has become, but it's a ton more useful to me and most other people than it was 10, 20, 30 years ago.

InvertedRhodium• 5 years ago

Home, and the internet I remember, are both not only a place but a specific period in time. As I get older the phrase "You can never go home" has really started to resonate with me.

yuhong• 5 years ago

Remember that day in 1998 when the world changed because some Stanford project called 'Google' appeared?

You may want to see https://en.wikipedia.org/wiki/Draft:Effects_of_the_2007-2008...

totetsu• 5 years ago

I kind of wish the next generation of my family wasn't having thier young minds and perception of tech shaped by the corporate dystopia net. Even if I did have to download the the matrix as a multi part rar file in tiny resolution, or leave Napster running all night on a noisy desktop to get that Radiohead album mp3s.. it's better than bugging a parent for credit card like an addict to buy some cosmetic skin for a game.. skins used to be free and fan made mods! https://ut99.org/viewtopic.php?t=3471

DanHulton• 5 years ago

There's no need to go back, and every reason to go forward. Just because a lot of tech has gotten very good is no reason we have to passively accept that it can't get any better or friendlier or safer.

To abuse a metaphor, we're not advocating throwing the baby out with the bathwater, but that bathwater still _has to go._

jeegsy• 5 years ago

That stanford project is very different from the behemoth today. I think thats the point.

salawat• 5 years ago

You misunderstand.

The hatred of targeted advertising comes more out of what it systemically enables, and incentivizes. The mapping and realtime exploitation of UUID like-metadata collected through ubiquitous surveillance. Dossiers were the things of novels and intelligence agencies, nowadays marketers have sold people (even those like you) that somehow this gratuitous invasion of your privacy is normal, desirable, acceptable, and even more insidiously, always was.

Nothing could be further from the truth. You now have multiple dossier's that will follow you around the world. Some governments will deny you entry unless you surrender access to any social media accounts.

None of what is normal about the web today was ever at all what made the early web magical. You weren't monetized. You were reaching out and leaving something of yourself out there, and finding that there were like minded individuals to you the world over!

You also had the cloak of anonymity. Anything on the net was a non-issue. Controversial viewpoint? Whatever. Really need some insight on XYZ? Trawl the BBS's or a chat room.

Nothing was as centralized as it is now. People didn't do daft things like trying to put things you shouldn't on a fundamentally insecure network. People weren't so dependent on things that the ne net was more... Relaxed. Not a full time deal.

I have no illusions the magic has faded not just due to age and familiarity, but to what it has become, and what it has enabled the world to become.

bawolff• 5 years ago

But, again, it's less clear to me that general internet users -- that is, mostly people who never experienced the internet of 20 years ago -- have the same preference.

This may be the case, but i don't think we can draw the conclusion from that that they like the new internet, only that we dont know if they do. Which is a very different conclusion

That said, i think the real reason is that the internet sold out and went corporate. I think its pretty similar to what happens when an indie band makes it mainstream - all the original fans tend to hate the change.

astatine• 5 years ago

I suspect its as much due to the speed as anything else. The internet has moved from early adopter/enthusiast to ubiquity in less than a lifetime. In fact, in less than a working career time span. I imagine that rate of change is not going to keep the early adopters as thrilled as they used to be.

OnlyLys• 5 years ago

Recently I asked my non tech savvy mom if she wanted to join YouTube Premium with me under a family plan so that she doesn't have to see ads on her YouTube any more.

Her response was "No thank you. I like the ads. Sometimes I see things I like".

rglullis2• 5 years ago

Ask her if she likes all the implications that comes with giving in to all the privacy invasion and manipulation that comes with those ads that she might like.

Ask her if she would give up on the ads that she sometimes likes if she learned that ad tech makes us addicted to our computers, more socially isolated, less likely to connect to our family and community, etc. IOW, ask her if she would trade the ads on Youtube for better quality time with her children and (potential?) grandchildren.

Giving in to ads because "some ads are nice" is no different to think that a diet based only on heavily processed foods are nice because "some of it taste good".

"The ads are annoying" is the last of the problem with the ad-based economy. People do become ad-blind after a while. The problem is all the tracking, profiling and the "eyeball-based website funding model".

Hard_Space3• 5 years ago

This is why I'm not going to bother with a Pi-Hole. For my girlfriend, half the things she likes to look at would disappear.

On a more positive note, I bought my 81 year-old Dad 'Mindf*ck: Inside Cambridge Analytica’s Plot to Break the World' for his birthday in January. He's so knocked out by it that he sends me PDF scans of certain pages. So probably the way to go is starting with a little covert education.

marricks2• 5 years ago

What a cop out. Why carry water for the awful way the internet is heading?

Perhaps it’s because the net of the past used to be a “wild frontier” not owned by a couple companies is why people have nostalgia. Those companies can make major decisions for the web based on solely on securing their own profit.

40four3• 5 years ago

I don’t understand the line of logic here. What does nostalgia for the internet of twenty years ago have anything to do with the way big advertising takes advantage of us now?

They use underhanded, arguably immoral, technological tricks that most general internet users might not even be aware of, much less understand how to defend themselves. It has nothing to do with the fact they never experienced the ‘old’ internet, they just don’t understand how or why they are being taken advantage of.

The HN crowd isn’t mad about obscene privacy practices because of nostalgia. They’re mad about it because they understand the actual technological mechanisms behind it, and how they work. And why the way big advertising exploits those mechanisms is so f’ed up.

Edit: Sorry, maybe I’m getting too angry. I think I see what you were going for, about many HN frequenters pining for the days of old. But I don’t agree with the idea that general internet users who weren’t online back then are okay with the current state of big advertising tracking technology. I think they just have no idea how or why it works.

I think many people are confused and frustrated that seemingly every random site or social media app they use seems to be aware of everything they do and look at online.

cm20122• 5 years ago

Besides encouraging people to buy things you might think they don't need, what's an actual harm people experience from targeted ads as opposed to non targeted ads?

judge20202• 5 years ago

I think OP’s just trying to say that we’re the vocal minority - Google has literally billions of users yet HN gets ten million or so unique monthly viewers[0] (my estimate from 2015 stats). I think we’re nostalgic but for different reasons than what OP suggests - that is, we want a web not driven purely for profit at the expense of privacy (and whether or not FLoC solves this is discussed elsewhere in the comments).

https://news.ycombinator.com/item?id=9220098

mycologos3• 5 years ago

I think I see what you were going for, about many HN frequenters pining for the days of old. But I don’t agree with the idea that general internet users who weren’t online back then are okay with the current state of big advertising tracking technology.

Yeah, my original post is not very clear about this. I'm not trying to argue that general modern internet users like the targeted advertising ecosystem. Instead, reading through some of the discussions here -- and past discussions of similar topics -- many of them at some point feature one user saying "tbh, i think it's fine if getting rid of targeted ads means losing a lot of revenue, because the old internet did just fine without all that revenue". But "how appealing is the old internet to modern internet users?" is a different question. And it's one where, I think, HN users overestimate the number of people that agree with them. My overall suggestion is that it's good to check whether or not this assumption is getting made somewhere along the way in these kinds of arguments, because I think for a lot of HN users, it is getting made.

gerash• 5 years ago

The problem I see mainly is people complain about something without providing a usable alternative.

Most of the web tech are open source so it's just a matter of forking an existing tech and convincing others to use your thing instead. If your thing breaks half the existing workflows that's your problem, not others'

KirillPanov• 5 years ago

Hacker News likes the internet of 10-20 years ago a lot more than the average person.

Isn't that tautological? "The average person" knows nothing (or almost nothing) about the Internet of 20 years ago.

AshWolfy4• 5 years ago

I have no nostalgia for the internet of old, the internet for me growing up with facebook, reddit, and newgrounds, i just dont want my privacy violated

nine_k• 5 years ago

I like your observation. I do not completely agree, though.

A tech-unsavvy user often dislikes "targeted advertising", as much as I could observe. For one, for the weird cross-media targeting effects, when a person sees the same ads, or ads about the same thing, like a fridge, following the user on many unrelated sites. It's most annoying when this keeps happening after the user has bought a fridge, and is unlikely to buy another just yet.

A less recognized but more annoying effect of ads is that they consume as much CPU and network latency as possible without making some sites outright unusable. The user says: see, I have this new and powerful computer, and this new and fast network thingie — why is the internet so slow? This is when installing even a simple ad-blocking extension shows the difference very vividly.

BTW I think that truly targeted ads can be useful — such laser-precision ads in Facebook showed me a few niche communities that interested me, e.g. dedicated to chiptune music creation. But most ads I see when I browse without ad-blocking are pretty lame, maybe 2% are well-targeted (and then I click on them). I keep a separate browser profile without ad-blocking to see what the internet is like for a vanilla user. OTOH the amount of tracking normally present on innocuous sites is surprisingly large, and slows things down rather unpleasantly, even if the ads are served instantly.

So yes, the internet full of ads is the norm for last 20+ years, and no, "normal users" do notice the impact of it.

vntok• 5 years ago

It's most annoying when this keeps happening after the user has bought a fridge, and is unlikely to buy another just yet

On the contrary, the most likely moment any random person online is to buy a fridge is just after they bought one: we know they had a need + awareness of the desired specs + intent to buy, so it's really just a question of convincing them that fridge B is better than the one they bought.

Buyer's Remorse is basically free in many countries, ex 14 days to return item in the EU.

de6u99er• 5 years ago

My problem is, that the data collected is not only used by advertisers.

ehsankia5• 5 years ago

Advertisers don't collect data, and ad-tech companies don't sell users data.

oytis5• 5 years ago

I really doubt that an average internet use is craving for being tracked. GDPR seems to be widely supported in Europe, the only thing that annoys people are numerous "give us consent please" pop-ups which some attribute to GDPR itself, not to advertisers' attempts to track people despite GDPR.

BrianOnHN• 5 years ago

Another example is the periodic highlighting of somewhat garish HTML-based websites. I like these too!

I've learned that the mainstream sees these and thinks "bot" or "fake" websites.

It took me quite a while to understand what they were saying, which was that my designs, ones that I'd considered minimalist, just plain sucked.

AlchemistCamp• 5 years ago

You got me.

I feel nostalgia for lower gini coefficients and less widespread surveillance.

Even if my point of view is in the minority on this issue, I do not regret it at all.

karmakaze2• 5 years ago

Here's the part of how does this work that's my TL;DR.

A browser with FLoC enabled would collect information about its user’s browsing habits, then use that information to assign its user to a “cohort” or group. Users with similar browsing habits—for some definition of “similar”—would be grouped into the same cohort. Each user’s browser will share a cohort ID, indicating which group they belong to, with websites and advertisers. According to the proposal, at least a few thousand users should belong to each cohort (though that’s not a guarantee).
If that sounds dense, think of it this way: your FLoC ID will be like a succinct summary of your recent activity on the Web.
Google’s proof of concept used the domains of the sites that each user visited as the basis for grouping people together. It then used an algorithm called SimHash to create the groups. SimHash[0] can be computed locally on each user’s machine, so there’s no need for a central server to collect behavioral data. However, a central administrator could have a role in enforcing privacy guarantees. In order to prevent any cohort from being too small (i.e. too identifying), Google proposes that a central actor could count the number of users assigned each cohort. If any are too small, they can be combined with other, similar cohorts until enough users are represented in each one.

[0] https://en.wikipedia.org/wiki/SimHash

In computer science, SimHash is a technique for quickly estimating how similar two sets are. The algorithm is used by the Google Crawler to find near duplicate pages. It was created by Moses Charikar.

So...in addition, Google can use all the users' CPUs instead of their own.

poundofshrimp• 5 years ago

The major flaw here, as pointed out in the article, is that third-party websites can tie authenticated users to their FLoC ids. This is much worse for privacy than the status quo.

On the flip side, if opting out of FLoC is a single switch that turns off all third party tracking, then it makes opting out a breeze (compared with ad blockers now).

jojobas• 5 years ago

Can't imagine why anyone would think it's a good idea.

A browser leaking browsing history was considered an outright bug (https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...).

One could standardize a list of things people would want to fill out about themselves (i.e. please put in your age and sex or else we can't guarantee you won't be hassled with ads of things completely irrelevant to you), but your software inferring things about you and snitching to the world is outright malware.

alfiedotwtf• 5 years ago

Feels like URL rewriting in some form (maybe in the form of XHR pings) will come back into fashion to skirt any future cookie laws or browser mitigations

srswtf1232• 5 years ago

There is no scenario in which Google should be trusted.

They’ve squandered that trust over the years. Frankly they should be broken up.

inakarmacoma• 5 years ago

Genuine, honest question. Are posts like this written by bot or bought propaganda? Nonspecific, knee-jerk overreaching generalizations, inspiring fear, uncertainty, and doubt. Who aims to gain, if it's the case? It's that incentive enough to warrant a smear campaign. I can't prove it. It just feels off. That's my hunch.

popcorncowboy• 5 years ago

Even if it is astroturfing (my hunch is no), it taps into a genuine, honest zeitgeist that gets plenty of air on HN. Google is practically a cliche for bad-faith acting these days, and the apostasy of abandoning its nobler founding sentiments (the "don't be evil" hypocrisy) rankles many. Knee-jerk it may be, but it's closer to war-mongering within a sympathetic circle than it is to smear-campaigning.

srswtf1232• 5 years ago

I'm reasonably certain I'm not a bot, and I'm 100% certain no one is paying me for my unpopular opinions.

So: who aims to gain from my comment? Well, if Google were to be broken up, and some amount of privacy restored to all of us, I'd say society would gain.

No one needs to mount a smear campaign against Google. Their own actions are damning enough.

Perhaps if you existed outside your karma coma, you'd see it. Perhaps if I existed outside the anger and rage that makes me comment as "srswtf123", I'd take your point of view. But I doubt it. That's my hunch.

perryizgr8• 5 years ago

A browser with FLoC enabled would collect information about its user’s browsing habits, then use that information to assign its user to a “cohort” or group.
Each user’s browser will share a cohort ID, indicating which group they belong to, with websites and advertisers.

Sorry, I'm out. My browser is my agent. I don't want it to analyse my browsing data and send the resultant classification to random machines over the internet. Why is this even a thing? Browser's job is to display websites, not spy on the user.

If advertisers want to track me, they can create their own software and entice me to install it. Oh wait, that's exactly what Google did with Chrome :(

roody15• 5 years ago

Why do we need user tracking at all. Advertisers can operate based on the sites that are relevant. For example let’s say a magazine website cpumagazine.com is popular. Advertisers for computer parts, computer services etc can pay to be ads on this site.

The point is the individual user doesn’t need to be tracked for advertising to work.

It’s a false choice thinking we need 3rd party cookies or a. special browser based UUID ad profile.

The truth is we don’t need either and advertising can still be effective.

Ronsenshi2• 5 years ago

What you're describing used to be called contextual advertising which worked perfectly fine based on the content of the page user views.

It just wasn't bringing all the excess profits that advertising corporations wanted. So, enter the fingerprinting and tracking. Like a stalker following you around the web, gathering data on what you are and what you might want to buy.

throway4234324• 5 years ago

Google has promised that the vast majority of FLoC cohorts will comprise thousands of users each, so a cohort ID alone shouldn’t distinguish you from a few thousand other people like you. However, that still gives fingerprinters a massive head start.

This is far fewer bits than one's IP address (> 32), unless you're using a VPN or have some weird ISP doing NAT for its users.

dathinab2• 5 years ago

ISP doing NAT for its

Or your IP address changing frequently, a properly not really applying to FLoC.

ericholscher• 5 years ago

This is exactly why we're building EthicalAds. It's an ad network that only targets based on the content of sites, doesn't allow any third-party media, and is currently only focused on a developer audience: https://www.ethicalads.io/advertising-vision/

We had the same choice on Read the Docs, but didn't really have any other way to make money but advertising. We decided to build ethical advertising, so that we could be proud of the ads we show, knowing we weren't adding to massive pool of data out there. I talked a bit more about it here: https://www.ericholscher.com/blog/2016/aug/31/funding-oss-ma...

ttiurani• 5 years ago

Fully agree with EFF here, and what's most frustrating is that Google could actually be on the side of banning tracking, and win big over Facebook.

Google had a fully working, very lucrative business model in search term based ads. You search for "office rent Arizona", and Google shows you ads about offices in Arizona. No privacy violations.

There was no other problem with search term based ads except that Google wanted to pump up shareholder value faster than what that could give them.

danShumway• 5 years ago

I agree with a lot of this.

Last time FLoC came up, I commented that the idea of FLoC missed the point of why we oppose tracking: https://news.ycombinator.com/item?id=25906791

The EFF writes:

The power to target is the power to discriminate.

I would extend on this point: the power to target information that the user is not choosing to share is the power to discriminate. Part of recognizing people's agency online is giving them the ability to choose how they present themselves and to choose what they share. It's not inherently wrong to say that someone might want to signal something about themselves that they find important or even just convenient to share. But that should always be their choice, it should not be a top down decision about what information is "safe" or "dangerous".

FLoC has some benefits (although they won't matter once every website decides to use FLoC as a fingerprinting vector), but even saying that FLoC has benefits, it is still based on the idea that users should not be in charge of their identities. It's got to be automated, it's got to happen in the background, it's got to use machine learning and be something that users can't inspect. I oppose the philosophy behind both current tracking systems and proposals like FLoC.

Last time this came up I also theorized about what a privacy-respecting version of FLoC could look like for people who do want to see ads or who do want personalized content online -- what a version of FLoC could be that I would be more supportive of: https://news.ycombinator.com/item?id=25907079

None of those ideas are fleshed out, but they try to get at the heart of what the fundamental difference is between allowing a user to easily signal that they want to see personalized content about shoes, and trying to intuit behind a user's back that they will buy shoes if you show them a particular ad.

nexthash• 5 years ago

I mean... what do you expect from Google, or any internet advertiser for that matter? If 90% of your revenue comes from advertising, getting rid of tracking is like pulling the chair out from under your bum. Having a committee of advertisers sitting on a board governing advertising & tracking in the W3C is going to go about as well as you expect. Conflict of interest: massive.

Their only concern is maximizing their revenue in any way possible, because otherwise they will cease being competitive and go out of business. Ergo this lovely new "Privacy Sandbox" that provides advertisers with a standardized, direct way to get to you. As long as Google or any other advertiser has sway over Internet standards, there will be a fox guarding the henhouse type situation. Moral of the story: don't use Chrome.

supermatt• 5 years ago

I am still not sure how and what google are doing to generate these cohorts or label a browser accordingly.

This article talks about simhash. My understanding is that simhash does NOT perform any such analysis but generates a fingerprint based on the content that is comparable to those of similar content - for example, a checksum of my HN homepage is different to yours, as it contains user-specific information. Simhash, however, gives us a comparable "fingerprint".

In short, this only works for identifying pages of similar content - by itself i cant see how it could be used for cohort analysis unless there is either a client-side ML model involved, or millions of simhashes are shipped with the browser.

I raised this question the other day, and a googler pointed me to the "code". That code contained no reference to an ML model, its construction, or datasets. The code also contained no pool of simhashes. To me, that means that there is no way to label the browser with cohorts. Furthermore, the code appears to generate these simhashes, and then sync them to google via (the account identifiable) chrome sync. It is there that analysis is performed. Maybe this is why it's called "Federated LEARNING", instead of "Federated INFERENCE"?

Is this truly what we can expect from this? That instead of google tracking our behaviour from ONLY their analytics and advertising partners, they will now be secretly collecting a hash of EVERY page we visit and sending it to google directly? How is this private? The whole point of a simhash is to establish similarity between pages - and google has a huge rainbow table of simhashes for their search.

I got downvoted for raising this concern before. I would appreciate if someone would tell me what I have wrong instead of piling on the downvotes. Noone seems to be talking about this.

finchisko• 5 years ago

How will browser behave, when you combine no-store and no-cache in a single header?

jokoon• 5 years ago

What made advertisers thrive is now going away. I guess it was time.

leotaku• 5 years ago

This signals to me that Google thinks that Chrome either has, or will soon have, a significant enough market share where it is realistic and useful to move their invasive tracking methodology from the web into the browser. Maybe they also realize that any sensible browser vendor which is not also an ad giant should already be blocking web-based tracking technologies. So why even try to make them compatible.

Honestly, as long as Firefox is still compatible with most sites, this won't hugely impact me. After that, I don't know.

yholio• 5 years ago

So the floc is supposed to change one week over the next, but it most likely will remain correlated to previous values. It will provide something like 10-15 bits of entropy. You then have the geolocation from your IP provider, another good 10-15 bits. And then of course you have the browser fingerprinting, even my Brave leaks 18 bits.

It seems trivial to write a machine learning model that can correlate slowly drifting flocs with the other information. And this is especially true if one already knows the sites that the old floc has been visiting, for example via Analytics data, so you can predict the direction of the floc drift and uniquely identify the majority of web users.

Essentially, Google is not proposing limiting tracking, it proposes raising the entry bar into tracking so that a centrally placed company that can correlate all this data has a massive advantage. I wonder why.

And for the punchline, they call it... democratization!

zimmen• 5 years ago

So after years of profiting from the dark practices cookies allowed they decided to replace them with something new, better, more powerful, and potentially harder to block (when they decide to make it mandatory or burry it so deep that the average person can’t find the off switch).

Are we supposed to be grateful now? Are we expected to celebrate this as a “huge win for the end user”?

This looks like a typical case of “fighting symptoms, not the cause”.

lovemenot3• 5 years ago

If FLoC is what I have understood it to be then, I support it.

Two things in FLoC's favour: The algorithm is open-source and it's client-side.

It would be trivial for developers of ad-blockers to provide tools for anyone who cares about privacy to inject poisoned data into their stream. And for those who don't care, well it's a market and they are free to choose to partipate or not.

fartcanister• 5 years ago

So, big companies have big appetites. This article should end at line: "multi-billion dollar advertising-surveillance industry on the Web"

minusSeven• 5 years ago

It is bad idea for one company(whatever it maybe) to be gatekeeper of the web. Thing is in today's world it is more a question of when rather than if. And it seems like there is nothing we can do about it except not be part of it. Even that won't work if everyone is part of it.

We are progressing more towards a dystopian reality where nothing is really in our control.

pull_my_finger• 5 years ago

Something I didn't know was a thing, that I really shouldn't be surprised about, is that website owners actually jump through some hoops to further sell out the users privacy. FB has the "Conversion API" where they enable website owners to basically "manually" track you by attaching an ID to users and sending "events" to FB via their API, in lieu of try to do so with a tracking pixel. Literally, it's an API to subvert people trying _NOT_ to be tracked with ad blockers and hostfiles etc. FB isn't even the only company that has an API like this, apparently, it's pretty established and developers/site owners are more than happy to narc you out if it means they can extend their advertising reach a little.

yasinaydin• 5 years ago

To block all these ads and tracking, I am already using DNS over TLS/HTTP, NextDNS with custom DNS block lists (including almost all CDN's, Google Services, fonts etc), ADblock Plus with custom lists, Ublock Origin, Firefox, extensive browser settings (blocking cookies or JavaScript unless whitelisted, blocking almost anything except images), isolating websites in Firefox containers, custom privacy settings for each website I have an account at, DuckDuckGo, iOS with only necessary apps and very strict settings, Arch Linux with custom settings, etc etc...

Yet there are still ads or tracking. And it doesn't look like it's getting any better or easier to opt out.

Google’s FLoC Is a Terrible Idea

Related Stories