Rebranding FLoC Without Addressing Key Privacy Issues

https://brave.com/web-standards-at-brave/7-googles-topics-api/

by skellertor • 4 years ago

185 111 4 years ago

jqpabc1233• 4 years ago

"Don't be Evil" wasn't a motto --- it was a warning.

A peak into their mindset that foretold what they were thinking and where they were headed.

They sell you and your privacy to their "associates" --- aka, anyone willing to pay in some way. Their concern for your interests only extends to the level required to invade your privacy.

The thing I find most disappointing is the fact that it took so many so long to realize this.

fartcannon3• 4 years ago

Totally, or maybe a canary clause.

1vuio0pswjnm73• 4 years ago

As I recall the phrase was originally a comment from a new employee who had previously worked in the hardware industry.

Still baffled by the ambiguous name given to this secretive, exploitive set of companies, "tech". What the heck is it. Its everything and nothing, IMO. A cover.

The company is an intermediary, what many in other industries refer to as a "middleman". HN commenters have tried to attack this term in the past, but I just saw it a few months ago being used in a marketing slogan on the side of a company van. People outside of HN know what it means. Perhaps those who argue it is ambiguous on HN are "tech" workers who are aware of its accepted connotation in the real world. Otherwise why be concerned with the term.

nl• 4 years ago

Paul B worked at Intel before Google. He never worked in telecoms. Incidentally he was moderately active here in the FriendFeed days.

Tech means technology. Nothing ambiguous about it.

dylan604• 4 years ago

The thing I find most disappointing is the fact that it took so many so long to realize this.

The lure of "free" useful things is greater than most's concern/understanding of the capabilities of tech. Gmail is useful. GDocs is useful. Search is useful. Googs has been very smart on exactly the tools they've brought to market so that the lure is maximized.

david-cako• 4 years ago

i hope we find each other in our versions of the internet

smoldesu5• 4 years ago

This comes from the people distributing an ad-fuelled cryptocurrency called "Basic Attention Token". I'll take their word with two grains of salt and a tall glass of water, please.

fellellor• 4 years ago

At least you get paid for having your privacy treated as a commodity. If these people are selling indentured labor, then google is straight up promoting slavery. Brave is obviously the lesser evil.

cmeacham98• 4 years ago

"Lesser evil" implies Chrome and Brave are the only 2 reasonable options. You could install Firefox or ungoogled-chromium and an ad/tracker blocker.

colordrops7• 4 years ago

How is it evil at all if it's opt-in?

GeorgeWBasic2• 4 years ago

They aren't forcing it on you. It's opt-in. Google's trying to force things on all their users: manifest V3, this, et cetera.

colordrops7• 4 years ago

The brave-hate meme is self perpetuating at this point. Brave is privacy-oriented out of the box. You have to opt in for the ads and crypto. Isn't that what everyone has been asking for? opt-in instead of opt-out? I'm convinced that Google is behind a smear campaign against Brave. If Brave got real traction it could be a serious threat to their business.

tentacleuno• 4 years ago

I politely disagree. When I use Brave, I always see these "Tip" buttons on GitHub, Reddit and Twitter despite going out of my way to disable Brave's Rewards scheme. It really grinds my gears when a product forces these sort of schemes onto me (hence why I mainly use Linux instead of Windows), so I uninstalled Brave.

fartcannon3• 4 years ago

I would use Brave if they didn't use chrome as a backend. We need more diversity in rendering engines otherwise things like FLoC happen.

sneak• 4 years ago

FLoC has nothing to do with rendering and can easily be removed from the codebase. People make this argument a lot but I don't think it makes logical sense. We all use libicu too, what does that ultimately matter?

fartcannon3• 4 years ago

Well that is great news.

It ultimately matters because if we didn't all use Chrome, Google would have to compete more on good things, instead of building bad things that we have to remove. Basically, it's the position of the privacy whack-a-mole oveton window.

akvadrako• 4 years ago

Diversity of code bases limits the impact of bugs and implementation quirks.

For example I used to be part of a team that ran an important DNS service. We purpously used several different server softwares on different nodes to increase resiliency.

kmeisthax• 4 years ago

Rendering engine diversity is a different problem. In order to actually have a web standard, then we need at least two frequently-used implementations. If there is only one implementation, or one dominant implementation, then people stop coding to the spec and start coding to whatever works in browser.[0]

Right now, if Mozilla goes bust, then the last hope for web standards is the fact that Apple's mobile OS rules preclude shipping Blink on iOS. If everything is Chrome, then we're right back to the days of Adobe Flash Player, where bugs in one implementation effectively become part of the spec.

If we didn't have or didn't care about this problem, then yes - we could just clip FLoC out of the browser and run that. However, that also assumes Google won't mandate FLoC or ban alternative browsers. Their recent attempts to cut down on credential stuffing through headless CEF browsers[1] have already made it harder to actually ship an alternative browser that can log into Google. So hypothetical future Evil Google could totally say "no FLoC, no service" and we would be screwed.

[0] This is the same reason why WebSQL died on the vine. SQL is a standard with a lot of wiggle room, enough that most applications either only work on one particular flavor of DB, or ship separate drivers for each DB they need to work with. In practice everyone shipped SQLite, so WebSQL was just "here's a sandboxed SQLite instance".

[1] Which, BTW, is not a bad thing in and of itself.

tadfisher• 4 years ago

If you want to ship a browser without writing a browser engine, there are three realistic options. Chromium is the best of these options.

eitland• 4 years ago

[...]there are three realistic options.

Is the Librewolf option included in those three? Because that (a patch on top of newest Firefox) is something I have been wanting for a long time and I just recently realized someone had done it.

Chromium is the best of these options.

Easiest is maybe the word you are looking for here?

Because best depends on your goals. If your goal is to reduce dependency on Google (as it is for many here) it could be close to directly counterproductive.

WithinReason• 4 years ago

I believe Brave was initially (supposed to be?) based on Firefox but needed support for a feature that only Chromium supported and had go with that.

donkarma• 4 years ago

feature was DRM

bfung3• 4 years ago

Use a different browser that’s not chrome.

Problem solved.

Disclaimer: I don’t use Brave because I don’t want to see more ads. In the 90s, there were little banner ads that ran on your pc in the same app that helped you connect to the internet. That’s essentially what Brave is, except I don’t NEED to see more ads, as I needed to pay for internet in the early days. Just us a browser that blocks cookies.

ocdtrekkie• 4 years ago

Brave is far from being my primary browser, but this is far from an accurate take.

I wanted to play with Brave Rewards, and it's actually surprisingly involved to enable it and get it to start showing ads... By default, Brave is pretty much "just another Chrome clone", albeit with default privacy settings that everyone but Chrome has accepted should be standard.

FWIW, NetZero was pretty cool if you couldn't afford the phone bill for using AOL. :P

thinkmassive• 4 years ago

In the 90s, there were little banner ads that ran on your pc in the same app that helped you connect to the internet.

NetZero & Juno, the good ol’ days of free dialup!

mike_d• 4 years ago

NetZero was the best. When you created an account with their custom dialer it generated a username and password pair (that the user didn't know) for the local dial-up POP in your town. The credentials were stored in a text file using a substiution cipher, so you could extract them and create your own Windows Dialer profile to get free internet without having to use their dialer that showed ads on your screen.

colordrops7• 4 years ago

How are you seeing ads in Brave? I don't see anything. I believe you have to turn them on, no?

bfung3• 4 years ago

How are you seeing ads in Brave

I don’t, I’ve never used Brave.

From https://brave.com/brave-rewards/

   Brave Ads do not replace current web page ads. By default, Brave blocks privacy-invading web ads and trackers that are embedded in page content. Joining Brave Rewards and viewing Brave Ads does not affect your current blocking settings for each website you visit. The ads you see as part of Brave Rewards are shown separately from your browsing experience and are not the same as the invasive, performance-sapping ads embedded in websites.

But I can already block ads with uMatrix and other ad blockers. So why do I need another browser that does essentially the same, but adds more complexity to the mix, potentially more browser bloat? So instead of funneling ad spend to google, it’s funneled to Brave - but that doesn’t really make a difference to me as a consumer. I can donate or buy products of creators I want to support w/o dealing in BAT.

josefx3• 4 years ago

Wont work, the moment this lands in Chrome websites will check for it and if your non chrome browser doesn't implement it they will redirect you to an upgrade your browser page. Browsers that fake it will get the same treatment, do not track has already shown that advertisers will not respect any attempt to prevent tracking by the user.

asvitkine• 4 years ago

Controversial opinion:

Why is that wrong?

If you want to consume content that costs money to produce that is being paid for via advertisement, and your user agent blocks said advertisement, why should you be entitled to that content?

waffle_maniac10• 4 years ago

I use 100% of my earnings to donate creators (mostly YouTube and Github). I'm very generous and very cool.

newscracker2• 4 years ago

This is Google extending an invite to the EU and other regulators to bring their war hammers and forever ban browser makers from pushing targeted ads and enabling profiling of people. Maybe break Google up and make the Google Chrome team a separate company with restrictions on how much it can work hand-in-hand with Google? Anyone in the EU who can file complaints about these abuses of market power?

Tell the people you know to switch from Google Chrome to another browser as their primary one. Google will still pester them on Google’s online properties to install Chrome, and may resort to other tricks on Android. But we are at a time when this can gather momentum and result in some good for all in the future (not mainly for Google, as it seems to be now).

petre2• 4 years ago

How can the EU break up a US company?

kittywav• 4 years ago

https://about.google/intl/ALL_us/locations/?region=europe

If you don't want to follow the rules (against anti-competitive practices) of a certain set of countries, perhaps you shouldn't have offices in that set of countries? Just an idea...

newscracker2• 4 years ago

GP here. I didn’t mean that EU should break it up. I had said “EU and other regulators” to mean the ones in the U.S. too. Other replies here have provided more substantive options that the EU could exercise to force Google to break up. I’m not saying it will be easy or quick, but it’s possible to make Google’s business more painful.

3836293648• 4 years ago

It's not a US company. Google is Irish.

Sure, it's a technicality, but Irish law still applies

speedgoose2• 4 years ago

Floc was not enabled in Europe, and was probably never going to be enabled because of its high incompatibility with GDPR.

anticristi2• 4 years ago

Ditto. EU already solved the problem -- legally, not technically. A few fines later, Google is actually really privacy-minded to EU citizen. I get a yearly reminder to do a privacy checkup and can disable Google tracking if I want to -- which I do.

California and Virginia also enacted similar laws. More lawmakers need to understand tech.

hackerfromthefu4• 4 years ago

This is the answer - forever ban targeted ads.

Ads should be a display only HTML tag that just allows limited read only display WITH NO JAVASCRIPT. This would remove tracking and malware and force ads to be targeted on the content page not on the user.

1vuio0pswjnm73• 4 years ago

Here is one way to disable "FLoC"

chrome://settings/privacySandbox

Evolution from FLoC

FLoC ended its experiment in July of 2021. We've received valuable feedback from the community^1 and integrated it into the Topics API design. A highlight of the changes, and why they were made, are listed below:

FLoC didn't actually use Federated learning, so why was it named Federated Learning of Cohorts?

This is true. The intent had been to integrate federated learning into FLOC but we found that on-device computation offered enough utility and better privacy.

FLoC added too much fingerprinting data to the ecosystem

The Topics API significantly reduces the amount of cross-site identifiable information. The coarseness of the topics makes each topic a very weak signal; different sites receiving different topics further dilutes its utility for fingerprinting.

Stakeholders wanted the API to provide more user transparency

The Topics API uses a human-readable taxonomy which allows users to recognize which topics are being sent (e.g., in UX).

Stakeholders wanted the API to provide more user controls

With a topic taxonomy, browsers can offer a way (though browser UX may vary) for users to control which topics they want to include

The Topics API will have a user opt-out mechanism

FLoC cohorts might be sensitive

FLoC cohorts had unknown meaning. The Topics API, unlike FLoC, exposes a curated list of topics that are chosen to avoid sensitive topics. It may be possible that topics, or groups of topics, are statistically correlatable with sensitive categories. This is not ideal, but it's a statistical inference and considerably less than what can be learned from cookies (e.g., cross-site user identifier and full-context of the visited sites which includes the full url and the contents of the pages).

FLoC shouldn't automatically include browsing activity from sites with ads on them (as FLoC did in its initial experiment)

To be eligible for generating users' topics, sites wil have to use the API.

https://github.com/jkarlin/topics

It is remarkable to me that Google can freely experiment on whomever they wish. If the experiments demonstrate negative effects, e.g., generation of execssive amounts of fingerprinting, it's unfortunate for those who were swept up in these "experiments".

Why not ask users if they want to volunteer to particpate in a trial/experiment.

Imagine if drug companies did not obtain permission to test their compounds on new patients. Instead they just substituted the new drug into what they sold on the market. Same label. Chrome is Chrome, right. Nevermind all the undisclosed variations and experiments. For example, "field trials" identified by only a number. This is hardly informed disclosure and consent.

1. This is amusing. What users were solicited for feedback. Perhaps they are referring to some surveillance they conducted, looking for mentions of FLoC.

chrismorgan• 4 years ago

Here is another way to disable "FLoC":

https://firefox.com

speedgoose2• 4 years ago

Another one :

https://ec.europa.eu/immigration/index_en

adamsvystun• 4 years ago

I hate tracking as much as the next guy, but this article is so disingenuous that it's painful to read.

If you literally look up the most upvoted HN article about FLoC [1], it specifies two main issues with FLoC in BOLD: Fingerprinting and Cross-context exposure. Which if I understand correctly the Topics API fixes. But the article implies that these are minor problems that we never really cared that much about.

Whether it is this or constant aggressive writing, it seems that the goal of this blog post is to simply inspire anger and hate, while not furthering the discussion on the topic. Which makes this article unhelpful (if not damaging) to the goal of personal data privacy.

[1] https://news.ycombinator.com/item?id=26344013 [2] https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-...

xg155• 4 years ago

In some sense you are right - the article hasn't much useful criticism of Topics in comparison to FLoC (and the Brave plug at the end makes it read like an advertisement).

However I think the article is right in the sense that we shouldn't miss the forest for the trees. Image you were robbed and the robber suddenly asked if your issue with him could be solved if he only took half of what's in your wallet. Surely that would be an improvement but it doesn't solve the root issue of him robbing you in the first place.

In the same sense, I think pulling attention back to the fact that Google is building third-party tracking right into the browser - and also aggressively protecting the whole concept of tracking as some sort of fundamental necessity of the web - is justified.

throwawaythekey• 4 years ago

Image you were robbed and the robber suddenly asked if your issue with him could be solved if he only took half of what's in your wallet.

The pejorative robbed is doing a lot of heavy lifting here. Advertising is how users pay for free services. Making the form of payment more agreeable is a worthwhile goal.

As full disclosure I earn a living in the advertising ecosystem. Any feature that means stakeholders stop asking me to invent backdoor fingerprinting and correlate against data obtained from shady brokers is a welcome step in my opinion.

hackerfromthefu4• 4 years ago

Nonsense, as an individual that values my privacy I don't want to be distracted by Googles PR - Google is clearly a stalker, and users want it to stop!

The blog post makes sensible points identifying Google's PR based response. Thus your ad hominem attack on the blog instead of the content makes me wonder if you have conflicts of interest regarding this topic?

sva_• 4 years ago

Whether it is this or constant aggressive writing, it seems that the goal of this blog post is to simply inspire anger and hate, while not furthering the discussion on the topic.

There isn't much to discuss, I would think. This is an extremely user-hostile feature to be implemented in the clients (browsers) which comes with a lot of downsides, and absolutely no benefit to the user. I don't know how detached people at Google must be to consider this okay, or to think that any of the privacy-focused browsers would join in on this.

hackerfromthefu4• 4 years ago

The people implementing this know it's not okay, their plan is to use monopoly power to force it down the world's throat.

Rygu• 4 years ago

FLOC stands for Federated Learning of Cohort.

cma• 4 years ago

If Google succeeds in making the whole web Amp, they won't need FLoC anyway.

Rebranding FLoC Without Addressing Key Privacy Issues

Related Stories