It implies that other browser vendors (Mozilla, Safari/WebKit, new Edge) are in fact making the Web a more dangerous place.
I believe it's dangerous because it creates a harmful, unproductive PR narrative—people might just assume this is a true statement, without learning about both sides of the problem. I'm not trying to strip anyone of agency, I just don't think most of my friends would have time to research this topic and might decide to follow the main opinion instead.
The answer I'd like to hear: Yes, it does push some actors towards fingerprinting, but preventing fingerprinting should be dealt with regardless. Changes should happen both on legislative and browser-vendor level.
> But it is clear for me how all this anti-thirdparty cookies situation will go further: server side third party ad trackers -- this will bypass Same Origin Policy and will pose a privacy and security threat for users and websites even more than todays third party frontend ad trackers.
Server-side as well as white-labelled (subdomain) integrations already exist. Lotame (DMP) has at least one product of this kind, afaik.
That said, Apple/Mozilla/etc know this and so they are simultaneously trying to make fingerprinting more difficult. If they were not, I would agree with Google's stance. But since they are, it is really more of a footnote.
You forgot to mention them abusing children and planing terror attacks.
No terror stuff, but plenty of anti-Semitic material.
This might very well be true for what I know, but the general idea that optional privacy leads to more hostile environments seems to have been conclusively destroyed by HN and certain other forums, especially when compared to Facebook.
FB is interesting in that you would think that it would inhibit all bad behavior since you are using a real name. But really, people don’t care quite so much. Much improved though! Well, except for the bots, hacked accounts, and bad actors.
From the standpoint of dealing with crap messages, there are no silver bullets. But there are tools. Not everyone knows how to snowshoe, so you can have a decent win with even simple blocks.
Same Origin Policy does not seem to provide any protection against DNS-based tracking.
For example, putting a series of links to resources in a page and making conclusions from the series of DNS requests made automatically by "modern" browsers like Chrome, Safari, Firefox, Edge, Opera, etc.^1,2
To be fair, this sort of tracking is arguably brittle, e.g., if user has auto-loading of images disabled or is not using a cache that randomises the ordering of IP addresses within a response packet like BIND.
It can also be easily avoided by user control over her client automatically making DNS requests for any resource^3 and user control over her own source of authoritative DNS data. For example, using a client that does not automatically load resources and using a local source of DNS data like a HOSTS file or a zone file served from a logging authoritative server on localhost like tinydns.
1. https://www.ndss-symposium.org/wp-content/uploads/2019/02/nd...
3. Not just images or third party scripts
Not very reliable when user disables it or uses client that does not support it.
HTTP headers are malleable yet I still see the big tech companies appearing to treat them as reliably identifying a program/device. A new user-agent string or set of HTTP headers is not necessarily a new program/device.
Arguably gun owners, strip clubs and porn magazines have fought for free speech more than facebook and google combined.
I am happy to willingly share my personal data with your advertisers if that helps you keep profitable (NYT, Reason, Cato, Vice, Pornhub etc.) you need to figure out how to achieve that without acting like jerks.
But these discussions will soon go into "how easy it should be to opt in?". Should it be a pop up like "allow location" or something more complex as enabling CORS.
From my perspective, good. Advertising is toxic even when it's not invading my privacy, and maybe if we make it less effective people will do less of it.
This is exactly what happened during the first dot com crash when we went from $35 CPM banner ads to $1. Suddenly, ads were slathered on every page or websites simply disappeared. What we really need is a deal that works well for all three parties: advertisers, consumers and content providers. Google Adsense was this perfect solution for a while (until it got optimized to max profitability).
Maybe online advertising is like social networks and can only enjoy brief moments of relative balance before the cycle starts anew.
I don't think such a thing actually exists. I mean, there is a way to do advertising that doesn't require spying on everybody -- contextual ads -- but advertisers seem to consider that a bad outcome, and instead are spending a lot of time and energy trying to figure out how to continue to spy on everybody.
The problem right now is that it's all mingled together.
Sure you can. "Use check-out code 'newspaper1' to get 5% off any purcahse!" or something.
1. Find out about content I want. Decide to pay for it. Pay for it. Receive content. A simple, fair transaction where everyone gets what they want with no bullshit.
2. Find out about content I want. Receive content, along with ads that spy on me, distract me from the content I actually cared about, and tell me my girlfriend isn't hot enough, my car isn't fast or luxurious enough, my house isn't big enough, my family isn't safe enough, etc. Under the barrage of this constant psychological attack, I'll occasionally fall for it and end up spending much more money on things that I don't need than I would have spent on the content. And yet the content that I actually cared about and wanted to pay for only receives a fraction of those profits.
As I understand it today, I can view an ad on a random site and have a cookie with my unique ID in it saved. If I view other network ads, they know it's me and update my profile. Then when I check out, the site I'm buying from reads this cookie and reports back that it worked based on impressions.
AFAIK this won't be easy to replace if a random eCommerce store is blocked from reading Facebook et al cookies, it won't be able to report back reliably. You could do something like submit their email address or other data to Facebook and see if you get a hit, but that's probably illegal in many places without permission. And in most cases, the cookie from the ads will be blocked as it's third party (but would be able to be written for ads shown on-platform, which doesn't really matter since they can track server side anyway).
But clicks are very easy, you just tie a unique ID to the ad URL and have the landing page and checkout page track that. No cookies needed. It can report back in real time or later to update stats.
The browser will not make cookies from other sites available to the e-commerce site. There is no chance for the e-commerce site to take a look at what is in the Facebook cookie
I meant the 'page' (including the FB pixel JS on it) could read the pixel but the problem is of course the page is composed of resources from multiple domains and parties.
I'm pretty sure these days the default is just a JS ping to an endpoint, but the eponymous pixel exists under noscript tags for legacy support.
Which is of course the intent.
AFAIK, all that matters is how many conversions you get from $ spent. Both of those are perfectly visible, no tracking needed.
Maybe it helps society to go back to such models over destroying privacy.
(And as answer to the question: Statistical methods by comparing areas/times with no ads vs. with ads etc.)
As much as many HN readers would love to see ads and even the most benign forms of tracking to disappear, if you're aiming for something realistic (e.g that would still allow ads to exist and be a minimum profitable for all involved) you cannot just go back to the dark ages, and show the same ads to everyone.
You can - without detailed tracking - identify rough location of the user. (IP etc.)
You can pick ads based on the content, not based on the user. (A site with beauty tips probably has different readers from a site on woodworking; a site with celebrity news has different readers than deep political analysis)
And yes, Google and Facebook would make less money (disclaimer: I have a handful Alphabet shares in my portfolio and probably funds containing those) and yes spread would be higher, but this could still pay a lot of bills and interestingly could lead to revert from clickbait to proper content, as readers of proper content are more likely the target audience for high-paid ads.
Not willingly, but perhaps they can be forced through legislation. In any case, as long as the industry insists on spying on me, I will continue to fight them tooth and nail.
Ads are pollution, and need to be treated as such. Information providers need to develop business models which do not depend upon advertising revenue. (foundations, Patreon, whatever).
Short term: Less tracking is good. (Not only for privacy, but also since I don't want to see "optimized" content – I want to be surprised, contradicting opinions etc. like in a good newspaper)
The one thing that you can't reliably do, browser privacy or not, is gathering the useless number ad-companies currently rely on.
Would these users be using Chrome in the first place?
The Google search engine could be run for some small number of billions per year (or less) but Google extracts tens of billions per year from our pockets. It's a leech on society in the same way that Wall Street is.
They successfully propagandized the idea that "relevant ads are good" when it's patently obvious that relevant search results are what you want from a search engine. There's no need for ads at all.
This caught my attention, as I haven't heard anything about this before. Do you have a source with more details on it specifically? All I see is that Google pays Mozilla to make Google Search the default search engine and pays Adblock Plus to whitelist their ads. I'm not seeing any sources indicating that Google paid Mozilla any money to keep ad blocking out of their standard feature set.
But Google really has no choice here due to aggressive campaign by Mozilla, Apple and Microsoft who boast with their Intelligent Tracking Prevention ( https://webkit.org/blog/8828/intelligent-tracking-prevention... ) implementation blaming Google as a company which does not value users privacy. Google would lose privacy-conscious users otherwise.
But it is clear for me how all this anti-thirdparty cookies situation will go further: server side third party ad trackers -- this will bypass Same Origin Policy and will pose a privacy and security threat for users and websites even more than todays third party frontend ad trackers.