Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is Stack Overflow trying to start audio?

meta.stackoverflow.com

Post reply on HN
Print view View original

31–40 of 416 posts

Re: Why is Stack Overflow trying to start audio?

#31

Post by inglor »

Why is this surprising to anyone? It is clear that ads use tracking mechanisms and cookies and this is no different.

Audio feature detection isn't even a novel techique.

I've seen trackers look at download stream patterns to detect whether or not BBR congestion control is used, I have seen mouse latency based on the difference between mouse ups and downs in double clocks and I have seen speed-of-interaction checks in mouse movements.

Just checking for the constructor of something an ad might legitimately use (like audio) is relatively benign to be honest and it is naive to expect ads to not do this and it is why I use an ad blocker even on sites without annoying ads

Re: Why is Stack Overflow trying to start audio?

#32

Post by inglor »

inglor wrote: post #31

Why is this surprising to anyone? It is clear that ads use tracking mechanisms and cookies and this is no different. Audio feature detection isn't even a novel techique. I've seen trackers look at download stream patterns to detect whether or not BBR congestion control is used, I have seen mouse latency based on the difference between mouse ups and downs in double clocks and I have seen speed-of-interaction checks in…

And as a fun fact networking timing fingerprinting attacks and work even if you don't have JavaScript enabled and I have been able to make a PoC that was very accurate (I did not release it but I did disclose some bits to relevant parties)

Re: Why is Stack Overflow trying to start audio?

#34

Post by noobermin »

yoz-y wrote: post #20
Gibbon1 wrote: post #15

Earlier quoted context omitted.

I think ad blocking is a misnomer. What people are trying to do when blocking ads is prevent marketing people from spying on them. And the performance and resource consumption that comes from that. Personal opinion: Laws are needed to make what advertisers are doing illegal. Advertisers are spying on people to the extent where if the government did it they'd need a warrant.

I disagree. The tech crowd is using adblockers to prevent spying and resource consumption. But majority of people running adblockers just don't want to see ads.

I think the reality is more complicated. People sort of suspect being spied on, but it's hidden, not so real. It's abstract so if you ask any reasonable person, they'll say they don't like the spying, but few will take an impairment in function for something they use in order to avoid it because it seems somewhat distant.

Re: Why is Stack Overflow trying to start audio?

#35

Post by BonesJustice »

yoz-y wrote: post #20
Gibbon1 wrote: post #15

Earlier quoted context omitted.

I think ad blocking is a misnomer. What people are trying to do when blocking ads is prevent marketing people from spying on them. And the performance and resource consumption that comes from that. Personal opinion: Laws are needed to make what advertisers are doing illegal. Advertisers are spying on people to the extent where if the government did it they'd need a warrant.

I disagree. The tech crowd is using adblockers to prevent spying and resource consumption. But majority of people running adblockers just don't want to see ads.

In most cases, I don’t think it’s ads as concept that’s the problem. If websites only had static ads in the sidebar, I question how many people would bother with ad blockers.

But when ads block content; include flashing animations, audio, and video; and take up more layout space on a site than the actual content; then people have had enough.

Re: Why is Stack Overflow trying to start audio?

#37

Post by JimBrimble35 »

Aside from the obvious usability benefits, this kind of thing makes it abundantly clear why much of the web has gone to javascript dependent SPAs. If you need JS to run the site, then you also have to leave it on to be tracked/fingerprinted.

Kind of makes sense why companies like Google and Facebook have invested so much in creating open-source front-end frameworks. The ROI is probably phenomenal.

I get that stackoverflow isn't an SPA, it just made me think of this point.

Side-note: you can block JS on stackoverflow and still view answers. That works for 98% of my usecase for the site.

Re: Why is Stack Overflow trying to start audio?

#38

Post by captn3m0 »

A little bit of corporate newspeak (and digging):

Ad URL: https://static.adsafeprotected.com/sca.17.4.95.js

JS Domain: adsafeprotected.com

Domain Owner: Integral Ad Science, Inc[0]

Google's recent stance on the matter of fingerprinting[2]:

>Chrome also announced that it will more aggressively restrict fingerprinting across the web. When a user opts out of third-party tracking, that choice is not an invitation for companies to work around this preference using methods like fingerprinting, which is an opaque tracking technique. Google doesn’t use fingerprinting for ads personalization because it doesn't allow reasonable user control and transparency. Nor do we let others bring fingerprinting data into our advertising products.

The important part being: _Nor do we let others bring fingerprinting data into our advertising products._

The same company advertises their fingerprinting capabilities:

>Browser and Device Analysis: We analyze the technological fingerprints of browsers and devices in order to uncover bots fraudulently posing as human users. We can validate what type of mobile or desktop device a browser is running on, providing additional context with which to identify fraud.

And it is this fingerprinting that gets them selected as a Google Brand Safety and Viewability Preferred Measurement Partner[1]

>New York, NY – Integral Ad Science (IAS) has been selected as a preferred partner in Google’s Measurement Program for both brand safety and viewability. Partners were selected after meeting rigorous standards for accuracy and using reliable methodologies to measure KPIs that matter for marketers. The program is designed to make it easier for advertisers to source trusted, third-party measurement providers.

The gist of it being that Google has heavy cognitive dissonance, with their advertising wing rewarding partners that fingerprint users (against their own policies), and the Chrome team barely managing to introduce some anti-fingerprint measures, which are clearly not enough.

[0]: https://integralads.com/capabilities/ad-fraud/

[1]: https://integralads.com/news/google-selects-ias-brand-safety...

[2]: https://blog.google/products/ads/transparency-choice-and-con...

Re: Why is Stack Overflow trying to start audio?

#39

Post by saagarjha »

superasn wrote: post #22
apetresc wrote: post #13

Earlier quoted context omitted.

> And while we're at it the container should just spit out random shit like different resolution, audio api, user agent, once in a while (unless the user turns it off) to thwart such attempts. Wouldn't that break the legitimate feature-detection uses for these APIs? Asking the user to identify and whitelist each call is impractical, especially since the fail-case in this scenario would be subtle (you'd still see the…

Yes I thought about it that's why "unless the user turns it off" comment in parens. I think out of 100 sites I visit everyday no website needs to access the audio api without my consent maybe except one or two which i can whitelist. Same for user agent, I don't think it should break if the container says I'm running firefox v65 or v67, etc.

Changing the resolution sounds like it would break a lot of websites, though.

Re: Why is Stack Overflow trying to start audio?

#40

Post by ehsankia »

inglor wrote: post #31

Why is this surprising to anyone? It is clear that ads use tracking mechanisms and cookies and this is no different. Audio feature detection isn't even a novel techique. I've seen trackers look at download stream patterns to detect whether or not BBR congestion control is used, I have seen mouse latency based on the difference between mouse ups and downs in double clocks and I have seen speed-of-interaction checks in…

But for code that's supposed to be so smart in trying to fingerprint people without them knowing, calling an API that throws a warning in the browser seems like a really stupid move. Especially since that can be checked through feature detection, which is literally what this code is doing...
Post reply on HN