Privacy Analysis of FLoC

#1

Post by jonchang » Thu, Jun 10, 2021, 6:25 PM UTC

Privacy Analysis of FLoC
blog.mozilla.org

Re: Privacy Analysis of FLoC

#2

Post by ______- » Thu, Jun 10, 2021, 6:51 PM UTC

> FLoC is premised on a compelling idea: enable ad targeting without exposing users to risk

The second you open your browser you are exposed to risk. Many times I have had to tweak the default settings of my browser to comply with my (non paranoid) requirements. Basic things like putting DuckDuckGo as the default search engine, turning off various JS APIs like HTML5 Canvas, WebGL, using AD-blockers and other addons, tweaking about:config and hardening it, etc

Call me a power user if you want, but all this hardening stuff should ship out-of-the-box.

Re: Privacy Analysis of FLoC

#3

Post by SimeVidas » Thu, Jun 10, 2021, 7:06 PM UTC

______- wrote: post #2

> FLoC is premised on a compelling idea: enable ad targeting without exposing users to risk The second you open your browser you are exposed to risk. Many times I have had to tweak the default settings of my browser to comply with my (non paranoid) requirements. Basic things like putting DuckDuckGo as the default search engine, turning off various JS APIs like HTML5 Canvas, WebGL, using AD-blockers and other addons,…

> all this hardening stuff should ship out-of-the-box.

I mean, Brave kinda does that. It’s much more “hardened” by default.

Re: Privacy Analysis of FLoC

#4

Post by dang » Thu, Jun 10, 2021, 7:10 PM UTC

Ongoing related thread: Ad tech firms test ways to connect Google’s FLoC to other data - https://news.ycombinator.com/item?id=27459247 - June 2021 (183 comments)

Re: Privacy Analysis of FLoC

#5

Post by slver » Thu, Jun 10, 2021, 7:13 PM UTC

______- wrote: post #2

> FLoC is premised on a compelling idea: enable ad targeting without exposing users to risk The second you open your browser you are exposed to risk. Many times I have had to tweak the default settings of my browser to comply with my (non paranoid) requirements. Basic things like putting DuckDuckGo as the default search engine, turning off various JS APIs like HTML5 Canvas, WebGL, using AD-blockers and other addons,…

Disabling canvas...

Re: Privacy Analysis of FLoC

#6

Post by vlovich123 » Thu, Jun 10, 2021, 7:22 PM UTC

______- wrote: post #2

> FLoC is premised on a compelling idea: enable ad targeting without exposing users to risk The second you open your browser you are exposed to risk. Many times I have had to tweak the default settings of my browser to comply with my (non paranoid) requirements. Basic things like putting DuckDuckGo as the default search engine, turning off various JS APIs like HTML5 Canvas, WebGL, using AD-blockers and other addons,…

The funny thing is that customizing your browser in this way can be its own kind of fingerprint.

Re: Privacy Analysis of FLoC

#7

Post by tylersmith » Thu, Jun 10, 2021, 7:23 PM UTC

vlovich123 wrote: post #6

______- wrote: post #2

> FLoC is premised on a compelling idea: enable ad targeting without exposing users to risk The second you open your browser you are exposed to risk. Many times I have had to tweak the default settings of my browser to comply with my (non paranoid) requirements. Basic things like putting DuckDuckGo as the default search engine, turning off various JS APIs like HTML5 Canvas, WebGL, using AD-blockers and other addons,…

The funny thing is that customizing your browser in this way can be its own kind of fingerprint.

That's the number 1 reason it should be the default.

Re: Privacy Analysis of FLoC

#8

Post by ______- » Thu, Jun 10, 2021, 7:37 PM UTC

vlovich123 wrote: post #6

______- wrote: post #2

> FLoC is premised on a compelling idea: enable ad targeting without exposing users to risk The second you open your browser you are exposed to risk. Many times I have had to tweak the default settings of my browser to comply with my (non paranoid) requirements. Basic things like putting DuckDuckGo as the default search engine, turning off various JS APIs like HTML5 Canvas, WebGL, using AD-blockers and other addons,…

The funny thing is that customizing your browser in this way can be its own kind of fingerprint.

Yes but disabling JS as a default wipes out whole classes of attacks against your browser.

On top of disabling JS, just a simple AD blocker like uBlock Origin greatly diminishes the amount of profiling. There is no silver bullet however. It depends on your threat model.

If you really don't want to be tracked and profiled, using the Tor Browser Bundle is worthwhile, but even that is problematic since it's heavily surveilled (both at the entry node and exit nodes).

Re: Privacy Analysis of FLoC

#9

Post by freebuju » Thu, Jun 10, 2021, 7:37 PM UTC

tylersmith wrote: post #7

vlovich123 wrote: post #6

Earlier quoted context omitted.

The funny thing is that customizing your browser in this way can be its own kind of fingerprint.

That's the number 1 reason it should be the default.

Not happening. All those anti-tracking measures break websites more often than not.

Re: Privacy Analysis of FLoC

#10

Post by jonchang » Thu, Jun 10, 2021, 7:37 PM UTC

This is a summary of the more detailed findings in their paper, which I found easy to read and has some intriguing suggestions for fixing privacy issues with the original proposal: https://mozilla.github.io/ppa-docs/floc_report.pdf