Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy Analysis of FLoC

blog.mozilla.org

Post reply on HN
Print view View original

11–20 of 167 posts

Re: Privacy Analysis of FLoC

#11

Post by passivate »

______- wrote: post #2

> FLoC is premised on a compelling idea: enable ad targeting without exposing users to risk The second you open your browser you are exposed to risk. Many times I have had to tweak the default settings of my browser to comply with my (non paranoid) requirements. Basic things like putting DuckDuckGo as the default search engine, turning off various JS APIs like HTML5 Canvas, WebGL, using AD-blockers and other addons,…

Realistically, can you ship a website where everything happens client side? - reflow, adjusting layout, computing locations/sizes and whatnot. I am not a web person so my thinking may be outdated on this. I'm imagining something like a stand-alone self-contained "docker" type thing.

Re: Privacy Analysis of FLoC

#12

Post by justinplouffe »

What bothers me the most about FLOC is that there is no reason or advantage for me as a user to run it unless I'm forced to. Cookies, even if they get hijacked for tracking, are genuinely useful to persist state and having them on results in a better experience. Even in the case of something more invasive like DRM/EME, I might want to turn it on in exchange to be able to watch some new show on a streaming service. Turning on FLOC brings nothing to the user in return and feels like charity towards advertisers.

Re: Privacy Analysis of FLoC

#13

Post by freeone3000 »

passivate wrote: post #11
______- wrote: post #2

> FLoC is premised on a compelling idea: enable ad targeting without exposing users to risk The second you open your browser you are exposed to risk. Many times I have had to tweak the default settings of my browser to comply with my (non paranoid) requirements. Basic things like putting DuckDuckGo as the default search engine, turning off various JS APIs like HTML5 Canvas, WebGL, using AD-blockers and other addons,…

Realistically, can you ship a website where everything happens client side? - reflow, adjusting layout, computing locations/sizes and whatnot. I am not a web person so my thinking may be outdated on this. I'm imagining something like a stand-alone self-contained "docker" type thing.

That's how most websites work. The JavaScript code that runs on the browser then reports back to a server, because it makes money for the people who wrote the app.

Re: Privacy Analysis of FLoC

#14

Post by LeoPanthera »

SimeVidas wrote: post #3
______- wrote: post #2

> FLoC is premised on a compelling idea: enable ad targeting without exposing users to risk The second you open your browser you are exposed to risk. Many times I have had to tweak the default settings of my browser to comply with my (non paranoid) requirements. Basic things like putting DuckDuckGo as the default search engine, turning off various JS APIs like HTML5 Canvas, WebGL, using AD-blockers and other addons,…

> all this hardening stuff should ship out-of-the-box. I mean, Brave kinda does that. It’s much more “hardened” by default.

"No, you shouldn't use Brave": https://web.archive.org/web/20210531085250/https://aspenuwu....

Re: Privacy Analysis of FLoC

#15

Post by thanhhaimai »

______- wrote: post #2

> FLoC is premised on a compelling idea: enable ad targeting without exposing users to risk The second you open your browser you are exposed to risk. Many times I have had to tweak the default settings of my browser to comply with my (non paranoid) requirements. Basic things like putting DuckDuckGo as the default search engine, turning off various JS APIs like HTML5 Canvas, WebGL, using AD-blockers and other addons,…

Opinions are my own.

I'm not sure if we're being led to focus on a wrong problem. I hate intrusive Ads as much as everyone else. However, it's not only that "when you open your browser, you are exposed to risk". It's also:

- Every time you use Windows (without turning off all the bad settings)

- Every time you connect to a Cell tower (telcos openly sell your location data)

- Every time you use your credit cards

Now, I'm not saying those are OK, or to justify intrusive Ads. However, I see a magnitude difference in the "violation of my privacy" for the above cases. The media and certain communities keep focusing on Ads tech because it drives clicks. But then we let the Telcos, Insurance, and Credit Card companies establish a creeping normality on our privacy violation.

We don't spend as much effort to stop Telco from directly selling our location data [1], but we have daily threads about companies indirectly use our location data for targeting Ads. Are we having our priority wrong? I couldn't shake the feeling that we're being led by a different narrative. The best situation of course is when we have good privacy laws and practices. However, focusing on the wrong priority like this is how we let other (much more severe) violators (Insurance, Telcos) get away with their creeping normality.

[1] https://www.marketplace.org/2020/02/28/fcc-set-to-fine-big-t...

Re: Privacy Analysis of FLoC

#16

Post by kevin_thibedeau »

freebuju wrote: post #9
tylersmith wrote: post #7

Earlier quoted context omitted.

That's the number 1 reason it should be the default.

Not happening. All those anti-tracking measures break websites more often than not.

They break sites that are broken by design. If a site isn't usable with html and css it's the devs fault. They don't get to dictate my browser's capability or assume I don't have special accessibility needs.

Re: Privacy Analysis of FLoC

#17

Post by aboringusername »

It's really a genius level move by Google here. Get rid of the cookie, implement your own solution, make it seem somewhat unique and rely on other data to identify users and claim impunity since it's nothing to do with them.

So how about this, Google must not, and cannot implement FLOC without it being a cross-browser standard; that is to say if anyone of Microsoft, Apple or Mozilla veto FLOC, it's dead.

This is how standards are supposed to work. Google should not be given the power to make a thing (like AMP) and just force it upon everyone.

We MUST start regulating Google's every product development, I'd rather it get held up for a year in court before it sees the light of day.

Re: Privacy Analysis of FLoC

#18

Post by tomrod »

FLoC: micro market segmentation. Profiles versus data.

It requires on 33 bits to uniquely identify an individual. [0].

I would be interested to learn whether FLoC employed k-anonymity measures, and their report on it.

If I am retired, female, live in the 830* zip3, and own a sedan, it is probably hard to identify me. Add that I am Korean and am searching for thyroid cancer treatments on Tuesday at 8:43AM local, then I am way more identifiable. I don't understand how FLoC works, and how it gets around this type of intrusion.

The only solution I am aware of is to dramatically limit the category depth. But that sort of defeats the purpose of micro market segmentation. And that's a good thing, IMO.

[0] https://www.eff.org/deeplinks/2010/01/primer-information-the...

Re: Privacy Analysis of FLoC

#19

Post by passivate »

freeone3000 wrote: post #13
passivate wrote: post #11

Earlier quoted context omitted.

Realistically, can you ship a website where everything happens client side? - reflow, adjusting layout, computing locations/sizes and whatnot. I am not a web person so my thinking may be outdated on this. I'm imagining something like a stand-alone self-contained "docker" type thing.

That's how most websites work. The JavaScript code that runs on the browser then reports back to a server, because it makes money for the people who wrote the app.

Yeah, I meant without the 'reporting back to a server'. Like for e.g., the website sends a 'package' to the browser - The package is built on the fly and contains all the dependencies. The package is then unarchived and files are opened in the browser w/o the server being involved.
Post reply on HN