Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Tag Manager, the new anti-adblock weapon (2020)

chromium.woolyss.com

Post reply on HN
Print view View original

151–160 of 902 posts

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#151

Post by EamonnMR »

totony wrote: post #62
gigel82 wrote: post #48

Earlier quoted context omitted.

Highly doubtful the method would continue to be called "gtag"; any js bundling / minification would replace that with a randomly generated string, and it's just as easy to randomize the server-side api endpoint url, making this virtually impossible to block (maybe a pattern analysis on the data being transmitted, but that can also be encrypted with random algorithms and keys, beyond recognition).

ML is already applied to spam mail, maybe it could be applied to JS runtime behavior to detect this kind of tracking. Fight ML analytics with ML

There's an asymmetry nat play here though. You're now burning battery to block stuff.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#152

Post by [deleted] »

strogonoff wrote: post #91
gernb wrote: post #81

Earlier quoted context omitted.

Do what? Record who came in and out of your house?

Imagine if Google offered a retail solution advertised as “record who came in and out of your house”. They would offer a CCTV for free and run centralized face recognition on everybody visiting. They’d give you a bit of stats, but truly they would aggregate data on where people go and build shadow profiles (supposedly to facilitate ad targeting). And imagine 90% of households were using it.

[deleted]

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#153

Post by l33t2328 »

paulryanrogers wrote: post #143
reaperducer wrote: post #110

Earlier quoted context omitted.

I have no concern with blocking Google App Engine holistically Unfortunately, it seems that more and more government web sites rely on Google services to function. And there's no replacement for those.

How can it be legal for a government to make increasingly core services depend on these amoral, for profit monsters?

I’m not sure if this is a serious question, but what would this imaginary law say?

The government can only do business with companies who aren’t in it for the money?

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#154

Post by easytiger »

UK local newspapers have been bought up by a company called Reach. Most of their sites look the same. On my laptop visiting their home page is burdensome on my laptop.

e.g. https://www.mylondon.news/

Looking at firefox's network tabs. It mostly completed after 41 seconds and almost 9MB. In the article pages there are adverts dynamically loaded every couple of lines of text

An article page from that site ,e.g.

https://www.mylondon.news/news/east-london-news/heartbroken-...

Takes around 1m50s to load at 18 MB.

The web is a disaster right now

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#155

Post by GekkePrutser »

irrational wrote: post #103
ec109685 wrote: post #36

Earlier quoted context omitted.

Apple’s Private Relay blocks this type of cross site tracking. Given this tracking is all server side, third party cookies across sites aren’t possible using this mechanism, and private relay cycles through your IP addresses frequently and uses common IPs across multiple users. Regarding your other point, unless Google execs want to be thrown in jail / sued, they can’t use things like first party cookies for their be…

I wonder why Safari is required? I’d be interested in paying for this if it worked with Firefox.

Yeah that would be a useful service that Mozilla could offer and I'd actually pay for.

I don't like their VPN as it's too basic in terms of privacy protection and it's much more versatile to just sign up with Mullvad myself because then I can use it on other stuff than just the browser.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#156

Post by iptq »

strogonoff wrote: post #91
gernb wrote: post #81

Earlier quoted context omitted.

Do what? Record who came in and out of your house?

Imagine if Google offered a retail solution advertised as “record who came in and out of your house”. They would offer a CCTV for free and run centralized face recognition on everybody visiting. They’d give you a bit of stats, but truly they would aggregate data on where people go and build shadow profiles (supposedly to facilitate ad targeting). And imagine 90% of households were using it.

Isn't this literally what Ring does?

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#157

Post by GekkePrutser »

quicklime wrote: post #38
gigel82 wrote: post #25

God damn... this is it, this is the end-game. There's no way to fight this unless you customize and maintain blocking scripts for each individual website. Yes, websites could always have done this, but the REST (CDN-bypassing) requests' cost and the manual maintenance for the telemetry endpoints and storage was an impediment that Google just gives them a drop-in solution for :( I think Google is happy to eat some of…

> Maybe using an archive.is-like service that renders the static page (as an image at the extreme) A lot of companies are starting to use "browser isolation" which is essentially what you're saying. A proxy runs between the client and the server, but it does more than just direct TLS streams - it actually builds the DOM and executes the JS. The resulting web page is sent to the actual client browser, which might send…

Browser isolation isn't quite that. It's just running a browser that is heavily sandboxed from internal files and networks, or running on another machine so any exploits don't hit your machine.

It's very much like running a browser through Citrix (in particular the remote flavour which is the most common as far as I've seen). But of course any data in the browser itself is still within reach for the malicious code... Which only solves half the problem. Unless you rigidly separate internal browsing from external sites.

But it doesn't run all the JavaScript and then send you a screenshot or anything. The resulting page is still interactive.

Remote browser isolation has the ability to change the landscape of personal computing enormously by the way. Right now we equip all our laptops with at least 16GB (32 for customer care) because some web apps like Salesforce Lightning are such memory hogs.

Considering the importance of the browser in modern computing this model world basically make the PC more like a terminal and require much less resources.

Of course this has already been going on with web based apps and streaming of things like games but this could be the final nail in the coffin of the PC as we know it. Not sure I'm happy with that...

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#158

Post by downrightmike »

gigel82 wrote: post #25

God damn... this is it, this is the end-game. There's no way to fight this unless you customize and maintain blocking scripts for each individual website. Yes, websites could always have done this, but the REST (CDN-bypassing) requests' cost and the manual maintenance for the telemetry endpoints and storage was an impediment that Google just gives them a drop-in solution for :( I think Google is happy to eat some of…

The greatest minds of a few generations really should think about not being evil.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#159

Post by ReactiveJelly »

booleandilemma wrote: post #68
gigel82 wrote: post #25

God damn... this is it, this is the end-game. There's no way to fight this unless you customize and maintain blocking scripts for each individual website. Yes, websites could always have done this, but the REST (CDN-bypassing) requests' cost and the manual maintenance for the telemetry endpoints and storage was an impediment that Google just gives them a drop-in solution for :( I think Google is happy to eat some of…

Simpler protocols (Gemini, Gopher...), outright refusing to use what the modern web has become. I only use HN and a few select sites. You don't need an ad-blocker if there are no ads in the first place.

Using Gemini as an allowlist doesn't seem any better than allowlisting known-good domains for HTTPS sites

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#160

Post by ignoramous »

gigel82 wrote: post #25

God damn... this is it, this is the end-game. There's no way to fight this unless you customize and maintain blocking scripts for each individual website. Yes, websites could always have done this, but the REST (CDN-bypassing) requests' cost and the manual maintenance for the telemetry endpoints and storage was an impediment that Google just gives them a drop-in solution for :( I think Google is happy to eat some of…

I co-develop an open source firewall for Android, which most of our users use for ad-blocking purposes.

The community has known about server-side collection for quite sometime now. You could run Google Analytics on any of the serverless environments since a year or two ago (I noted this on news.yc a year back [0][1]). Tag Manager server-side is Google throwing its own solution in to the mix.

DNS based content blocking was always DoA, there simply are too many chinks in the armour besides CNAME or HTTPS/SVCB or SRV or ALIAS record cloaking [2]. The worst I've seen reported to me by users is a tracker generating domains names on-the-fly (domain generation algorithms) and A/AAAA records pointing to different IP addresses each time [3].

That said, a firewall can still mitigate this offensive, while network security with just DNS was always going to be what it was: A stop-gap.

This isn't the end-game: I fully expect that IP address blocklists would crop up in no time, and will be painfully maintained by folks pouring their life in to it.

TFA points that Google's reverse-cloaking presumably with IP addresses, but the worse would be if multiple domains shared IP addresses (like in a CDN), reverse-cloaked with Server Name Identification. Even firewalls would have to blanket block IPs... and what if those IPs are shared with other Google front-ends like the AMP project / YouTube / Mail / Docs?

The firewalls would also have trouble with something like Ao1 [4]: If multiple websites were behind multiple IPs, or in the extreme, a single IP.

The firewall is bust, but that's good, now we simply de-Google / de-Cloudflare ourselves, and be luddites like they want us to be.

[0] https://news.ycombinator.com/item?id=26003654

[1] https://news.ycombinator.com/item?id=25169029

[2] https://news.ycombinator.com/item?id=26298339

[3] Ex: https://www.reddit.com/r/uBlockOrigin/comments/srza8x/changi...

[4] https://nitter.net/rethinkdns/status/1448738898998292495

Post reply on HN