Proposal: Treat FLoC as a security concern • Hacker News Board

Re: Proposal: Treat FLoC as a security concern

#11

Post by llarsson » Sun, Apr 18, 2021, 5:19 PM UTC

ocdtrekkie wrote: post #3

meattle wrote: post #2

WordPress is 41% of the web. If this goes through and FLoC is disabled by default by WordPress, will FLoC be dead on arrival?

Between large web publishing platforms and all alternate browsers blocking FLoC, I think we could kill it, yes. WordPress is used by a lot of marketing focused folks though, so we'll see if WP is able to land this.

The ones in marketing will rather immediately request that it is turned on instead.

Re: Proposal: Treat FLoC as a security concern

#12

Post by karaterobot » Sun, Apr 18, 2021, 5:20 PM UTC

markovbot wrote: post #5

meattle wrote: post #2

WordPress is 41% of the web. If this goes through and FLoC is disabled by default by WordPress, will FLoC be dead on arrival?

Most likely google will just turn off that silly opt out functionality. It's not like anyone's going to stop using their spyware browser.

I wonder whether, if WP takes the stance that FLoC is a security risk, whether they'd also consider a version of Chrome that doesn't allow opting out of it a security risk as well. And, if not, why not?

Re: Proposal: Treat FLoC as a security concern

#13

Post by ocdtrekkie » Sun, Apr 18, 2021, 5:21 PM UTC

blakesterz wrote: post #8

I am hopeful that this will help get rid of FLoC but I worry about two things. One, this will end up being treated like the "no track" headers. That's just totally ignored after IE (was it IE?) enabled it be default. That gave all the trackers a reason to just ignore it and track everyone. I don't know if that exact same thing can happen here, but something similar maybe? The other thing I worry about is that FLoC 2.…

We're already successfully killing third party cookies and most browser fingerprinting strategies. This is an attempt by a browser to build an intentionally user hostile mechanic to compensate, but we can kill this too.

We just need to continue to make it increasingly impractical and expensive to track users until it stops being considered a viable business strategy.

Re: Proposal: Treat FLoC as a security concern

#14

Post by ocdtrekkie » Sun, Apr 18, 2021, 5:22 PM UTC

enlyth wrote: post #7

meattle wrote: post #2

WordPress is 41% of the web. If this goes through and FLoC is disabled by default by WordPress, will FLoC be dead on arrival?

This assumes the majority of these Wordpress websites will update to the latest version in a timely manner

A key point of this is that if they consider it a security flaw, they will backport it into point releases for WordPress blogs that haven't done major upgrades in years.

Re: Proposal: Treat FLoC as a security concern

#15

Post by izacus » Sun, Apr 18, 2021, 5:30 PM UTC

blakesterz wrote: post #8

I am hopeful that this will help get rid of FLoC but I worry about two things. One, this will end up being treated like the "no track" headers. That's just totally ignored after IE (was it IE?) enabled it be default. That gave all the trackers a reason to just ignore it and track everyone. I don't know if that exact same thing can happen here, but something similar maybe? The other thing I worry about is that FLoC 2.…

> "Kill it before it lays eggs." but do we worry about what evolves from this if it dies?

Nothing really evolves here - status quo is what stays. You continue to be tracked head to arse on everyones servers, the media keeps adding 150 trackers to every webpage and the internet moves on.

Thinking that one of the biggest profit making industries in US will just go away if you scream loud enough on HN is utterly naive and will require a better push. This approach is inherently negative and just STOPS a process - but it doesn't IMPROVE on the current state and that will require more work.

I'm not quite sure what that work would be though - it seems that current approach is "this gigantic multibillon industry must be banned and completely destroyed" which is great on a personal level, but I don't feel like it's realistic on a purely political level.

Re: Proposal: Treat FLoC as a security concern

#16

Post by codegeek » Sun, Apr 18, 2021, 5:31 PM UTC

meattle wrote: post #2

WordPress is 41% of the web. If this goes through and FLoC is disabled by default by WordPress, will FLoC be dead on arrival?

"WordPress is 41% of the web"

This blows my mind every time. Even though I know it.

Re: Proposal: Treat FLoC as a security concern

#17

Post by skybrian » Sun, Apr 18, 2021, 5:32 PM UTC

ocdtrekkie wrote: post #13

blakesterz wrote: post #8

I am hopeful that this will help get rid of FLoC but I worry about two things. One, this will end up being treated like the "no track" headers. That's just totally ignored after IE (was it IE?) enabled it be default. That gave all the trackers a reason to just ignore it and track everyone. I don't know if that exact same thing can happen here, but something similar maybe? The other thing I worry about is that FLoC 2.…

We're already successfully killing third party cookies and most browser fingerprinting strategies. This is an attempt by a browser to build an intentionally user hostile mechanic to compensate, but we can kill this too. We just need to continue to make it increasingly impractical and expensive to track users until it stops being considered a viable business strategy.

What do you mean? They are widely used, which seems far from dead. Aren’t you declaring victory too early?

Re: Proposal: Treat FLoC as a security concern

#18

Post by codegeek » Sun, Apr 18, 2021, 5:32 PM UTC

enlyth wrote: post #7

meattle wrote: post #2

WordPress is 41% of the web. If this goes through and FLoC is disabled by default by WordPress, will FLoC be dead on arrival?

This assumes the majority of these Wordpress websites will update to the latest version in a timely manner

If added as a security patch, lot of websites will auto update.

Re: Proposal: Treat FLoC as a security concern

#19

Post by skybrian » Sun, Apr 18, 2021, 5:33 PM UTC

codegeek wrote: post #16

meattle wrote: post #2

WordPress is 41% of the web. If this goes through and FLoC is disabled by default by WordPress, will FLoC be dead on arrival?

"WordPress is 41% of the web" This blows my mind every time. Even though I know it.

I don’t know it. Where did you learn it?

Re: Proposal: Treat FLoC as a security concern

#20

Post by Silhouette » Sun, Apr 18, 2021, 5:33 PM UTC

markovbot wrote: post #5

meattle wrote: post #2

WordPress is 41% of the web. If this goes through and FLoC is disabled by default by WordPress, will FLoC be dead on arrival?

Most likely google will just turn off that silly opt out functionality. It's not like anyone's going to stop using their spyware browser.

Surely that depends on what their experience using it is, just like every other "winning" browser before that is no longer winning? If FLoC generates so much hostility within the web dev community that a few major sites/platforms start actively blocking it, and if Google responds by ignoring the opt-outs in Chrome, and if the community responds with a SOPA-like "no access using Chrome for the next 48 hours then, here are some other fine browsers you can use instead that don't invade your privacy in this way", Google will simply be outgunned. However, you probably need platforms on the scale of WP and/or some sites with huge audiences like Facebook/Wikipedia/Netflix/Reddit to be on board for the effect to be fast and powerful enough to make a difference.