Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proposal: Treat FLoC as a security concern

make.wordpress.org

Post reply on HN
Print view View original

101–110 of 274 posts

Re: Proposal: Treat FLoC as a security concern

#101

Post by jefftk »

ocdtrekkie wrote: post #92
jefftk wrote: post #54

Earlier quoted context omitted.

The causality is more complex: Chrome's approach from the beginning was that they would remove third-party cookies and replace them with more private alternatives like FLoC: https://blog.chromium.org/2020/01/building-more-private-web-... (Disclosure: I work on ads at Google, speaking only for myself)

If we kill FLoC, my hope would be that Google still finds it untenable to backpedal on removing third party cookies... or that public awareness about Google's antiprivacy stance kills Chrome if they do backpedal. It's simple: We force Google to stop tracking us, or we stop using Google products.

Chrome is not the only browser working on more advertising-specific APIs as more-private replacements for third-party cookies. For example, Edge is proposing PARAKEET [1] for remarketing, and Safari has implemented an initial conversion tracking API [2].

[1] https://github.com/WICG/privacy-preserving-ads/blob/main/Par...

[2] https://webkit.org/blog/8943/privacy-preserving-ad-click-att...

Re: Proposal: Treat FLoC as a security concern

#103

Post by Google234 »

qyi wrote: post #85

I mean yes, web ads have been used to hack people for decades. Just put your code in the ad and steal his cookies (and the next 10 issues after that gets patched by the ad service). It was a favorite topic in blackhat presentations. At the end of the day there is no way to do ads securely, aside from maybe JPEG ads. People don't seem to understand that adding more bloat to the web (which is already a terribly insecur…

Nope.

Re: Proposal: Treat FLoC as a security concern

#104

Post by withinboredom »

skybrian wrote: post #42
itcrowd wrote: post #27

Earlier quoted context omitted.

https://w3techs.com/technologies/overview/content_management 41.1% of websites

Okay, thanks! It looks like it’s based on the top ten million websites by traffic, but weighted equally. Maybe there are lots of low-traffic WordPress sites?

> Maybe there are lots of low-traffic WordPress sites?

And many, many more high traffic websites. There's even some Facebook landing pages running WordPress and other many high profile sites[1].

1: https://wpvip.com/

Re: Proposal: Treat FLoC as a security concern

#105

Post by kjjjjjjjjjjjjjj »

pm90 wrote: post #74
takeda wrote: post #59

I just love the Google's way of thinking. Users: We hate cookies, because they are abused to hurt our privacy by allowing advertisers to build a profile about us Google: We have a great idea! We can get rid of 3rd party cookies and instead make your browser build profile about you and share it with everyone.

IIUC while floc does indeed build a profile browser side it isn’t something that advertisers can track with the same precision as they can with 3p cookies. So while it’s not the holy grail it does appear to be a small step in the right direction from the status quo. Do I understand the situation correctly? Genuinely curious.

Paraphrasing what I saw somewhere

> If I go to thing W, X, Y, and Z (where those are distinct elements with distinct fans), people within those cohorts will be indistinguishable but I will likely be the only person who has been to all 4. Therefore, you can easily identify individuals. FLoC is a crock of shit. At least you could block 3rd party cookies

Re: Proposal: Treat FLoC as a security concern

#106

Post by extropy »

Santosh83 wrote: post #49
izacus wrote: post #15

Earlier quoted context omitted.

> "Kill it before it lays eggs." but do we worry about what evolves from this if it dies? Nothing really evolves here - status quo is what stays. You continue to be tracked head to arse on everyones servers, the media keeps adding 150 trackers to every webpage and the internet moves on. Thinking that one of the biggest profit making industries in US will just go away if you scream loud enough on HN is utterly naive a…

Only govt action will work. That too concerted action by several national govts.

The govt action is the shitty way out. This all is a classic there is not enough to go around situation. Govt regulation will make it more entrenched and "manageable".

The best outcome is to come up with a fundamentally better business model. Something that satisfies seller's desire to promote their products and customers desire to feel respected and important. Preferably cutting out a middleman and reducing costs of doing business at the same time.

Re: Proposal: Treat FLoC as a security concern

#107

Post by ocdtrekkie »

jefftk wrote: post #95
danShumway wrote: post #93

Earlier quoted context omitted.

If Chrome wants to be the only browser with third-party cookies, they're welcome to, I suppose. Breaking down Chrome's dominance has to start somewhere, and having a straightforward, easily verifiable reputation as the single least private browser on the market is a decent start. I already know what the headlines from most sites will look like if Chrome decides to reverse course. If only Firefox was removing cookies,…

> If only Firefox was removing cookies, that would be a problem, because Chrome could just ignore them. But with Safari on board as well, and with the entire iOS market at stake for sites that try to ignore the policy. nit: Safari was ahead of Firefox here, with ITP 1.0 blocking most third-party cookies by default in 2017.

Indeed, Apple's been at the forefront here. It's why I'm low key okay with the WebKit monopoly requirement on iOS, everyone has to deal with it.

And the other minority browsers are also on board now. Edge and Brave and such are also preferring privacy-friendly default configurations.

Re: Proposal: Treat FLoC as a security concern

#108

Post by kevingadd »

toomim wrote: post #97

The intro lost me: > WordPress powers approximately 41% of the web – and this community can help combat racism, sexism, anti-LGBTQ+ discrimination and discrimination against those with mental illness with four lines of code:" function disable_floc($headers) { $headers['Permissions-Policy'] = 'interest-cohort=()'; return $headers; } add_filter('wp_headers', 'disable_floc'); If you seriously think this is going to make…

FLoC exists to group users down into behavioral targeting categories, it should be obvious that some of those will end up corresponding to gender or race or other traits that are protected statuses. We've repeatedly had incidents where big companies were caught accidentally letting (for example) landlords filter advertisements by race or recruiters filter listings by age, both of which are illegal.

Re: Proposal: Treat FLoC as a security concern

#109

Post by neolog »

dang wrote: post #99
neolog wrote: post #87

Earlier quoted context omitted.

> That makes it sound like Wordpress itself is officially making this proposal. Is it? Seems like it is to me.

It looks like it to some and not to others, which is already confusing if it's an official proposal.

Clicking on the author's user profile [1] says they're a "Core Contributor". So maybe not the Wordpress org itself making the proposal but a core team member.

[1] https://profiles.wordpress.org/carike/

Post reply on HN