Honestly I’m starting to think treating google like a security concern is the answer here. Lately their moves have been actively open web hostile. See AMP etc
Proposal: Treat FLoC as a security concern
191–200 of 274 posts
Re: Proposal: Treat FLoC as a security concern
#192FLoC cohort computation only triggers on websites which call the document.interestCohort API or load ads. This is not quite an opt-in. But a blanket opt-out isn't necessary either.
This is an important point if true, do you have a citation for that? I can't find anywhere in the documentation indication that sites are only included in the FLoC model if they call the FLoC API.
Re: Proposal: Treat FLoC as a security concern
#193Earlier quoted context omitted.
IIUC while floc does indeed build a profile browser side it isn’t something that advertisers can track with the same precision as they can with 3p cookies. So while it’s not the holy grail it does appear to be a small step in the right direction from the status quo. Do I understand the situation correctly? Genuinely curious.
Paraphrasing what I saw somewhere > If I go to thing W, X, Y, and Z (where those are distinct elements with distinct fans), people within those cohorts will be indistinguishable but I will likely be the only person who has been to all 4. Therefore, you can easily identify individuals. FLoC is a crock of shit. At least you could block 3rd party cookies
You can block FLoC: switch to Firefox, or at least to any Chromium derivative that isn't Chrome.
Re: Proposal: Treat FLoC as a security concern
#194Earlier quoted context omitted.
> Chrome has not started preventing third party cookies yet, but they're the last holdout and have already stated they will kill them shortly. Chrome's original announcement about phasing out third-party cookies is explicit about new technologies like Privacy Sandbox (which includes FLoc) being how third-party cookies will no longer be needed: "After initial dialogue with the web community, we are confident that with…
So probably the phasing out third-party cookies will be postponed due to these reaction?
It is not clear to me at all what the overall view is on FLoC. Brave and Vivaldi don't like it, sure, but they already ship with built-in ad blockers so of course they don't. People here who don't like it also seem to be against advertising in any form beyond direct deals between publishers and advertisers for https://advertiser.example/ad">.
If there are people who are (a) ok with personalized ads, providing they can be done sufficiently privately and (b) do not like FLoC, then I'd love to read what they have to say!
(Still speaking only for myself.)
Re: Proposal: Treat FLoC as a security concern
#195Earlier quoted context omitted.
IIUC while floc does indeed build a profile browser side it isn’t something that advertisers can track with the same precision as they can with 3p cookies. So while it’s not the holy grail it does appear to be a small step in the right direction from the status quo. Do I understand the situation correctly? Genuinely curious.
That's what I've been wondering. If FLoC is better for privacy than current tracking methods and Google intends to switch to using FLoC instead of current tracking methods, wouldn't it be better for FLoC to succeed?
The privacy of current tracking methods (3rd party cookies) is bad, which is why a lot of browser vendors are starting to block 3rd party cookies by default. FLoC may be marginally better than 3rd party cookies, but still browser vendors are mostly choosing to block it by default. There isn't a good reason to let either succeed.
Re: Proposal: Treat FLoC as a security concern
#196I've not been following this proposal closely I did find
>Tracking people via their cohort
>A cohort could be used as a user identifier. It may not have enough bits of information to individually identify someone, but in combination with other information (such as an IP address), it might.
Whose purpose is:
>A FLoC cohort is a short name that is shared by a large number (thousands) of people, derived by the browser from its user’s browsing history.
I wonder if it's possible to define a large enough number X that people are OK with the idea. (Cookies are effectively "1" and nothing is "3,010,000,000" ie on the internet)
Could the cohort minimum size be configurable?
Given the IP address can be known today: what's the existing accidental "FLoC proxy" or "How unique are you online?" Or "online finger print" (something I'd not thought of before: my timezone can significantly narrow down who I am) You can try using yourself on: https://amiunique.org/fp
Re: Proposal: Treat FLoC as a security concern
#197I am hopeful that this will help get rid of FLoC but I worry about two things. One, this will end up being treated like the "no track" headers. That's just totally ignored after IE (was it IE?) enabled it be default. That gave all the trackers a reason to just ignore it and track everyone. I don't know if that exact same thing can happen here, but something similar maybe? The other thing I worry about is that FLoC 2.…
> this will end up being treated like the "no track" headers
This seems disanalogous. FLoC requires browser cooperation. The user can simply use a browser other than Chrome.
Re: Proposal: Treat FLoC as a security concern
#198FLoC cohort computation only triggers on websites which call the document.interestCohort API or load ads. This is not quite an opt-in. But a blanket opt-out isn't necessary either.
This is an important point if true, do you have a citation for that? I can't find anywhere in the documentation indication that sites are only included in the FLoC model if they call the FLoC API.
Yes. Take a look at this issue: https://github.com/WICG/floc/issues/103
Then again: "final design is still subject to change based on [Origin Trial] feedback".
Re: Proposal: Treat FLoC as a security concern
#199The intro lost me: > WordPress powers approximately 41% of the web – and this community can help combat racism, sexism, anti-LGBTQ+ discrimination and discrimination against those with mental illness with four lines of code:" function disable_floc($headers) { $headers['Permissions-Policy'] = 'interest-cohort=()'; return $headers; } add_filter('wp_headers', 'disable_floc'); If you seriously think this is going to make…
It seriously smells like virtue signaling extraordinaire, worse still when corporations do it, because we know it's often for marketing purposes. Did H&M and Nike really care about Xinjiang cotton before people in social media started making a stink about it?
A lot of this is reminiscent of the hyperbole over AMP.
Re: Proposal: Treat FLoC as a security concern
#200Earlier quoted context omitted.
Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out. And a long phase out is not something around which you can form a singular rallying cry. FLoC is a new thing which is just being rolled out, so it's a lot easier for people to resist adding a new thing that makes the internet more crappy and less private. I think it'…
> Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out. Not true, FireFox and Safari have had them off by default for over a year now. Additionally Chrome had planned to turn them off last year but then cried "covid" which for some reason = delay... because... think of the adverts! i mean covid! Anyway, I'm pretty sure…
Care to reach out? This username at Microsoft.
We're working to understand what legitimate use cases are broken without 3p cookies so we can work with Google to backfill them. FLOC helps ad trackers track but doesn't help with any of the legitimate uses of 3p cookies like auth.