Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proposal: Treat FLoC as a security concern

make.wordpress.org

Post reply on HN
Print view View original

201–210 of 274 posts

Re: Proposal: Treat FLoC as a security concern

#201

Post by jffry »

tomxor wrote: post #183
jffry wrote: post #155

Earlier quoted context omitted.

Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out. And a long phase out is not something around which you can form a singular rallying cry. FLoC is a new thing which is just being rolled out, so it's a lot easier for people to resist adding a new thing that makes the internet more crappy and less private. I think it'…

> Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out. Not true, FireFox and Safari have had them off by default for over a year now. Additionally Chrome had planned to turn them off last year but then cried "covid" which for some reason = delay... because... think of the adverts! i mean covid! Anyway, I'm pretty sure…

Sure, I suppose all that (waves hand at third-party cookies situation) is what I meant by the long phase out of them. As far as I can recall those defaults were signaled a fair amount of time in advance.

I have sympathy for anybody with a legitimate use for third-party cookies whose life has been made more difficult by bad actors abusing features to maximise their own profits.

Same tragedy that finally caused origin-based cache partitioning at the expense of some performance.

Re: Proposal: Treat FLoC as a security concern

#202

Post by rattray »

dannyw wrote: post #157
rattray wrote: post #151

Ah come on. The FLoC proposal has built in ways to turn it off. If you don't wanna be put in a cohort you can just configure your browser (even chrome) to say you don't have one.

If it's not opt in, it's malware and should be treated as such. Don't let Google gaslight you.

I'm not going to let anyone gaslight me. Features of a browser that aren't opt-in aren't definitionally malware.

User agents, for example, or even cookies, are not malware by any reasonable definition of the term. They present risks to the user and must be managed, but this is bounded.

Re: Proposal: Treat FLoC as a security concern

#203

Post by jffry »

slver wrote: post #159
jffry wrote: post #155

Earlier quoted context omitted.

Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out. And a long phase out is not something around which you can form a singular rallying cry. FLoC is a new thing which is just being rolled out, so it's a lot easier for people to resist adding a new thing that makes the internet more crappy and less private. I think it'…

If you have figured out a way to eliminate tracking, be my guest. Mozilla would like to know, Apple would like to know. Until then FLoC attracts attention because it's new, yes, this explains our reaction. It's still an irrational reaction. Also what's this "predatory targeting of unsophisticated consumers" about? You don't need targeting for this. Heck you don't need anything for this. The way it's usually carried o…

Mozilla at least has done plenty of things to reduce the effectiveness and scope of tracking on the web.

Just because we can't create an ironclad solution doesn't mean that there isn't real value in reducing the usable surface area for profiling and tracking users across the web.

FLoC is an additional means of tracking users that is presently being pushed by a giant corporation who controls a significant web browser, of course anybody who is pro-user-privacy would rail against its rollout. It's ridiculous to call that an irrational reaction.

Re: Proposal: Treat FLoC as a security concern

#204

Post by pabs3 »

hirsin wrote: post #200
tomxor wrote: post #183

Earlier quoted context omitted.

> Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out. Not true, FireFox and Safari have had them off by default for over a year now. Additionally Chrome had planned to turn them off last year but then cried "covid" which for some reason = delay... because... think of the adverts! i mean covid! Anyway, I'm pretty sure…

Care to reach out? This username at Microsoft. We're working to understand what legitimate use cases are broken without 3p cookies so we can work with Google to backfill them. FLOC helps ad trackers track but doesn't help with any of the legitimate uses of 3p cookies like auth.

Auth should be doable with just redirects though right? Isn't that how OAuth and OpenID connect work?

Re: Proposal: Treat FLoC as a security concern

#205

Post by pabs3 »

Nasrudith wrote: post #172
sneak wrote: post #56

Earlier quoted context omitted.

Developing a browser (or forking the existing one) with comprehensive anti-tracking features would also work. There are a half-dozen plugins one can add to Ungoogled Chromium to browse the web in (relative) safety. It's not a nation-state level undertaking: six or seven figures. The problem really comes from apps, which are loaded to the gills with spyware.

How can it do that when the server needs an IP address to send traffic to? Cookies just make it more convenient but there is fundamentally that "analog hole". You can Tor things up and obfuscate but if you can interact with them they can track you.

The Tor Browser is a pretty comprehensive solution to that, especially in high security mode.

Re: Proposal: Treat FLoC as a security concern

#206

Post by mark_and_sweep »

lolinder wrote: post #193
kjjjjjjjjjjjjjj wrote: post #105

Earlier quoted context omitted.

Paraphrasing what I saw somewhere > If I go to thing W, X, Y, and Z (where those are distinct elements with distinct fans), people within those cohorts will be indistinguishable but I will likely be the only person who has been to all 4. Therefore, you can easily identify individuals. FLoC is a crock of shit. At least you could block 3rd party cookies

You can block FLoC: switch to Firefox, or at least to any Chromium derivative that isn't Chrome.

I think you can enable/disable FLoC via chrome://settings/privacy or chrome://flags.

See: https://github.com/WICG/floc/issues/103#issuecomment-8218146...

Then again, FLoC is only enabled "in a limited set of circumstances" anyways.

For details on said circumstances, see: https://github.com/WICG/floc#qualifying-users-for-whom-a-coh...

Re: Proposal: Treat FLoC as a security concern

#208

Post by livre »

hirsin wrote: post #200
tomxor wrote: post #183

Earlier quoted context omitted.

> Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out. Not true, FireFox and Safari have had them off by default for over a year now. Additionally Chrome had planned to turn them off last year but then cried "covid" which for some reason = delay... because... think of the adverts! i mean covid! Anyway, I'm pretty sure…

Care to reach out? This username at Microsoft. We're working to understand what legitimate use cases are broken without 3p cookies so we can work with Google to backfill them. FLOC helps ad trackers track but doesn't help with any of the legitimate uses of 3p cookies like auth.

Since you seem to work for Microsoft, the broken use case I know: without 3p cookies Microsoft Teams is broken (it shows a not very useful error page asking to refresh the page, when you do it shows the same error again). Many of us need it for remote work so I guess this one of the things Google had in mind when they delayed disabling 3p cookies by default.

Re: Proposal: Treat FLoC as a security concern

#209

Post by nightpool »

Forge36 wrote: post #196

I've not been following this proposal closely I did find https://github.com/WICG/floc >Tracking people via their cohort >A cohort could be used as a user identifier. It may not have enough bits of information to individually identify someone, but in combination with other information (such as an IP address), it might. Whose purpose is: >A FLoC cohort is a short name that is shared by a large number (thousands) of peo…

"Could the cohort minimum size be configurable?"

this is a good idea, but unfortunately it would just lead to MORE ways to track users, since "size of cohort" is now a (probably very, very high entropy, given how many users never configure anything) source of information

Re: Proposal: Treat FLoC as a security concern

#210

Post by 0xy »

mark_and_sweep wrote: post #198
lolinder wrote: post #192

Earlier quoted context omitted.

This is an important point if true, do you have a citation for that? I can't find anywhere in the documentation indication that sites are only included in the FLoC model if they call the FLoC API.

Yes. Take a look at this issue: https://github.com/WICG/floc/issues/103 Then again: "final design is still subject to change based on [Origin Trial] feedback".

Final design is subject to the numbers in Google's ad department. Chrome is an adware browser, and security takes a backseat to any broken API or security disaster that Google's ad customers decide to mercilessly abuse for fingerprinting (AudioContext, etc).
Post reply on HN