Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

blog.mozilla.org

Post reply on HN
Print view View original

231–240 of 246 posts

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#231

Post by JohnFen »

crummy wrote: post #157
JohnFen wrote: post #78

Earlier quoted context omitted.

> Targeting this advert to most likely be seen by people who actually had been thinking of buying a hat shaped like sporting equipment is still a good idea too. Not if that targeting is done using data gathered about me without my consent -- as it almost universally is. Targeting based on context (what sort of website the ad is on, for instance), is fine.

> Targeting based on context (what sort of website the ad is on, for instance), is fine. Why? I didn't consent for that.

Because that sort of target is based on the context the ad is appearing in, not on any data gathered about you specifically.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#232

Post by JohnFen »

manigandham wrote: post #229
Yizahi wrote: post #213

Earlier quoted context omitted.

Metadata = Surveillance https://www.schneier.com/blog/archives/2014/03/metadata_surv... Quote: "An easy thought experiment demonstrates this. Imagine that you hired a private detective to eavesdrop on a subject. That detective would plant a bug in that subject's home, office, and car. He would eavesdrop on his computer. He would listen in on that subject's conversations, both face to face and remotely, and you would…

I'm not sure of your point. My point is that surveillance is not illegal and does not require any consent to accrue information through public observation.

I think whether or not it's legal is irrelevant. Things can be wrong -- even unconscionable -- and still be legal.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#233

Post by JohnFen »

manigandham wrote: post #136
JohnFen wrote: post #135

Earlier quoted context omitted.

> It's the same thing here. I disagree completely.

Why?

For two reasons.

First, most of this sort of spying involves using my own equipment as a weapon against me -- and actively subvert my defenses in order to do it. This is, in my view, not much different than them breaking into my home and installing surveillance equipment.

Second, the data gathered about me (even if it doesn't involve subverting my own equipment) is not kept in isolation. It is combined with a lot of other data about me and then mined for further insights. Every little data gathering act may be insignificant in isolation, but the end result is a degree of surveillance that is deeply immoral if done without my consent.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#234

Post by jefftk »

smadurange wrote: post #168
jefftk wrote: post #24

> In the coming months, we will start testing these protections with small groups of users and will continue to work with Disconnect to improve and expand the set of domains blocked by Firefox. We plan to enable these protections by default for all Firefox users in a future release. While lots of people here already have uMatrix or other blockers running, blocking fingerprinting and cryptomining domains by default wo…

Why the disclosure? Are you saying this in a personal capacity or is this the stance of Google Ads team? Like, hey we love and embrace any technology that fights our team's fingerprinting efforts...

> Why the disclosure? Are you saying this in a personal capacity or is this the stance of Google Ads team?

I'm commenting as myself, and not for the company. But my perception is likely colored by working for an ads company and it seems fair to let people know that.

> Like, hey we love and embrace any technology that fights our team's fingerprinting efforts...

While I don't know for certain, I don't believe Google Ads uses fingerprinting. Firefox/Disconnect doesn't seem to think so either, since Google ad domains are on the "Google" list but not the "Fingerprinting" list: https://github.com/mozilla-services/shavar-prod-lists/blob/7...

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#235

Post by ogre_codes »

mindcrime wrote: post #161
ogre_codes wrote: post #138

Earlier quoted context omitted.

Advertising doesn't help the advertiser unless it helps you. This is nonsense. History is littered with cases of advertising abuse and misuse. Everything from literal snake oil salesmen to modern day shysters profiting from selling conspiracy theories and anti-tax bullshit is enabled and propagated by advertising.

OK, fair enough, I should have specified that I meant outside of the case of obvious fraud (eg, snake-oil). Also, FYI, I'm not the one who down-voted you. In fact, have an upvote to counter-balance that.

I get your point about the potential benefits of targeted advertising, and in an ideal world it's true. Of course in that same ideal world we wouldn't have sleazy non-targeted advertising either. I just see so much abuse of tracking and targeting that the damage far outweighs the benefits.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#236

Post by manigandham »

fwip wrote: post #149
manigandham wrote: post #114

This endless war could be solved with a single meeting with the 3 major adtech companies. All browsers have to do is share a single advertiser ID and have it reset by the user whenever they want. No more cookies, pixel syncs, or fingerprinting and all the related countermeasures. This is the exact mechanism used by mobile apps right now so it's already well-tested and proven to work.

Why would advertisers stop using the existing, better methods?

An Advertiser ID is the best method, especially because it can be looked up by multiple companies and is user controlled.

Unlike what people seem to think, adtech has been designed from the start for anonymity. The persistent ID is needed primarily for ad frequency and conversion tracking. Eventually identity is revealed when someone fills out a form or buys something but that's not necessary at the top of the funnel.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#237

Post by jefftk »

wurst_case wrote: post #47
jefftk wrote: post #24

> In the coming months, we will start testing these protections with small groups of users and will continue to work with Disconnect to improve and expand the set of domains blocked by Firefox. We plan to enable these protections by default for all Firefox users in a future release. While lots of people here already have uMatrix or other blockers running, blocking fingerprinting and cryptomining domains by default wo…

Since you work on ads, may I ask why you support this? Won't this make most of your features ineffective?

The two main ways ads have of tracking users are:

* Cookies: ads ask the browser to store something, later they can ask what the stored value is.

* Fingerprinting: ads collect enough information about the browser that they can distinguish it from other users' browsers.

While cookies aren't ideal, I think an ad industry that uses them is a lot better than one that uses fingerprinting. The key differences are user control and visibility. If you clear your browsing history, or close an incognito tab, your cookies are gone but your fingerprint is unchanged. Similarly, you can see who's setting cookies but you have no idea who is trying to fingerprint you.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#238

Post by fwip »

manigandham wrote: post #236
fwip wrote: post #149

Earlier quoted context omitted.

Why would advertisers stop using the existing, better methods?

An Advertiser ID is the best method, especially because it can be looked up by multiple companies and is user controlled. Unlike what people seem to think, adtech has been designed from the start for anonymity. The persistent ID is needed primarily for ad frequency and conversion tracking. Eventually identity is revealed when someone fills out a form or buys something but that's not necessary at the top of the funnel…

Currently: Advertisers can track you and estimate whether you are likely to buy the product.

This is good for advertisers.

If a user-controlled resettable ID prevents advertisers from doing this, what incentive do they have to not use their existing methods (in addition to the advertiser-ID)? Further, why would they not use tracking to say "Well, they reset their ID, but I know they're the same because of this other data, so I'm gonna link it back up behind the scenes."

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#239

Post by AgentME »

manigandham wrote: post #129
AgentME wrote: post #123

Earlier quoted context omitted.

"Solving" fingerprinting by fingerprinting ourselves seems like it might miss the point for a lot of people.

Missing the point is the cause of all this mess.

If you care about fingerprinting because you care about privacy and limiting companies' ability to profile you, then adopting an advertiser id is giving up completely.

Re: Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta

#240

Post by dblohm7 »

oftenwrong wrote: post #64
jefftk wrote: post #24

> In the coming months, we will start testing these protections with small groups of users and will continue to work with Disconnect to improve and expand the set of domains blocked by Firefox. We plan to enable these protections by default for all Firefox users in a future release. While lots of people here already have uMatrix or other blockers running, blocking fingerprinting and cryptomining domains by default wo…

>(Disclosure: I work on ads at Google.) Is that relevant?

How do you know whether someone works at Google?

Don’t worry, they’ll tell you.

Post reply on HN