Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to fight back against Google FLoC

plausible.io

Post reply on HN
Print view View original

41–50 of 95 posts

Re: How to fight back against Google FLoC

#41

Post by sanxiyn »

berkes wrote: post #37
sanxiyn wrote: post #12

I want to suggest another thing we can collaborate on. File bugs against Apache and nginx such that Apache and nginx emit Permission-Policy header by default. People who want FloC can opt-in, but since Pervasive Monitoring Is an Attack (RFC 7258), it is clearly severe security bugs in Apache and nginx that they don't emit this header by default. This may need CVE.

If your webserver security relies on sending a header to clients, your security is wrong. Not saying that filing issues against weservers is a bad idea. Just that the security angle is wrong. For one, because Google, or chrome, could just choose to ignore that header if too many servers fly it.

That's like saying not sending Content-Security-Policy when it is needed to prevent XSS is not a security bug, since Chrome can start to ignore Content-Security-Policy (which it can). That is absurd.

Re: How to fight back against Google FLoC

#44

Post by andreareina »

sanxiyn wrote: post #41
berkes wrote: post #37

Earlier quoted context omitted.

If your webserver security relies on sending a header to clients, your security is wrong. Not saying that filing issues against weservers is a bad idea. Just that the security angle is wrong. For one, because Google, or chrome, could just choose to ignore that header if too many servers fly it.

That's like saying not sending Content-Security-Policy when it is needed to prevent XSS is not a security bug, since Chrome can start to ignore Content-Security-Policy (which it can). That is absurd.

That's more like the case with the Do Not Track header being defaulted to 1 in some browsers and many (most?) sites using that as an excuse to not honor it.

Re: How to fight back against Google FLoC

#45

Post by eterevsky »

papaf wrote: post #19
eterevsky wrote: post #2

While I do understand that some people may not like it, I don't see how FLoC is particularly harmful. I've read several articles about it, and most of them just say something like "you are being put in a advertising cohort -- see how creepy it is", which doesn't really prove anything. One more specific argument against FLoC is that it will make help tracking users via fingerprinting. I don't really buy it. First of a…

and if FLoC has only 8 bits of entropy From the EFF article that you don't like: > Google’s experiment used 8-bit cohort identifiers, meaning that there were only 256 possible cohorts. In practice that number could be much higher; the documentation suggests a 16-bit cohort ID comprising 4 hexadecimal characters. Also, its since someone can belong to more than 1 cohort, the 8bits is a bare minimum and not a maximum. F…

Ok, I agree that it is plausible that eventually more than 8 bits will be used. But in that case, the users will likely change their cohorts at a much higher rate, which will make them less useful for tracking.

> someone can belong to more than 1 cohort

I'm pretty sure you will only belong to one cohort at a time. Otherwise it would defeat the purpose of this change. It seems like k-anonymity is an express goal of FLoC.

Re: How to fight back against Google FLoC

#46

Post by sanxiyn »

why_Mr_Anderson wrote: post #39
andrei_says_ wrote: post #18

Earlier quoted context omitted.

Maybe notify instead of block? “You are using Chrome which tracks you without consent. Download a spyware-free browser here.” In red at the top of the page with links to brave and Firefox.

Isn't Brave just attempt to copy Google? It's Chromium based, with their own ad system ... why choose lesser evil?

Their own ad system which does not track users. An important difference.

Re: How to fight back against Google FLoC

#47

Post by 8128js8121 »

andrei_says_ wrote: post #18
sanxiyn wrote: post #8

I want to suggest another thing you can do as a web developer. If you can afford it, block all Chrome users, and instruct users to download Firefox instead. Explain why your website is not available for Chrome.

Maybe notify instead of block? “You are using Chrome which tracks you without consent. Download a spyware-free browser here.” In red at the top of the page with links to brave and Firefox.

Good luck telling users apart from Chromium which is fine and Chrome which is a rip off and filled with shit

Re: How to fight back against Google FLoC

#48

Post by throw_m239339 »

eterevsky wrote: post #2

While I do understand that some people may not like it, I don't see how FLoC is particularly harmful. I've read several articles about it, and most of them just say something like "you are being put in a advertising cohort -- see how creepy it is", which doesn't really prove anything. One more specific argument against FLoC is that it will make help tracking users via fingerprinting. I don't really buy it. First of a…

> While I do understand that some people may not like it, I don't see how FLoC is particularly harmful.

FLoC, AMP, ... With Chrome, Google is hijacking the web in a more cunning way than Microsoft and IE. The revolt against that needs to happen now. When Firefox is dead, it will be too late...

Re: How to fight back against Google FLoC

#49

Post by ihuman »

sanxiyn wrote: post #12

I want to suggest another thing we can collaborate on. File bugs against Apache and nginx such that Apache and nginx emit Permission-Policy header by default. People who want FloC can opt-in, but since Pervasive Monitoring Is an Attack (RFC 7258), it is clearly severe security bugs in Apache and nginx that they don't emit this header by default. This may need CVE.

Why would Apache include the Permission-Policy header when they previously chose to ignore the "Do Not Track" header?

Re: How to fight back against Google FLoC

#50

Post by berkes »

mavhc wrote: post #25
robin_reala wrote: post #14

Earlier quoted context omitted.

It’s not local, because your cohort id will be sent to advertisers, and they’ll back-reference that against what they believe you’re interested in. But either way, your initial statement assumes that ads will only be interesting to you if your browsing habits are tracked across the internet. There’s another option: if you visit sites that are focused on GPUs they can advertise GPUs to you. This is the way advertising…

From 1700-2000 you just had whatever adverts everyone else had. From 2000-2010 you had site/search based adverts From 2010-2020 you had tracking based adverts I can't think of even 1 time I've seen a useful advert though

I can.

And almost without exception, those were relevant ads, not targeted.

Relevant like getting a coupon code for digital ocean storage credits below an article on how to run your own IPFS host.

Or relevant like getting an offer for pizzafriday on the 'where to eat' information section of a campsite in some unfamiliar city.

Post reply on HN