AdNauseam: Browser extension to fight back against tracking by ad networks
github.com
github.com
Why would a potential AdNauseam user even use Chrome?
edit: forgot to also mention, I'm also aware FF has profiles as well (about:profiles) but the implementation has too many speedbumps. As I mentioned in another post on HN, the profile manager needs to be an upfront and first class UI citizen, something hidden away with a fairly poor UIX.
First of all I don't see the point. I don't click on ads, so there is no profile that advertisers can extract from that.
Having an extension that simulates clicks would only link to my supposed profile shit that I don't want, plus in my experience from when I worked in the ads industry, the user profile often gets compiled from better signals, like actual searches, apps used, websites visited, articles being read, or data freely provided by the user himself, like age, sex or location.
Clicks on ads are misleading because the ads themselves are misleading. It's not a good signal unless it leads to a conversion and a click is just part of the funnel and not a conversion. In fact the only really useful signal is that the user clicks on ads, in general, or in other words you're inviting publishers to serve you more ads.
Also this "fighting back" attitude is not very constructive. If you hate the direction of this industry, consider paying for shit that you consume, instead of pushing for extensions that will inevitably get banned (due to this being essentially fraud) and that are pushing more and more publishers towards native apps and towards DRM, because the open web is a risky platform due to these extensions.
---
For protecting my privacy, besides Firefox's built-in trackers blocking and uBlock Origin, I also use and recommend Privacy Badger ... this is a neat extension that automatically learns about trackers that follow you around the web; it can brake some websites, but it's the best at bypassing protections against ad/tracker blocking.
- Your ad profile will be built based on pages you visit as you indeed note, not just things that you click. Any noise you can introduce surely has to be a win for obfuscation? Would be interested in your thoughts here because you have more experience than I do!
- I'm not certain that paying for content makes any difference from a data mining perspective. Loading a NYT article causes uBlock Origin to deny 14 requests; I don't currently have a subscription but I imagine those assets are still loaded even if I'm signed in (with much clearer markers towards my identity!)
- Fighting back is a fine way to effect change. It's clearly working or Google wouldn't be banning this extension from their store or limiting their API.
I'm very comfortable with this so it's interesting to speak with someone who isn't. If adblocking is on the rise, I wonder what the next step will be towards monetizing content? Micropayments didn't take off (perhaps unsurprisingly) and subscription models seem to not have the return that people had hoped. There's huge amounts of money on the table but a lot of very smart people don't seem to have hit upon anything yet!
From the guidelines: https://news.ycombinator.com/newsguidelines.html
AdNauseam has been up on Firefox Add-ons for a while and it is not banned and I don't believe it will get banned. Explain why you think differently please.
Personally I think that if people hate ads so much they should just block them (I do). This attitude of "sticking it to the man" by "screwing with their data" seems petty and potentially counterproductive.
Fighting back is very constructive. It's a market signal. People aren't only restricted to express their dissatisfaction through buying elsewhere (people on the producing side would love everyone to believe that, though). Complaining loudly, accurately portraying adtech as the scoundrels they are publicly, to discourage others from using such products, are also valid market signals. And so is AdNauseam.
AdNauseam is definitely not fraud. Clicking on random ads with no intention of buying is something I, as a user, can do. I've signed no contract with advertisers saying otherwise, and the tech is deployed in such a way that I get to view and click (or not view / not click) how I please. AdNauseam just automates my preference for clicking on random ads while not looking at them. My preference to express that the whole industry is bullshit and should simply die in a fire. It's perfectly legal, perfectly by the rules of the Web and the HTTP protocol, and runs entirely on the User-Agent side of Browser/Server border.
Remember, Google didn't ban AdNauseam because it's wrong. They banned it, because it went against their commercial interest, and being a private platform they could just ban it without asking anyone.
OK, if you don't pay then money has to be found somewhere for the web to still work[1] which advertising seems to be the only source of. Payment provides that cash thus squelching the need for ads.
If they don't advertise then they don't need to track AFAICS.
If they do start advertising as well as accepting payments for non-advertising, they are going to get spanked by users withdrawing payments, and installing ad-blockers.
I'd prefer to pay, anonymously, but as people clearly won't cos they want free stuff at any cost, advertising will persist. It's a social problem not a technical one.
Anyway, I block all 3rd party ads, which is 99% of them and 100% of the bad crap, and block all JS, with a VM for the rare cases I need it on. Not totally safe but pretty close without actually unplugging.
People complain about ads presumably because they see them, but they are so damn easy to block why don't they? I just don't get the perennial complaints. Just do it, find a minimum 10X speedup... but no, it doesn't seem to happen, and they keep discovering that Free Stuff Costs.
It's more of a content quality issue. There are examples where large numbers of people will pay for quality content (example [1]). Large swathes of 'content' is junk (clickbait, listicles, submarine articles, actual fake news, etc) and few will pay for that.
[1] https://www.theguardian.com/media/2018/jul/24/guardian-media...
I work at a very large bank. We make money by through account fees and interest charges, but we still do all the sleazy tracking and analytics that you would expect from a company with a you-are-the-product business model. We work closely with ad networks so that we can get demographic data about who our users are. And in return, we share/leak our customers' (anonymized and bracketed) income.
This is now done through first-party tracking, so you won't see it if you look in the network tab in DevTools.
Why do we do this? Because it helps us target our marketing to an individual's demographics. Yes we make money through other ways, but this helps us make even more money. That's how businesses operate, and I don't think that companies like mine are uncommon.
Thinking that paying for shit will let you avoid tracking is like thinking that paying for cable TV will let you avoid ads. Companies will do whatever they can to make an extra buck on top of the money they're already taking from you.
Ad/tracker blockers are useless. Short of creating legislation to stop it, the only way to stop this tracking is to fuck with the data enough that it's no longer worth mining.
> I worked in adtech a few years ago, and AdNauseam-style click fraud is a relatively trivial to detect and ignore. It does nothing, and adtech companies don't care about your hate of online advertising the least because that's what brings in the cash.
Then other user clarified [1]:
> The most usual technique is to setup click baits/traps, once you click on a trap link you (= IP or UID via cookie) are added to an ignore list, where all your actions are not invoiced to advertisers. Simple and works,
With all that in mind I came up with an idea at a time [2]:
> What would happen if there would be a popular extension that would share UID cookies between all its users?
Now, the question is: is it worthwhile to do something like this?
[0] https://news.ycombinator.com/item?id=19279384
The click baits/traps would, in terms of cookies, be countered by the Cookie AutoDelete extension and whenever you browsed in private mode. As for blacklisting IPs, that seems very risky since an IP is often shared among many users (and it's always a risk people use same device, e.g. a MacBook), and it would continue to result in an increasing amount of legitimate users being wrongfully blacklisted as the extension's user base grew. Moreover, assuming these techniques are actually used, then it's safe to assume that at least a few ads would be clicked before they detected they were malicious clicks. And this would be the case whenever a user used a new IP with no cookie present. I'm definitely not convinced it's something ad networks can reasonably detect, especially considering it's important that the ads are served as fast as possible.
I've used it for over a year (also on $XXXX estimated cost figures on 3 different devices) with several thousands of ads clicked. My ad vault contains everything from porn, electronics, job boards, ads in languages I do not understand, gambling, gaming, and all sorts of crap I have zero interest in. I pretty much never see ads while surfing the net, and when I do then it's the ads that would also slip through uBlock Origin and other ad blocking extensions.
That was the best thing about some of the addons to the old adblock plus addon - you could keep your own list, and the average user was entirely unaware of the extent that they were doing so.
It’s a nice additional data point to identify and track the users running it, though.
2. How would you filter out AdNauseam ad clicks with genuine ad clicks?
AdNauseam clicks occur far more often than normal ad clicks, aren’t associated with other ad load events, timing is all similar, ads are clicked regardless of predicted relevancy. There’s dozens of obvious, and hundreds of non obvious, ways to detect if a particular user is a bot or not. Literally legions is PhDs study this attack vector and work at Google and Facebook.
This extension just isn’t effective, and any time working in the ad industry makes that overwhelmingly obvious.
Adnausium can just connect us through an anonymizing server so that we can sell our well chosen (by them) clicks to those organized crime and sophisticated actors. Heck, those bad guys would probably be willing to pay me or Adnausium a fractional CPM for the service.
You can easily adjust the click rate in AdNauseam's settings (assuming I only click 1 out of 50 ads then it will be completely random if Google's ads are clicked once per 1 or 1000 ad loads because they don't know how many ads were loaded by other providers inbetween), click timing is affected by so many load factors that I'd think it isn't even necessary to sleep a random period before clicking. Other techniques, such as "ad traps" are easily countered by IP changes/Cookie AutoDelete extension.
Does this extension change your IP?
How bad at their job do you think these data scientists are, to make companies like Facebook and Google such great money printing machines?
This extension doesn't change my IP nor does it auto clear cookies, but are we not allowed to combine multiple tools? I use VPNs (both my own and from work), I often change location (home, office, hotels, cafes, etc.), have several phones/laptops that use different operating systems/browsers. At the office everybody use the same computer model, are you going to blacklist 50+ peoples potential ad clicks from that IP because I use AdNauseam?
I don't think the data scientists at Facebook/Google/others are bad at their job because of their likely inability to invalidate all AdNauseam clicks, nor do I think the addon, with its current userbase, has the slightest impact on their money printing machine.
Your browser leaks a lot more information than just cookies and IP.... canvas fingerprinting for example is particularly pernicious. Check this [1] for a demo of the known leaks (there are probably more that aren't in this project yet)
In any case then I still think the goal should be to recommend AdNauseam to as many people as possible, because it does work against most ad networks, especially when it's accompanied by extensions such as Privacy Badger that will block a lot of tracking domains.
Even the most sceptic users (with regard to AdNauseam's ability to hurt user tracking ad networks) will still benefit from using AdNauseam as an alternative to uBlock Origin, because uBlock Origin is still running under-the-hood. There's nothing to lose and a lot to gain, especially when we in the future figure out how to defeat canvas fingerprinting without disabling JavaScript.
You know a society is in decline when their smartest and best-educated members dedicate all their efforts to advertising crap to people to buy, instead of something more constructive like medical technology, space exploration, etc.
How does this work? Remove clicks from people that click many ads? Doubtful!
It is noteworthy that Google doesn't bitch too much about AdBlocking in the past, but lost their shit at AdDauseam![1]
https://www.theregister.co.uk/2017/01/05/adnauseam_expelled_...
- How do I make sure this extension will not download and run a javascript exploit from fake ads ?
Security, ecology, business threat : they are valid arguments to Google for banning it