Hacker News Reader

Comment by xg15 | Hacker News Reader

I've found that most press statement that contain the term "we believe" go on with some utterly ridiculous mental gymnastics to justify shady behaviour. This one is no exception:

> [IAB Tech LAB svp of Membership and Operations said:] “They believe no third party can be trusted. We take a different position: that trust should be established directly between consumers and the brands, and publishers they trust, and with the third parties that those brands and publishers trust.”

Question to that guy: What act specifically would establish that trust? My browser downloading JavaScript from half a dozen companies that I've never heard of?

Or is their position that by opening a link to some web page, I declared my boundless, irrevocable trust in that site, all third-parties that site delegates to, all third-parties those third-parties delegate to, etc etc as infinitum?

Where else in life do you get this understanding of "trust"?

View on HN

I expect nothing less from someone from a company called "TrustX, a member of DigiTrust". Just like with any other scammer, when someone uses a word "trust" excessively, you know that you shouldn't.

Why is the company called TrustX instead of AdX, if that's what they're dealing with? Maybe so that they appear more innocent when they show up in your browser warnings or cookie alerts? That's the kind of "trust" they're hoping to exploit.

>>Question to that guy: What act specifically would establish that trust?

I'm "that guy", and yeah I feel ya about "most press statements". Anyway, here's what we think would be a good start in establishing trust ... do you agree? 1. Consumer visits a website or app they like. 2. Website/app offers standardized privacy preferences/controls that are easy to understand, and apply globally. 3. Consumer indicates their preferences, realistically based on their inherent trust in the website/app ... could be anything from ghost mode ("no tracking at all") to limited ad targeting ("ok, you can retarget me for 3 days only, that's it") to measurement only ("count me as a distinct user, but no ad tracking, profiling, etc.") 4. those preferences are propagated to any/all downstream parties working on behalf of the website/app or the advertiser, all of whom have to submit system-level log file samples daily (a blood sample, if you will) to a central processing system NOT governed wholly by ad industry 5. ongoing data analysis, with data exhaust, provides for open accountability 6. oh, and consumer empirically sees that their preferences are being respected

We'd also love to see a significant reduction in the amount of JS and third-party requests. But these are all hard problems to solve while also maintaining an open web/ecosystem.

No, I don't agree. Here's what I want:

Entity visits a website. The website logs whatever they want, subject to GDPR-style rules. They never send the full logs to a third party, and never send individual information, anonymized or not, without a specific business reason that benefits the entity.

Entity creates an account on the website. Now the website gets to display a privacy policy that conforms to GDPR-style rules, and creates the account only with explicit informed consent from the entity. The website specifically notes the jurisdiction in which they operate and the contact method for complaints, inquiries, deletions, and so forth.

No central processing systems, no unified trackers, no cross-site data analysis.

Seems like you're suggesting that, to establish YOUR trust, either the website does not use any third-party vendors or services (in the delivery of the experience to you), or they use third-party vendors/services but do not send them any data ...? If so, in this age of open web services and distributed systems/infrastructure, are either of these scenarios reasonable to expect?

This comment seems rather disingenuous to me, and puts words in the mouth of the grandparent post. It’s not that my data should not be sent to any third parties ever, it’s that (as the GP said) my should not be sent to any third parties without a specific business reason that benefits me.

I do not consider any form of ad targeting to be of benefit to me. Therefore, my data should not be sent to any third parties for that purpose.

Serious question: isn't that how SSL/TLS certificates work too, by chain of trust?

Yes, but only because every other known solution is worse in practice.

The infosec definition of trust is not really the same as the colloquial meaning of trust.

The infosec "trust" is not something earned or even verified, but an assumption that something is not malicious. Imagine a fortress: inside of the walls is called "trusted", outside of the walls is "untrusted". So a trusted CA merely means a certificate inside your fortress' walls that an attacker can't modify.

> an assumption that something is not malicious.

It's not even that. It's just a statement of fact. The things that you put in positions where they can fuck you are de facto the things you trust. You might know for a fact that they are untrustworthy garbage, but you're still trusting them.

Relatively few companies can sign TLS certificates, and you have the security of the domain name as well. In order for an attacker to steal a TLS session they need to compromise both the certificate system and the dns lookup.

It also helps that the CAs have an incentive not to get caught (CA death penalty for misissuance)

The trust that browsers place in the TLS chain of trust is basically just the assertion that the holder of the TLS key is the one who owns the domain.

This doesn't imply anything about the contents that can be transferred over the TLS connection. Could be malware. The other side could leak your private data like crazy. That's outside the scope of the TLS chain of trust.

When you use your car, you trust 100 different manufacturers from all corners of the earth. When you go to the hospital, you trust 100 different machines, chemicals, gloves, needles etc. It's no different.

I'd argue that there's an obvious difference between buying a car or receiving medical care versus being targeted for advertising purposes.

When I go to the hospital I trust the local doctors to make good decisions on products to buy, I don't trust the products themselves let alone the products manufacturers. Moreover it's not so much trust as resignation to the fact that I have no better option but to hope they don't do something stupid.

When I use a car I trust the combination of the manufacturer and the regulator to have used parts in a fashion such that they won't kill me. I don't know or trust the individual part manufacturers, that's the automakers job.

There is no equivalent to the doctor, or the automaker, or the regulator here. It is not at all similar.

I trust that the hospital complies with medical regulations and standards and that the manufacturers do as well, with the appropriate inspections by a relatively disinterested regulator.

Similar for the car manufacture, plus there are negligence laws in place if either the hospital suppliers or car manufacturers fail.

When I can file malpractice lawsuits against ad-tech companies for leaking my personal data, maybe then, after a few years of lawsuits causing their insurance rates to skyrocket, can we maybe talk about trusting them.

When you go to the hospital, every machine, chemical, glove, needle has gone through an FDA approval process or has been manufactured to pass FDA standards.

There is no FDA or NHTSA for web technologies.

Reply on news.ycombinator.com