Hacker News Reader

Comment by negus | Hacker News Reader

Yes this will have a great negative impact for Google's adtech competitors who unlike Google do not have other means to spy on users such as Chrome, search engine, Accelerated Mobile Pages, Gmail, voice assistant and so on.

But Google really has no choice here due to aggressive campaign by Mozilla, Apple and Microsoft who boast with their Intelligent Tracking Prevention ( https://webkit.org/blog/8828/intelligent-tracking-prevention... ) implementation blaming Google as a company which does not value users privacy. Google would lose privacy-conscious users otherwise.

But it is clear for me how all this anti-thirdparty cookies situation will go further: server side third party ad trackers -- this will bypass Same Origin Policy and will pose a privacy and security threat for users and websites even more than todays third party frontend ad trackers.

View on HN

I find their "removing 3rd party cookies will incentivise businesses to rely on fingerprinting" discourse dangerous.

It implies that other browser vendors (Mozilla, Safari/WebKit, new Edge) are in fact making the Web a more dangerous place.

I believe it's dangerous because it creates a harmful, unproductive PR narrative—people might just assume this is a true statement, without learning about both sides of the problem. I'm not trying to strip anyone of agency, I just don't think most of my friends would have time to research this topic and might decide to follow the main opinion instead.

The answer I'd like to hear: Yes, it does push some actors towards fingerprinting, but preventing fingerprinting should be dealt with regardless. Changes should happen both on legislative and browser-vendor level.

> But it is clear for me how all this anti-thirdparty cookies situation will go further: server side third party ad trackers -- this will bypass Same Origin Policy and will pose a privacy and security threat for users and websites even more than todays third party frontend ad trackers.

Server-side as well as white-labelled (subdomain) integrations already exist. Lotame (DMP) has at least one product of this kind, afaik.

15-20 years ago, we found that people that were aggressive online and harassing people often cleared their cookies too. That constant clearing of cookies had us look into using flash to hold cookies, since that data didn't really get deleted when you cleared your cookies in the browser. So there is something to be said about that issue.

That said, Apple/Mozilla/etc know this and so they are simultaneously trying to make fingerprinting more difficult. If they were not, I would agree with Google's stance. But since they are, it is really more of a footnote.

I remember in the days of MSN gaming zone (zone.com, c. 1999), I was a vicious troll, and I'm pretty sure MS used their control of the OS to enforce a machine ban, as every attempt to use it from my home desktop was blocked. Also, somewhere in the Windows system registry I found a list of all the screen names I used.

> 15-20 years ago, we found that people that were aggressive online and harassing people often cleared their cookies too.

You forgot to mention them abusing children and planing terror attacks.

Acting like children, sure.

No terror stuff, but plenty of anti-Semitic material.

> 15-20 years ago, we found that people that were aggressive online and harassing people often cleared their cookies too.

This might very well be true for what I know, but the general idea that optional privacy leads to more hostile environments seems to have been conclusively destroyed by HN and certain other forums, especially when compared to Facebook.

We had a million communities, and learned a lot about how people act and react. Trolls, spammers, and people with some severe mental problems.

FB is interesting in that you would think that it would inhibit all bad behavior since you are using a real name. But really, people don’t care quite so much. Much improved though! Well, except for the bots, hacked accounts, and bad actors.

From the standpoint of dealing with crap messages, there are no silver bullets. But there are tools. Not everyone knows how to snowshoe, so you can have a decent win with even simple blocks.

I also don't see what has changed if businesses using 3rd party cookies to identify and track users switch to fingerprinting to identify and track users. My privacy is still being invaded in exactly the same way. Forcing companies to fall back to more bizarre and costly tactics seems to be the only path to victory.

A big difference is that every browser provides easy-to-use native features to clear or block cookies--not true for fingerprinting. The complexity and opacity of how it works makes fingerprinting harder to block and clear.

"... this will bypass Same Origin Policy..."

Same Origin Policy does not seem to provide any protection against DNS-based tracking.

For example, putting a series of links to resources in a page and making conclusions from the series of DNS requests made automatically by "modern" browsers like Chrome, Safari, Firefox, Edge, Opera, etc.^1,2

To be fair, this sort of tracking is arguably brittle, e.g., if user has auto-loading of images disabled or is not using a cache that randomises the ordering of IP addresses within a response packet like BIND.

It can also be easily avoided by user control over her client automatically making DNS requests for any resource^3 and user control over her own source of authoritative DNS data. For example, using a client that does not automatically load resources and using a local source of DNS data like a HOSTS file or a zone file served from a logging authoritative server on localhost like tinydns.

1. https://www.ndss-symposium.org/wp-content/uploads/2019/02/nd...

2. http://dnscookie.com

3. Not just images or third party scripts

I think there are currently more reliable ways of fingerprinting.

Most of them rely on Javascript or some other "modern" browser feature.

Not very reliable when user disables it or uses client that does not support it.

HTTP headers are malleable yet I still see the big tech companies appearing to treat them as reliably identifying a program/device. A new user-agent string or set of HTTP headers is not necessarily a new program/device.

Privacy is one side of the coin. Other side of the coin is that web adverts help web remain open, it helps independent and anti-establishment institutions to have an audience in a profitable manner. Remember, free speech does not exist unless that speech is also economically sustainable.

Arguably gun owners, strip clubs and porn magazines have fought for free speech more than facebook and google combined.

I am happy to willingly share my personal data with your advertisers if that helps you keep profitable (NYT, Reason, Cato, Vice, Pornhub etc.) you need to figure out how to achieve that without acting like jerks.

This is why tracking should be opt-in. Then you can allow it to support the things that you value without my privacy being invaded.

For that we need to somehow agree that tracking is not just a legitimate business practice but also a desirable one (as long as the individual has consented).

But these discussions will soon go into "how easy it should be to opt in?". Should it be a pop up like "allow location" or something more complex as enabling CORS.

The issue with server side 3rd party ads is that the advertiser has no way to assure the impressions are real.

How relevant is this information?

AFAIK, all that matters is how many conversions you get from $ spent. Both of those are perfectly visible, no tracking needed.

How would you know that a conversion came from an impression?

How do you know the highway billboard or TV commercial lead to conversions?

Maybe it helps society to go back to such models over destroying privacy.

(And as answer to the question: Statistical methods by comparing areas/times with no ads vs. with ads etc.)

That ship already sailed. People are not going back to blind ad investment most of which has incredibly low ROI.

As much as many HN readers would love to see ads and even the most benign forms of tracking to disappear, if you're aiming for something realistic (e.g that would still allow ads to exist and be a minimum profitable for all involved) you cannot just go back to the dark ages, and show the same ads to everyone.

Strangely, I still see plenty of billboards and TV commercials.

Well TV commercial effects on web traffic and on revenue are measurable. We do that for a client. We can even tell which creatives, channels, surrounding program types work better.

So what service do I subscribe to so that I never see ads at all?

Ads are pollution, and need to be treated as such. Information providers need to develop business models which do not depend upon advertising revenue. (foundations, Patreon, whatever).

I would love that. Unfortunately I also love the fact that I can share links to sites without paywall issues. I don't know how to combine those things in a working manner. But I hope there are smarter people than me.

Short term: Less tracking is good. (Not only for privacy, but also since I don't want to see "optimized" content – I want to be surprised, contradicting opinions etc. like in a good newspaper)

You don't have to show the same ads to everyone.

You can - without detailed tracking - identify rough location of the user. (IP etc.)

You can pick ads based on the content, not based on the user. (A site with beauty tips probably has different readers from a site on woodworking; a site with celebrity news has different readers than deep political analysis)

And yes, Google and Facebook would make less money (disclaimer: I have a handful Alphabet shares in my portfolio and probably funds containing those) and yes spread would be higher, but this could still pay a lot of bills and interestingly could lead to revert from clickbait to proper content, as readers of proper content are more likely the target audience for high-paid ads.

> People are not going back to blind ad investment most of which has incredibly low ROI.

Not willingly, but perhaps they can be forced through legislation. In any case, as long as the industry insists on spying on me, I will continue to fight them tooth and nail.

Ad tech doesn’t a priori have the right to do whatever they dream up. We can choose to fight it with both legal and technical means.

Tracking clicks is easy and non-invasive. Tracking exhibitions is basically impossible, even if the browser cooperates. So you either take the number of direct conversions the easy way, or you do some of the many causal research techniques later to try to discover indirect conversions.

The one thing that you can't reliably do, browser privacy or not, is gathering the useless number ad-companies currently rely on.

Tracking incremental conversions is possible with statistics but only if you know who saw your ads.

From the advertiser's perspective, that's a problem.

From my perspective, good. Advertising is toxic even when it's not invading my privacy, and maybe if we make it less effective people will do less of it.

No, it would simply move even more from impression to action.

why is that good? you're paying for it.

Here are the ways I can pay for it:

1. Find out about content I want. Decide to pay for it. Pay for it. Receive content. A simple, fair transaction where everyone gets what they want with no bullshit.

2. Find out about content I want. Receive content, along with ads that spy on me, distract me from the content I actually cared about, and tell me my girlfriend isn't hot enough, my car isn't fast or luxurious enough, my house isn't big enough, my family isn't safe enough, etc. Under the barrage of this constant psychological attack, I'll occasionally fall for it and end up spending much more money on things that I don't need than I would have spent on the content. And yet the content that I actually cared about and wanted to pay for only receives a fraction of those profits.

Reality leans the other way. What eill likely happen is that sites that used to make 100k a year from ads see their revenue drop to 70k then 50k then 30k. To stay afloat they plaster more and worse ads in order to survive.

This is exactly what happened during the first dot com crash when we went from $35 CPM banner ads to $1. Suddenly, ads were slathered on every page or websites simply disappeared. What we really need is a deal that works well for all three parties: advertisers, consumers and content providers. Google Adsense was this perfect solution for a while (until it got optimized to max profitability).

Maybe online advertising is like social networks and can only enjoy brief moments of relative balance before the cycle starts anew.

> What we really need is a deal that works well for all three parties: advertisers, consumers and content providers.

I don't think such a thing actually exists. I mean, there is a way to do advertising that doesn't require spying on everybody -- contextual ads -- but advertisers seem to consider that a bad outcome, and instead are spending a lot of time and energy trying to figure out how to continue to spy on everybody.

People easily forget the days of punch the monkey and x10 ads

Did those companies go out of business? An ad company in its death throws is going to be annoying right up until someone puts it out of its misery.

An appropriate free market solution would be to construct an easy way to search only the ad-supported web, or only the non-ad-supported web and let people choose.

The problem right now is that it's all mingled together.

There is zero chance that poorer tracking will reduce advertising meaningfully. You can’t track the effectiveness of TV and and radio and newspaper ads, but it’s not like people don’t use them.

> can't track the effectiveness of TV, radio, and newspaper ads

Sure you can. "Use check-out code 'newspaper1' to get 5% off any purcahse!" or something.

Perhaps ad servers could tag served ad images or JS with tracking IDs that get round-tripped back to the advertiser through the first-party server, third-party requests, or navigator.sendBeacon().

Assuming they implement via some kind of full server-side proxying of an arbitrary endpoint bi-directionally so that it appears first-party (and no 3rd party cookies) I would think they'd have nearly as good of means for verifying impressions as they do already. The main "downside" seems like it'd just be harder to create unified multi-site profiles as they'd have to resort to fingerprinting of some kind to track people across multiple sites.

I think the main issue is impressions vs clicks.

As I understand it today, I can view an ad on a random site and have a cookie with my unique ID in it saved. If I view other network ads, they know it's me and update my profile. Then when I check out, the site I'm buying from reads this cookie and reports back that it worked based on impressions.

AFAIK this won't be easy to replace if a random eCommerce store is blocked from reading Facebook et al cookies, it won't be able to report back reliably. You could do something like submit their email address or other data to Facebook and see if you get a hit, but that's probably illegal in many places without permission. And in most cases, the cookie from the ads will be blocked as it's third party (but would be able to be written for ads shown on-platform, which doesn't really matter since they can track server side anyway).

But clicks are very easy, you just tie a unique ID to the ad URL and have the landing page and checkout page track that. No cookies needed. It can report back in real time or later to update stats.

Minor point but the e-commerce site will not be able to read the cookie from Facebook - it will have a special code snippet on the "thank for your purchase" page. When your browser loads this page it also loads the snippet from Facebook (could be a 1x1 pixel or iframe etc etc) and your browser dutifully passes on the cookie as usual to facebook.com when it loads that snippet (i.e. facebook.com is the third party host) then Facebook's servers log the http request with the cookie ID so they mark that as a successful "conversion" (aka sale).

The browser will not make cookies from other sites available to the e-commerce site. There is no chance for the e-commerce site to take a look at what is in the Facebook cookie

Yeah true,and thanks for that. I unintentionally oversimplified.

I meant the 'page' (including the FB pixel JS on it) could read the pixel but the problem is of course the page is composed of resources from multiple domains and parties.

I'm pretty sure these days the default is just a JS ping to an endpoint, but the eponymous pixel exists under noscript tags for legacy support.

That sounds very close to "it makes it harder for advertisers to track you."

Which is of course the intent.

> Google would lose privacy-conscious users otherwise.

Would these users be using Chrome in the first place?

Why not? Privacy is not the only goal even for paranoids. It is all about compromise. Otherwise you would use lynx or wget -- truly private web clients. Or at least turn off JS.

Why are you speaking as if there are no better alternatives than Chrome? Other than a few organizations who decided that only supporting Chrome as a browser is enough for their sites and some extensions, there are viable web browser alternatives from companies which don't make their money off of user's data.

Google created Chrome, and bribed Mozilla with billions, to keep ad blocking from becoming a standard browser feature.

The Google search engine could be run for some small number of billions per year (or less) but Google extracts tens of billions per year from our pockets. It's a leech on society in the same way that Wall Street is.

They successfully propagandized the idea that "relevant ads are good" when it's patently obvious that relevant search results are what you want from a search engine. There's no need for ads at all.

>Google created Chrome, and bribed Mozilla with billions, to keep ad blocking from becoming a standard browser feature.

This caught my attention, as I haven't heard anything about this before. Do you have a source with more details on it specifically? All I see is that Google pays Mozilla to make Google Search the default search engine and pays Adblock Plus to whitelist their ads. I'm not seeing any sources indicating that Google paid Mozilla any money to keep ad blocking out of their standard feature set.

Reply on news.ycombinator.com