Hacker News Reader

Comment by s3r3nity | Hacker News Reader

As anyone who is, or has, worked in ad-tech would tell you, this is pretty _tame_ in terms of the "offline conversion problem."

When there are $billions$ of dollars at stake for this type of information, you can guarantee there will be many companies attacking this problem.

Therefore, not to be a pessimist, but if you think that 1) using a fake cell number on Facebook is going to help or that 2) there aren't services like Google doing this already, potentially with just as good match rates as Facebook, or 3) that using Firefox + adblock is all you need, then you're going to be constantly plugging holes in a leaking boat.

View on HN

> you're going to be constantly plugging holes in a leaking boat.

True, but the ad industry isn't like a boat. They don't want to track everything or build a complete profile about everyone. They just want to track most things and build a fairly complete profile about most people.

That means every privacy step you make has some incremental gains. Just because a private detective could use the collected data to build a complete profile of you, doesn't mean the ad company will - they'll collect data from the easiest sources, and if you make it too hard for them to get data about you, they'll simply collect data about other people.

> They don't want to track everything or build a complete profile about everyone

Citation needed

In the sense that they will only put in a finite amount of effort (compatible with profitability), and take everything they can get. Over years, the amount of effort or technological means might increase, but it’s not like they operate with the singular focus of collecting everything about everyone.

Right. They don’t care about having data about “you” in particular, they care about having enough data about enough people to sell ads effectively.

Marketing to you doesn’t make them money. Marketing to many, many people roughly like you makes them money.

You yourself are only a tiny and statistically irrelevant piece.

Right up until the exact moment you aren't.

> You yourself are only a tiny and statistically irrelevant piece.

Perhaps, but they engage in so much effort to spy on me and defeat my protection against them that this distinction doesn't actually matter.

This is only really true of marketing campaigns, and even then only in some instances. In certain kinds of marketing (e.g. direct campaigns), there may be downside risks to casting too wide a net beyond just cost vs profit.

It's also important to understand that these data aren't just used for shotgun marketing campaigns, they're also used in highly targeted applications. For example, if you give a company a small amount of information about yourself, for example through a insurance or financial services "estimate" page, that company has very good reasons for wanting as much (and as accurate) data about you as possible. The two biggest reasons are:

1. If they're smart, they're running models to associate those and other things with purchasing behavior. Notwithstanding the fact that they need to stay on top of the model's accuracy, having information about you that is too incomplete or too inaccurate can really fuck up their shit.

2. In domains where customers are extremely profitable (again, e.g. insurance and financial services), it can likewise be extremely expensive to acquire the data needed for robust modeling, even dirty data.

In both of these cases, they do very much care "about having data about 'you' in particular".

They would if it were free, but getting the marginal information isn’t that valuable for them while being relatively expensive

I am pretty sure they are not interested in you per se, but at all those people like you.

Not every conversational point in an online forum needs a formal citation.

At the moment, from various advertising agency surveys, it seems that small/local businesses are still "dipping their toes" into digital ads and not really trying to track their audience at all beyond simple geographic segmentation.

The bigger agencies are building their own databases, but they haven't been able to link ad spend and customer purchases effectively, so that's the main focus at present. In particular they need to know ROI to effectively budget ad spend. Obviously, they have estimates of these numbers, but not an accurate per-ad-buy prediction. Google/Facebook are full of clickbots and there seems to be minimal incentive on their part to remove the bots. They've made some efforts with pay-per-conversion but it seems like marketing theater rather than a business model shift.

So until the fraud problem is solved, I don't think they care about microtargeting too much, except for its anti-fraud properties (attractive ad profiles are hard to fake).

> and if you make it too hard for them to get data about you, they'll simply collect data about other people.

I strongly disagree, and with all respect, this is a naive view.

This might be true when you're looking at the mapping of individual company to individual person (ex: "You to Facebook" or "You to Google.") But the ecosystem approach to building a profile on you is more comprehensive than you think.

Example: you might get very very good at removing your phone and TV/Movie interests from Facebook, or never having it on there to begin with. But then Media Conglomerate X owns a cell/wireless provider, internet provider, and hell maybe even a cable company. There's a high probability that you pay for >= 1 service from this company, that can be matched back to your Google profile and/or Facebook profile - via a DMP (data management platform) or something similar.

Oh and remember when you used your real phone number to make a reservation at a restaurant? AND they needed a credit card on file, just in case you don't show up? Well those are uploaded and grouped in the same data pools.

And then when enough stores / restaurants / ecommerce sites pool this information, they can build a pretty reasonable shopping profile for you, make (very good) estimates on your demographics, etc. Almost like it's crowd-sourced!

Therefore the "you" that is supposedly a "small, statistically irrelevant piece" is actually part of a group that has an ecosystem of companies and DMPs pooling data to make that group smaller and smaller.

Okay, I've generally wavered on this between "assume the online advertising sector is nefarious and evil and perfectly competent" to "assume the standard level of bureaucratic incompetence". Your comments here are moving the needle back towards the former.

So what in your opinion can people do, that are reasonable, actionable steps to take, to avoid being an unwilling part of this ecosystem?

Destroy your cell phone, delete your internet accounts, and only use cash.

You have to be a part of the ecosystem. If you need any connectivity (internet or phone), you really have no choice. Unless you buy prepay cell phones with cash, change the number every few months, only use public WiFi, wipe your computer, change browsing habits, etc.

Even if you Adblock and never give away personal info, like op said, your cable, bank, insurance, dmv, internet, and phone provider will still collect and sell your data.

Your comment and the sibling comment are both saying this is an all-or-nothing situation with no degrees of variation at all. That flies in the face of pretty much all other data science, so I find it hard to believe.

I mean you can have some impact, but at the end of the day the variables you control are relatively minor in the grand scheme. For example, uBlock will prevent your browsing habits from being used.. but browsing habits aren't really a great signal anymore. I only ever used audiences that are based on strong signals like purchases, location visits, verified demographics, etc.

What's your goal exactly?

Yes you can make their ad targetting somewhat less accurate in some circumstances.

> You have to be a part of the ecosystem. If you need any connectivity (internet or phone), you really have no choice.

Which is why we need really tough legislation to put a stop to this abuse. The GDPR and CCPA are good starts, but both of those are much too weak. Here's hoping that such legislation will get better, and more pervasive, over time.

And then, they throw away all that information and give you targeted ads that are so bad that you couldn't make a worse job if your life depended on it.

I guess it is a mixed blessing.

They use all of that info to target you, limit the number of times you’ve seen an ad, and stop sending you ads after you buy the product. Obviously it’s a really hard problem though, because the above list doesn’t always work as intended.

It seems to work more like after you research and buy a lawn mower, they conclude that you are really, really interested in lawn mowers from then on.

Yeah that happens often. I ran these campaigns for two years - you effectively get 200 dials, knobs, and levers to pull all making minor changes to an incredibly complicated adtech ecosystem. My first year I ran 80 of these campaigns, and could spend <20 minutes a week on each.

Missing something like “exclude recent purchasers” was easy to forget, but easier to not even have time to set up. (It might take 10-30 minutes to set that up)

I've noticed a lot of Instagram ads where the advertisers seemed to ignore a regional target, or Instagram does. I get ads for restaurants all over the country, which makes no sense for the advertiser. I'm not about to go eat at some Mexican restaurant 2000 miles away from me in a suburb.

This is because of the vastly different amounts of work involved on either end.

Knowing you browsed a product is as simple as firing a tracking image on the product page from the adtech platform. Knowing you actually bought it means having a connection from the ecommerce system back to your email then back to the id that used used in the adtech and then setup as an exclusion filter in all of the campaigns.

It's also usually not worth it since conversions are low and ads are cheap so better to keep advertising and get net new sales then worry about the people who already bought seeing the same ad.

it would be good for them to work that out because showing me the same ads for lawn mowers for months straight is a waste of their advertising space and their clients' dollars.

I also do things like look up something on Google for someone else, then see ads about it for months. While I understand the simple way of this technology works, they might want to rethink the idea that I need to see ads endlessly for everything I did one search for.

I explained it's not worth it in the last sentence. It's year of work and millions in cost, and now regulation prevents tying PII from your purchase to the anonymous IDs used in adtech. You're going to get new ads anyway, retargeting campaigns rarely last beyond a few weeks from the last product page visit.

> you might get very very good at removing your phone and TV/Movie interests from Facebook

Also, your Smart TV may simply be spying on you and sending that data back to the manufacturer[1] either by sending a hash of portions of your screen, or in Samsung's case, straight-up sending screenshots.

[1] https://news.ycombinator.com/item?id=21657930

This is completely unreasonable. There is no network for uploading and matching customer phone numbers across businesses. Who owns this company, in your mind? They must have tens of thousands of customers and be making billions in revenue to have the kind of scale and reach you're describing.

It generally takes years for a big company to completely ingest the data of a company that they acquire, and even then everything is siloed in 20 different ways. People only wish that company X buying company Y meant that the two merged all of their databases synergistically. The world definitely does not work this way

Liveramp.

You literally upload any offline data (phone numbers, names, address, whatever you have) and they match it to online profiles. They take the data you give them and use it in their cross-device graph, which is the exact thing you said doesn’t exist. Any business can go license or use that cross device graph in a variety of ways. $RAMP, 2.2B market cap.

Same service is provided by oracle with their cdp and dmp, and a few other companies. If you want to do more research the terms to look for are identity graph, cross device graph, offline matching, and other variants of those. Fb, google, LinkedIn, etc all offer some version of this in their walled garden. In the blog post they talk more about offline conversions, but it’s the same idea.

There are a lot of companies in the cross-device graph space. As I said, they do not have nearly the level of integration described in the great-grand parent comment.

If I'm wrong, sign up with Liveramp and use my phone number to tell me what restaurants I've booked reservations at in the last month. Is that how it works?

So yeah the restaurant or restaurant group doesn't have that great of a profile, it is built by companies like liveramp who get data from tens of thousands of sources and pool it into their own graph + audience data. Then they license it back out to those same companies. FB/Google and Oracle (crosswise) probably have the best identity graphs and are on par with what the original comment was describing. (I used to work at oracle on their audience products)

Liveramp is b2b and definitely won't support anything you want to do with them, but there are some comically bad tools (haven't been updated and are purposefully inaccurate) that let you check what data pools you're currently in.

https://datacloudoptout.oracle.com/registry

Liveramp has been particularly irritating me of late, because they seem to be trying to position themselves as if they were defenders of customer privacy -- when they are, in fact, doing the opposite of that.

If you're going to be bad, at least don't try to pretend that you're good.

Its very easy for adtech vendors to implement legally required or industry-wide standards and call themselves privacy conscious.

Yes, but they're lying when they do so. What's required legally, and the industry-wide standards that are currently in place are both insufficient. Adhering to them is great, but companies doing so cannot reasonably be characterized as being defenders of privacy if that's all they're doing.

From your perspective, yes they are definitely lying. From their perspective they've implemented a pro-privacy feature and advertise it and their company as doing so. I'm not saying either side is 100% correct, but there are two sides. The industry groups call something like the below pro-privacy and adtech/pubs do the same.

Example: https://digitaladvertisingalliance.org/license-pricon

> From their perspective they've implemented a pro-privacy feature and advertise it and their company as doing so.

If that were the specific claim they made, I wouldn't call them lying. But I was talking about Liveramp specifically, and they're making claims well beyond that -- they're claiming that they're actually defenders of privacy. That's a straight-up lie.

I keep a close eye on the adtech/martech world ("know your enemy"), and it's clear that on the whole they've managed to reframe the issue in their own minds in a way that is favorable to them (mostly by doing what Facebook is doing: considering themselves as "pro-privacy" by defending the data they collect against outside attackers and abuse rather than considering their own collection and data use).

I don't think they're lying when they do this, I think they've managed to delude themselves in the way that salespeople often do: by convincing themselves that the lie is actually true. It's not lying, after all, if you believe it.

But Liveramp has elevated this to a level that I believe is intentionally deceptive.

False flags and information is the only way to deal with this stuff...

If FB thinks you're a 72 yr old retired dentist from OK, and you buy nothing but feminine hygiene products and 3 wheel wheel barrels, you're pretty worthless as a consumer.

The future of ad block is disinformation. Makes the entire ecosystem worthless

Vernor Vinge's "Rainbows End" novel has the Friends of Privacy who spew falsehoods into the Network so as to disrupt attempts to track everybody all the time. My first "Agent" contribution when I worked as a researcher was just code which listened in to other conversations and then lied about stuff. If another agent said "X = 4" my agent would state "X is not 4" just to disrupt things.

I suspect it's much harder to do this successfully in real life than it is in a novel where it's just an excuse as to why otherwise resourceful intelligence agencies don't know who the central character Rabbit is (Vinge says he's not sure either, to me it seems obvious Rabbit is an AI, surely the whole point of all Vinge novels is that there's a Singularitarian Apocalypse, and in Rainbows End the humans think they've averted that apocalypse but actually the thing that just saved them is the Apocalypse and they ought to be terrified)

AdNauseam is here:

https://adnauseam.io/

It's on in the Firefox extensions site:

https://addons.mozilla.org/en-US/firefox/addon/adnauseam/

But not on the Google Chrome site:

https://www.theregister.co.uk/2017/01/05/adnauseam_expelled_...

Thanks for sharing this. Looks very interesting but with the fraud filtering in place for most ads, I wonder how effective this can be in the long run. Seems as if it'd be filtered out but maybe, that's the point???

i think that's exactly it - hopefully you'd get put on some adnauseum users list where your traffic is just dropped. OTOH maybe google et al just uses that list for working on fraud denial/defeat so you're probably feeding the beast no matter what.

There is a very cool book on the topic. If anyone is interested in finding out some potential mitigations (some implemented, some theoretical), I'd recommend giving it a read: https://mitpress.mit.edu/books/obfuscation

Thank you for sharing this. I ordered the book.

That relies on the majority of people putting in constant vigilance to be implausibly decoded as as 72-yrs old buying feminine hygiene products. Your specific profile may be worthless as a consumer, but unless you can convince 100 of your close friends to similarly feed the system disinformation, you've made it ever so slightly less effective. The metric used evolves (CPC) and the pay rates for them, but until more people actually care to disinform, I don't see that advertising will die any time soon. (Hopefully I'm wrong!)

You are so right. People forget that the cell companies know who you are and where you are 100% of the time. They also know every site you visit on their network. Things like this remind me of people using TOR and then signing into Instagram or Facebook. You just destroyed your anonymity. These sites would need to allow for anonymous login structures that almost none do.

"You are so right. People forget that the cell companies know who you are and where you are 100% of the time."

My mobile phone company has no idea who I am. It was trivially easy to purchase an iphone, at the Apple store, with cash and then purchase a Verizon MVNO SIM from US Mobile (which I prefer over StraightTalk because they allow tethering).

Neither Apple nor my MVNO nor Verizon knows who I am.

I, personally, am not a customer of any mobile provider.

Certainly my mobile provider could find out if they dug deeply enough - specifically, they could (somehow) check the Visa card I use for payment and see the corporation that that Visa card was issued to and then look up the corporate records and then ... they would know that somebody at X Corp is their customer. Possibly me.

Remember: neither Visa nor Mastercard verifies purchaser name. Only AMEX does this. You can purchase online with your personal or corp Visa/MC and put in "Mickey Mouse" as the name - it will always work unless they are a very, very rare merchant (usually European) that has put the "Verified by Visa" component into their workflow.

Or the could:

1. sample the HSS (HLR in old-money) every night to find which phones are camping in which location areas (LAC)s;

2. this given them a phone → area location for every phone in the country, where area is about 200 cells (a few km²);

3. then they could draw out the call detail_record (CDR) of very outgoing call, SMS, and even data session to get the cell identity;

4. this gets the phone → area mapping down to a few hundred m²;

5. then if they are motivated, they will use the location services in the Mobile Application Part (MAP) to silently move every unknown phone into dedicated mode and repeatedly determine its location to within 10m - 50m;

6. if the phone has control plane, GPS, they just ask it that. Many, many phones do;

7. this information is collected all the time and passed to in-house and 'external' GIS teams to cross-reference against all sorts of wonderful data;

8. they know who you are.

The good news is they don't care. They just want you to spend more. ARPU is everything.

Source: I built this stuff for a living.

All points well taken - and that I have a firm grasp on.

My threat model is "telco or ISP employee decides to see if John is a customer and, if so, just what John does with his phone". They will not find me in their customer database and they'd have to dig fairly deeply, and possibly involve banks and/or LEAs which are not my threat model.

Also, just as a coincidence, and not by design, my place of residence has zero bars of mobile service ... I lose it about two miles from where I live ...

When I was playing the game we cross licensed with banks, credit agencies, and etc. I couldn't evade my own nets because I have a drivers license, property, and bank accounts.

I'm sure that you've done better.

They generally know your location via tower triangulation. They know the sites you visiting via DNS or IP > reverse DNS. Combined with other data sources, they can get pretty close, probably exact. If you are not in a high rise apartment, they can guess your address and/or your work address based on normal 9-5 work patterns. They can map business to LinkedIn for employees of that company. I'm just trying to say that we leak a LOT of personal data to a LOT of people practically all the time. It is very very hard to stay anonymous today.

Also, I wouldn't be surprised if in the near future, KYC is required to buy any SIM that connects to the network. It isn't here yet but is coming.

"They generally know your location via tower triangulation."

Correct, but to clarify - they know your SIM cards location. In my case this correlates to a corp name and no actual personal name (mine or otherwise).

"Also, I wouldn't be surprised if in the near future, KYC is required to buy any SIM that connects to the network."

I suspect you are correct and I think this is already de facto practice for a consumer purchasing mobile phone service in the United States. I suspect, however, that an EIN and a corp name will continue to allow SIM provisioning without associated PII.

Something to consider: we are promised many, many more 5G SIM cards on the network than there are people on the planet. Most of those SIMs will be provisioned by corporate entities and, therefore, the ability to procure and deploy SIMs with no PII will persist ...

This is naive. Via triangulation they know your approximate location, and there are likely cameras with facial recognition and/or license plate readers in the area that can be used to correlate with arrival/departure to get your identity. Unless every single thing you use is in somebody else's name and you wear some kind of disguise everywhere it is already possible to bypass anonymity in most urban areas. If someone isn't doing it already someone will be soon, there's a lot of money at stake.

No it won't. Anonymous SIMs were already wiped out in large areas of the world. The way KYC works is you need to know the "beneficial owner" i.e. ultimate owner of an asset. The bazillions of 5G sims we're promised will all be tied to a strongly verified corporate identity and to get on a network will require you to present ID if an individual, or do corp KYC if a firm (which will in turn require the heads of the company to do personal KYC to establish beneficial ownership information).

Remember, this isn't even new for many countries.

> My mobile phone company has no idea who I am. It was trivially easy to purchase an iphone, at the Apple store, with cash and then purchase a Verizon MVNO SIM from US Mobile (which I prefer over StraightTalk because they allow tethering).

You may be able to do this in the US for the time being. However, in many countries already – a list that is steadily increasing – you cannot purchase a SIM card without showing ID, a copy of which is made and forwarded to state authorities. In other countries – I know of at least Chile – you may have to register the IMEI of the phone as well.

> then purchase a Verizon MVNO SIM from US Mobile

Are you paying with a pre-paid card? If not, your number is tied to your card which is tied to your identity.

Hold up. GPS coordinates - yes, but not the sites visited. HTTPS traffic hides the URLs. This is the reason why I can't block anything with HTTPS in it from my Netgear router. By the time the packets hit the router, it's all encoded.

Please correct me if I am wrong.

You are wrong.

You can hide content, except where the sender is mirroring it. You can hide your DNS lookup by using a DNS aggregator (are you?), unless you are using 1.1.1.1 or something, where the business model is harvesting. But unless you route everything through a foreign VPN, the phone company knows what site you asked for a connection to.

And who owns that VPN, and what is their real business model? The bigger they are, the more their customer list is worth.

Sites visited.

Unavoidably if you aren't using Tor the network can see the IP address, which would pin down that this is say, Facebook or Wikimedia, or Porn Hub. On its own you can't be sure this is Wiktionary not Wikipedia, or which type of porn.

In almost all cases the HTTPS traffic uses SNI (Server Name Indication) which deliberately carries the name of the server (the news.ycombinator.com in the URL you're looking at right now) in plain text. This enables Virtual Hosting - otherwise how would a bulk hosting company give you the certificate for bumsex.tinyblog.example rather than cats-in-boxes.example which are run by entirely different customers but hosted on the same cheap Apache server in a rack in Ohio? So that's enough to know it's the English language Wikipedia not Wiktionary or whatever.

But yes, it's only the site and so they won't know (at least just from this) if you looked up Bowel Cancer or Elizabeth Warren; if you are watching a Youtube video about Minecraft or Venezuela; and so on.

Medium term the plan is to deploy two technologies that mean the site's name isn't available, improving privacy. DPRIVE (encrypted DNS, often via DNS over HTTPS) and eSNI (Encrypted Server Name Indication) but while DPRIVE is complete and being rolled out (controversially as you may have seen right here on HN) eSNI isn't finished and is tricky to get right, it may be some years before you get much benefit. We need both for (hopefully) obvious reasons although DPRIVE already makes a lot of cheap censorship options impossible, and making censorship expensive makes it de facto unpopular in democratic countries where voters don't want to pay lots of money for something that seems mostly to inconvenience them. See also: popularity of the American TSA.

Even after all that work is done though, if the mere IP address you're connecting to is enough to be a problem you must use Tor today, and then, and likely forever.

Interestingly the Network described in Stephenson's "The Diamond Age" actually works exactly like Tor all the time, with (apparently) no way to directly send things to an address whatsoever. But this will always be more expensive to do with technologies we know about today, and so it is unlikely that we're destined to replace the Internet with a network that always behaves like Tor.

I see now. IP. Of course... Thank you for the detailed explanation.

They see your DNS. If not, they see the IP (it has to be routed) and they can reverse lookup the DNS from the IP.

Working in ad-tech I know these problems are ubiquitous but apart from trying to patch these issues when we notice them in whatever in significant ways we can what else can you do?

Spinning it in a way that doing it becomes a threat to business continuity?

If they’re deducted $0.15 from income, paid to you, on spot each time they query that information, or if it adds 0.015% to probability of their stock crashing in that quarter quantifiably, then I’d expect it’ll be gone forever before any of their C-class stands up for some coffee next time. The reality is roughly reverse of that.

Interesting point. Can you imagine how the attitude around facebook would change instantly if they started profit sharing with their users?

Paying facebook’s users for facebook’s spy network isn’t quite the right [dis]incentive though. I don’t use Facebook but they still pay others to spy on me. Those others should have to pay me for the spying they do on me.

Revenue sharing is not my point. Some platforms do and makes no difference.

What I am describing is a destructive change to revenue streams for ad companies. That is as nonsense as reversing direction of couple major rivers and I know obvious open question will be how in the world.

How about stop spying on people, and only collect data from those who have given informed consent?

If you have location history enabled in Google Maps, they tie it to ad impressions and offline credit card transactions they buy from Visa and friends.

If i don't have a profile on Facebook or on any social network at all, how much does it help?

It helps some, but not enough. Some of these social networks (such as Facebook) will develop a profile on you whether or not you have an account with them.

To escape the marketing-surveillance bear, I just have to run faster than most other people.

You're probably not wrong and can you provide some specifics?

Reply on news.ycombinator.com