Hacker News Reader

Comment by bartread | Hacker News Reader

That's not what the GP is saying. They're saying that only Facebook and the like have the resources to catch fraud, and smaller players won't. Yes, it's harder, but that hardness is almost an irrelevance to Facebook and other FAANG-alikes, whereas it could be much more of a problem for smaller businesses who will struggle to bear the costs both of fraud, and to develop anti-fraud solutions (or pay for anti-fraud services).

Maybe that opens up some opportunities as well, but that's not necessarily particularly appetising for businesses that aren't focussed around those areas of opportunity.

View on HN

Can you explain how Apple’s anti tracking measures are going to hurt small business and make fraud easier?

Most of the time, privacy and fraud both benefit from the same changes. To prevent tracking online, you want your device to look just like everybody else's devices. To prevent fraud, you want devices to look different so you can tell when a device does not represent a real user.

At the extreme, imagine if every person has a unique identifier that was automatically sent whenever they used any device: preventing ad fraud would be really easy, and you would have essentially zero privacy. At the other extreme, imagine if every device looked exactly the same, with no user agent, no IP, no cookies, no way to tell my traffic from yours. In that situation, people would have pretty strong privacy, but if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users.

As the GGP says, removing IDFA shifts the balance toward both privacy and fraud. See https://blog.cloudflare.com/cloudflare-supports-privacy-pass... and https://web.dev/trust-tokens/ for attempts to separate these.

(Disclosure: I work on ads at Google, speaking only for myself.)

> To prevent fraud, you want devices to look different

To me, if your system relies on being able to tell most internet users apart, that sounds extremely close to processing personally identifiable information.

It doesn’t need to tell them apart individually, just high level demographics or geography are already useful. If your website suddenly got 99% of traffic from Tibet (random example), you would probably discount those impressions/clicks.

> if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users

This seems like a problem with the current model of ads being paid for by impression/click, and switching to a model where ads are being paid for the time they're being displayed (pay X to have your ad appear here for Y time) the problem goes away.

Furthermore, the current advertiisng model also suffers from this problem even beyond malicious intent. Is it fraud if a real user "looks" at the ad but actually looks away from their screen? If they mute the sound? If they don't speak the language the ad is in? Etc.

> switching to a model where ads are being paid for the time they're being displayed (pay X to have your ad appear here for Y time) the problem goes away

I don't think it does. How does the advertiser know what the spot on the site is worth without traffic estimates? See my response to chongli downthread: https://news.ycombinator.com/item?id=25431138

> Is it fraud if a real user "looks" at the ad but actually looks away from their screen? If they mute the sound? If they don't speak the language the ad is in?

None of these are fraud, because the ad is in front of a real user.

Fraud here doesn't mean "the ad doesn't perform as well as the advertiser hoped for some reason" it means "the ad was not actually shown to real users on the site, contrary to the agreement between the publisher and the advertiser".

pay X to have your ad appear here for Y time

Someone once told me how they got a bunch of cheap/used phones and just left them all running an app that shows ads. They'd glance at the phones now and then to see if they needed to "interact" with them to keep the ads rolling.

By fraud you mean ad fraud?

Yes; we're talking about endymi0n's claim in https://news.ycombinator.com/item?id=25429278 that without IDFA preventing ad fraud is (a) harder and (b) disproportionately harder for smaller players

>but if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users.

There is literally nothing in the world I care about less than this.

Of course you don't care about it directly, but it is part of a chain that funds things you probably do care about?

Advertisers pay publishers to show their ads to real users. Publishers run their sites because they receive money from advertisers. We visit the sites because they're diverting/informative/useful/etc. If the advertisers can't tell whether their ads are instead shown to robots, the whole thing falls apart.

I like the trust tokens proposal as a way to exclude bot traffic without tracking: https://web.dev/trust-tokens/

This is an interesting proposal, thanks for sharing.

Shouldn't advertisers instead care about the acquisition cost per customer and revenue per customer? Do publishers not offer pricing based on these things?

> if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users

What users actually care about protecting your propaganda based business model though? Sounds like it's pretty much your problem and you want to reduce privacy to make manipulating their behavior a bit more profitable.

Google’s inability to protect its core revenue stream is squarely in the “not my problem” category. In fact, making internet advertising less desirable for businesses sounds like a benefit to me.

So, Apple’s decision is looking even better to me now.

Google's core revenue stream doesn't rely on IDFA. Many 3rd party advertising companies and apps do rely on IDFA. Apple's move helps Google.

This is not true, any ad network benefits from IDFA, bigger the better.

Removing of IDFA should close the gap between big players like Google, Facebook etc vs others.

I don't do mobile advertising but this is just incorrect... Most of Google's revenue comes from Search and that has nothing to do with IDFA.

Then how would third parties with no access to first party data compete when there's no more third party data would be something I'm curious for you to explain.

Ok first of all I am not saying that third parties without access to first party data will compete with google's search ad business.

I think after removal of IDFA, smaller ad networks will steal some of big players mobile market share. And mobile advertising will not move to search based advertisement as much as you think. Maybe some revenue will shift there, but I think lose on mobile side will be bigger.

Google's search revenue accounts for around 95% of it's top line revenue.

Google’s ability to protect its core revenue stream is squarely in the “not impacted” category when it comes to Apple's IDFA move.

Banking fraud is a much bigger deal, and fraud detection works similarly there.

For Google yes, I agree. But for services you pay for directly it is your problem because it raises the cost of that service for you.

As a user I would like zero tracking because I don't care about ad fraud that much. I also think advertisers and contemporaries collecting my info is a security problem or even a breach.

I was expecting fraud here to refer to that which might impact the user in some way (i.e. credit card / bank, identity, fraud etc) - was genuinely surprised that other people read 'ad fraud' from this...

1. You’re allowed to use IDFA. But users will now have to allow access, as a permission dialog will pop up first.

2. The IDFA is just a simple static UUID. It cannot do a very good job at preventing fraud. There is no way to validate anything about it or affirm that it ties to a genuine device.

1: I expect this will translate to the majority of traffic will not have IDFA available, either by apps not wanting to annoy users by asking, or users saying no.

2: On a single request, yes. But users typically make very large numbers of requests over time. The pattern of requests that you'd see from a real user looks pretty different than what you'd see from a bot.

Of course they look different over time, isn't the problem here that same data can be used to do statistical analysis for other purposes than fraud prevention?

I'm responding here to willstrafach 's claim that "The IDFA is just a simple static UUID. It cannot do a very good job at preventing fraud" and wil421's earlier "Can you explain how Apple’s anti tracking measures are going to hurt small business and make fraud easier?"

But yes, of course IDFA can be used for things other than ad fraud detection.

> To prevent fraud

Honest question, I am not trying to be obtuse, but in this context can you more specifically define fraud? Is it just "ad fraud" as defined here: https://www.clickcease.com/blog/what-is-ad-fraud/

I get why businesses should care about ad fraud, but why should I, as a consumer care about it? Frankly I don't even want to know about my traffic, let alone yours.

Yes, ad fraud. We're talking about endymi0n's claim in https://news.ycombinator.com/item?id=25429278 that without IDFA preventing ad fraud is (a) harder and (b) disproportionately harder for smaller players.

As for why you should care about it, see my response to thesuitonym below: https://news.ycombinator.com/item?id=25431866

The cost of a phone becomes a barrier to scaling fraud because once you use a phone for fraud it can be blacklisted.

Advertiser fraud is hardly the only type of fraud. It happens with services you directly pay for like ridesharing and food delivery as well. The cost of fraud becomes another cost for a service provider and prices for all users need to be raised to offset losses from fraud.

For smaller businesses without the brain power to combat fraud, their margins will be greatly hurt by fraud, making it harder to compete.

I'm in favor of what Apple is doing myself, but it's definitely a legitimate unintended consequence of this measure.

What would be useful is if Apple became the gatekeeper for tracking fraud and companies could report ephemeral identifiers for fraud that only Apple can de-anonymize and then Apple provides fraud scores for ephemeral identifiers on account signup.

Market will catch up. I used Apache beam and we got really creative. As with all things it’s an arms race.

Did not expect to see Apache Beam mentioned as part of this conversation. Mind me asking what you mean?

Apache beam is the underlying engine we use for fraud detection. Based on proprietary heuristics we can provide the application with a confidence score the user is legit. Its up to the sec/product teams to determine when specific actions need additional verification like one time token via email or captcha. Just two examples.

Reply on news.ycombinator.com