Hacker News Reader

Comment by est31 | Hacker News Reader

> Some website owners think the best strategy is to opt their websites out of FLoC by attaching a header.

I've tried to look up which header that would be. The only thing I could find was a github issue, but only containing a request for such a header, not actually describing one. https://github.com/WICG/floc/issues/13

So I understand it correctly, currently publishers can't opt out from this tracking? What if you process sensitive data, e.g. protected by HIPAA, or attorney client communication?

View on HN

Short version:

    Permissions-Policy: interest-cohort=()

So in nginx for example:

    add_header Permissions-Policy interest-cohort=();

It's freaking stupid that it's opt out, but what you're gonna do. I've added it to my own website as soon as I found out. Organization I'm working for will be doing the same.

Thank you!

Check this:

https://news.ycombinator.com/item?id=26828967

Thanks!

How would FloC compromise the integrity of sensitive or privileged data? It’s certainly creepy but I don’t see how that would work.

From how I understand it, site data like the URL or even the content of the website is fed into an ML model which outputs a cohort value. That cohort value might be changed by every single individual website you visit, or by content on that website. So it's possible that some sensitive data you'd rather keep private lands in the hands of Google. It's probably made even worse as websites can change their content and thus influence the ML model, tickling out data that would otherwise not have been available.

> The browser uses machine learning algorithms to develop a cohort based on the sites that an individual visits. The algorithms might be based on the URLs of the visited sites, on the content of those pages, or other factors.

https://github.com/WICG/floc

There's currently a tutorial on how to do this just below this link on the front page, posted 3 hours before this one.

It would be very interesting if such sites had to block floc due to regulatory constraints.

Also interesting if GDPR applied.

Basically, this would make it extremely risky for companies NOT to opt out of Floc.

Which might be the way to kill it

Reply on news.ycombinator.com