A privacy war is raging inside the W3C
protocol.com
protocol.com
That is until I switched to iOS and was given the option to hide my true email address, tell an app not to track me, and otherwise get visibility into just how much my data is getting sniffed for stupid reasons that have nothing to do with the service I’m using.
Google is a for profit company. On the side the offer products and services. Their profits come from selling your data to others.
Yes, I personally trust one over the other in this case. Although I don’t know what “for profit” has to do with anything. If it comes to Google or Government, geez, tough call that one.
It is a common misconception that FB and Google sell user data.
E.g. see https://www.facebook.com/help/152637448140583
"Google has also played a leadership role in creating industry standards for transparency and data protection. More than a dozen privacy employees at Google spoke to WIRED about how they make sense of the paradox of their work, insisting that there’s no internal pressure to compromise privacy protections to make a larger profit." -Wired (https://www.wired.com/story/wired-guide-personal-data-collec...)
Google also sells a plethora of physical products (Pixel devices, Nest devices, etc.) and services (Storage[Drive], YouTube premium, Stadia, Nest, Fibit, etc.).
This would be similar to calling Amazon "just a [book]store or a marketplace", whereas they also have their hands in Cloud Computing, logistics, grocery, iot, etc.
Note: Those products by and large all permit and enrich surveillance aggregation of the picture of you, and use with/for third parties/ads. It’s creepy how fast and accurate the multidimensional take has become.
I'd like to learn more. Do you have a source for that?
FWIW, I’ve seen you comment on Google email and ads. From what I am aware of, your information on what was/wasn’t and is/isn’t done has been… optimistically colored. I stayed out of it. But you could be less confident in some of these and/or disclose more readily that you are coming with a pro-employer lens while (you say) being far enough from it you might not know for sure.
Google does not sell the data to others. (In fact, much of Google's profits would remain intact even without any user data. That is the great thing about search ads -- the user tells you exactly what they want. There is no need to guess)
YMMW and what matters for me might not matter for everyone and weeding spam might be harder than before but:
Double quotes used to work reliably.
By collecting data about you, usually without you being consciously aware of it, they can offer access not just to a name/address but to a "profile". You are being profiled.
Incentives matter.
To get the full functionality from the device, it is difficult to avoid obtaining an "AppleID". There is an "incentive" for users to sacrifice privacy and control to Apple. That appears to be intentional. Then the after purchase data collection and storage begins.
I am glad these practices have not spread across the entire hardware industry. Imagine buying an SBC and being asked to purchase an "RPi Developer Certificate" or register a "SiFiveID".
You can see this trend quite clearly already: in 2012 Apple generated only 6% of its revenue from services while in 2020 it was 20%. Services tend to be also more profitable compared to hardware.
iPhone 12 was biggest super cycle since iPhone 7. It’s not that hardware revenue is declining so much as the flywheel is spun up for the ecosystem.
… [2021] a record-breaking year for Apple, beating the previous full-year record of 231 million units sold in 2015.
Apple is also benefiting from a higher average selling price, with ASPs said to be trending "higher on a positive mix" for the iPhone 12 Pro and iPhone 12 Pro Max.
https://appleinsider.com/articles/21/03/22/iphone-12-supercy...
We wouldn't know about it, but they were caught.
It's just marketing.
https://www.zdnet.com/article/apple-data-collection-stored-r...
https://www.apple.com/legal/privacy/en-ww/
https://www.apple.com/legal/transparency/account-preservatio...
Looks like they set this up in response to GDPR.
Interesting how the communications services create a pen register by default.
Isn't iCloud data backed up on Chinese servers? I'm pretty sure that means you're being spied on.
This is not to mention the waste generated by Apple actively fighting the right to repair.
So, good, Google needs to go. But so do the tech giants.
Are you thinking of Apple’s switch in 2018 to storing icloud data in China for users in China?
https://en.wikipedia.org/wiki/ICloud
> In February 2018, Apple announced that iCloud users in China would have their data, including encryption data, on servers called “云上贵州” located in the country to comply with local regulations. This raised concerns from human rights activists who claim that it may be used to track dissidents.
From some quick reading it looks like apple “has six data centers in the United States, two in Denmark, and three in Asia” as well as use of the major cloud providers. I’m not sure if there are restrictions on where or how data is stored for people not located in China though. I am assuming so.
You are ultimately arguing that a business protecting my data, while also using it themselves to sell me their own products, is just as bad in other ways as a company taking my data and using it to manipulate election results, to sell to shady companies and to market the shit out of me.
iCloud data is backed up on Chinese servers? Without being E2EE to boot? Do you have a source on this?
If consumers seriously want easily repairable devices, it seems like such a phone would compete easily in the free market.
Honestly, this sounds like you are lying intentionally to spread misinformation.
You are clearly informed and have a strong opinion. I find it hard to believe that you don’t know that only Chinese users data is backed up on Chinese servers.
If I’m wrong and you didn’t know this, please accept my apology in advance.
The fact that we're now seeing multiple lawsuits, PR campaigns, and lobbying to damage Apple since they put a requirement to disclose privacy details in the App Store shows how much surveillance capitalism has twisted the world.
Browsing on my phone at home with all those ad networks blocked okay... until you go outside your home network and get all the ads again. It's almost made my stop using my phone outside of my home network.
All multinationals need strong tax enforcement, but this isn't actually one where Apple is really any worse than others (and better than many).
Switched over to NextDNS, so that my ad blocking is on the macro network too. I'm satisfied. My wife is not, since her trashy "click here" links don't work half the time. :) Tells me it is working just fine.
My NextDNS dashboard - https://i.imgur.com/bjJ9OZH.png (My garage door opener is a chatty bastard)
Until an EMP takes us back to the Stone Age, it is really hard not to be tracked on the internet.
Source - I used to work for a company that does the tracking.
The top list seems like a reflection of market share: fls-eu.amazon.de, sessions.bugsnag.com, googleads.g.doubleclick.net, data.mistat.intl.xiaomi.com, app-measurement.com, in.treasuredata.com ..
Then just connect your WireGuard client on your phone to the endpoint
Use something like freedns.afraid.org for dynamic IP address support
In a nutshell: `update-dns get-my-current-external-ip-address $MY_DOMAIN_NAME`
You can have a subdomain like `vpn.yourwebsite.com` point to your residential IP. It may take a bit of fussing to get the ports and such right. But otherwise it's "just worked" for me, for the last 6 months.
Useful if you want to remove the dependency on yet-another-service-provider that can go out of business (the dynamic-dns people).
They have a paid option that gives you a higher query quota.
Try to be more condescending, kid. It'll make your point so much more effective if you think I don't know what DNS filtering is.
Trying to spackle over social, economic, and political problems with technical hacks doesn't solve the underlying issue.
Related, but different: There's a new proxying web browsing service for Safari called "Safe Browsing": https://www.macrumors.com/2021/02/11/ios-14-5-beta-safe-brow...
(edit: clarity)
You don't actually know if your data is given away. We only learn after Apple is caught.
Only if you live in China, which is well known to be a surveillance state with access to all personal data.
> and the US government.
Yes, but only by court order, rule which applies to every US company. This is a problem, but not one with Apple.
> You don't actually know if your data is given away. We only learn after Apple is caught.
True for every company in the world.
You make this sound like a problem with Apple, but these are problems with the US and Chinese governments.
There are trillion dollar companies on both sides of the argument, and their eventual compromise will establish the defaults for billions of users.
There are also two fundamental components of the Big Tech debate at odds with each other here - privacy and competition. Increasing privacy decreases competition by strengthening the Big Tech companies that engage with users at the platform/browser/OS/hardware level. See: Google's removal of third-party cookies from Chrome in the name of privacy was just blocked by EU competition regulators, because it would cripple competing advertising companies[1].
[1] https://arstechnica.com/tech-policy/2021/06/eu-antitrust-reg...
Increasing privacy doesn't decrease competition, it would force businesses to not deal with private data. There is no conflict here. There is no net loss here aside for specialized advertisers.
That's not what the article is saying. The referenced EC PR[0]: "Antitrust: Commission opens investigation into possible anticompetitive conduct by Google in the online advertising technology sector".
Nothing has been blocked. Restriction of third-party cookies is only one of 6 points that will be particularly looked at. This investigation may rightly so have launched at this or a later point regardless of third-party cookie restrictions in Chrome.
[0]: https://ec.europa.eu/commission/presscorner/detail/en/IP_21_...
What about products that people actually pay for directly instead of products that are "free" but funded under the table through surveillance and manipulation? Why can't those compete just fine?
The article explicitly talks about how this is a false dichotomy.
> Regulators in the U.K., he said, had bought the ad industry's argument that privacy and competition are on a collision course. That, he said, is a false choice. "They could have required everyone to not access that data, Google included, which would have been a net benefit for competition and privacy," Soltani said.
https://dictionary.cambridge.org/example/english/average-per...
Apparently they exist.
The arguments against Big Tech the smaller ad tech folks are raising sound legit, but obviously they are not being made in good faith. Big Tech has no more respect for user privacy than companies like Rosewell's. They are all a threat to user privacy. Companies that make browsers should not also be taking in online ad services revenue. It is a clear conflict of interest.
51degrees provides the public with a CSV list of user-agents, e.g., for use in browser fingerprinting (or perhaps user defence against browser fingerprinting). What does Google provide. We know they are fingerpringing on a mass scale. There is zero transparency.
https://raw.githubusercontent.com/51Degrees/Device-Detection...
Just for fun, I periodically compile w3c-libwww. It still compiles and it still works today. I use it through a TLS-enabled proxy. It reminds me of all the potential for experimetation the www once had. Today the web just looks like a Big Tech-led surveillance dystopia slowly coming together. Unless someone stops it. Lina Khan, godspeed.
The disputes described in the article with lawyers from W3C and IAPP looking on reminds me a little of the formation of ICANN back in the 1990's and the disputes over domain names versus trademarks.
Interesting. I work at Google ads and I am not aware of fingerprinting on a mass scale. AFAIK, all the tracking is done with cookies. Not a lawyer and purely my opinion but IIUC, DoubleClick acquisition made it practically impossible to do fingerprinting since Google is not allowed to join first party and third party cookies and fingerprinting imposes significant risks to violate that condition.
Why do you say that? I'm not aware of any situations where Google targets ads based on fingerprinting, and if they did I probably would have come across it. And in March, Google Ads committed that "once third-party cookies are phased out, we will not build alternate identifiers to track individuals as they browse across the web, nor will we use them in our products" -- https://blog.google/products/ads-commerce/a-more-privacy-fir...
(Speaking only for myself)
Still unacceptable. This implies psychological manipulation, price discrimination, automated racism, etc, are all still in scope.
Also, if you log into google, they’ll still track you for ad targeting. Finally, this wording implies the privacy preserving profile can be linked to your primary identity if you momentarily log in.
s/device fingerprinting/device detection/
s/defence against browser fingerprinting/control over "UI" selection/
A simple example of where Google uses device detection is Gmail. However the process is non-transparent as Google does not share the list of user-agent strings utilised, like the sample list provided by 51degrees.
I was sloppy with the terminology in the original comment and I apologise for that. I meant "device detection" not necessarily "fingerprinting".
I used to work on GWT and we baked user agent detection into the very framework and compiler itself so that each application is compiled into multiple optimized permutations.
This has nothing to do with ads or fingerprinting, it’s purely about writing code that works on legacy vs newer browsers.
Funny this Rosewell guy. "Should web browsers really become implementation mechanisms of specific government regulation?" -- Isn't everything a mechanism of specific government regulation? We seem to have an autocrat in the making here who would prefer the Web existed in isolation of civilization and where he could squeeze out that ad cash unhindered by government regulations. Given that he likes to ask philosophical questions, perhaps he could ask himself why the Web is being regulated in the first place.
It's also funny how in the article, the only people who seem to actually care about privacy are the non-profits advocating for it and the government regulators fighting antitrust.
Um, no?
I agree with this.
Can I introduce you to the IETF (https://www.ietf.org/)? :-)
We already have autocrats in Facebook and Google. What they're fighting is an attempt to put them back under civil oversight.
Honestly the internet was a better place when THAT was the situation sorry if I sound like a deluded man but the internet being so close to the world, or at least as much as it is now, is part of the problem.
And even if I do not agree with this guy and his pretensions, at least we would have better ways to combat guys like him in the old internet, but company owners like him at the end of the day have much more power thanks to the internet being so prevalescent and hyperreal, as the same authorities and entities that protect unbalanced power holders, can arrest you and fight you because of things that happen on the internet.
OK, I was hoping someone already addressed this, but apparently not. What "website optimization" requires cross-site tracking? Is there any real application for cross-site tracking besides advertising? I honestly would like to know.
Optimisation as in conversion optimisation.
Imo, a lot of this stuff ends up being just as bad.
Thing easily being able to add embedded Youtube videos to your watchlist, adding favorite articles to Pocket, being able to pay with 1 click using a payment method saved somewhere else, and so on.
No, Floc will not "eliminate the ability for advertisers to track specific users with cookies", the phase out of third party cookies on Chrome will do that, Google needs something to replace the current tracking method for his ad business and is trying to push Floc to do that. But this are two separate things that OP seems to mix up, Google needs something to keep tracking and is painting the notion that third party cookies can not be phased out without implement Floc before, and is not the case.
After initial dialogue with the web community, we are confident that with continued iteration and feedback, privacy-preserving and open-standard mechanisms like the Privacy Sandbox can sustain a healthy, ad-supported web in a way that will render third-party cookies obsolete. Once these approaches have addressed the needs of users, publishers, and advertisers, and we have developed the tools to mitigate workarounds, we plan to phase out support for third-party cookies in Chrome.
(Disclosure: I work on ads at Google, speaking only for myself)
Well, that’s ominous. Presumably the plan is to close source Chrome or do some DRM thing to prevent sites from rendering if the Privacy Sandbox has been tampered with?
Great.
"By undermining the business model of many ad-supported websites, blunt approaches to cookies encourage the use of opaque techniques such as fingerprinting (an invasive workaround to replace cookies), which can actually reduce user privacy and control."
"At the same time, we’re developing techniques to detect and mitigate covert tracking and workarounds by launching new anti-fingerprinting measures to discourage these kinds of deceptive and intrusive techniques"
("Mitigating workarounds: As we’re removing the ability to do cross-site tracking with cookies, we need to ensure that developers take the well-lit path of the new functionality rather than attempt to track users through some other means. ...")
IANAL, but even I can see that making changes to Chrome that impact advertising is risky even if you ignore Google's own advertising interests. So far they're trying to push things along, but they need buy-in from most of the rest of the advertising industry before they feel they can do anything too radical.
So as far as Google is concerned the elimination of third party cookies (and bounce tracking protection, browser fingerprinting, etc) is definitively tied to something that replaces it. One of those things is FLOC.
Considering that ad blocking extensions still exist, yes. The browser (user agent) is supposed to act on the behalf of the user, not the remote server. It's not required to use cookies, display ads or run malicious code.
On what grounds would an ad company sue Google for a change in Chromium that enhances the user's privacy, while they can still display ads (just not track the users as much)?
Almost anyone other than Google can make this change without major legal worries, but because Google is in both the ads market and a browser vendor they can't rock the boat.
On what grounds? There are businesses whose only product is targeting information for ads. If they can't get the data they need then they can't produce a product and will go out of business.
Hopefully Mozilla and Apple can start pushing some of the tracking replacement technologies since they don't have their hands tied like Google.
I don't think people abusing cookies have a standing as I see it. On what grounds, that their predatory business model is obsolete?
On the contrary, even if many web services are financed by ads, most customers of advertising just care about having the same possibilities to advertise their products. So a more healthy ad world would remain.
"Legal" advertising has eclipsed spam with its toxicity.
Not disagreeing, but ad companies attempting to sue Google out of existence would be worth watching.
What a scary name. Feels like the only thing GAFA use machine learning for, it's pretty worrying...
The Rosewell guy may not be a saint, but omitting Google from the list as the ones standing to win from privacy features, through ga and the usage they have over the Web via Chrome anyway is completely missing the point of a single party having monopolistic control over click data.
Can't also agree with the characterization of the W3C in TFA.
The changes to the web platform necessary to protect user privacy will require reinventing the industry (which will naturally pick winners and losers).
I expect that Google will come out in the end doing well, but that's not because they have a competitive advantage here, but instead because these changes don't really affect their core business (at least no where near as much as the proliferation of paywalls and app-ification have).
That's completely different from display advertising. For most sites on the web there's not enough information about a user's interests on that site alone to get a lot of different bidders for the ad slot. Fewer bidders generally means the a list auction price, so less money for the publisher.
I thought this had to have been a joke or some sort of analogy, but no they were literally humming.
Google is assisting them by adding extra steps to find out what permissions app requests. Also, it appears, that Android is opting you in, unless permissions are configured before starting the app. Because of that, there are apps with sole purpose of tricking you into installing it so it can get your data.
I found that many Android apps, that are also available on IOS, insist on location data and refuse to run, whereas they run fine w/o it enabled on IOS.
Location access attempts result in a prompt, asking whether you want the app to have access to your location. You can give it access once, only when it's active, or even in the background (the latter might make sense for a fitness app/ mileage tracking app/ that sort of thing). It's your choice.
If you buy a Pixel, I don't think there should be such crap? A lot of times it's the manufacturers. Samsung is a terrible offender in this category, I regret my most recent Galaxy phone and will not make that mistake again.
Unless you run a self-flashed OSS OS, the least invasive choices for mobile seem to be Apple, followed by vanilla Android on Google Pixel (but then you might as well run GrapheneOS).
Bah
Things like single sign-on are done with the same tech (cookies, redirects) that are used by advertisers, and in some cases are indistinguishable. This is a common use case, though of course small fry compared to the privacy vs ad tracking folks.
If you'd like to learn more about this aspect, here's a video from one of the Auth0 folks: https://identiverse.gallery.video/detail/videos/architecture...
(The video is from 2020. He gave an update at the same conference in 2021, but they haven't posted those videos yet.)
There's also a Federated ID Community Group at the W3C on the same issue: https://www.w3.org/community/fed-id/
Where would we be if not for this stick-it-to-em person, who wants to defend his life's work of fingerprinting our web browsing to assist in targeted advertising?
I've sat in a large audience hall listening to assholes like these guys talk about their businesses, and when they are called out publicly for not caring about individual privacy and desire not to be tracked, and they shrug their shoulders.
He and the rest of this datamining gold rush needs to be stopped.
Everything has its time and place, and this certainly fits the sentiment for many.
There's a wide swath of libertarians like this (yes, I know... not all libertarians)... they want to reduce regulation and give people more freedom so they can swindle them.
He doesn't disagree with FLOC because it's wrong, he disagrees with it because it's not his proposal.
Soltani has it right:
> "I'm very much concerned about the influence and power of browser vendors to unilaterally do things, but I'm more concerned about companies using that concern to drive worse outcomes,"
One technical solution would be to decentralize internet even more, but it's pretty complex to do.
And for everything else, I really wish we would go back to smaller websites which are run out of a desire to share. I don't get why every blog has to have ads and affiliate links. Web hosting is cheaper than dirt in 2021. I colocated a server out of my allowance when I was 13, simply because I had a desire to share some of the things I was tinkering with. If you can't afford the €1/month it costs to host something in 2021, maybe you just shouldn't.
It's probably easier for them to just get together outside of the W3C and make up a new standards committee. From what I understand, nothing in the W3C is binding, so there would be no repercussions whatsoever.
What I'm referring to is the browser vendors leaving the W3C and forming an alternate group.
Go to a convention. ask people about why we don't make software im a way that empowers users without a crippling dependence being created, or inflicting on users a leaky or otherwise insecire experience, and watch the room clam up.
These decisions might as well be made in closed rooms at Google and Mozilla, and there wouldn't be much you could do about it. By the power of browser market share, they could just skip W3C and implement whatever they want. What they'd get away with is only limited by the point where someone with a different agenda starts funding their own browser fork (and can convince users to use it.)
(Hint: it starts with a G and rhymes with frugal.)
As an aside: In some ways it's kind of funny to hear a bunch of engineers talk about technology while all casting shade at the other participant's motivations.
What I read: "why you should keep your ad-blockers and script-blockers properly configured and updated".
Good one. Google doesn't care about privacy, it just wants to monopolize the tracking with FLOC.
A decade, or more ago IEEE had a rule that anything said in a standard board meeting cannot be be expected to not be public, or be subject to any disclosure limit post-factum.
In 2019, after years of relentless pressure from Google, Cisco, Amazon, the rule was effectively reversed, and now IEEE standard board meetings can be made super duper secret, so members can now conspire to break antitrust laws in every imaginable way in complete privacy, free of recordings, and stenography.
https://gemini.circumlunar.space/
The only thing standing between you and the next web is... a lot, but try it anyway, things have to start somewhere.
Also, frankly, the spartan design of native Gemini pages (very limited formatting, no scripts or even inline images!) means that the circle of nerds who use Gemini will almost certainly remain too small to catch the eye of ad-tech. It's hostile to commerce in a way I find kind of delightful.
For now.
The original HTTP (now retroactively called HTTP/0.9) also had none of these, and also wasn't extensible enough; it had no headers at all, just the verb (GET) and the path. Yet somehow, it was later extended to include all of these.
> very limited formatting, no scripts or even inline images!
The original HTML was also like that, even inline images came later.