Pirates beware? Privacy violated?

[Edgar R. Zakarian]

Hi,

 

What are your thoughts about this?

https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea

 

[WkdPaul]

Someone has a TLDR for those that don't have time to read all this ?

[SupaKomputa]

Just copy paste the text, so i don't have to participate in that website user count.

[AbydosOne]

3 minutes ago, SupaKomputa said:

Just copy paste the text, so i don't have to participate in that website user count.

What do you have against the EFF?

[WhitetailAni]

1 minute ago, wkdpaul said:

Someone has a TLDR for those that don't have time to read all this ?

Attempt:

FLoC is cookies v2. No longer sometimes localized to a single site, but one "cookie dish" for every person.

Quote

We stand at a fork in the road. Behind us is the era of the third-party cookie, perhaps the Web’s biggest mistake. Ahead of us are two possible futures. 

 

In one, users get to decide what information to share with each site they choose to interact with. No one needs to worry that their past browsing will be held against them—or leveraged to manipulate them—when they next open a tab. 

 

In the other, each user’s behavior follows them from site to site as a label, inscrutable at a glance but rich with meaning to those in the know. Their recent history, distilled into a few bits, is “democratized” and shared with dozens of nameless actors that take part in the service of each web page. Users begin every interaction with a confession: here’s what I’ve been up to this week, please treat me accordingly.

People with similar "cookie dishes" will be put into a "bowl", and given similar or the same ads.

The "bowl" assignments will be changed every week.

Problems with it:

1. Fingerprinting.

Each "bowl" will be given an ID. Google has said that there will be thousands of people with the same ID, but it's a lot easier to find one person amidst thousands than hundreds of millions.

2. Cross-context exposure.

This one's confusing, so I'll just copy+paste the section of the article:

Quote

The second problem is less easily explained away: the technology will share new personal data with trackers who can already identify users. For FLoC to be useful to advertisers, a user’s cohort will necessarily reveal information about their behavior. 

The project’s Github page addresses this up front:

This API democratizes access to some information about an individual’s general browsing history (and thus, general interests) to any site that opts into it. … Sites that know a person’s PII (e.g., when people sign in using their email address) could record and reveal their cohort. This means that information about an individual's interests may eventually become public.

As described above, FLoC cohorts shouldn’t work as identifiers by themselves. However, any company able to identify a user in other ways—say, by offering “log in with Google” services to sites around the Internet—will be able to tie the information it learns from FLoC to the user’s profile.

Two categories of information may be exposed in this way:

1. Specific information about browsing history. Trackers may be able to reverse-engineer the cohort-assignment algorithm to determine that any user who belongs to a specific cohort probably or definitely visited specific sites. 
2. General information about demographics or interests. Observers may learn that in general, members of a specific cohort are substantially likely to be a specific type of person. For example, a particular cohort may over-represent users who are young, female, and Black; another cohort, middle-aged Republican voters; a third, LGBTQ+ youth.

This means every site you visit will have a good idea about what kind of person you are on first contact, without having to do the work of tracking you across the web. Moreover, as your FLoC cohort will update over time, sites that can identify you in other ways will also be able to track how your browsing changes. Remember, a FLoC cohort is nothing more, and nothing less, than a summary of your recent browsing activity.

You should have a right to present different aspects of your identity in different contexts. If you visit a site for medical information, you might trust it with information about your health, but there’s no reason it needs to know what your politics are. Likewise, if you visit a retail website, it shouldn’t need to know whether you’ve recently read up on treatment for depression. FLoC erodes this separation of contexts, and instead presents the same behavioral summary to everyone you interact with.

The rest of it is just the dangers of tracking where you are uniquely identified.

[minibois]

Looks like these are the most important pieces of the article:

Quote

[...]

phasing out tracking cookies and other persistent third-party identifiers is long overdue.

[...]

FLoC is designed to help advertisers perform behavioral targeting without third-party cookies. A browser with FLoC enabled would collect information about its user’s browsing habits, then use that information to assign its user to a “cohort” or group. Users with similar browsing habits—for some definition of “similar”—would be grouped into the same cohort. Each user’s browser will share a cohort ID, indicating which group they belong to, with websites and advertisers. According to the proposal, at least a few thousand users should belong to each cohort (though that’s not a guarantee).

[...]

If that sounds dense, think of it this way: your FLoC ID will be like a succinct summary of your recent activity on the Web.

Google’s proof of concept used the domains of the sites that each user visited as the basis for grouping people together. It then used an algorithm called SimHash to create the groups. SimHash can be computed locally on each user’s machine, so there’s no need for a central server to collect behavioral data.

[...]

The power to target is the power to discriminate. By definition, targeted ads allow advertisers to reach some kinds of people while excluding others. A targeting system may be used to decide who gets to see job postings or loan offers just as easily as it is to advertise shoes. 

[...]

We wrote about FLoC and the other initial batch of proposals when they were first introduced, calling FLoC “the opposite of privacy-preserving technology.” We hoped that the standards process would shed light on FLoC’s fundamental flaws, causing Google to reconsider pushing it forward. Indeed, several issues on the official Github page raise the exact same concerns that we highlight here. However, Google has continued developing the system, leaving the fundamentals nearly unchanged. It has started pitching FLoC to advertisers, boasting that FLoC is a “95% effective” replacement for cookie-based targeting. And starting with Chrome 89, released on March 2, it’s deploying the technology for a trial run. A small portion of Chrome users—still likely millions of people—will be (or have been) assigned to test the new technology.

 

Seems like it comes down to "third party cookies are bad, because traces of it can be scattered around the internet to track people. FLoC will instead place you in a group based on what webpages you recently visited, to generate what 'group' you fit in to (this generating is done locally, so the data is not stored somewhere online).

The issue is that AI can make the wrong assumptions and place people in a 'box' they don't belong in, because of unrelated factor" (Think "oh you visit website Y a lot, that must mean you fall in category X of people", even though that might be unrelated to each other. So basically discrimination by AI).

 

They are also starting to implement it in some users' Chrome 89 (released March 2nd) version to test it out.

[gloop]

The people that the large companies want to go after (scene groups, crackers, repackers, etc.) aren’t dumb enough to be caught by this, so I wouldn’t say pirates should be beware. 

[Edgar R. Zakarian]

1 hour ago, gloop said:

The people that the large companies want to go after (scene groups, crackers, repackers, etc.) aren’t dumb enough to be caught by this, so I wouldn’t say pirates should be beware. 

2 people in Denmark using DanishBits (Private torrent site, invitations only) are already being prosecuted for sharing illegal movies etc.

Not sure if it's specifically related or anything. But if you can identify a person uniquely, then I guess you COULD be traced?

https://www.version2.dk/artikel/nu-falder-domme-sager-brug-ulovlige-fildelingstjenester-1092378

[LogicalDrm]

22 hours ago, wkdpaul said:

Someone has a TLDR for those that don't have time to read all this ?

You and OP both it seems.

[Rauten]

Oh god.

Please tell me this is not coming to Chromium, just to normal Chrome?

20 hours ago, Edgar R. Zakarian said:

2 people in Denmark using DanishBits (Private torrent site, invitations only) are already being prosecuted for sharing illegal movies etc.

Not sure if it's specifically related or anything. But if you can identify a person uniquely, then I guess you COULD be traced?

https://www.version2.dk/artikel/nu-falder-domme-sager-brug-ulovlige-fildelingstjenester-1092378

Stuff like that has been happening for years now, so I think it's highly unlikely it's related.

[BuckGup]

Google has to be one of the worst companies in the world and they are constantly lying too. I would also like to know if anyone actually thinks about issues like this. If you take everything in its current state then sure it might be a bigger concern for pirates now but that's not how the world works. Since we now know how it works and because of that you can find ways around it. This cat and mouse game is human innovation and one of the sole reasons piracy is a byproduct rather than an issue.

[seban]

*starts sweating heavily*

[Edgar R. Zakarian]

Well I generally don't mind targeted ads, as they in some cases help me find what I need. Especially if you have the choice to decline cookies from specific websites.
It's the "fingerprinting" behaviour I'm really against. That is not something I want any part of.