Google considers switching FLoC to a topic-based approach

Earlier comment with more details: https://news.ycombinator.com/item?id=27367482

(Disclosure: I work on ads at Google, speaking only for myself)

Good catch, forgot this was a bit-vector not a single key.

> Yeah, well theoretically you could. But that assumes that browsers are able to extract and balance some very arbitrary and very specific information from the browsing habits of all people on earth in a perfect decision tree.

Not really, people have found in the past that combinations of user agent, screen resolution, installed fonts, installed extensions, and things of that sort can come very close to uniquely identifying individual people.

> Though I think you are absolutely correct that in practice the number of bits to build up a classifier able to uniquely classify each person must be pretty low. Maybe a few hundreds.

Exactly. It might not narrow it down to one person, but perhaps a relatively small pool.

N bits of entropy refers to 2^n possible possible states.

Cryptanalysis:

AES-128 has a key size of 128 bits, so there are 2^128 possible AES-128 keys. A brute-force attack capable of testing 2^128 keys can break any AES-128 key with certainty.

Fingerprinting:

If a website measures your "uniqueness", saying "one in over 14 thousand people" isn't a great way to measure uniqueness because that number changes exponentially. Since we're dealing possible states, i.e. possible combinations of screen size, user-agent, etc., we instead take the base-2 logarithm of this to get a count of entropy bits (~13.8 bits).

Thermal physics:

The second law of thermodynamics states that spontaneous changes in a system should move from a low- to a high-entropy state. Hot particles are far apart and moving a lot; there are many possible states. Cold particles are moving around less and can't change as easily; there are fewer possible states. Heat cannot move from cold things to hot things on its own, but it can move from hot things to cold things. Think of balls on a billiards table moving apart rather than together.

Entropy of the whole universe is perpetually on the rise. In an unimaginably long time, the most popular understanding is that particles will all be so far apart that they'll never interact. The universe will look kind of like white noise. And endless sea of random-like movement, where everything adds up to nothing, everywhere and forever.

Every major browser other than Google is taking proactive steps to limit cookies right now. Firefox very recently announced better cookie deletion for sites; they'll now try to delete cookies from other domains that are linked to those sites. This is going to get progressively better and better.

But the sentiment here is exactly what Google promotes. It begs the question over whether or not we need to compromise with content-holders on privacy. We don't, no browser other than Chrome views user tracking as a necessary compromise with advertisers. There was a point in the past where we might honestly worry about whether it was feasible to block 3rd-party cookies, but since then multiple efforts and improvements from Mozilla and Safari have made it clear that browser manufactures don't have to get advertisers' permission to push code.

Google is refusing to proactively move forward with steps that everyone else has agreed are necessary, because Google is mad that we're not thinking enough about their business interests. We have a good path forward, Google is blocking it for a large number of users, and then Google is complaining "why is no one else except us coming up with solutions?" But we have come up with solutions, they're just not solutions that Google likes.

The caution from Chrome about cookies is really interesting. Chrome broke web audio, alerts, the dev team is regularly openly hostile to suggestions that the consensus process moves too quickly. They tried tried to deprecate the url for crying out loud, but now they want to be all cautious about cookies? Sure.

> There is a huge astroturfed war going on.

Agreed, but not in the direction that you're suggesting. The general public wants better privacy, they don't care about whether or not it makes advertisers happy. Nontechnical users are often misinformed about tracking and they often lack technical skills or willpower to increase their privacy on their own. But that doesn't mean the public doesn't care about privacy, ordinary users do support the figerprinting protections Apple is building into iOS, they support the privacy changes Mozilla is building into Firefox. Most ordinary people are on the side of privacy in this debate.

Advertisers are desperate to argue that users are being harmed or that moving forward without an alternative tracking system is impossible, when the reality is that even the nontechnical public has turned out to have overwhelmingly positive feelings towards on-by-default technical measures to reduce tracking. The astroturfing here is the FUD coming out of companies claiming that we need (for either moral, technical, or PR reasons) to compromise with advertisers before we can move forward removing 3rd-party cookies.

It's really only Google who is lagging on this stuff. If they want the least private browser on the market, then they can have it. I don't think we need to hold back everyone else while we wait for Google to make up their mind about this.

They are not.

The world has survived for millenia without tracking ads.

Then again, rarely is lawbreaking by corporations adequately prosecuted. Even more rare are actual guilty verdicts resulting in actual punishment. Of course, "Don't be evil" isn't a law, and I'm not claiming Google is breaking any.

So while I think I may be technically correct, reality certainly does seem to favor your statement. This seems like a fairly sad state of affairs.

Is it like this everywhere capitalism is practiced? I'd think a visiting extraterrestrial scholar might be able to weigh in.

No it isn't.

I don’t personally think targeting works - does anyone have a good research paper that proves it?

I think the optimal solution would be the old pre-internet advertising.. general ads on billboards, but now on websites. No tracking.

I agree with your overall sentiment, but I think the solution you propose is bad. It allows companies to collect data automatically behind users' backs, and then tries to address the extreme power imbalance that creates with regulations and escape hatches that users can take after that data has already been created. But ideally, we want to prevent problems from occurring at all, not just to try and fix them after the fact.

To your point about voluntary tracking, users may want to signal interest in some topics but not others. They may want to signal interest about some topics only in certain situations. They may want to signal interest about a topic to one site, but signal interest about another topic to a different site. They may want to "freeze" the topics that they signal interest about, so that they don't need to worry about accidentally revealing new preferences in the future, or to think about how browsing a set of sites will change the ads that they get. All of these are valid things for a user to want to do.

It is better if users have complete agency over what data is transmitted, and if companies do not fingerprint or correlate users behind their backs at all. Attempting to determine user cohorts clientside is the correct move, arguably the only part of FLoC that Google got right. The problem with FLoC is that even if cohorts are determined completely clientside, the user still does not have agency and transparency about those cohorts.

There is theoretically a version of FLoC that would be really good for privacy, and that would also allow the kind of optional tracking that some users want. Such a system would need to be easy for users to toggle on and off on the fly on a site-by-site basis. It would need to be transparent to users about what categories they're in, it would need to allow users to edit and delete their categories, to add new categories, and to turn off category aggregation. It would need to not send new categories to a website without the user's permission. It would need to block websites from determining whether they're being given an automatically generated category, or a user-defined category. And importantly, it would all need to be opt-in.

Right now, tracking is an invisible system that happens automatically, with (rare) escape hatches that the majority of users are not expected to pursue, and that give little to no granularity about how users can customize how they present to the world. This kind of tracking is inherently invasive. We should pursue a paradigm shift where users proactively volunteer information about how they want to present to the world in any given situation -- in other words, we should give users agency to choose their own identities online.

Most regulatory suggestions that I see online (including the one you give) consciously or unconsciously focus on preserving the invasive nature of tracking while adding safeguards to try and prevent advertisers from abusing the inherent power imbalance. Instead, that power imbalance ought to be totally flipped in favor of the user. We need to reject the underlying idea that preferences should be extracted from users, rather than something that users consciously choose to volunteer.

----

I've commented to the same effect a couple of times in the past:

- https://news.ycombinator.com/item?id=25906791

- https://news.ycombinator.com/item?id=26353494

- https://news.ycombinator.com/item?id=25907079

This isn't only true for advertising. Think about how little control users have over how personalized algorithmic content filtering/ordering works on sites like Youtube, and you'll see similar conceptual problems with how the systems are designed. But it's really apparent in advertising, moreso than in other contexts.

I want to fight back against policy changes that (in my mind) cement and normalize the current philosophical approach to advertising. It's not OK to be tracked without your permission, and regulations or safeguards and escape hatches around tracking aren't enough to make it OK. The system would still be fundamentally broken.

With FLoC, though, the idea was that the browser would provide document.interestCohort() and the individual site's JS could react accordingly: https://github.com/WICG/floc . This means that any site, regardless of its contracts with ad networks, could immediately identify your cohort and associate it with your activity. Web developers working in good faith would be encouraged to have user.cohort or user.topic fields from day one "just so you have it" - imagine all the ways someone could use this in bad faith. Inevitably this data would leak (or be intentionally leaked) and could trivially become a target list for doxxing closeted people. It's a dangerous, dangerous proposal.

FLOC is centralized at the individual. That means YOU are profiled completely and all the profile info is centralized for everyone to grab.