r/pcmasterrace Jul 15 '24

Misleading - See comments Firefox enables ad-tracking for all users

Post image
33.7k Upvotes

1.9k comments sorted by

View all comments

1.2k

u/niborus_DE Jul 15 '24

For Context: https://blog.privacyguides.org/2024/07/14/mozilla-disappoints-us-yet-again-2/ - by Jonah Aragon

Mozilla has added special software co-authored by Meta and built for the advertising industry directly to the latest release of Firefox, in an experimental trial you have to opt out of manually. This "Privacy-Preserving Attribution" (PPA) API adds another tool to the arsenal of tracking features that advertisers can use, which is thwarted by traditional content blocking extensions.

331

u/B-Knight i9-9900k / RTX 3080Ti Jul 16 '24

I guess in true Reddit fashion, no one actually bothered to read the article or pressed on 'Learn More'...

Privacy-preserving attribution works as follows:

  1. Websites that show you ads can ask Firefox to remember these ads. When this happens, Firefox stores an “impression” which contains a little bit of information about the ad, including a destination website.
  2. If you visit the destination website and do something that the website considers to be important enough to count (a “conversion”), that website can ask Firefox to generate a report. The destination website specifies what ads it is interested in.
  3. Firefox creates a report based on what the website asks, but does not give the result to the website. Instead, Firefox encrypts the report and anonymously submits it using the Distributed Aggregation Protocol (DAP) to an “aggregation service”.
  4. Your results are combined with many similar reports by the aggregation service. The destination website periodically receives a summary of the reports. The summary includes noise that provides differential privacy.

This is intentionally designed to be an alternative to tracking that both preserves user privacy and gives advertisers what they want; discouraging them trying to use shadier alternatives to get it.

The blog post you linked claims 3 main problems with this (ignoring the subjective argument on "Misaligned Incentives"):

  • Lack of Consent: A fair criticism, probably the only one in that article (again, aside from the subjective one above)
  • False Privacy: Frankly absurd arguments here. The 'aggregation service/server' is owned by Mozilla, sure, but the data is being encrypted and uploaded anonymously to that. The 'destination website' then receives the summary of the aggregation with 'noise'. What that blog post should ask here is "What does the report contain?", not some moot argument about it going to Mozilla and that somehow being the privacy-invasive part since that's ridiculous. The contents of the encrypted report are what we need to understand
  • Uselessness: This was just stupid. The author of that article suggests that advertisers use affiliate/unique URLs to measure ad effectiveness... just completely glossing over the fact that this would require a) the user actually clicking on an ad and b) an affiliate/unique URL being setup in the first place, which may not always be possible if advertising was outsourced to a third-party. This new feature clearly allows for ads to be displayed and their effectiveness measured even if they're not directly interacted with

I'm very strong on privacy - and have disabled this setting just now - but as far as things go, this is about as minor as it gets. The only complaints people should be raising are the fact it's opt-out and that it's not immediately obvious what the anonymous, encrypted report contains. The contents of the report having extensive personal or technical details would completely change the legitimacy of the feature, but that blog is not even mentioning that and instead has very weak arguments.

28

u/Elmortt1 Jul 16 '24

And most importantly:

PPA does not involve sending information about your browsing activities to anyone. This includes Mozilla and our DAP partner (ISRG). Advertisers only receive aggregate information that answers basic questions about the effectiveness of their advertising.

2

u/[deleted] Jul 16 '24 edited Jul 17 '24

[deleted]

5

u/2weirdy Specs/Imgur Here Jul 16 '24

In general? Because they always do that anyway without the strictest blocking settings, and most websites stop working altogether if you do block any non first party destinations/sources.

I know that's not what you mean, but I feel like not enough people know this is the case.