Hacker News Reader

Comment by ma2rten | Hacker News Reader

now that the commonly used hostnames are published.

The problem I see with that is that apps could easily start proxying the requests though their own servers.

I personally believe this is unlikely, because then the firms paying for this data will not be so sure that the information is legitimate, whereas collecting directly from user devices makes fraud more difficult.

Are you sure that that is actually a big problem for them? I imagine it would be quite hard to convincingly fake user data data.

I could also imagine ways around that. For instance their proprietary SDK could generate the data and cryptographically sign it. Or they could require that app makers set up a special subdomain that points to their ip address. I guess it would only be worth the trouble if enough people care about it.

It is most definitely a problem. Detecting fake clicks is hard enough even when the links are pointing to ad-tracking hosts. In fact browser adblocking could be wiped out instantly if ad networks trusted websites to report their own hits.

That day probably someone will write a browser extension that does essentially what trackmenot did against search engines: make noise. That is, as soon as the user loads a page, N threads would crawl the same page in background and start random silent clicking while the user surfs normally. They could even make a memory map of the site and assign the random clicking to any of the active connections just in case on the other side someone tries to filter against the connection order (1st one is the user, from 2 on they're bots).

Not certain what you mean about the IP address, but for signing it, they would need to bundle a key and that could be extracted.

It is a genuinely tricky challenge from their perspective.

Reply on news.ycombinator.com