Also, "advertiser" is way too benign a term: in cryptography we generally use "adversary". Consider that in this election season, the Trump and Biden political campaigns will be among the biggest advertisers. Mozilla will sell them information and they will use it. Question: will they only use it to solicit votes, or will they also use it to help round up their enemies if they get into power?
And yes, they can use statistical information for that. The first thing they will want to know about any specific class of enemy is how many of them there are, before worrying about identifying individuals. So Mozilla shouldn't help them with either.
> Mozilla will give them information and they will use it.
Let's just get on the same page about what information the advertisers get. I'll reproduce the paragraph I linked to:
> Since the DAP server acts as a middleman, and reports are only generated at conversion times (impressions without conversions are not reported), ad networks have no way through this method of collecting your personal information (such as your user information or your IP address/browser client info). All they receive is an aggregate that informs them that their ad y (published on source x) led number of people to a positive outcome for their customer over a period of time p. Some amount of noise is also added to the information in order to further strengthen privacy[7].
I'm not aware of how you "round up your enemies" using conversion rate information on websites. It doesn't even tell you how many "specific class of enemy" there is, it's too muddled by the variable of the click rate of the audience.
Not to mention that as state actors I'm sure they would have other, more useful and reliable methods of doing... whatever you're accusing them of doing.
Perfect secrecy is the standard that a browser calling itself privacy preserving should use. It should give the adversary no information that they don't already have. The concept of browser privacy of course didn't exist when Shannon wrote his paper.
> I'm not aware of how you "round up your enemies" using conversion rate information on websites. It doesn't even tell you how many "specific class of enemy" there is, it's too muddled by the variable of the click rate of the audience.
The adversary can make a statistical estimate before getting the conversion rate, and another one that has been conditioned on the conversion rate. If the two estimates aren't the same, they have gained information, so Shannon secrecy has failed.
Why do you make this so complicated? Mozilla runs this program and if you participate in it, your adversaries benefit from your participation. So do you want to participate? More concretely, what do you think of Mozilla opting you in by default? Which side did they say they were on?
I'm not convinced. It sounds nice, but why? We already know Mozilla's counterargument, and in my personal experience of having thrown chaff in the way of annoying interlopers before, it seems reasonable.
> If the two estimates aren't the same, they have gained information
Okay, so by my understanding, now the goalposts are all the way out to being unable to capture the count of enemies but being able to verify the count? I feel like this is a long way from the original argument (in either intention or phrasing).
> Why do you make this so complicated?
Because I have at least a passing interest in nuance.
It's not great that Mozilla hasn't learned from the Pocket debacle, and I am glad that folks like yourself are understandably angry about being opted into something that benefits others without not just consent but even notification, because pushing back on stuff like this even on principle is commendable. We don't disagree on that being wrong.
I would just prefer we discuss facts based in reality and focus our conversation, because that makes change more effective. If you want a blanket ban on advertisers across the web, I'm in agreement with you. If you want Mozilla to stop shipping potentially privacy-affecting changes without consent or notification, I'm in agreement with you. But the actual system they describe and their reasoning for implementing it is, in my mind, relatively sound.
I don't think the goalposts have moved, at least for me. I've always had them set at Mozilla not turning any info over to advertisers. They spout a mathematical formalism (differential privacy) so I point out that a better formalism (Shannon secrecy) already existed 70 years earlier and they should stay with it.
> If you want Mozilla to stop shipping potentially privacy-affecting changes without consent or notification, I'm in agreement with you. But the actual system they describe and their reasoning for implementing it is, in my mind, relatively sound.
"Without consent or notification" is more misdirection, since they did give notice and arguably obtained consent, knowing perfectly well that almost nobody actually reads the notifications and conditions, and instead uses the defaults. If they have default opt-out and a true affirmative opt-in then that is more acceptable. We went through this with email spam more than a decade ago, and currently acceptable practice is DOUBLE opt-in.
> But the actual system they describe and their reasoning for implementing it is, in my mind, relatively sound.
I can believe that in technical terms, their system does what it says it does. Their reasoning for implementing it is that it brings in money, and that reasoning is probably sound too (i.e. it really does bring in money). Their reasoning that it preserves user privacy is self-serving and obnoxious. They too successfully obfuscate how real privacy protection would work.
What a pointless bit of FUD in an otherwise fairly rational comment.
"The FBI sifted through customer data collected by San Francisco-area grocery stores in 2005 and 2006, hoping that sales records of Middle Eastern food would lead to Iranian terrorists," CQ's Jeff Stein reports.
"The idea was that a spike in, say, falafel sales, combined with other data, would lead to Iranian secret agents in the south San Francisco-San Jose area.
"The brainchild of top FBI counterterrorism officials Phil Mudd and Willie T. Hulon, according to well-informed sources, the project didn’t last long. It was torpedoed by the head of the FBI’s criminal investigations division, Michael A. Mason, who argued that putting somebody on a terrorist list for what they ate was ridiculous — and possibly illegal."
So we escaped that time. What about now? Don't forget that thanks to the Supreme Court, the President is now immune from prosecution.
For the record, while I think differential privacy is a really cool idea, I also fully support users having the choice to participate or not.
I just don't understand why you see it as invasive, given nothing about you is revealed.
From there we can devise that the best solution for society is a global ban on advertisement.
I don't think it actually allows advertisers to identify trends except in terms of conversion rates. Let me reproduce the paragraph I linked to:
> Since the DAP server acts as a middleman, and reports are only generated at conversion times (impressions without conversions are not reported), ad networks have no way through this method of collecting your personal information (such as your user information or your IP address/browser client info). All they receive is an aggregate that informs them that their ad (published on source ) led number of people to a positive outcome for their customer over a period of time . Some amount of noise is also added to the information in order to further strengthen privacy[7].
Impressions without conversions aren't reported, so the only trends seen are over conversions as grouped by websites. If that's all it takes for advertisers to stop fingerprinting us, I'm open to something along those lines.
The idea of advertisers respecting boundaries or caring what other people think is acceptable seems hopelessly naive. As I remember, the Do Not Track (DNT) header was motivated by the same ideal, and it failed totally, as one should expect. Advertisers will take whatever they can pry loose.
> Impressions without conversions aren't reported, so the only trends seen are over conversions as grouped by websites. If that's all it takes for advertisers to stop fingerprinting us, I'm open to something along those lines.
They won't stop, and anyway fingerprinting is just one invasion out of many. If they also want information about trends, then of course I want to deny that to them as well.
Thought experiment: instead of opting everyone in by default, suppose Mozilla does an A/B test. Opt in 50% of the users by default, and opt out the other 50%. Then see how many users in each group switch the setting away from the default. Do you expect more will opt in on purpose, or opt out on purpose? What does that make you think of Mozilla's actual choice of default?
Microsoft decided to turn on DNT by default in Windows 8 / MSIE 10, which led to a violation of the DNT standard and a complicated debacle which rendered the whole thing pointless. It was a silly idea and an even sillier outcome, but that does not make the ideal itself silly.
> They won't stop
Then we can rip this out later, or submit a patch to opt everyone out. I trust Mozilla to accept such a patch much more than I do Google. It's not irreversible, it's an ongoing negotiation.
> Thought experiment:
Your thought experiment ignores the rationale Mozilla provided. I think ideally we would be notified on first upgrade / out of box that we are opted in to sharing our preferences with advertisers in a limited way, with a nice obvious "Opt out" button in that notification. That way, legitimate advertisers get the limited conversion rate information they desperately want from enough people who aren't interested one way or the other, and those who are diametrically opposed to the entire concept are perfectly able to turn it off before their first browsing action.
But I also don't think they'd build an interface this extensive for what they describe as a limited test run against a handful of allow-listed sites for exploratory and standards-determining reasons. I would have liked to at least see a heads-up upon the activation of this system in those cases, since that seems easy enough to build for a test run.
Like removing the UI option to turn off Javascript? In fact they've now made it near impossible to turn off Javascript in a running window. (You can turn it off before it begins to run, but it used to be possible to turn it off after it had already started running, say to populate a page that you wanted to look at). When has a revenue-generating "test" ever been reversed?
Anyway, what info that advertisers are currently getting, will be withheld from them under the new regime? If they will get everything they got before, plus more stuff besides, that can only make things worse. Most of us think that it's plenty bad already.
> That way, legitimate advertisers get the limited conversion rate information they desperately want from enough people who aren't interested one way or the other, and those who are diametrically opposed to the entire concept are perfectly able to turn it off before their first browsing action.
By that logic, it's ideal for the Mafia to recognize a "do not kidnap" button that anyone diametrically opposed to kidnapping could choose to wear. They are then free to kidnap anyone not wearing the button. I could accept it being the other way around (they can kidnap you if you wear an opt-in button) though I'd hope they get few takers.
In fact, the statistical "great unwashed" info does tons of damage in its own right, and that's why it's not ok to simply exclude a few self-selected outliers. Shoshana Zuboff's book "Surveillance Capitalism" goes into this. They want to make behavioural predictions about whole populations, and "differential privacy" is one of the obfuscations they use to sell invasions that enable that. Disclaimer: I haven't read the book yet--it's been on my list for a long time. I got the above info (about predicting population behaviour) from reading an online interview with the author. IDK if she mentions differential privacy specifically. That conflict is my own interpretation.
They didn't say that. They said this isn't it.