Hacker News Reader

Comment by RockRobotRock | Hacker News Reader

CNAME cloaking? Does this mean an ad site may use a randomly generated subdomain pointing to a wildcard record?

That's part of it.

Normally when you visit contentsite.com which serves ads from adsite.com. Adblocker rules can just block adsite.com and the ads won't be shown. CNAME cloaking would have the main site have a subdomain like adsite.contentsite.com point to adsite.com, now the adblockers have the impossible task of blocking millions of subdomains that seemingly belong to legit sites, this also allows the legit sites to keep changing the subdomain since the adblocker will have no idea which subdomains serve legit content vs ads. As a bonus since the content is being served from the same domain, they can bypass certain cookie browser policies and track users even better.

This update allows you to set rules so that you can filter by resolved ip.

this reminds me of domainfronting, who was a super smart way to get around of ads and other sites blockers, not sure if it's all 'fixed' now.

i hope that this results in sites that host malicious ads and use wildcard session-cookies get hacked to all hell by their ads.

I would hope that this results in websites hosting malicious ads which harm users, which then results in a big lawsuit against these websites with a huge payout for the harmed users. After all, if the malware ad is being effectively hosted by the site, then the site should be legally responsible.

The upside is that it would only really impact their interaction with that specific site, not with anything else (unless there's opportunity for lateral moves because of SSO or the site hosts email and so they could hack password resets or something).

My dream scenario would be this happening to an in-company administrative user with the keys to the kingdom. Imagine an ad-ridden site like Fandom.com getting hacked in that way.

Yes. Ads and analytics providers have started doing this to get around third-party cookie protections.

This is such an intrusion of privacy. I wish I could just disable cookies entirely but the usability of many webpages just goes down. I should not be punished for not wanting 3rd party trackers.

Before I get too alarmed someone would have to tell me how an adsite.com cookie is being sent to adsite.example.com. This workaround seems to let adsite.com profile me as well as example.com already can, but it loses the ability to correlate my activity across example2.com and example.com with a single cookie.

(I guess ad providers have gotten good enough to not need cookies? Like they know my browser window size, installed fonts, GPU vendor and model, IP address, geolocation, header order, etc. so they don't even need cookies anymore to track my activity across the web? I suppose it was only a matter of time.)

Browser profiling has been a thing for at least a decade if I'm not mistaken.

Makes sense. "I am session abcdef12345" always seemed significantly guaranteed to me, but in a world with ad blockers and third-party cookie restrictions, using heuristics is the only way forward.

It's somewhat scary how much information our browsers leak to unknown parties.

(I don't really take sides on this. I use an ad blocker and am very anti-ad, but am impressed when ad companies come up with tech to thwart them. The cat-and-mouse game is entertaining to read about.)

it's more than enough. especially that the competition is also only using the same tech

cookie is for each site, but that's enough... sure, maybe no retargeting ads, but those were creepy anyways (and likely not more effective)

The correlation is happening through an API connection between adsite.com and example.com and not through cookies. So even if you block all third party cookies and scripts your activities are being tracked through the first party.

I run all the time with first-party cookies disabled.

Most of the web works. Anything that does not, and I care about, gets blessed.

The only content I allow by default, even in low-security browser profiles, and even from first-party domains, are HTML, CSS, and images.

I consider the occasional broken page to be a successful test of my configuration. If I care, I adjust permissions.

What do you use to enforce this? Is it something that's going to break with Manifest V3?

I use uMatrix. On Firefox, so no current concerns about MV3.

I always find this development curious. About a decade ago I worked in this space. When someone brought up ad blockers I just said "put the analytics on our main domain. No one is going to block the entire website". The answer I got was "no one would ever do that because of the implications of serving advertising from your main domain". Yet, here we are.

They use a third party domain just because that way they can track the user actions with cookies, for example Google can track your navigation across multiple websites, and thus propose to you more relevant ads. Also using a different domain was simpler and cheaper, since you don't have to host the AD content and metadata, just include the JS from the AD provider somewhere in your HTML.

Now that thanks to EU laws and browser imposing restrictions about third-party cookies it's more difficult, the whole "serve ads from other domain" may not be that relevant anyway.

If you use a random wildcard subdomain... just serve them from the main website, what is the difference? On the other side with a proxy just route the AD requests to another server if it needs to be, of course you have to find a way to distinguish which requests are for AD and which are not, something you can do with some sort of signature in the filename, so that only the server can know which requests shall be handled locally and which one forwarded to the AD provider server.

News payers used to all serve their own ads including in house sales and design. Frankly with how key advertising is I don't understand why anyone would out source it.

This. Everyone and their grandma decided it's cool for Google and others to decide what should display on your website next to your content because of "magic online advertising".

How much of the efficiency of online advertising comes from the actual "art" of tracking users and their preferences to display "personalized" ads vs the "efficiencies" from firing/outsourcing your marketing, ad sales and creative workforce.

Particularly with the reams of evidence that fraud is rampant, both in advertising content and in claimed click/view rates.

cost and effectiveness.

selling ad space was always a lot of work. algorithms do it cheaper and in general better.

next step is just to run a GoogleAds lib/proxy...

Until the algorith associates you with an ad for something negative to your audience. Scams for example are common for algorithms to allow while a human can validate some legitimentch

The opportunity cost of lost sales due to unwanted associations is a drop in the bucked compared to the cost of having humans in the loop. And when the most of the market moves to a low-cost regime eventually almost everyone has to because being a holdout now means you can't even find enough other counterparties (to sell your ad space to, or to buy ad space from).

Advertisers trust other advertisers not to lie but not the content providers. well except Google they trust Google. So you have to use these hella shady and networks that are fly by night and security and privacy nightmares across many domains. Instead of many walled gardens of ads like you're saying.

What are the implications?

It more or less boiled down to "we would be labeled an advertiser and not a destination for information on the internet". Like being an advertiser stopped people from using Google search or something

Or newspapers, both before and after it. They've always been vast advertising platforms, but don't have anywhere near the same stigma that online advertisers have acquired (for extremely good reasons imo - they're as invasive as possible, while printed media has rather tight limits)

They could have become the dominant advertisers online too, and then no doubt they'd be just as nasty. But they lost that war multiple times, first to doubleclick-likes and then to social media.

Presumably that adblockers (or rather their users) would object to blocking domains that folks might actually want to load content from. I can’t imagine “domain” is the only signal one could use to identify ads, though. To truly befuddle them you’d make advertisements truly indistinguishable from content. This is not trivial.

Not entirely true. If you lower the quality of your content enough the advertisements are in fact indistinguishable. I often enjoy reading the "chumbox" at the bottom of the news article more than the reporting itself

I think what we're asking is what are the implications for the advertisement company.

And yeah, I can trivially block stuff in uBO by using CSS rules for example, so that's still on the table.

> I think what we're asking is what are the implications for the advertisement company.

Higher impressions? Higher integration cost? I guess I'm not sure what the confusion might be. Advertisers obviously want to ram their bullshit down as many eyesockets as they can find.

If third party ad servers get access to your main domain's cookies, they can impersonate your signed-in users and steal their data.

...Unless you're savvy. Thank goodness for the availability of https://publicsuffix.org/ (as long as you only use your main domain and don't need to share cookies with your own subdomains), and the includeSubDomains directive to HSTS! But - if you already set this up, you probably are savvy enough to avoid the problems created (or your provider is)

HSTS won't prevent this at all; the advertiser merely needs to also set up TLS by getting a certificate for that subdomain, which they can already do precisely because it goes to their web server -- not yours. This also lets them steal cookies marked secure (sent over HTTPS only).

Edit: A combination of DNS CAA with an account identifier restriction in the record would prevent this. Then the advertiser would complain, and any ads served would have to be over plaintext, which would cause browser warnings about mixed content and allow MITM injection of (more) malicious content.

Well, it's just a question of priorities. What do you care about more, security on your site, or getting your ads past ad-blockers?

I'm not surprised there are people who prioritize the latter, especially for small sites where they may not have someone who fully understands the risks.

There is a part of me that, at a high level, appreciates the back and forth between the user and the ad industry. On a personal level, I am slowly getting to the point, where I am less.. uhh.. understanding.

That said, the average person's conception of what acceptable needs to change. I did briefly think that they need suffer through more ad-infestation first, but I realized that the answer is more in line with what my wife seemed to have gone through. The low exposure to ads made her less willing to deal with them. This might be the way forward.

It is hard for a person used to existing ecosystem to even imagine, there could be something better.

Certainly, streaming services have ruined broadcast television for me. I don’t know how I used to spend over $100 a month on cable TV to be advertised to. Spending four and a half days a year (44 minutes out of every two hours) watching ads is not for me.

Randomly generated domains are a major red flag for abuse and malware detection, and seems to have become a rather large part of how the domain industry manage abuse. Domain "credit score" is also something that is used in the email industry to score links and thus spam values. A large part of providing score values is behind security companies that offer their service as a paid services, but as with a lot of this stuff there are a lot of movement to offer it for free similar to spam block lists.

It will be interesting when this kind of technology moves down to browser add-ons.

Reply on news.ycombinator.com