Hacker News Reader

Comment by hypeatei | Hacker News Reader

What are the implications?

If third party ad servers get access to your main domain's cookies, they can impersonate your signed-in users and steal their data.

...Unless you're savvy. Thank goodness for the availability of https://publicsuffix.org/ (as long as you only use your main domain and don't need to share cookies with your own subdomains), and the includeSubDomains directive to HSTS! But - if you already set this up, you probably are savvy enough to avoid the problems created (or your provider is)

HSTS won't prevent this at all; the advertiser merely needs to also set up TLS by getting a certificate for that subdomain, which they can already do precisely because it goes to their web server -- not yours. This also lets them steal cookies marked secure (sent over HTTPS only).

Edit: A combination of DNS CAA with an account identifier restriction in the record would prevent this. Then the advertiser would complain, and any ads served would have to be over plaintext, which would cause browser warnings about mixed content and allow MITM injection of (more) malicious content.

Presumably that adblockers (or rather their users) would object to blocking domains that folks might actually want to load content from. I can’t imagine “domain” is the only signal one could use to identify ads, though. To truly befuddle them you’d make advertisements truly indistinguishable from content. This is not trivial.

Not entirely true. If you lower the quality of your content enough the advertisements are in fact indistinguishable. I often enjoy reading the "chumbox" at the bottom of the news article more than the reporting itself

I think what we're asking is what are the implications for the advertisement company.

And yeah, I can trivially block stuff in uBO by using CSS rules for example, so that's still on the table.

> I think what we're asking is what are the implications for the advertisement company.

Higher impressions? Higher integration cost? I guess I'm not sure what the confusion might be. Advertisers obviously want to ram their bullshit down as many eyesockets as they can find.

It more or less boiled down to "we would be labeled an advertiser and not a destination for information on the internet". Like being an advertiser stopped people from using Google search or something

Or newspapers, both before and after it. They've always been vast advertising platforms, but don't have anywhere near the same stigma that online advertisers have acquired (for extremely good reasons imo - they're as invasive as possible, while printed media has rather tight limits)

They could have become the dominant advertisers online too, and then no doubt they'd be just as nasty. But they lost that war multiple times, first to doubleclick-likes and then to social media.

Reply on news.ycombinator.com