Gregory's Server@thomholwerda Also, just to note, there's a comment in your thread saying that Firefox for iOS doesn't have this problem because it uses Webkit, not Firefox's engine (I can't reply because I guess fosstodon and m.s don't talk). Anyone assuming this should be aware that Apple has had this same feature since 2021 https://www.apple.com/legal/privacy/data/en/safari/#:~:text=You%20can%20disable%20Privacy%20Preserving,off%20Privacy%20Preserving%20Ad%20Measurement.&text=When%20you%20are%20in%20an,Pay%20enabled%20on%20that%20devicef And this *is* in WebKit, you can find it in the source code. It is unknown (to me) if the feature activates in apps embedding WebKit, or if it can be turned off.
|
7 comments
@mcc @thomholwerda it seems like it should be possible to send fake conversion events from a surrogate script that gets pulled in by a uBlock Origin rule...anyone got an example of a script actually doing this on a live site?  @dmarti @thomholwerda Maybe a good first step would be a browser extension that just identifies whether "please phone home later" codes of Google, Apple, or Firefox/Facebook formats are seen and which ones. I think it would be interesting to do a survey of popular websites and identify which of these are making use of the "ad measurement"/browser phonehome capabilities. @dmarti @thomholwerda This entire technology class and the details of its implementation have been way under-reported even in webtech blogs, which normally are falling over themselves to give tutorials on every new browser feature. It's weird considering that theoretically this technology is useless unless somewhere an engineer with a website implements it (maybe there's a separate adtech information ecosystem I don't read?) @mcc @thomholwerda For the Google stuff you don't need an extension, you can check for an attestation file under .well-known https://developers.google.com/privacy-sandbox/relevance/enrollment (just going by market share that seems like it will be the most common one—so far it looks like the Firefox ad tracking feature has resulted in more fediverse+Reddit+Hacker News+LWN posts than actual ads) @dmarti @thomholwerda According to Firefox the "ad measurement" feature in 128.0 is not generally available yet. It's locked behind this thing https://wiki.mozilla.org/Origin_Trials which means each site using the feature has to be individually approved. I don't know if Firefox publishes the lists of who's enabled for which origin trials. They assert the feature is only for "experiments" about whether the feature gathers useful data, but I'd be very curious if Facebook sites are among the ones "experimenting".  It's not dissimilar from pinky-swearing not to abuse the system: https://github.com/privacysandbox/attestation?tab=readme-ov-file#core-privacy-attestations |
@mcc @thomholwerda fwiw the instructions on that page don't mention that it's buried under "Advanced" in the iOS settings and on the "Advanced" tab in Mac OS