Apple's pending privacy clampdown drives desperate marketers to overwhelm domain database
(2021/04/09)
- Reference: 1617933367
- News link: https://www.theregister.co.uk/2021/04/09/apples_privacy_clampdown/
- Source link:
Marketers frantic to preserve their ad tracking capabilities in advance of [1]Apple's iOS 14.5 privacy restrictions have overwhelmed a volunteer-maintained database used to oversee domain names and improve web security.
The [2]Public Suffix List (PSL) is a Mozilla-founded, community-run project to provide a list of domain suffixes, from .com and .co.uk to things like github.io and pvt.k12.ma.us, that can be used to build effective top-level domains (eTLDs) that form the basis of the web's [3]same-origin security model .
[4]
eLTDs exist as a designation because top-level domains (TLDs) themselves [5]aren't sufficient to define the scope of a site.
The issue is that browsers can't look at domain names in URLs and automatically know for certain where individual websites begin and end. For example, theregister.com and google.com are clearly two distinct sites, and cookies set by Google shouldn't be send to The Register just because our domains both end in .com. And then there are things like github.io, which allows people to host webpages on GitHub's infrastructure: you wouldn't want cookies set by yourcoolproject.github.io to be visible to snoopingmiscreant.github.io.
[6]
Thus, the PSL is employed by browser makers and other software developers to ensure that domains can't be used to create super-cookies that track users across multiple web domains.
Two weeks ago, Jothan Frakes, senior product manager at PLISK and PSL volunteer, [7]reported a surge of new pull requests to be included on the list, attributed to [8]Facebook's guidance to advertisers that they may need to verify ownership of their domain to continue using the Facebook Pixel tracker when Apple implements its App Tracking Transparency rules in iOS 14.5 in a few weeks.
Apple begins rejecting apps that use advertising SDKs for fingerprinting users [9]READ MORE
Facebook says it will support domains included in the PSL, despite efforts by developers like Google software engineer Ryan Sleevi [10]to discourage people from using the PSL because it's obsolete. And so, companies that use Facebook's ad tech, among others, are trying to register with the PSL.
For example, Dave Sanders, co-founder and CTO at Service Magnet, filed [11]a pull request with the PSL repo on GitHub to add the domain (eTLD+1) used by his company – magnet.page – to be included on the PSL so that Facebook's ad tech will recognize customers pages hosted at [customer].magnet.page subdomains as separate origins.
A week ago, Frakes observed these pull requests accelerating and [12]announced no new requests of this sort will be merged until Apple and Facebook have sorted things out among themselves.
Nice idea, but...
That may be easier said than done. For months, developers at Facebook and Apple have been trying to figure out a way to continue [13]to allow advertisers to track ad conversions – to understand which ads people click on – in the web's increasingly complicated technical environment.
Since January, Benjamin Savage, a software developer at Facebook, has been trying to solve what he referred to as the Etsy problem. Etsy, he explained, offers its merchants the ability to set up their own Facebook Pixel to run ads on Facebook and measure conversions.
"We can't support these merchants using [Apple's] ' [14]Private Click Measurement ' [PCM] right now," he lamented. "The way the spec is currently written, ALL ads that run on facebook.com and direct to ANY part of etsy.com would be eligible to take credit for ANY conversion fired from ANY part of etsy.com. Unfortunately, this is not a particularly useful statistic for the individual merchants who sell their wares on etsy.com."
John Wilander, a WebKit security engineer at Apple, has been corresponding with Savage, trying to come up with potential solutions that fit with Apple's evolving privacy requirements.
So far, the discussion has yielded, as Savage [15]put it , "a pretty grim set of options."
It was Savage who on Tuesday [16]opened a new issue in Apple's Private Click Measurement [PCM] repo to call attention to the PSL submission freeze, and addressed his concerns to Wilander.
Browser tracking protections won't stop tracking, warns DuckDuckGo [17]READ MORE
"We have a problem," he said. "As [18]this GitHub issue explains, there is an increased volume of requests to add entries to the Public Suffix List."
Pointing out that this is not specifically a Facebook problem but a concern of anyone running ads under Apple's privacy policies, he argues that Apple should step in to help support the PSL, or come up with another solution, because its impending ATT changes have created the situation.
The issue is basically that merchants operating on hosted platforms can't measure their ads under the limitations from Apple's privacy regime unless the platform domain is listed on the PSL, which PCM uses to determine what is [19]a registrable domain .
"Apple created this issue in the first place," [20]said Savage. "The need for multi-tenant websites to add themselves to the PSL exists only because of the PCM design decision to limit measurement to registrable domains. The urgency exists because [of] Apple's planned ATT enforcement."
Google meanwhile has been trying to solve a related problem – letting different domains operate as if they were the same origin – through a technology called First-Party Sets. The W3C's Technical Architecture Group, however, considers the proposal to be [21]harmful to the web .
[22]
It would be so much easier for advertisers if everyone just gave up on privacy. ®
Get our [23]Tech Resources
[1] https://www.theregister.com/2021/04/02/apple_apps_tracking/
[2] https://publicsuffix.org/
[3] https://web.dev/same-site-same-origin/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YG-RaTPVpzSpUDu8RAGkBAAAAE8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://publicsuffix.org/learn/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YG-RaTPVpzSpUDu8RAGkBAAAAE8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://github.com/publicsuffix/list/issues/1245
[8] https://www.facebook.com/business/help/331612538028890?id=428636648170202
[9] https://www.theregister.com/2021/04/02/apple_apps_tracking/
[10] https://github.com/sleevi/psl-problems
[11] https://github.com/publicsuffix/list/pull/1230
[12] https://github.com/publicsuffix/list/issues/1245#issuecomment-812228981
[13] https://github.com/privacycg/private-click-measurement/issues/60
[14] https://webkit.org/blog/11529/introducing-private-click-measurement-pcm/
[15] https://github.com/privacycg/private-click-measurement/issues/60#issuecomment-782163753
[16] https://github.com/privacycg/private-click-measurement/issues/78
[17] https://www.theregister.com/2021/03/30/duckduckgo_tracking_protection_claims/
[18] https://github.com/publicsuffix/list/issues/1245#issuecomment-812228981
[19] https://webkit.org/tracking-prevention/#terminology
[20] https://github.com/privacycg/private-click-measurement/issues/78#issuecomment-814737936
[21] https://www.theregister.com/2021/04/08/w3c_google_multple_domains/?td=keepreading-top
[22] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YG-RaTPVpzSpUDu8RAGkBAAAAE8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[23] https://whitepapers.theregister.com/
The [2]Public Suffix List (PSL) is a Mozilla-founded, community-run project to provide a list of domain suffixes, from .com and .co.uk to things like github.io and pvt.k12.ma.us, that can be used to build effective top-level domains (eTLDs) that form the basis of the web's [3]same-origin security model .
[4]
eLTDs exist as a designation because top-level domains (TLDs) themselves [5]aren't sufficient to define the scope of a site.
The issue is that browsers can't look at domain names in URLs and automatically know for certain where individual websites begin and end. For example, theregister.com and google.com are clearly two distinct sites, and cookies set by Google shouldn't be send to The Register just because our domains both end in .com. And then there are things like github.io, which allows people to host webpages on GitHub's infrastructure: you wouldn't want cookies set by yourcoolproject.github.io to be visible to snoopingmiscreant.github.io.
[6]
Thus, the PSL is employed by browser makers and other software developers to ensure that domains can't be used to create super-cookies that track users across multiple web domains.
Two weeks ago, Jothan Frakes, senior product manager at PLISK and PSL volunteer, [7]reported a surge of new pull requests to be included on the list, attributed to [8]Facebook's guidance to advertisers that they may need to verify ownership of their domain to continue using the Facebook Pixel tracker when Apple implements its App Tracking Transparency rules in iOS 14.5 in a few weeks.
Apple begins rejecting apps that use advertising SDKs for fingerprinting users [9]READ MORE
Facebook says it will support domains included in the PSL, despite efforts by developers like Google software engineer Ryan Sleevi [10]to discourage people from using the PSL because it's obsolete. And so, companies that use Facebook's ad tech, among others, are trying to register with the PSL.
For example, Dave Sanders, co-founder and CTO at Service Magnet, filed [11]a pull request with the PSL repo on GitHub to add the domain (eTLD+1) used by his company – magnet.page – to be included on the PSL so that Facebook's ad tech will recognize customers pages hosted at [customer].magnet.page subdomains as separate origins.
A week ago, Frakes observed these pull requests accelerating and [12]announced no new requests of this sort will be merged until Apple and Facebook have sorted things out among themselves.
Nice idea, but...
That may be easier said than done. For months, developers at Facebook and Apple have been trying to figure out a way to continue [13]to allow advertisers to track ad conversions – to understand which ads people click on – in the web's increasingly complicated technical environment.
Since January, Benjamin Savage, a software developer at Facebook, has been trying to solve what he referred to as the Etsy problem. Etsy, he explained, offers its merchants the ability to set up their own Facebook Pixel to run ads on Facebook and measure conversions.
"We can't support these merchants using [Apple's] ' [14]Private Click Measurement ' [PCM] right now," he lamented. "The way the spec is currently written, ALL ads that run on facebook.com and direct to ANY part of etsy.com would be eligible to take credit for ANY conversion fired from ANY part of etsy.com. Unfortunately, this is not a particularly useful statistic for the individual merchants who sell their wares on etsy.com."
John Wilander, a WebKit security engineer at Apple, has been corresponding with Savage, trying to come up with potential solutions that fit with Apple's evolving privacy requirements.
So far, the discussion has yielded, as Savage [15]put it , "a pretty grim set of options."
It was Savage who on Tuesday [16]opened a new issue in Apple's Private Click Measurement [PCM] repo to call attention to the PSL submission freeze, and addressed his concerns to Wilander.
Browser tracking protections won't stop tracking, warns DuckDuckGo [17]READ MORE
"We have a problem," he said. "As [18]this GitHub issue explains, there is an increased volume of requests to add entries to the Public Suffix List."
Pointing out that this is not specifically a Facebook problem but a concern of anyone running ads under Apple's privacy policies, he argues that Apple should step in to help support the PSL, or come up with another solution, because its impending ATT changes have created the situation.
The issue is basically that merchants operating on hosted platforms can't measure their ads under the limitations from Apple's privacy regime unless the platform domain is listed on the PSL, which PCM uses to determine what is [19]a registrable domain .
"Apple created this issue in the first place," [20]said Savage. "The need for multi-tenant websites to add themselves to the PSL exists only because of the PCM design decision to limit measurement to registrable domains. The urgency exists because [of] Apple's planned ATT enforcement."
Google meanwhile has been trying to solve a related problem – letting different domains operate as if they were the same origin – through a technology called First-Party Sets. The W3C's Technical Architecture Group, however, considers the proposal to be [21]harmful to the web .
[22]
It would be so much easier for advertisers if everyone just gave up on privacy. ®
Get our [23]Tech Resources
[1] https://www.theregister.com/2021/04/02/apple_apps_tracking/
[2] https://publicsuffix.org/
[3] https://web.dev/same-site-same-origin/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YG-RaTPVpzSpUDu8RAGkBAAAAE8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://publicsuffix.org/learn/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YG-RaTPVpzSpUDu8RAGkBAAAAE8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://github.com/publicsuffix/list/issues/1245
[8] https://www.facebook.com/business/help/331612538028890?id=428636648170202
[9] https://www.theregister.com/2021/04/02/apple_apps_tracking/
[10] https://github.com/sleevi/psl-problems
[11] https://github.com/publicsuffix/list/pull/1230
[12] https://github.com/publicsuffix/list/issues/1245#issuecomment-812228981
[13] https://github.com/privacycg/private-click-measurement/issues/60
[14] https://webkit.org/blog/11529/introducing-private-click-measurement-pcm/
[15] https://github.com/privacycg/private-click-measurement/issues/60#issuecomment-782163753
[16] https://github.com/privacycg/private-click-measurement/issues/78
[17] https://www.theregister.com/2021/03/30/duckduckgo_tracking_protection_claims/
[18] https://github.com/publicsuffix/list/issues/1245#issuecomment-812228981
[19] https://webkit.org/tracking-prevention/#terminology
[20] https://github.com/privacycg/private-click-measurement/issues/78#issuecomment-814737936
[21] https://www.theregister.com/2021/04/08/w3c_google_multple_domains/?td=keepreading-top
[22] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YG-RaTPVpzSpUDu8RAGkBAAAAE8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[23] https://whitepapers.theregister.com/
re: easier for advertisers if everyone just gave up on privacy
sbt
You know what would be even easier for everyone? If advertisers just gave up on tracking.
Lies
doublelayer
"For months, developers at Facebook and Apple have been trying to figure out a way to continue to allow advertisers to track ad conversions – to understand which ads people click on – in the web's increasingly complicated technical environment."
No, they're not. It is easy to determine which ads people are clicking on. Let's say a company is running five different ads for the same thing and they want to measure whether there is a difference in effectiveness between the presentations. Here's how you do that:
Ad 1: links to https://ispamyou.adnetwork/ad/1
Ad 2: links to https://ispamyou.adnetwork/ad/2
And so on. Or, because the short numbers will get reused:
Ad 1: links to https://ispamyou.adnetwork/ad/aei6zln2
Ad 2: links to https://ispamyou.adnetwork/ad/fl2ozvnp
If you're on something which doesn't do custom paths, you can do the same thing with query parameters. Then you just dump the request in a database to look at later and redirect the user. Facebook could build a server to collect that if there is a user who lacks the technical knowledge to do it themselves. I wouldn't be surprised to hear they already have that. The privacy protection thing doesn't make that harder.
What it does make harder and what Facebook wants to make easy again isn't figuring out what ads people are clicking on, but to figure out who the people are who click on the ads. Or do anything else online. That's what Apple's privacy measure is intended to protect. Facebook and its advertisers are angry about that and I understand why, but that's just too bad. They never asked my permission for invading my privacy. I will neither ask their permission nor care when they object to my blocking and impeding them.
"Apple created this issue in the first place"
No Benjamin Savage, it was companies like your employer, Facebook, tracking people across the web that caused the real problem - the attack on personal privacy. Apple is trying to fix that problem. That fact this causes an issue for companies trying to measure tracking clicks is unfortunate for those companies, but it is not Apple's fault.