
This Student Project Could Kill Digital Ad Targeting - mnazim
http://adage.com/article/privacy-and-regulation/student-project-kill-digital-ad-targeting/242955/
======
tokenadult
From the end of the article kindly submitted here:

"'In its current state now it's a weapon,' said Ms. Law. 'Do I want it to get
in the hands of the Syrian Electric Army? No!'

"To be fair, Ms. Law is not the most experienced computer programmer, so she
said she needs assistance to make Vortex more secure. She has an undergraduate
degree in Philosophy and Photography from the University of Melbourne in
Australia, and 'crash-learned' programming."

So it sounds like the code base and the security model of this new project
need thorough review. But if the project works, we could all have fun with an
online game while obfuscating our consumer behavior data. Who would like to
contribute to a project like this?

~~~
hmind
I don't get it, why is obfuscating consumer data a good thing? If I have to
see ads, I'd much rather they be relevant things like hosting providers than
random things I don't care about...

~~~
freshhawk
Firstly the term "relevant ads" is good marketing. They are really "ads
targeted to extract maximal revenue from this user".

Well targeted ads are basically useless to the consumer since if you actually
need something then you know this and you can search for it. The market
operating in ad networks optimizes ads that sell enough to pay for more ads
while remaining profitable, there is no mechanic that bubbles the best/least
expensive offer to consumers since they are not the customer.

To enable all this targeting you need to implement surveillance on your
targets as widely as possible.

So nearly all my internet is surveilled, by many parties, in order to spam the
web with offers that are marked up enough to pay for winning ad auctions on
popular terms for things I don't need, and could easily find if I did.

I get not caring about this. I don't get how anyone who understands how it
works would not understanding the popular interest in subverting this mess.

~~~
gohrt
That's like saying teaching in school is useless, because if I need to know
something, I'll ask someone.

This point of view is value-destroyingly cynical.

~~~
_delirium
That's not quite analogous, because in this situation the ad-seller is _also_
claiming to be the teacher. Google's mission is to return the most relevant
content whenever you search. If they succeed at that, then every time you
search for something, you will get the most relevant stuff as the top few
organic search results. The ads will therefore just be noise; the organic
search results will be exactly what you want.

~~~
bobwaycott
Exactly this. Organic search always wins, while ads distract. I've never
stopped finding ads to be the not-so-poor-man's way of not bothering to be
good at SEO. I tend to view them as a rough analogue to a traffic camera
ticket--do nothing to improve the public interest, and basically allow people
who can afford it to not bother about playing by or learning the rules.

------
qq66
Targeted ads are actually small businesses' greatest weapon against large
businesses.

My company, LiveLoop, sells PowerPoint collaboration software. How do we get
it in front of users? We buy Google ads. For 50 cents a click we get in front
of the narrow sliver of people who desperately want our software NOW. And our
users are ecstatic about our product once they start using it -- without
targeted ads, they'd never have heard of us.

How does Google Apps, one of our competitors, advertise? However they want to.
Billboards in Times Square. Super Bowl commercials. Anything they want,
really.

Startups begin by serving narrow audiences, and targeted ads are today's best
way of finding narrow audiences. This may end up hurting the wrong people.

------
Tichy
Not sure exactly how it works, but it gave me the thought that making
collecting ads into a game could be fun. For example there could be
competitions for getting specific ads (the most expensive loan, the weirdest
health treatment, and so on...). Maybe this game already does that, not sure.

------
dntrkv
I really don't see the point of this. Who is the target audience for this? Do
they really think enough people will use this to the point that it will "kill
digital ad targeting"?

~~~
tankbot
There is no target audience, it's not available for any audience. There's also
no 'they', it's one student who created a program as a class project.

It's interesting because the game involves collecting tracking cookies into
your browser, so that any site that tries to track you thinks you're everyone
in the cookies. It's hard to target a needle in a stack of needles.

------
kleinsch
"Part of the goal is to understand how ad targeting algorithms peg people in
specific audience segments. "That's why it needs critical mass, because only
when enough people are playing can we start seeing patterns in what kind of
cookies or attribute-identifiers companies look for and discriminate with,"
she said."

Doesn't sound like she knows how ad serving companies operate. These days many
companies are just storing one cookie with some sort of unique identifier for
the user, then storing user profiles, targeting data, behavioral tags, etc in
a server-side cookie store. You're not going to be able to gather much data
about companies that operate like that by analyzing huge numbers of their
cookies, since every user will have a unique cookie.

------
austenallred
This seems like a very complex alternative to installing Adblock

~~~
bnegreve
Hum, but Adblock doesn't prevent tracking through cookies.

~~~
jbnicolai
I can recommend looking into ghostery for that.

~~~
subpixel
Except that blocking cookies renders much of the web unusable. I use Ghostery
and am often finding that videos don't load, sometimes whole pages don't load,
etc.

I love the idea of a tool that actually uses advertising technology to subvert
it.

~~~
gohrt
Ghostery doesn't block "cookies", it blocks _content_ from blacklisted sites.

~~~
subpixel
Corrected! (Actually there used to be a 'cookies' tab, if I recall correctly,
but no more.)

------
arjn
So is this a kind of a reverse-Denial-of-Service-by-misinformation attack ?
You can bet some people in the Ad industry will insinuate this is a kind of
"hacking".

~~~
glesica
Or claim copyright over the cookies they set in your browser...

~~~
dredmorbius
They can try, but copyright covers expressive works of original authorship.
Not machine-generated identity tracking.

------
kposehn
Interesting.

I have yet to find anything that can really mess up our own targeting
algorithms, but I do find what she has done to be quite fascinating.

~~~
X4
Are you saying that you've counter-measures against this type of attack?
Poisened or fake-chunks/blocks have been infiltrated into P2P Networks for
many years and P2P networks were able to fight against it pretty well.

But I cannot imagine a way how you can take measures against this type of
attack. Please tell us more.

~~~
kitcar
There are a few different ways; Flash Shared Objects
([https://en.wikipedia.org/wiki/Local_shared_object](https://en.wikipedia.org/wiki/Local_shared_object)
), using Browser + Machine ID information to make sure cookies are linked to
the right machine, etc... - see
[http://samy.pl/evercookie/](http://samy.pl/evercookie/) for a few different
other methods

------
nathas
If cookies are being shared, and the users have access to them, what about the
cookies from sites with passwords in them...? I don't _think_ I use any sites
that do something that dumb, but I'm sure they exist.

I would never use this specifically because of that.

------
huntedsnark
I am unsure as to what purpose the game aspect serves, if you're installing
this is a browser extension couldn't you just give the service access to all
your cookies all at once rather than having to 'mine' them? What am I missing?

~~~
Yaa101
That it will drown the readers of those cookies, the advertisers, into a sea
of fake data, forever fauling up their ability to know who is who.

~~~
PavlovsCat
Yes, but why require users to play a game for that, why not skip that part and
just mess with the cookies?

~~~
rogerbinns
Because any decent implementation doesn't trust client cookies. Typically the
server signs them so the only messing that can be done on the client side is
to delete/not send them.

~~~
Kiro
Still doesn't explain why you need a game. You add your cookies to a pool
which randomly exchanges them between users. No game needed.

~~~
rogerbinns
You don't "need" a game. The point of the game is fun while screwing with
people trying to profile you, but poisoning their data instead.

There is a precedent with barcode games of collecting things
[http://en.wikipedia.org/wiki/List_of_barcode_games](http://en.wikipedia.org/wiki/List_of_barcode_games)

Randomly exchanging cookies with other users (assuming they are even
structured that way) is a considerably larger coding challenge than just
examining cookies and giving an arbitrary score.

------
LandoCalrissian
It's called FakeBlock.

~~~
lurkinggrue
That is one amazing app, That George Maharis is a genius!

------
hawkharris
By providing misleading cookie info, couldn't you make the targeted ads even
worse?

For example, suppose that the cookies are arbitrarily altered, and they make
advertisers think that I'm an older man who's extremely wealthy and takes
vacations.

Now, whenever I visit travel websites, I'll see higher prices, whereas if I
hadn't mislead the advertisers, I might see prices that are more reasonable
and appropriate for my age / income bracket.

~~~
freshhawk
There's a mention about selecting a "shoe lover profile" when shoe shopping or
something along those lines so it seemed to me that this was accounted for.

"For instance, if a user decides to go shoe-shopping for summer, he or she
could equip their browser with the cookies most associated and aligned with
shopping, shoes and summer"

You could do the same thing by trial and error switching profiles or some kind
of way of sharing "this profile gives low prices at X travel site" information
between users.

~~~
raldi
The shoe shopper could also just go to
[http://www.google.com/ads/preferences/‎](http://www.google.com/ads/preferences/‎)
and add it under the "Interests" section.

~~~
freshhawk
That wouldn't affect differentiated pricing based on user profile information.
It would get you more ads in that vertical but wouldn't get you the cheapest
prices.

------
EGreg
This might be interesting for you if you are concerned about tracking across
sites:

[http://www.faqs.org/patents/app/20120110469#b](http://www.faqs.org/patents/app/20120110469#b)

------
uptown
So you're exchanging targeted ads for identity theft?

------
sweetp
I use Cookie app from sweetp productions on Mac OSX to deal with tracking
cookies, it seems to work well

------
fearlessleader
This will work until they just start encrypting cookies server-side.

------
andyl
re-writing cookies with misinformation: creative!

