zlacker

[return to "Mozilla Standards Positions Opposes Web Integrity API"]
1. dhx+oi[view] [source] 2023-07-25 05:09:58
>>danShu+(OP)
Can Mozilla also respond with their position on their own IPA proposal[1] for tracking users across the Internet?

If you are shown a product ad whilst browsing searchengine.example and then later look up the product at reviews.example, then end up making a purchase at shop.example, your Mozilla browser will send all of these events to one or more aggregation services that allows shop.example to understand (at least in aggregate, assuming you trust the cartels running the aggregation services) that you were exposed to their product at searchengine.example and further exposed to their product at reviews.example.

Where previously an ad tech company was ultimately able to track users based on source IP address (even if cookies had been disabled by a user), IPA now allows these companies to track users across multiple IP addresses, and regardless of the user's cookie settings, via a unique tracking identifier. It is also proposed that the operating system provides the unique tracking identifier which can then be used by all applications or browsers on a device, allowing different devices behind a single IP address to be distinguished.

[1] https://github.com/patcg-individual-drafts/ipa/

◧◩
2. mindsl+sB1[view] [source] 2023-07-25 14:55:17
>>dhx+oi
To be fair, "Web Integrity" (aka remote attestation aka a corporate surveillance agent built into "your" hardware) is much more fundamental as it would prevent the running of forked browsers that remove deliberate security vulnerabilities like IPA. It's unfortunate that Mozilla "plays ball" on garbage like IPA, but at least as things stand users are free to disable/remove/fork/etc. Whereas remote attestation is fundamentally game over for the idea of user representing agents altogether.
[go to top]