[JohnMakin]

I've been experimenting with behavioral tracking on a bunch of platforms for a while now, but it's very difficult research - if you come across something interesting, replication is very difficult if not impossible, or sometimes the underlying paradigm will change entirely and force you to start from square 1.

My motivation is that I would love, and personally pay a ridiculous amount of money for, a service that obfuscates the upstream data that ends up in stuff like bidstreams and other behavioral tracking data sources in a way that makes the data essentially worthless (or even better, extremely expensive) to them. Have had almost no success, at least from means that wouldn't get you in hot water- it feels a lot like pissing into a forest fire expecting to put it out.

[brokenmachine]

Just mentioning AdNauseam, which clicks on all ads in the background to poison the data.

https://github.com/dhowe/AdNauseam

[JohnMakin]

I like the spirit of stuff like this a lot and have entertained similar ideas, but the issue with specifically this is that depending on where you live, this may be illegal (which is effing ridiculous - I’ve had to build defense against click fraud, in my opinion if a website or company is vulnerable to this it’s their own lack of diligence, but whatever). So to me, stuff like this is a fun gray area middle finger but ultimately does not do anything to solve my problem, which is I want to completely opt out of behavioral tracking in any way shape or form, and if I cannot, I want the data truly anonymous as was promised/implied by these same people over the last two decades every time privacy conerns were raised. I know it’s a much wider problem than stuff like this is meant to solve, just wanted to throw it out there that (hilariously) stuff like this is illegal depending on local statutes.

[brokenmachine]

It's illegal to auto-click on ads that are automatically delivered? That's good example of a law I don't care about.

[Halfwhit]

If enough of us piss into the fire would it make a difference?

[JohnMakin]

That’s the idea, and I’ve seen speak of it in comments in places like these, but I’m not aware of there being a specific term for it. I call it privacy by obfuscation but that’s kind of boring. It’s easy to start experimenting with to see how invasive it is. Try changing your birthday to under 18 or over 35 if you’re under 35 and see how drastic your ad experience changes across anything you interact with on the web, and how fast it can happen. It’s creepy, but doing an experiment like this has essentially cost someone money, as I am not the person they are targeting. A problem though with this approach is creating any realistic technology that could employ tactics like this without changing the user experience in a way people immediately reject it, and the answer to me is, it’s probably not feasible. But, I keep trying to think about the problem because there probably is some happy middleground. I still believe privacy is possible today.

[adiabatichottub]

I've thought about this, and I'm almost certain I've seen some basic tools to do similar. Call it "semantic chaffing". Maybe one example could be for every search query you make three random queries are generated. Random results are followed through their tracking links. Now it's much less clear to a dumb algorithm what your interests might be. Maybe a human or well-trained LLM could pick up the thread, but now it takes considerably more resources. It's a form of asymmetric warfare.

[MrVandemar]

Probably need something that periodically adds and removes fonts as well, at least once per day, probably more often. That's one element of fingerprinting.

[adiabatichottub]

Fooling device fingerprinting would be wonderful, but could never provide 100% cover against tracking, since any site you log into has has a user identity that can be tracked using your email or phone number.

Maybe we could break this into categories of knowledge:

* A user identity on any particular site, and the personally identifying information (PII) attached to it (email, phone, IP addresses used)

* A wider identity profile that can be stitched together via site user identities and browser fingerprinting

* The topical interests of an identity

It'd posit that to break tracking you'd have to disguise the first two by randomizing PII and browser fingerprint. Randomizing the third is more about making the collected data on personal interests useless regardless of identity, thus decreasing the value proposition of invasive advertising.

[JohnMakin]

Yea, this is why I think it's an intractable problem that cannot be approached from the device level, and needs to be more of a user-driven movement and more about spreading awareness. However, that doesn't make for sexy privacy selling service products, who mostly sell products that delete your data every couple of months and then it re-appears because the upstream sources just keep pumping the data into the well. It isn't a thing anyone really would usually care about either, until they are impacted by it, and as much as I care about this I can attest to it - I have got ads that led me to some really good products or creators I still enjoy. Just as many if not more times though I've gotten scammed or manipulated, and that's the part of the awareness that I think needs to be spread.

Tackling this from a technical level, to me, at this point seems infeasible. Feel free to inbox my email if you have any more thoughts about this, this is something that is difficult to discuss in such public forums.

I will just leave this - to me, people place undue faith in adblockers and extensions. That fixes only a part of the problem. You're also placing a lot of trust in your browser (not to mention the extension). If I really, truly want to determine who you are - from the perspective of a data miner - I can trivially hide all backend requests behind a proxy that you will never know about, and your adblocker will never know about. It provides a false sense of security that a lot of otherwise technical people hide behind.

[thewanderer1983]

I agree in a world of data surveillance, techniques that obfuscate, like you have mentioned are ideal. The problem with this form of obfuscation is it also impacts other industries (legitimate functions) including areas of national security. Therefore I imagine it will be met with resistance, if any useful tools become widespread in use.

For example, faking traffic jam data for google maps with phones. https://www.abc.net.au/news/2020-02-04/man-creates-fake-traf...

Faking wifi and location data to unlock airpods pro in India. https://www.reddit.com/r/AirpodsPro/comments/1gqscig/two_guy...

DataPools is a Wi-Fi geolocation spoofing project that virtually relocates your phone to the latitudes and longitudes of Silicon Valley’s elite pools. https://adam.harvey.studio/datapools/

These are just a couple of fun examples, obviously you could augment these with LLM/DL tools and other anti-censorship (mixer, DCnets etc ), bot(nets) tools to create multiple identities that post in other languages, create fake photos of your in various countries, to make it hard to follow.

[JohnMakin]

> The problem with this form of obfuscation is it also impacts other industries (legitimate functions) including areas of national security.

I'm aware that "national security" is often invoked in these types of discussions, and a little aware more than I think the general populace at how valuable some of this data is to intelligence operations. However, I would counter that by saying perhaps someone should consider whether it's a problem that such "critical" national security functions belong in the hands of companies that control the flow of such data for profit to anyone with a pocketbook, and ponder whether this is actually working to cause net help or harm for national security. I would argue strongly the latter, to the profitability of the people that control such data and contribute a lot of money to the elections of people that put forth their agendas, but this isn't the place to do so.

[thewanderer1983]

I agree with your conclusion. There have been similar discussions around backdoors and “lawful intercept” systems in the past. The intelligent argument didn't win there either. Then you get Salt Typhoon, and maybe people will rethink them.

[thewanderer1983]

Some areas you might want to consider looking into.

https://en.wikipedia.org/wiki/Differential_privacy

https://vitalik.eth.limo/general/2022/06/15/using_snarks.htm...

Obviously this requires companies to embrace said technologies.

[alphan0n]

>DataPools is a Wi-Fi geolocation spoofing project that virtually relocates your phone to the latitudes and longitudes of Silicon Valley’s elite pools. https://adam.harvey.studio/datapools/

That is hilarious and should be expanded.

[portaouflop]

I think most of the data they collect is pretty bad so it’s more like pissing in an ocean of piss.