{"id":13687,"date":"2021-08-30T04:01:00","date_gmt":"2021-08-30T04:01:00","guid":{"rendered":"https:\/\/wpinitiate.com\/index.php\/2021\/08\/30\/googles-vague-privacy-cure-all-is-showing-up-in-new-proposals-but-some-say-it-could-break-the-internet\/"},"modified":"2021-08-30T04:01:00","modified_gmt":"2021-08-30T04:01:00","slug":"googles-vague-privacy-cure-all-is-showing-up-in-new-proposals-but-some-say-it-could-break-the-internet","status":"publish","type":"post","link":"https:\/\/wpinitiate.com\/index.php\/2021\/08\/30\/googles-vague-privacy-cure-all-is-showing-up-in-new-proposals-but-some-say-it-could-break-the-internet\/","title":{"rendered":"Google\u2019s vague privacy cure-all is showing up in new proposals, but some say it could break the internet"},"content":{"rendered":"

In its scramble to advance ad targeting and measurement methods that work without third-party cookies, Google has been accused of throwing lots of barely-cooked concepts at the wall to see what sticks. But one idea intended to protect people\u2019s privacy \u2014 Google\u2019s Privacy Budget<\/a> \u2014 is winding its way into several proposals. <\/p>\n

Technologists, including some representing companies that make web browsers competing with Google\u2019s popular Chrome browser, say the browser-based Privacy Budget concept is \u201cvague\u201d and \u201cnot useful.\u201d Yet, despite its inchoate state and potential dismissal by other browsers, the method has been added not just to specs for digital ad techniques but for a variety of potential web standards. <\/strong>Meanwhile, if adopted by Chrome, the Privacy Budget could actually create privacy harms or, if poorly implemented, could disable some of the web\u2019s standard functionality.<\/p>\n

\n

Like boilerplate at the end of a press release, a statement mentioning the Privacy Budget concept\u00a0turned up recently in specifications<\/a>\u00a0for proposed <\/strong>tech that would enable services like Zoom to determine how best to format video for a conference call or for Netflix to choose the most appropriate format for movie streaming.\u00a0The specs acknowledged the potential for misuse: the streaming tech could identify people via\u00a0fingerprinting<\/a>\u00a0by helping\u00a0distinguish someone\u2019s device from another.\u00a0So, as a possible mitigation for that privacy infringement, Google engineer Chris Cunningham, a co-editor of the spec, suggested that web browsers \u201cmay implement a \u2018privacy budget.’\u201d<\/p>\n

\u201cThe Privacy Budget is kind of poisoning the space,\u201d said Pete Snyder, senior privacy researcher and director of privacy at browser maker Brave. Snyder described what he said is a \u201cconstant\u201d flow of statements mentioning Privacy Budget that have been inserted into specs for proposed technologies he has reviewed as chair of the Privacy Interest Group at the Worldwide Web Consortium (W3C). The group provides guidelines and advice for addressing privacy considerations in web standards specifications like the aforementioned proposed streaming technology. The Privacy Budget has also appeared as a protective panacea in specs for\u00a0font-related technology<\/a>\u00a0and tech\u00a0that\u00a0helps websites choose optimal media<\/a>\u00a0content for people.\u00a0<\/p>\n

Designed as a defense against fingerprinting, the\u00a0Privacy Budget<\/a>\u00a0is a browser-based technique intended to place limits on \u201cfingerprinting surfaces,\u201d or distinctive characteristics associated with someone\u2019s device \u2014 such as installed fonts or configurations that help a streaming codec choose the best video format to use \u2014 that can be pieced together to detect or assign someone\u2019s identity. In an effort to prevent fingerprinting, the Privacy Budget restricts the amount of those distinctive characteristics that a technology can access or detect.<\/p>\n

\n

\u201cThe privacy budget is kind of poisoning the space.\u201d<\/p>\n

Pete Snyder, senior privacy researcher and director of privacy, Brave<\/p>\n<\/p><\/div>\n

Google engineers have pointed to the Privacy Budget as a way to reduce fingerprinting potential in its Privacy Sandbox tools since at least as far back as 2019, when it got a\u00a0shout-out in early specs for FLoC<\/a>, a highly-scrutinized ad targeting method\u00a0the firm itself acknowledges could help identify people<\/a>\u00a0through fingerprinting. Google included the method\u00a0way at the bottom of a list<\/a>\u00a0of privacy-protecting tech it plans to launch as part of its Privacy Sandbox initiative, giving it a wide 2023 launch window.<\/p>\n

\u201cPrivacy Budget is an early-stage proposal designed to protect people from fingerprinting, a problem we believe is critical to solve holistically as the web evolves,\u201d a Google spokesperson told Digiday for this story.<\/p>\n

\n

Privacy solution: details TBA<\/strong><\/p>\n

The problem is, even though Privacy Budget is mentioned in multiple proposed tech specifications as a possible safeguard for privacy abuses, it is far from ready for prime time. \u201c[We want to] make sure [we\u2019re] looking at mitigations we can ship today,\u201d wrote Sam Weiler, an MIT security engineer\u00a0during a meeting<\/a>\u00a0in May of the consortium\u2019s Privacy Interest Group, expressing a concern commonly raised about the lack of details about how the Privacy Budget would be implemented.\u00a0<\/p>\n<\/div>\n

\u201cThe Privacy Budget is more aspirational than a concrete proposal,\u201d said Eric Rescorla, CTO at Mozilla\u2019s Firefox, another of Chrome\u2019s competitors.\u00a0Although he said it is common for preliminary ideas to be included in collaborative specs as technologies are in development, he added, \u201cI\u2019m a little surprised it\u2019s showing up in a lot of places because as an implementer I don\u2019t know what to do with that text.\u201d\u00a0<\/p>\n

\n

\u201cPrivacy Budget is intended by Chrome\u2019s security folks to be the way to solve the problem discussed here.\u201d <\/p>\n

Tab Atkins, Jr., Chrome programmer, Google<\/p>\n<\/p><\/div>\n

Another member of the Privacy Interest Group, Konrad Dzwinel, an engineer at browser maker DuckDuckGo (another Chrome competitor), told Digiday in an email, \u201cGoogle only shared a vague definition of the privacy budget idea so far, so we don\u2019t have many thoughts about it. We do think that fingerprinting is an important problem to solve,\u00a0we\u2019re working to\u00a0address it in our products, and are waiting for Google to share more details about their idea.\u201d<\/p>\n

\u201cAs with all Privacy Sandbox proposals we will continue to get feedback through the open and iterative process and provide resources for developers to test and integrate in advance to help ensure a smooth transition to a more private web,\u201d said the Google spokesperson.<\/p>\n

Disrupting standard web functions = \u2018developer hell\u2019<\/strong><\/p>\n

In general, technologists including privacy tech researchers <\/strong>Digiday spoke with about the Privacy Budget, as well as others commenting in developer forums, said it is not clear how it would be implemented without some serious negative side effects. For instance, it could disable technologies used to identify whether people have logged into a website, essentially disrupting what\u2019s called session persistence by preventing sites from recognizing when a unique device has already logged in. One tech researcher Digiday spoke to who asked not to be named said that, if Chrome were to be updated without proper implementation plans made clear to site developers and ad tech providers, it could break a variety of standard web functions including recognizing logged-in users. \u201cThat\u2019s basically what will happen simultaneously across the internet,\u201d said the researcher.<\/p>\n

Without more clarification, enabling the Privacy Budget in Chrome could amount to what Snyder called \u201cdeveloper hell<\/a>.\u201d He told Digiday, \u201cIt\u2019s hard to get people to write code that says \u2018check to make sure functionality is available every second.\u2019 It seems like a non-starter from a developer perspective.\u201d\u00a0<\/p>\n

And at this point, it does not appear that Google has addressed what to do when it sets off errors. When asked during the May W3C meeting whether Chrome would generate error messages if Privacy Budget limits run out, Google\u2019s Cunningham wrote, \u201cI don\u2019t know what that would look like.\u201d<\/p>\n

Snyder and others also have said the technique could actually\u00a0enable <\/strong>new privacy harms because prior browser behavior could be revealed by the amount of \u201cbudget\u201d someone has remaining. \u201cThe way you spend your budget is in itself a unique identifier, which is ironic three times over,\u201d he said.<\/p>\n

But ultimately, said Rescorla, technical specs should come with workable approaches to limiting fingerprinting or other privacy infringements baked in. He said, \u201cPeople should not fool themselves into thinking that, if the spec otherwise has privacy issues, that this text fixes those issues.\u201d<\/p>\n<\/div>\n

\n