Schneier on Security

Clive Robinson • April 25, 2017 2:28 PM

With regards,

First, it looks at the struggle between advertising and ad blockers as fundamentally a security problem that can be fought in much the same way antivirus programs attempt to block malware

I regard all adverts as “malware” as the default position these days.

Secondly I also regard the advertisers as thieves in several ways.

Thirdly I regard having to run “javascript” or any other interpreter for what is compleatly unknown thus untrusted code on my machine to be a Red Line.

Which as I used to be involved with revenue based online services in the past might appear to be supprising.

The reason we have unconstrained advertising in the hands of just one or two major players is in fact due to the failure of economics. Specifically the assumption of Distance Cost Metrics alowing independent markets to form as a result of being distributed thus the local person has a lower cost advantage…

There is no distance cost metric with the Internet that either leaf content suppliers or leaf content consumers see. They just pay a time/quantity not distance rate.

Thus there is a global single market which as is the way of these things it’s control falls into the hands of just one or two players.

These players will use their position as with any monopoly to form the market in their favour, by fair means or foul. Usually the latter.

Thus if a major player such as Google say they are going to put technology in their products that at first sight would appear to kick the legs of their financial model you should be asking why? And to treat it as a poison pill untill you know otherwise.

A number of ad-blockers have and still continue to be poison pills, in that they have a behind the scenes agreement to allow “approved advertising” through. The problem is that the “approval aspect” has nothing what so ever to do with checking that the ads are not in anyway harmfull, it’s all to do with payment, that is likewise not checked.

Thus somebody with an exploit can make a payment to some ad-blocker organisations to let their “ad” with exploit inside through. Provided the exploit payload does not make it’s self obvious then there is a high chance that they will not be caught out.

The only protection against this is not to alow the exploit into your system… Which means turning off the likes of javascript and the downloading of image files… You don’t get the malware, but you don’t get much of what the WWW was about without images and other “rich” data, nor do you get some types of functionality.

Personaly I’ve found that turning off javascript is acceptable to me, if a site such as slashdot / utube require it I don’t use the site plain and simple, the loss is not sufficient to tip the scales into me alowing javascript even on a site by site basis.

The fact that Google is making more and more of their services “javascript dependent” should be a major red flag to people. Because it tells you they are giving up on advertising and going for spying as a revenue model…

Which is sort of what has been predicted for some time. But people want to fight the wrong battles, in the same way a dog goes after the stick not the person who threw it and they are now heading off elsewhere unscathed as the dog runs away.

Clive Robinson • April 25, 2017 7:34 PM

@ Slime Mould… With a touch of piquance.

With javascript off, I rarely see ads.

Yup it’s not just more restfull, it also saves a lot of bandwidth as well. I realy object to bandwidth thieves such as advertisers, I have a dislike for them as much if not more than those early morning or late night door rattling leaf-litterers, who apparently speak no English and appear to be organised by “Gang Bosses” to disturb the peace of the honest (I’ve never been sure if you could get the varmints under Human Rights legislation about the right to a peacful home life, and get the lot of them deported to one of those atols the French use for testing nukes ;-).

Clive Robinson • April 25, 2017 8:02 PM

@ Systate,

What changed your perspective after working for an ad based company?

It was not ad based, it was subscription based.

I did some post graduate research into payment methods for raising revenue for academic search services getting on for twenty years ago.

You come down to three basic ideas based on the actual service,

1, Annual or shorter subscription.
2, Invoice for number of searches
3, Pay as you go per search.

As online newspapers and other PayWalled services are finding the first and second models don’t work very well if at all.

The third method needs a new payment method to work. Currently nobody has a universal micro/nano payment system that works without some very strange assumptions.

This then gave rise to looking at secondary revenue raising. The simplest of which would be advertising. Well as many are discovering it does not pay service or content providers. The reason is the disparity between what an advertiser pays to the likes of Google and the sum the service or content provider receives from Google. Thus the only way to make money is to get the advertisers to come directly to you rather than through the likes of Google. Major content providers like the Guardian Newspaper have tried other sources such as syndicating content through the likes of Google and Apple via Instant Articles but are finding it to be unbenificial which is probably why they have just stopped using both Google and Apple.

The real problem that nobody wants to talk about is how to stop the Internet becoming “A winner takes all single market” which is de facto a monopolistic or cartel marketplace.

Clive Robinson • April 27, 2017 7:51 AM

@ George L.,

Would they still have an incentive to collect as much personal data from their visitors? Curious to hear your thoughts.

As I mentioned above to Systate, I looked into revenue raising models getting on for twenty years ago. And suprisingly little had changed apart from things have become more polarized and cartel controled.

The real problem that caused this mess was that there was no sensible way to do “micro/nano charging” for content access.

Untill that arrives the only way to raise revenue is by some form of pre-payment –be it subscription or usage token– or by turning the content viewer into a commodity to sell on to others at the maximum possible price.

Now that the “you are the product” model has been established for the cartel they are going to do whatever they can to,

A, Keep it churning in the cash.
B, Prevent legislation against it.
C, Prevent alternative revenue methods becoming available to others.

If you accept that this is the case then there are a number of options open to raise revenue from the “you are a product model”.

Firstly you have the Facebook method, where you provide a method for “the products” to hemorrhage personal information about themselves. This includes the likes of LinkedIn and job sites as well. Also the likes of free blog sites, which the cartel scrape with their robots or tools like discus etc. Oh and don’t forget those “like buttons” and similar on web pages, in most cases they do an ET and “Phone Home” to twitter facebook etc etc, irrespective of what you do (youl’d have to turn off both javascript and image downloading to stand a chance).

If you don’t play those games then there are the likes of free EMail and Twitter, where your links to others and things that interest you can be fairly easily determined. This includes all that “colabarative working” nonsense via Google Gadgets, I dread to think how much valuable IP goes that way. But Google are preying on the young in a quite sick way, through their various schools and student initiatives. The same applies to Microsoft with Office 365 and just about any other online service wich requires a “middle point” of some form.

Which takes us from the relms of direct data analysis into the more creepy world of Traffic Analysis. Thus even if everything you do is encrypted they see connectivity paterns between you and others. Humans being human will make mistakes and from these they can put names and thus faces, habits and interests to identifiers.

As has been seen recently[1] the likes of IP address spoofing is not that effective and that mobile app developers can overcome the deleating of the app and still track the user[2] as well as using other numbers that are unique[3] within a device or PC.

But it does not need to be just unique numbers it can be combinations of numbers/data that when combined make a near unique fingerprint of a device or PC. Worse even quite common combinations can still be tracked if a geo-spatial or temporal element is involved. That is say 1% of smart phones have the same combination, when you add the cell tower and time of day data it becomes more or less unique again.

Whilst there are things you can do to limit this, the level of OpSec required is significantly more than most people can reasonably be expected to do. Thus even though you might achive the level of OpSec required another person you communicate with might not, and you inherit their failing and become visable through Traffic Analysis…

As far as I can see this is the direction the likes of Google are going to go. Thus their ad-blocker initiative can be seen as a way to despoil others revenue models, and by reducing the oppositions market share increase their own as well as moving from a cartel to a monopoly, thus vastly increased profit.

The only fly in the ointment is that ISPs in the US now have abilities Google do not. Thus it will be interesting to see what Google does with respect to them.

[1] https://www.theregister.co.uk/2017/03/10/mac_address_randomization/

[2] https://www.theregister.co.uk/2017/04/24/uber_cloaked_its_spying_but_apple_gave_it_a_wrist_slap/

[3] https://www.theregister.co.uk/2017/04/25/uber_sued_lyft_hell/

Clive Robinson • April 27, 2017 5:58 PM

@ mere mortal,

That is, with regards to blocking a given site’s scripts, Is it all or nothing?

It is not all or nothing, but it is highly nonlinear. Look at it this way a single point gives little or no information. Two points however can be compared for similarities. Thus the more points the more a signal comes out of the noise. In effect each point falls on a power law curve which starts below a threashold point. The first few points don’t make it even close to the threashold point but subsiquent point bring it more rapidly not just to the threashold but straight through it.

@ Haroun,

why are people outraged at the thought of making that insignificant payment to Facebook when they spend five times that amount every day on snacks?

Because the fee is not insignificant when viewed against an individual snack cost.

It sounds mad but that’s just the way the vast majority of people view things. Thirty chocalate biscuits for 1USD will sound better to the majority of people than 1month of Facebook usage even though that’s on average thirty days worth.

The 3USD muffin from Starbucks with the 5USD coffee will sound better / more convenient than six equally good muffins for the same price from your local Sainsburys etc.

It’s just the way people are…