turtledove

or between the user and one party explicitly. Admittedly OHTTP is also premised on multiple parties not colluding, but we decided to punt on the key consistency problem for the sake of simplicity. We also recognize that it’s possible for savvy users to fetch the keys from the endpoints we’re serving them on, compare those keys with other users, and fact check our claims. We honestly have nothing to hide about this; everyone is receiving the same key. To specifically address the two proposals you made: 1) Shipping the key with the client: it’s not clear this is any better than fetching it right from Google. Chrome updates and our experiment framework (known as Chrome Variations) are both Google-managed distribution mechanisms, not terribly different from fetching the key at a Google API endpoint. 2) Having the relay serve the keys: these keys are actually designed to protect data from the relay. If the relay could change the public key Chrome uses to something the relay knows the private key for it would undermine the purpose of HPKE encryption. You suggested the relay could serve a key signed by Google. The issue with that is it complicates the process of key revocation. We expect to rotate the key we use, and we want to maintain the ability to revoke keys if needed (say the relay learned of a private key). Sure we could serve a signing key revocation list, but then we’re back in into the world of complicating the multi-party relationships. All this being said, addressing key consistency issue is on our radar, and we hope to improve the distribution model in the future. We welcome feedback of course; and we’ll take it into consideration as we continue to evolve the designs used here. There is a general blog post on Privacy Sandbox feedback at [1] and you can take a look at specifically how Chrome is fetching keys in [2]. In case you're curious the key we’re serving today has a cipher suite of (DHKEM_X25519_HKDF_SHA256, HKDF_SHA256, AES_256_GCM) and at the moment we have two gateways (one for read traffic and one for write traffic) each using their own single keypair. [1]: https://developer.chrome.com/docs/privacy-sandbox/feedback/ [2]: https://source.chromium.org/chromium/chromium/src/+/main:chr....

ers this will probably shift budgets to subscription of which Apple takes its cut. All this will further the supremacy of walled-gardens and big tech, at the expense of smaller independent players. I'll be honest, there is a creepy feeling when being tracked cross-site, and adtech providers have collectively failed at providing explanations, and a transparent account of how this works and why this is useful. They have also relied on fingerprinting, which has hurt the credibility of the field. The issue is that the replacement that are currently in the works (https://github.com/WICG/floc and https://github.com/WICG/turtledove/blob/main/FLEDGE.md) are extremely complex, will still dramatically impact adtech performance and only improve privacy for a very contrived definition of the concept which incidentally benefits once again big tech vendors... As to the effectiveness of advertising, removing tracking will have a huge impact. And this affects all players in the value chain, not only adtech providers but also publishers and more importantly advertisers which will see their return on ad spent severely impacted. There is a real of loss "social welfare" (I mean in a game-theoretic sense, but also for real if you believe in capitalism) if tracking is disabled. The freakonomics article gets cited a lot but the industry as a whole is moving forward with a greater emphasis on proving incremental sales. Advanced clients (who can spend billions per year) have real statisticians doing permanent randomized control trials proving that every dollar spent is providing incremental sales. I work for an adtech company and we have automatic RCTs for every single client, and guess what, advertising works for most clients. This is on top of fact that we are measuring the effectiveness of dollars spent on us, in addition to the dollars spent on competitors/other channels on which we have no control of course. The fact that Uber could see no impact when going from 150m to 50m is a testament to the incompetency of their CMO, which could not be bothered to actually measure and pilot the campaigns correctly, not the effectiveness of adtech as a whole. Thoughts are my own not my employer's.