Skip to content
This repository was archived by the owner on Nov 7, 2025. It is now read-only.

Accessing interest groups from the same site#245

Open
xxia2021 wants to merge 3 commits into
WICG:mainfrom
xxia2021:xxia-patch-1
Open

Accessing interest groups from the same site#245
xxia2021 wants to merge 3 commits into
WICG:mainfrom
xxia2021:xxia-patch-1

Conversation

@xxia2021

@xxia2021 xxia2021 commented Dec 8, 2021

Copy link
Copy Markdown

Fixes #162

Comment thread FLEDGE.md Outdated
'prevWins': [[time1,ad1],[time2,ad2],...],
}
```
* sameSiteInterestGroups: if the user is added to `interestGroup` on a single site, this argement contains a list of all other interest group objects added by that site; if the user is added to `interestGroup` on mutliple sites, this argument will be empty.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Empty as in the empty list?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

argement -> arguement

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed both, thanks Jeff!

@jeffkaufman

Copy link
Copy Markdown
Contributor

I think there is a potential leak here. Imagine I operate sites A and B. On site A I add users to two IGs: IG_BOTH and IG_A. On site B I also add users to two IGs: IG_BOTH and IG_B.

In generateBid for IG_BOTH, my sameSiteInterestGroups will be [] if the user visited both A and B, and [IG_A] or [IG_B] if not. This allows an advertiser to target based on information about more than one site.

(I don't know whether this leak is acceptable, but we should think about it.)

Comment thread FLEDGE.md Outdated
}
```
* sameSiteInterestGroups: if the user is added to `interestGroup` on a single site, this argement contains a list of all other interest group objects added by that site; if the user is added to `interestGroup` on mutliple sites, this argument will be empty.
* sameSiteInterestGroups: if the user is added to `interestGroup` on a single site, this argument contains a list of all other interest group objects added by that site; if the user is added to `interestGroup` on mutliple sites, this argument will be a empty list.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit/typos:

  • Capital I for the first "if"
  • added by that site -> added on that site
  • Instead of the whole phrase "if the user ....", maybe just say "otherwise"?
  • mutliple -> multiple
  • a empty list -> an empty list

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed, thanks.

@jeffkaufman

Copy link
Copy Markdown
Contributor

I think there is a potential leak here...

Actually, this leak exists today with joinCount. Sites can use a first party cookie to ensure they add a user to an interest group exactly once, and then joinCount will tell you how many different sides the user was seen on.

(A buyer could transfer even more information by having site i add a user to an IG exactly 2^i times. If joinCount is not noised then generateBid can see exactly which combination of sites the user visited.)

@xxia2021

Copy link
Copy Markdown
Author

It seems to me the most straightforward solution to address the leak is to restrict each IG to be associated with a single site.

@JensenPaul

Copy link
Copy Markdown
Collaborator

This pull request has been open for a long time but I don't think it addresses my comment. Can I ask that it close it until we have a solution to the issue that I raised?

@JensenPaul JensenPaul added the Non-breaking Feature Request Feature request for functionality unlikely to break backwards compatibility label Jun 23, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Non-breaking Feature Request Feature request for functionality unlikely to break backwards compatibility

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Accessing Interest Groups from the Same Site in FLEDGE

4 participants