1425325 - Gmail seem to have figured a way to bypass adblocking/anti-tracking

Status: RESOLVED INVALID

(WebExtensions :: Untriaged, defect, P3)

Description

[Nima Fatemi]

Attachment: gmail ad.png

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:57.0) Gecko/20100101 Firefox/57.0
Build ID: 20171128222554

Steps to reproduce:

I have Firefox 57.0.1 (64-bit) for macOS in private mode, I've also enabled the Tracking Protection through preferences and it's set to "Always". I also have Privacy Badger installed.

Logged in Gmail and have manually set "googleads.g.doubleclick.net" and "googleads.g.doubleclick.net" (which seem to be the only 3rd party addresses loaded on gmail) set to block, previously.



Actual results:

Seems like gmail has already found a way to bypass this protection. And I see an ad loaded on the interface. Screenshot is attached.


Expected results:

The ad should have been blocked from loading.

Comment 1

[Nima Fatemi]

I see a network request being sent to https://clients5.google.com/ads/measurement/jn/jn.js getting a '200 OK' status.

and another one to https://clients5.google.com/ads/measurement/jn/?hd=mail.google.com which gets '304 Not Modified'.

Comment 2

[Ethan Tseng [:ethan]]

According to the reporter, Google had a new tracking technology to circumvent Tracking Protection.
Francois, do you know who is the best person to triage this bug?

Comment 3

[François Marier [:francois]]

Tracking Protection itself is only meant to block third-party tracking. We have an entity list to group related domains together. That allows us to treat domains owned by the same organization (e.g. GMail and Doubleclick are both Google) as effectively first-party (for the purpose of deciding whether or not to block it using Tracking Protection).

If AdblockPlus / uBlock Origin can't block it then there might be a problem with the WebExtension API it uses.

Comment 4

[Andrew Swan [:aswan]]

(In reply to François Marier [:francois] from comment #3)
> If AdblockPlus / uBlock Origin can't block it then there might be a problem
> with the WebExtension API it uses.

The original report does not say anything about ABP or uBlock (though it does mention Privacy Badger).

Its unclear from the original report though, were you expecting this element to be blocked by the built-in tracking protection or by Privacy Badger?

Comment 5

[Nima Fatemi]

(In reply to Andrew Swan [:aswan] from comment #4)
> Its unclear from the original report though, were you expecting this element
> to be blocked by the built-in tracking protection or by Privacy Badger?

Well, the built-in tracking protection advertise itself as this:

"Tracking is the collection of your browsing data across multiple websites. Tracking can be used to build a profile and display content based on your browsing and personal information. Use Tracking Protection to block known trackers"

Google ads and DoubleClick are globally known trackers, so I expect that to be blocked by this feature. And generally speaking, this feature is being marketed as an AdBlocker, not 3rd/4th party ad blocker. I assume one of the reasons FF incorporated this feature was so people wouldn't need ADP, uBlock or any other 3rd party tool -which have access to people's browsing habits- anymore.

I was a little surprised that neither Tracking Protection nor Privacy Badger managed to block those ads, hence this ticket. Google and Facebook are the biggest corps who do the most thorough analysis of the users' behavior through ads -which makes things very creepy often- so as a user I'd be slightly disappointed if this feature won't block their "first party" tracking and ads.

I hope it makes sense. Thanks for all the good work and happy holidays :)

Comment 6

[Andrew Swan [:aswan]]

Comment 3 explains why tracking protection doesn't block these requests.  If you think there's something more to discuss there, please move this bug back to the Tracking Protection component and re-open it.
As for Privacy Badger, you can raise issues at its bug tracker: https://github.com/EFForg/privacybadger/issues