00:04:06 betehess has joined #digimarketing 00:23:50 tmichalareas has joined #digimarketing 10:22:30 RRSAgent has joined #digimarketing 10:22:30 logging to http://www.w3.org/2015/09/18-digimarketing-irc 12:57:49 RRSAgent has joined #digimarketing 12:57:49 logging to http://www.w3.org/2015/09/18-digimarketing-irc 12:58:08 Meeting: W3C Web and Digital Marketing Convergence, Day 2 12:58:19 Chair: Chad_Hage, Reza_Jalili 12:58:34 Agenda: https://www.w3.org/2015/digital-marketing-workshop/agenda.html 12:58:53 -> http://www.w3.org/2015/09/17-digimarketing-minutes.html Draft minutes from day 1 12:58:58 rrsagent, draft minutes 12:58:58 I have made the request to generate http://www.w3.org/2015/09/18-digimarketing-minutes.html wseltzer 12:59:05 rrsagent, make logs public 12:59:08 rrsagent, draft minutes 12:59:08 I have made the request to generate http://www.w3.org/2015/09/18-digimarketing-minutes.html wseltzer 13:07:08 tmichalareas has joined #digimarketing 13:18:50 Jinhong has joined #digimarketing 13:20:08 andremafei has joined #digimarketing 13:20:40 Topic: Session 5: Privacy and Identity 13:21:02 brad_at_Trunica has joined #digimarketing 13:21:05 skjung has joined #digimarketing 13:21:41 bhill2 has joined #digimarketing 13:21:50 AshKalb has joined #digimarketing 13:23:19 Sel has joined #digimarketing 13:25:48 Greg's slides: http://www.w3.org/2015/digital-marketing-workshop/slides/norcieDigimarketing.pdf 13:26:16 jarrett has joined #digimarketing 13:26:17 skjung_ has joined #digimarketing 13:26:43 greg: https a baseline for security 13:26:45 greg: mixed content is harmful. 20% of advertisers do not support https 13:26:55 greg: mixed content attack: australian voting site 13:27:22 greg: https supported, but 3rd party javascript used an outdated version of TLS vulnerable to FREAK attack 13:27:36 greg: FREAK attack, renegotiation to export crypto -- crypto weak enough to give to our enemies in the '90s 13:28:01 greg: votes for the australian voting websites coud've been modified 13:29:12 greg: best practices: 1) use HSTS 2) use certificate pinning 3) use TLS not SSL 13:29:43 greg: data breaches due to failure to implement https may be seen as unfair businesspractice under FTC's section 5 authority 13:30:41 greg's slides: http://www.w3.org/2015/digital-marketing-workshop/slides/norcieDigimarketing.pdf 13:30:48 sjung has joined #digimarketing 13:31:13 USEMP Velti slides: http://www.w3.org/2015/digital-marketing-workshop/slides/USEMP-VELTI-privacy-aware%20digital%20marketing.pdf 13:31:55 tmichalareas: USEMP vision for privacy-aware digital marketing 13:32:26 brad_at_trunica has joined #digimarketing 13:32:57 bhill2 has joined #digimarketing 13:33:06 http://www.usemp-project.eu/ 13:33:54 tmichalareas: identified a number of issues around privacy on the internet 13:34:15 tmichalareas: should be developing tools for feedback and control by users 13:34:42 tmichalareas: economic awareness: provide feedback and control to the user about the value of the data they share 13:35:05 tmichalareas: there should be transparency about how they are being targeted 13:36:11 tmichalareas: vision: should be possible to know what personal data is accessible, who is requesting this data and for what purpose 13:37:13 tmichalareas: vision: should be possible to know what the value the data has, should be able to opt-in/out to 3rd parties and to access the derived data (inferences/classifications) relating to his/her profile 13:37:47 tmichalareas: there should be new business models generated where the user is on the receiving end of a financial transaction about their data 13:38:45 tmichalareas: could use DNT to reject ads. interest graph is computed locally by the browser, new targeting happens locally by the browser, ads use this interest graph 13:41:48 keiji has joined #digimarketing 13:43:30 BradIAB has joined #digimarketing 13:47:29 oyiptong: I have code for you, we worked on this 13:47:38 oyiptong: but challenges: how do you expose to the user what they're about to share 13:47:47 ... how do you change as user interests change? 13:48:03 ... how do you prevent advertisers from combinig this info with data they already have? 13:48:27 gnorcie: contractual options 13:48:35 oyiptong: many people don't like the contractual hammer 13:48:38 ... also, it's hard to audit 13:48:54 tmichalareas: deployment model for smart ads could be data never leaves the browser 13:49:17 ... we're going to run a pilot in the next year 13:50:09 BradHill: if you give info to everyone from the browser, you're still sharing with everyone 13:50:24 tmichalareas: if you only share transaction ID 13:50:37 oyiptong: it's very hard to implement client-side decision-making without sharing data 13:51:23 reza: additive suggestion, requires a standard. many tried it, it has tremendous potential 13:53:24 reza: lots of promise in local computing of preferences, connections to schema.org, 13:53:51 stevez: how do you deal with someone who doesn't own a computer; doesn't own a phone; or uses multiple browsers? 13:54:47 tmichalareas: perhaps we start with simple case, separate interest graphs per-browser 13:55:37 stevez: I can record that I purchased something, so I don't keep getting ads for it 13:56:09 BrendanIAB: I've heard several points at which this tech was designed to be inserted: extension, proxy 13:56:26 ... but the way to derive value from data is to prevent others from accruing it 13:56:33 ... so it's antagonistic to business models 13:56:39 ... it's not exactly friendly 13:57:13 ... once you establish buisiness relationships, you have behavioral data in one place, demographic data in another 13:57:25 ... so you have to send your proprietary behavioral algorithms to an untrusted client 13:57:47 ... and/or send non-behavioral data to the client, which you might be prevented from by contract, privacy risk 13:58:06 tmichalareas: it seems we're near a tipping point now regarding tracking 13:59:33 gnorcie: issue of consent, opt-out 13:59:36 greg: consent is important for tracking 14:00:17 greg: fingerprinting/super-cookie are OK in europe, but users need a way to opt out 14:03:05 Saravana has joined #digimarketing 14:05:49 BrendanIAB: companies that are circumventing ad-blocking are seeing higher click-through and conversion rates 14:08:25 Dutta: RTB 2.3 should require TLS on all communications 14:09:54 marktorrance: tipping point for us as DSP was when a major supplier switched to HTTPS (YouTube) 14:21:57 bhill2: RTB spec is IAB's; there are hard latency requirements, and also technical work that can improve the server-server communicaitons 14:22:16 ... there should be an equivalent of istlsfastyet for those measurements and tunings 14:32:04 marktorrance: how could client-side targeting work? At Rocket Fuel, we have 10k ads at one time 14:32:05 BillScannell has joined #digimarketing 14:32:11 ... we're not going to preload all of those 14:32:25 ... and if we don't preload, act of requesting some will leak informaiton 14:32:37 ... so we're going to be on the current system for a while yet 14:32:52 ... rich areas for W3C in standardization, taxonomies, product data 14:34:16 keiji: Thanks! 14:34:35 ... summary of issues: deployment of HTTPS, local-side targeting 14:58:40 BillScannell has joined #digimarketing 15:13:34 Topic: Session 6: Connections 15:13:51 khoya: Kazuhiro Hoya, Fuji Television Network 15:13:59 [slides will be available after] 15:14:33 khoya: Linear TV viewing is still strong 15:16:04 khoya: Over 30Gbits/sec traffic for 7 sec traffic down the streaming service. 15:16:17 khoya: challenge, TV and other viewing devices don't have same tracking ID 15:16:26 khoya: How to link devices with TV is issue. 15:16:56 khoya: TV in Japan has unique serial number that can be obtained in HTTP transaction 15:17:31 khoya: TV has unique serial No., MAC, and old data broad cast tech is being used. 15:18:02 khoya: 1 kb NVRAM data is used as cookie. 15:18:40 khoya: Hybird TV service (2012-) use HTML5 and CSS. 15:19:11 khoya: use Ureg/Greg 16kB each is used. 15:20:12 khoya: How to aggrigate user data. Interactive Content, QR-code, HybridTV. 15:21:21 khoya: Privacy is traumatized issues in Japan. 15:22:02 rrsagent, draft minutes 15:22:02 I have made the request to generate http://www.w3.org/2015/09/18-digimarketing-minutes.html wseltzer 15:22:41 khoya: Intrusive Agreement is another issue. 15:23:27 Sel has joined #digimarketing 15:24:31 khoya: Privacy Agreement Survey shows different kinds of terms and condition were preferd. 15:25:00 khoya: Same Agreement is used for all broadcasters as umbrella. 15:25:23 khoya: umbrella agreement much easier to get people's assent 15:25:32 s/is used/is prefered/ 15:26:42 khoya: Toshiba's TV-Point service, joint project with CCC shoppng point 15:26:56 ... offers mileage points for logging of data 15:27:08 ... non-exclusive agreement for 3d party use. 15:27:13 khoya: CCC/T-point is used as user identifier on TV products from Toshiba with Non-exclusive agreement for 3rd party use. 15:27:20 ... caused problems. 15:28:02 khoya: as broadcasters, we think the stare of the market should improve 15:28:29 jinhong: Jinhong Yang, KAIST 15:28:29 Jinhong: from KAIST presents Content Sharing on Mobile Browser 15:28:51 jinhong's slides: http://www.w3.org/2015/digital-marketing-workshop/slides/PositionPaper_ShareTag.pdf 15:28:55 jinhong: when we share a new on the website. 15:30:16 jinhong: share tag would trigger buttons for users' installed apps 15:31:08 jinhong: proposed idea is to have icons to express services to share user data. 15:32:57 dezell: David Ezell, NACS 15:33:02 dezell's slides: http://www.w3.org/2015/digital-marketing-workshop/slides/DigitalMarketingandPayments.pdf 15:33:18 David: from NACS digital marketing and payment 15:33:23 dezell: about 153,000 retail petroleum outlets, "convenience stores" 15:33:29 ... in the US 15:33:40 David: Review of NACS Industry Requirements 15:33:46 ... many of them single-store operators 15:34:00 s/David/dezell/ 15:34:08 ... digital marketing is really important to brick-and-mortar stores 15:34:34 ... also brands who distribute to convenience stores 15:34:36 dezell: will talk on web payment. 15:34:37 ... Web Payments 15:34:56 dezell: is co-chair of web payment IG. 15:36:39 dezell: mobile wallet, your interface with lots of these technologies 15:37:27 dezell: I'm looking for feedback for the Web Payments group. 15:37:39 dezell: Things have changed marchandize have more channel to their customer. 15:38:15 dezell: Transaction will become more complex, consumer-centric & safer. 15:38:34 dezell: about 153M transactions a day in C-stores; that's opportunities to interact with consumers 15:39:05 dezell: consumer need to be kept impressing. 15:39:43 dezell: consumers don't want yet another single-purpose app 15:40:43 dezell: transaction of the future, you'll get dozens of offers; consumer wants to know, what's the best deal? 15:41:23 dezell: merchants are thinking "own the customer," and "reduce costs" 15:41:38 dezell: merchants want to own their costomer while costomer do not want multiple apps. 15:44:13 dezell: other considerations on payments: what's a legal purchase, an offer, taxation, additional payment methods (SNAP) 15:45:13 dezell: Petroleum cards among the earliest credit cards, loyalty programs 15:46:38 dezell: Flash Foods, centralized loyalty program 15:47:34 ... saved money by establishing own ACH program, that covered the costs of loyalty program. 15:48:43 dezell: digital marketing needs to be able to promote brands, individual products, product categories, individual merchants, payment service providers, and payment schemes 15:49:45 dezell: Digital wallet app require digtal offers to answer their questions. 15:51:15 reza: Connecting digital to the physical world, outside interactions 15:54:49 khoya: T-point is a point program on merchants is now used to link to TV watching behavior data for advertisement. 15:56:08 dezell: Petro pyament now has point system with America express. 15:56:28 BradL: advertising displays at gas stations, why aren't they targeted? 15:56:32 Satya: How TV can detect other devices in house? 15:57:17 khoya: Now we do not have mechanism to link devices may use user ID application can be used. 15:58:01 khoya: T-point may be used to like those costomer devices. 15:59:12 Satya: Amazon has chash back now. Will digital wallet have such function? 15:59:53 dezell: We are now developing use cases that may include such function. 16:01:01 bhill2: "tracking" is fundamental to payments, reducing fraud 16:01:19 ... long precedent of credit card companies selling data offline 16:01:58 bhill: Human tracking and payment is interesting topic what do you think linking those data to advertisement or selling those data. 16:02:25 dezell: MC agreement with merchants says, for any txn in which MC is a party, MC is the sole owner of the data. NACS concerned aobut that. 16:02:38 dezell: People are going to connect those data. 16:03:01 dezell: I donot know what that means. 16:06:02 davidhumpherys: with credit card payments, my data is only as secure as the collection of merchants I've used. What are digital payments doing? 16:06:09 dezell: tokenization 16:06:12 BillScannell has joined #digimarketing 16:06:12 david: how digital wallet can manage trust of merchants. 16:06:52 dezell: We are working on tokenization to protect security of payment. 16:07:20 david: My data will sitll remain on the server side. 16:07:30 s/sitll/still/ 16:07:57 dezell: my definition of credential: a statement of fact 16:08:05 dezell: we work on related issues in credential CG. 16:08:13 ... authentication asymptotically moves toward identity 16:08:36 dezell: credential can be used to prove a fact. 16:09:40 dezell: Authentication is used to authenticate credential that is my understanding that may not be accurate. 16:09:41 bhill2: non-binary approach, does my confidence exceed my risk 16:10:54 wseltzer: differnet groups are using terms in different ways. 16:11:54 ted: IP address is being used as unique identifire. Is it the best way? 16:12:54 khoya: IP address is being shared among differnt users sometimes e.g. in huge apartment. 16:13:30 khoya: It is not accurate so we are not using it as identifier. 16:15:49 wseltzer: How meta-data work with share button on mobile e-mail apprications? 16:16:57 jinhong: User can have applications works on their smartphone to handle user operation. 16:18:18 dutta: Is there any way to link devices used by same user? 16:20:45 khoya: There are no specific technology has been developed. 16:20:50 betehess: re share button, you can use schema.org "share" action 16:21:01 ... maybe need an API to register services 16:21:05 ... but don't need new markup 16:21:29 keiji: UPnP may help to detect other devices on local network. 16:22:25 small clarification: schema:ShareAction doesn't seem to implement the same use-case, but that's the right approach 16:22:41 link http://schema.org/ShareAction 16:32:31 rrsagent, make minutes 16:32:31 I have made the request to generate http://www.w3.org/2015/09/18-digimarketing-minutes.html wseltzer 16:32:38 [lunch] 17:27:48 betehess has joined #digimarketing 17:30:48 betehess_ has joined #digimarketing 17:32:01 keiji has joined #digimarketing 17:35:03 Topic: Running Code 17:35:23 dankaminsky: WhiteOps 17:35:48 sel has joined #digimarketing 17:36:16 dankaminsky: I like the Web! 17:36:50 ... it's always up to date 17:37:02 BillScannell has joined #digimarketing 17:37:20 ... continuous integration 17:37:42 ... that model has now won, to the point that Windows is shipping like web pages 17:38:05 ... Web pages just show up, you don't have to install an app 17:38:11 ... Don't need permission to write a page 17:38:43 ... Independent broker, depends on 17:39:00 ... 1) same-origin policy. You can run anything you want, so long as it's on your own content 17:40:44 ... 2) the web is mostly safe. If you don't like a site, close it 17:41:22 dankaminsky: Malvertising Trap should we block ads? It is not web. 17:42:09 dankaminsky: Off-site navigation is a terrible design. 17:43:58 dankaminsky: demonstration with slightly modified chrome. 17:45:26 [demo of ways to change page element visibility] 17:45:35 [multiply nested iframe] 17:45:49 dankaminsky: You can modify appearance of web window freely. 17:46:41 [now, requestVisibility] 17:47:43 dankaminsky: either you're fully visible, or you're not visible and you know 17:50:12 dankaminsky: We take out image object under layear of iframe. 17:51:54 dankaminsky: I am going to post the code to the chrome engineer forum. 17:53:14 dankaminsky: We made output accessibility on top of existing framework. 17:53:40 dankaminsky: if you have input exclusivity and output visibility, we can start talking about the address bar, indications to user 17:54:12 ... make it easier for users to interact with users in a trusted manner 17:54:21 dankaminsky: Messing address bar is dangerous. We are dangerous persons. 17:55:06 aaa: If widow come from other app does this still protect? 17:56:01 dankaminsky: My assumption is attack from same application(window). 17:56:30 s/aaa/BradL/ 17:56:52 tmichalareas has joined #digimarketing 17:57:10 Andre: If we have multiple frame come from same window what happen? 17:57:19 dankaminsky: It is undefined. 17:58:39 dankaminsky: iframe is all around web being used various purposes. 18:00:00 BrendanIAB: Viewability can be access from parent window? 18:01:39 dankaminsky: Parent can know their child works normal. We can detect attacks ageinst the frames. 18:02:36 dankaminsky: timestamp is not moving. 18:03:27 mark: does filter still work on top of the frame? 18:04:18 dankaminsky: if it is unmodified it works. 18:04:48 dankaminsky: you can do what you want in the iframe, it won't be affected by what else is sent 18:05:15 marktorrance: much ad tech goes through multiple intermediaries. who should use ironframe? 18:05:31 dankaminsky: nested ironframe needs to specced out 18:05:51 marktorrance: what's the path forward? standards? 18:05:51 mark: does this work only on chrome? 18:06:08 dankaminksy: after 15 years, I finally joined a standards body 18:06:27 s/mark:/marktorrance:/ 18:07:15 dankaminsky: ancestorOrigins is part of the spec plan 18:07:24 dankaminksy: working with browser vendors and working for standardization as well. 18:12:11 jwold: I'm going to demo Ad-ID, download XMP, add it to some assets 18:13:08 jwold: We have authentication model id/password on https. 18:15:20 jwold: we have concepts of groups and accounts. 18:16:53 jwold: explains function of ad-ID management system. 18:18:50 jwold: This works would be based on contract. 18:19:30 jwold: I am making meta-data for ad-ID management. 18:23:14 [demo of the Ad-ID metadata creation] 18:32:30 keiji has joined #digimarketing 18:35:51 jwold: I made a demo how we can make systems to exchange meta-data with standardized way. 18:36:47 jworld: product ID can be stored but not associated with anything here. 18:37:41 wseltzer: we would like to discuss what would be next by reviewing what we had done this two days. 18:39:04 dezell: We may need to form IG or CG. 18:39:52 dezell: UI and web accessibility is important issue we should work on. 18:43:47 bbb: we need to way to control user tracking like standard for script to announce its purpose. 18:44:48 ccc: feature like sandbox and UI are important. 18:45:33 reza: browser support is necessary. 18:47:37 s/bbb/BradL/ 18:49:07 alex: standard for data sharing scaling, social search may be needed. 18:49:48 wisegirl has joined #digimarketing 18:51:58 Andre: topcs blocking, measuring, isolation etc may be need to disucss. Do not know where is the appropriate to discuss on those issues. 18:52:49 wseltzer: way to have more little data may be required. 18:53:30 chad: we need to distinguish bot from others. 18:55:41 chad: Authenticity is important for anti-bot, anti-malvertisement. 18:56:15 ddd: we need to identify good practices. 18:57:55 BrendanIAB: We have been talking on giving users more choices but publishers do not have chance to indicate their preferences. 18:58:39 BrendanIAB: How site can express their preference may be needed. 18:59:16 dankaminsky: What kind of Internet/Web we would like to provide is the key issue. 19:03:35 BradL: security and performance are key issues. 19:05:23 chad: feedback for retargeting may be useful. 19:06:53 Amazon is trying to avoid to give feedback because that may leak user’s privacy. 19:07:19 bhill: : Amazon is trying to avoid to give feedback because that may leak user’s privacy. 19:09:00 bhill: it is difficult to give feedback while protecting user’s privacy. 19:10:06 dutta: We should think from what we want. 19:15:55 wseltzer: iron frame concept is comming to W3C web app security working group. If you are interested in you can participate. 19:16:33 wseltzer: sandboxing is also things we may work on. 19:18:08 wseltzer: Server side ad stitching and https (server-server) are other topics need to be solved. 19:19:45 bill: isolation and federated contents 19:19:57 s/bill/bhill/ 19:21:25 dankaminsky: cross origin resouce integrity is hard to manage. Server side integration may work well. 19:23:14 BrendanIAB: responsibility issue (root of trust) have to be solved to have single stream of contents. 19:24:22 dankaminsky: I would like to think network channel and security channel separatedly. 19:28:35 keiji: client side (local) targeting is a topic many people are interested in. 19:31:48 Andre: Tracking interaction 19:32:51 BrendanIAB: IAB has API for ads on video 19:35:54 wseltzer: we may be able launch a community group to identify needs of new standards. 19:37:35 wseltzer: Web Payment activity may be related to your needs in some aspect so we encourrage you to participate. 19:38:39 wseltzer: linking local devices and users may be another required feature. 19:40:33 wseltzer: Web payment -> payment IG 19:41:09 wseltzer: sanbox -> webApp sec wg 19:43:26 eee: security / Malvertising and data collection should be considered differently. 19:44:24 wseltzer: we need to cooperatively work on these issues. 19:46:14 wseltzer: user agent support for marketing -> CG 19:48:12 wseltzer: permissions/requests -> WebAppSec WG(API) + permission CG 19:52:37 ;-) -> wseltzer 19:58:11 wseltzer: data sharing, sclaeing, social sarch, inter-op action -> scheme.org for marketing?? 19:59:56 rrsagent, make minutes 19:59:56 I have made the request to generate http://www.w3.org/2015/09/18-digimarketing-minutes.html wseltzer 20:06:16 wseltzer: Thanks to Chad and Nielsen for hosting in great facilities 20:06:28 ... Thanks to Reza for co-chairing and Adobe's sponsorship 20:06:49 ... and thanks to all participants and Program Committee 20:06:53 [adjourned] 20:07:02 rrsagent, make minutes 20:07:02 I have made the request to generate http://www.w3.org/2015/09/18-digimarketing-minutes.html wseltzer 20:07:30 trackbot, end meeting 21:01:27 betehess has joined #digimarketing 22:21:42 scribes: keiji, oyiptong, wseltzer 22:22:19 rrsagent, list attendees 22:22:19 I'm logging. I don't understand 'list attendees', wseltzer. Try /msg RRSAgent help 22:22:30 rrsagent, make minutes 22:22:30 I have made the request to generate http://www.w3.org/2015/09/18-digimarketing-minutes.html wseltzer 22:23:01 i|https a baseline|scribenick: oyiptong 22:23:54 i|dankaminsky: We take out image|scribenick: keiji 22:23:58 rrsagent, make minutes 22:23:58 I have made the request to generate http://www.w3.org/2015/09/18-digimarketing-minutes.html wseltzer 22:24:40 i|I have code for you|scribenick: wseltzer 22:24:42 rrsagent, make minutes 22:24:42 I have made the request to generate http://www.w3.org/2015/09/18-digimarketing-minutes.html wseltzer 23:53:28 bhill2 has joined #digimarketing