THWANGO

×

THWANGO: a technical overview

Advertising today works because somebody holds both halves of the picture: who you are, and what you were shown. THWANGO keeps the targeting and makes that join structurally unavailable to every party in the chain. This is a taster. There is a great deal more in the filings.

The partition

One rule runs through everything: the party that knows the recipient does not know the content, and the party that knows the content does not know the recipient. The recipient-knowing party verifies the device, meters it and strips network metadata, but sees only ciphertext. The content-knowing party decrypts the profile for an instant, runs the auction and encrypts the winner, and holds no device value, no user identity, no publisher identity and no page address. The two are operated by independent parties and are barred from common control. The property holds however many parties the roles are divided among.

The return path is sealed the same way. The device generates a fresh keypair for each impression, and the winning creative is encrypted to it, so the advertisement travels back through the recipient-knowing party as ciphertext. That party never learns which advertisement the user received, and nor does the publisher. Not every such step is strictly required by the guarantee; the design keeps every party as dark to every other as it can, on the principle that what is not held cannot be leaked, subpoenaed or repurposed.

Separation of that kind needs operators who are actually separate, so the arrangement requires an Advertiser Node and a Publisher Node, each run independently of us and of each other. Thort Werx holds the user node. Neither of the other two has been appointed yet, and expressions of interest from prospective operators are welcome: an operator takes the benefit of the patent portfolio under licence, and our support in standing a node up.

The rendezvous

The publisher mints an opaque value for each impression and sends it two ways at once: one half with the page category up the supply path, the other half inside a sealed envelope from the device. The content-knowing party joins the two halves on that value. It ties publisher to ad, ad to page, device to delivered ad, and delivered impression to publisher payment, yet each party holds only its own link in the chain, and the chain as a whole is assembled by no party. A binder derived from a publisher secret travels with it, so two publishers minting the same value simply fail to join rather than cross-deliver.

The envelope

The device signs, inside a hardware-protected key facility, a single message binding the impression value, the time, a counter, an epoch tag, a tier statement, a frequency sketch, a fresh public key, the encrypted profile and the encrypted slot manifest. Nothing in it can be altered, replayed or recombined. It is the means by which the device asserts eligibility without asserting identity. The agent declines to sign at all if the timestamp falls outside an attested screen-on window, and that check runs on the device, before anything is sent.

Metering without an identifier

The epoch tag is a function of the device key and the current epoch. Within an epoch a device always yields the same tag, so it can be counted, rate-limited and de-duplicated. Across epochs the tags of one device are cryptographically unlinkable, so no longitudinal record accumulates. A monotonic counter rides every envelope: two envelopes with the same value are self-evidently duplicates, a lower value proves rollback, and the rate is checkable against the budget, without any server-side database beyond a high-water mark. The device also keeps a local ledger of ordinary-use signals, which never leaves it, and emits only a sealed tier.

The profile, and where it exists

Attributes are curated by the user, who can see, edit and delete them. They are coarsened to a shared vocabulary of buckets chosen so that any emitted profile is common to at least a threshold number of users, padded to uniform size, and released per impression as only the subset relevant to the page. In the preferred arrangement the profile exists in plaintext in two places only: the device, and transiently inside the content-knowing party during selection, which destroys it on selection. Declared attributes outrank inference, on the ground that inference is necessarily lossy and may be stale.

No bid request is ever broadcast

Advertisers lodge creative, bid, targeting and budget in advance. At impression time no request for a bid, and no information about the impression, reaches any advertiser or demand-side party. Losing campaigns learn nothing, including that it happened. Compare the prevailing arrangement, in which the context of an impression is broadcast to hundreds of bidders for every ad you see.

Lodging in advance does not leave an advertiser in the dark. What it removes is the impression-time broadcast, not the market information. Through the console an advertiser sees the range of bids in play, recent clearing prices, its fill rate and how many bids it is competing against, and what a campaign would need to change to start winning: the bid, the targeting, the pacing, the evidence grade it is prepared to accept. That is the ordinary feedback of a market, published about the market rather than about any person, and it arrives without a single impression being described to anybody.

A further rung sends the device a price-resolved set of candidates and lets the device choose among them against the whole profile, which then never leaves it in any form. Money questions close at the content-knowing party; taste questions close at the device; neither can reach the other’s question.

The browsing record that is never assembled

A clear page address at the recipient-knowing party would put “this device was at that site at that time” in one place, which is a browsing history by another name. In the preferred arrangement the envelope carries no page address at all. The agent enforces the user’s consent scope itself and binds that into what it signs, and none of the recipient-side checks require knowing the property. The filing puts it exactly: a browsing history of the recipient exists nowhere in the arrangement, not as a protected record but as a record never assembled.

Proving the ad was actually shown

A creative is not re-encoded. Instead, positions are selected within its rendered form and a pad is derived backwards from it, so that reading those positions and combining them yields a required value. Any creative becomes a render-gated value dispenser after the fact, fresh per impression, at no re-encoding cost. The positions and the pad are never in page-visible memory.

Evidence grades in tiers: requested by an eligible device, delivered and decoded, rendered and tamper-evident, dwelled for a schedule of time slices, attended by a present human. Settlement follows the highest tier evidenced. Dwell is anchored to visible time, the window opening only when the slot enters the viewport on a lit foreground display. So an advertisement never scrolled into view cannot be billed as seen, because the evidence of being seen never came into existence. That inverts the prevailing practice of billing on service and arguing viewability afterwards.

The filings are candid about the limit. Because the device holds the creative bytes, any pixel function of them is computable without a display, so the software tiers prove rendering-equivalent computation under a secret, time-gated selection inside an attested, budgeted, metered device. That is enough to annihilate fetch-and-discard, blocked, scaled-to-nothing and tampered-composite fraud, and to price dedicated fraud at the full cost of really rasterising every impression. Confirmation of photons on glass is expressly reserved to the hardware extension, which is THWIXEL: pixels read at scanout, dwell counted in display refresh cycles. The double bind there is neat. Fraudulent pixels rendered only off screen never reach the glass and are silently refused; fraudulent pixels forced to the glass to be validated become visible to the human and expose the infection.

Fraud detection that its attacker cannot read

Prevailing anti-fraud systems run inside the rendering context, where an adversary can read the code, learn exactly what is measured and simulate exactly that. They are legible to their attackers by construction. Here the positions and pads are never in page memory, the analytic composition is server-side and unobservable, and the device-side checks run before anything is emitted, so an adversary sees only that an envelope was or was not signed, never which rule fired. Probing the live configuration costs genuine attested impressions from genuine devices, so each probe bears roughly the cost of the fraud it would enable, while rotation of the secrets is free and needs no client redeployment. The opacity conceals method, never people.

Failures are never visited on the viewer

No failure mode produces a blank slot, a broken layout or a creative that does not fit. Any failed check fills the slot with a neutral house creative of the right dimensions, pre-cached on the device, so even total unreachability of the intermediaries leaves the page undisturbed. Filler carries no settlement: it pays no publisher and bills no advertiser, so deliberately engineering integrity failures yields no revenue by construction.

KeyGate: content that arrives already unusable

Selected portions of a document are delivered in a state in which they cannot be used, the rest arriving normally. A carrier, usually the advertisement, is conditioned in advance so that its decoded values are known. The device reads values from the carrier as decoded, at positions determined for that occasion, and forms the key. The same values that unlock the content evidence that the carrier was handled: earning the key and taking the advertisement are one event.

The point is structural rather than adversarial. Removing the protection removes the path to the content, rather than removing a guard standing in front of content that is already usable. Nothing needs to detect a blocker, identify it, disable it or tell a blocking device from a non-blocking one, and detection is a contest that can be lost, since by the time detection happens the content is already present in usable form. Every delivery is gated; there is no lighter path for a reader who merely appears not to be blocking.

What follows from it: a paywall alternative, where a publisher accepts the handling of a gating signal in place of payment from the large majority who decline to pay and today produce no revenue while still costing money to serve; metering held by the party that releases the keys rather than in a cookie a reader can clear; and the ad-blocking cohort, commercially valuable and largely unreachable, becoming a class of inventory that can be priced and sold, identified as a class by the circumstance without any member of it being identified. The same slot shows a different advertisement, not more of them.

It also addresses why people block in the first place. Creative is sanitised before delivery by allowance rather than prohibition: what is recognised as needed for presentation is kept and everything else is simply absent, so unknown or novel misbehaviour is closed structurally rather than by a list. Every advertisement so prepared is sanitised, whether or not the reader would have blocked it.

Why a user would cooperate

Everything above is machinery. It exists to make one conversation possible: asking a person to tell us something about themselves.

That is normally an unreasonable thing to ask, because it cannot be honoured. A user who supplies a demographic detail today has no idea where it goes afterwards, and nobody can credibly promise otherwise, because in a conventional pipeline the promise rests entirely on the future conduct of whoever ends up holding the data. A policy is a statement of intention, and intentions change hands when companies do.

Here the promise is structural, and it can be demonstrated rather than asserted. Whatever a user chooses to supply, item by item, either stays on their device under their control, or is made available transiently to a party which has no means of associating it with them. Not a party that undertakes not to. A party that cannot. That is a claim which survives being checked, and a user can be shown why.

Because it can be demonstrated, it can be asked for, and it is worth asking for: information a person gives deliberately is better than information inferred about them, inference being lossy and often stale. So there is something on offer in return: a share of what the advertising earns; Something Useful, our facility for keeping an advertisement and getting back to it later; and real control over what is delivered, which formats and behaviours are permitted, how often, and of what kind. Per-item limits are binding at the device rather than advisory. The user is a participant in this arrangement rather than its subject.

There is a further point, and it may be the most commercially important of all. Privacy legislation in a growing number of countries is moving in exactly this direction: collect less, keep it for a stated purpose, do not join it up, be able to show what you did. Conventional advertising meets those obligations by policy, process and undertaking, which is expensive to run, expensive to audit and fragile under change. This arrangement meets them by construction: there is no joined record to minimise, no identity to purpose-limit, and each restricted serving is already recorded with its clearance grade, so compliance is demonstrable per impression without any record identifying a person or a device. A regime that is presently a cost and a risk to everybody else is, here, simply how the thing works.

Keeping an advertisement you liked

An item carries an identity that is the same for every recipient, for the life of the item. One tap keeps it. Recall is by identity alone: the item comes back on its own, without the page it was on, without that page’s resources, and without anything else the user did not ask for. Because the identity is common to all recipients, the party recalling it is anonymous within the set of everyone who received it, and possession of the identity is itself proof of prior receipt. Counting works by simple equality on the identity, so occurrences can be counted while holding nothing that refers to a user.

This runs from an ordinary hyperlink, requiring nothing installed and working wherever links work, up through page script, an extension that belongs to the user rather than to the page, a share target, and finally a vault inside secure hardware that a compromised host cannot read, alter, delete or even enumerate. Each rung is complete in itself and a user can move up or down, exporting the vault as a user right rather than a migration project. At recall, a further item may be presented alongside, chosen by the tags of the item recalled, and therefore directed at an interest the user declared by saving, with no profile of the user involved at all.

Paying instead of watching

A user may elect to receive content without advertising. The auction runs anyway and clears a price; no advertisement is delivered; the user is billed a function of the cleared price plus a disclosed publisher margin; and the publisher settles on the same impression value as it would have done. No demand-side party learns the election occurred: an unserved impression is indistinguishable from one it did not win. Nor can the price be gamed, because no bidder knows at bidding time which impressions will be skipped, so inflating a bid to raise the skipper’s price risks winning and being billed for a real delivery it valued less. The same uncertainty that makes a sealed auction truthful makes the election price honest. The price is honest and the payer is unknown.

Settlement that reconciles at every granularity

In conventional arrangements each intermediary reports its own figures, adjacent parties do not reconcile, and a material portion of advertiser spend is unaccounted for between the paying and receiving ends. Here the content-knowing party publishes a signed commitment over confirmed impressions and amounts, such that the inclusion or absence of any one can be proved without revealing the rest. The recipient-knowing party publishes an independent transit count carrying no identity, no content, no publisher and no amount, which bounds the number of settleable impressions by an independent witness. Total billed less total disbursed must equal the declared share and no other amount, and the check can be run by any party, for any period and any subdivision, at any time, so there is no subdivision at which misdeclaration is safe.

A publisher too small to audit a large settling party on its own gets the same arithmetic proof from a neutral verifier acting at scale. Campaign funds sit with an escrow party independent of everyone, so the party running the selection holds no custody of the money its selections allocate.

Assurance, inverted

Third-party verification today works by putting measurement code inside delivered pages and watching each user’s device. Here every figure an assurance party needs is produced as signed, committed or aggregate evidence, so assurance runs with no code of the assurance party on any user device and no user datum disclosed. It may run its own properties and its own devices through the live system and verify both ends from its own custody. The accuracy of assurance improves, rather than degrades, as the privacy protections strengthen, because the evidence is cryptographic rather than observational.

Remarketing with the surveillance subtracted

The one conduct these approaches usually cannot supply is showing an advertisement to a merchant’s own prior visitors, which today is done by cross-site identification. Here the merchant signs an audience token on its own property; the device records it subject to the user’s sight, veto and per-source disablement; and the envelope may carry a sealed indicator conveying only that the impression matches the audience, and nothing of when, where or how the membership arose. The merchant knows its own visitor, as it already lawfully does, and learns nothing of any later impression. Cross-site identification is used at no step.

Restricted categories, default deny

Alcohol, gambling, tobacco, weapons, therapeutic goods, financial products, electoral matter: a creative bearing a restriction class is ineligible unless the impression affirmatively carries matching clearance. Absence of information is absence of clearance. One consequence falls out without anybody configuring it: because the least-enrolled audience conveys the least information, the strictest treatment attaches to the audience we know least about. Each restricted serving is recorded with its clearance source and grade, so compliance is demonstrable per impression without any record identifying a person or a device.

Deployable now, hardening later

The same function runs at four depths: in-page script, a privileged web context or extension, the rendering engine below the script runtime, and an independent processing component with its own path to the display glass. Each level is independently deployable, each stage independently operable, and the user-facing behaviour is the same at every level. Nothing is bound to a single mandatory secure element. The network behaviour of the lower stages is unchanged by the higher ones, so what runs on ordinary devices today hardens at the glass when THWIXEL ships.

Why this can undermine the status quo

Put the pieces together and every party in the chain is better off than it is now.

Add THWIXEL and the last piece arrives: whatever the user keeps on their own device goes into a safe in the secure processor rather than sitting in host storage where any compromise of the operating system reaches it. The advertiser gets certainty that the advertisement reached the glass, and pays more for certainty than for a number it has to take on trust. The publisher earns more from fewer advertisements, because each one is worth more and nothing is taken out of the payment before it arrives. The user is paid, is shown less, and decides what kind of thing they are shown.

None of that depends on anyone behaving well. It depends on the parties being separated so that misbehaviour has nothing to work with.

Provisional applications covering content protection with selective user gating, user-controlled storage of displayed advertising, selective content management, targeted advertising without user identification, and ad attestation with paywall and adblocker mitigation. The full IP list ›