A system includes a television executing a discoverable service thereon to provide a communication, and a device residing in a same private network of a computer network as the television. The device is configured to constrain an executable environment in a security sandbox, execute a sandboxed program in the executable environment, use a pseudonym of a user, and call a discovery agent to find the discoverable service of the television within the same private network in accordance with the communication. The device and the television are associated by way of the sandboxed program and the discoverable service using at least the communication from the discoverable service within the same private network. The system also includes a targeting system to receive the pseudonym, identify the user of the device using the pseudonym, and target advertising to the identified user of the device using the sandboxed program and/or the discoverable service.