5 ms·
I've read a couple articles and haven't seen any details about how they're going to apply DP (differential privacy). It's important to clearly distinguish what
by bo1024 10y ago
I've read a couple articles and haven't seen any details about how they're going to apply DP (differential privacy).
It's important to clearly distinguish what DP can and cannot do. DP is just a technique for taking a database and outputting some statistic or fact about it. The output has some noise added to it.
The guarantee of DP is (roughly) that anyone looking at the output alone won't learn much about anyone in the database. This also holds for anything you do with that statistic.
Think about this carefully when thinking about what DP does and doesn't promise. Also think about the difference between "privacy" and "security".
Example of what DP does protect against: If Apple is recommending products to people based on others' download habits, and this recommendation is based on differentially private statistics, then no other user or group of users can infer anything about my downloads. In fact, even engineers at Apple, if they can only see the statistics and not the original database, cannot infer anything about my downloads.
Example of what DP does not protect against: government accessing the data. The database still has to exist on Apple's servers. The government can get to it just as easily as before via warrants or so on. DP is not cryptography.
My assessment: On one hand it is awesome that Apple is taking a lead in using differential privacy and thinking about mathematical approaches to privacy. On the other, there are many facets of privacy and right now I think people are more concerned about security of their data and privacy from the government, or else privacy from companies like Apple itself. DP doesn't address these; it only addresses the case where Apple has a bunch of data and wants the algorithms it runs not to leak much info about that data to the world at large.
- frankmcsherry 10y ago> The database still has to exist on Apple's servers. It doesn't, which is part of the reason Apple wants to do this. You can still do differential privacy without collecting all the data, you just get less accurate results. See page 232 in [1], re "The Local Model". [1]: http://www.cis.upenn.edu/~aaroth/Papers/privacybook.pdf http://www.cis.upenn.edu/~aaroth/Papers/privacybook.pdf Edit: the article even says this down when it talks about RAPPOR.
- conradev 10y agoEven though the technique doesn't require collecting all of the data, Apple still does collect a huge well of data. They store all iCloud sync material (backups, photos, contacts, calendars, mail, documents, etc.) without end to end encryption, and have all of the iMessage metadata.
- Twisell 10y agoThis is so wrong. The only thing that isn't user-encrypted so far is the iPhone backup on their server (Of course it is encrypted but Apple have the key to decrypt it as needed). The official explanation so far is that if the user forgot the password a user-encrypted backup would just become some useless junk. This is (officially) the sole remaining non user-encrypted personal data on apple server that authority can reclaim using a warrant. However after San Bernardino FBI mess, Apple start considering to also encrypt iCloud backup. So if you think you are right, proofs please...
- singularity2001 10y agoThe burden of proof should be on Apple's site. Given their secrecy all you can do is pray or switch to open source.
- Twisell 10y agoAlternatively you can also RTFM before complaining about secrecy... https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf Of course that will never be as audit friendly as an Open-Source code. But don't call it a secret, while you actually just didn't search for the information...
- corv 10y agoAre you saying Notes, Safari Bookmarks, Photos, etc are encrypted on iCloud? How come they are accessible from iCloud.com? Decrypted by the browser on the fly?
- deleted 10y ago[deleted]
- arnarbi 10y ago> The output has some noise added to it. You can also add noise to the input samples, so your database doesn't contain statistically significant information about any single individual. But aggregate queries will work as the noise evens out. See http://research.google.com/pubs/pub42852.html http://research.google.com/pubs/pub42852.html Edit: Just saw that the linked article actually explains this in the last section as well.