4 ms·

Do European Union users have a recourse against this? Or do they have to create an account, then request a deletion?

jacquesm 9y ago
By law you should but it will be an uphill battle. Technically each and every advertising agency that creates a profile on you, gives you a cookie and stores your IP address is in violation of the law. (IP addresses count as PII, Personally Identifiable Information). I don't see the legal hammer coming down on the advertising industry (of which Facebook and Google are the major players) any time soon if ever.
- poooogles 9y ago
  >IP addresses count as PII, Personally Identifiable Information. One way hashed (that can't be rainbow tabled) are not however PII afaik however, so it's quite easy to turn an IP address into a "net location ID" or something similar that can't be tracked back to a physical IP for analytics.
  - jacquesm 9y ago
    You could simply enumerate all 32 bits and end up with each and every IP reversed so that trick doesn't really hold water. No need for rainbow tables, the search space is small enough to brute force.
    - poooogles 9y ago
      Enumeration through 32 bits of bcrypt doesn't sound that feasible to me. Given a GPU farm however I'm sure it might be feasible. However at that point surely you just add a salt?
      - drdaeman 9y ago
        It's enumeration through 32 bits of 0-4294967295. There are only so much IPv4 addresses. If you add a salt, then that "net location ID" becomes of very limited use. You won't be able to grep through the logs for request from specific IP, you won't be able to tell how many distinct IPs are accessing your services, etc etc. The only use I can see is keeping it in the session to check if IP address had changed, as a security measure.
      - jacquesm 9y ago
        If you're going to add a unique salt every operation you just destroyed the value of that IP address for tracking purposes. Which was the whole point of the discussion to begin with. By your scheme you might as well store a random number. So, either you store the IP in such a way that you can later re-associate a new call with the previous IP or you might as well not have it.
      - moefh 9y ago
        > However at that point surely you just add a salt? How would that work? You'd have to use the same salt for every IP (which completely negates any benefit of the salt), otherwise how do you know that bcrypt(salt_1, IP_1), which you stored in your database yesterday, refers to the same IP as bcrypt(salt_2, IP_1) that you stored a month ago?
- deleted 9y ago
  [deleted]
- deleted 9y ago
  [deleted]
Mosi1 9y ago
They can use the Russian or Chinese social networks.
zmb_ 9y ago
In principle yes, in practice Facebook does not follow the EU laws. For example, they are required to provide you with all the data they hold about you. I requested this data (shadow profile) from them multiple times, they never responded. The next step would be to contact the Irish authorities responsible for overseeing FB, but from what I read they don't process complaints against FB, and the next place would be some EU court to force them to do their job.
- bigbugbag 9y ago
  Facebook sometimes submit to European laws. Facebook turned off their facial recognition after Germany made it illegal, registered used data has been made available for download among a few other cases. Recently Facebook got fined 110 millions by France for lying to antitrust regulators during the vetting of the whatsapp deal, a few days before it got fined the maximum of 150k euros for repeated infringement to local privacy laws (maximum has since been raised to a percentage of the worlwide revenue) and a few days later it got a 3 millions fine in Italy for a similar privacy offense. I'm not sure shadow profiles are covered by the legal obligation as facebook never acknowledged the existence of those for they are illegal in the EU. More about the difficulties and process to get your data from facebook here: http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data_.html http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data...
Msurrow 9y ago
With the new EU Data Protection Directive[1], I think they do, since the DPD covers not only EU based companies, but also any company that provides services for EU citizens in the EU (so, Facebook, LinkedIn etc. are covered by this..but also e.g. your little weather app). The new DPD is very strict, but there are two parts of the directive that a particularly interesting: - The Data Portability concept: A company covered by the DPD is required to deliver to the user all data the company has on the user, in a standardised format. That means Facebook now has to hand out all your data (information, pics, likes, posts,...) for you to use freely - also in other services. I think this in effect means you own your data. I'm excited to see the effect of this one. - The right to be forgotten: A company is required to delete all data they have on a user, if the user requests. Actually, if the user invokes this right, the company is not allowed make public, <b>store or process</b> any data related to the user. From what I hear in discussions between american colleagues, american companies have no clue whats about to hit them. I know there is a mild panic here in Denmark, and the DPD is the most talked about subject in IT at the moment - and we've always been rather anal with the privacy stuff (e.g. cookie-law). Edit: Oh, I forgot the fun part; this gets a lot of attention due to the sizes of the fines companies get for not adhering to the directive. Fines are up to EUR 20.000.000 or 4% of the company's global annual revenue, whichever is higher. Facebook made USD27.638.000.000 in 2016, so thats a fine of USD1.105.520.000 for not playing nice. [1]: http://ec.europa.eu/justice/data-protection/reform/index_en.htm http://ec.europa.eu/justice/data-protection/reform/index_en....
- bjelkeman-again 9y ago
  I foresee a long drawn out nasty international legal fight about this. In the same way the EU authorities have been very weak dealing with the car companies and emissions e.g. dieselgate, the US authorities refuse to see the problem with privacy and data. The governments are going to blame each other for stifling competition (companies from their country) etc. I think the practices of online tracking joined up with offline tracking, as Google is now doing is going to be forbidden unless you consent. https://www.washingtonpost.com/news/the-switch/wp/2017/05/23/google-now-knows-when-you-are-at-a-cash-register-and-how-much-you-are-spending/?utm_term=.777026bc2468 https://www.washingtonpost.com/news/the-switch/wp/2017/05/23...

By law you should but it will be an uphill battle. Technically each and every advertising agency that creates a profile on you, gives you a cookie and stores your IP address is in violation of the law. (IP addresses count as PII, Personally Identifiable Information). I don't see the legal hammer coming down on the advertising industry (of which Facebook and Google are the major players) any time soon if ever.

poooogles 9y ago
>IP addresses count as PII, Personally Identifiable Information. One way hashed (that can't be rainbow tabled) are not however PII afaik however, so it's quite easy to turn an IP address into a "net location ID" or something similar that can't be tracked back to a physical IP for analytics.
- jacquesm 9y ago
  You could simply enumerate all 32 bits and end up with each and every IP reversed so that trick doesn't really hold water. No need for rainbow tables, the search space is small enough to brute force.
  - poooogles 9y ago
    Enumeration through 32 bits of bcrypt doesn't sound that feasible to me. Given a GPU farm however I'm sure it might be feasible. However at that point surely you just add a salt?
    - drdaeman 9y ago
      It's enumeration through 32 bits of 0-4294967295. There are only so much IPv4 addresses. If you add a salt, then that "net location ID" becomes of very limited use. You won't be able to grep through the logs for request from specific IP, you won't be able to tell how many distinct IPs are accessing your services, etc etc. The only use I can see is keeping it in the session to check if IP address had changed, as a security measure.
    - jacquesm 9y ago
      If you're going to add a unique salt every operation you just destroyed the value of that IP address for tracking purposes. Which was the whole point of the discussion to begin with. By your scheme you might as well store a random number. So, either you store the IP in such a way that you can later re-associate a new call with the previous IP or you might as well not have it.
    - moefh 9y ago
      > However at that point surely you just add a salt? How would that work? You'd have to use the same salt for every IP (which completely negates any benefit of the salt), otherwise how do you know that bcrypt(salt_1, IP_1), which you stored in your database yesterday, refers to the same IP as bcrypt(salt_2, IP_1) that you stored a month ago?
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]

Mosi1 9y ago

They can use the Russian or Chinese social networks.

zmb_ 9y ago

In principle yes, in practice Facebook does not follow the EU laws. For example, they are required to provide you with all the data they hold about you. I requested this data (shadow profile) from them multiple times, they never responded. The next step would be to contact the Irish authorities responsible for overseeing FB, but from what I read they don't process complaints against FB, and the next place would be some EU court to force them to do their job.

bigbugbag 9y ago
Facebook sometimes submit to European laws. Facebook turned off their facial recognition after Germany made it illegal, registered used data has been made available for download among a few other cases. Recently Facebook got fined 110 millions by France for lying to antitrust regulators during the vetting of the whatsapp deal, a few days before it got fined the maximum of 150k euros for repeated infringement to local privacy laws (maximum has since been raised to a percentage of the worlwide revenue) and a few days later it got a 3 millions fine in Italy for a similar privacy offense. I'm not sure shadow profiles are covered by the legal obligation as facebook never acknowledged the existence of those for they are illegal in the EU. More about the difficulties and process to get your data from facebook here: http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data_.html http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data...

Msurrow 9y ago

With the new EU Data Protection Directive[1], I think they do, since the DPD covers not only EU based companies, but also any company that provides services for EU citizens in the EU (so, Facebook, LinkedIn etc. are covered by this..but also e.g. your little weather app). The new DPD is very strict, but there are two parts of the directive that a particularly interesting: - The Data Portability concept: A company covered by the DPD is required to deliver to the user all data the company has on the user, in a standardised format. That means Facebook now has to hand out all your data (information, pics, likes, posts,...) for you to use freely - also in other services. I think this in effect means you own your data. I'm excited to see the effect of this one. - The right to be forgotten: A company is required to delete all data they have on a user, if the user requests. Actually, if the user invokes this right, the company is not allowed make public, <b>store or process</b> any data related to the user. From what I hear in discussions between american colleagues, american companies have no clue whats about to hit them. I know there is a mild panic here in Denmark, and the DPD is the most talked about subject in IT at the moment - and we've always been rather anal with the privacy stuff (e.g. cookie-law). Edit: Oh, I forgot the fun part; this gets a lot of attention due to the sizes of the fines companies get for not adhering to the directive. Fines are up to EUR 20.000.000 or 4% of the company's global annual revenue, whichever is higher. Facebook made USD27.638.000.000 in 2016, so thats a fine of USD1.105.520.000 for not playing nice. [1]: http://ec.europa.eu/justice/data-protection/reform/index_en.htm http://ec.europa.eu/justice/data-protection/reform/index_en....

bjelkeman-again 9y ago
I foresee a long drawn out nasty international legal fight about this. In the same way the EU authorities have been very weak dealing with the car companies and emissions e.g. dieselgate, the US authorities refuse to see the problem with privacy and data. The governments are going to blame each other for stifling competition (companies from their country) etc. I think the practices of online tracking joined up with offline tracking, as Google is now doing is going to be forbidden unless you consent. https://www.washingtonpost.com/news/the-switch/wp/2017/05/23/google-now-knows-when-you-are-at-a-cash-register-and-how-much-you-are-spending/?utm_term=.777026bc2468 https://www.washingtonpost.com/news/the-switch/wp/2017/05/23...