5 ms·
This is neither advanced nor denanonymization (sic). They basically pluck an interesting route from the hotmap (as per other people's recent discovery), preten
by abcd_f 9y ago
This is neither advanced nor denanonymization (sic).
They basically pluck an interesting route from the hotmap (as per other people's recent discovery), pretend that they have also run/biked this route and Strava will show them names of others who run/biked the same way. That's clever, but that's not "advanced" by any means.
It's also not a deanonymization as there's really no option in Strava for public _anonymous_ sharing to begin with.
- wallace_f 9y agoThis is a good example to bring up when people talk about a digital bill of rights. It fundamentally shouldn't be so easy to undermine individual privacy and military op sec, but when you allow private data to be shared recklessly, you get that.
- maxerickson 9y agoIndividual privacy is the issue. Op sec is the military's problem.
- wallace_f 9y agoI agree, but what I'm saying is that it's not at all "advanced deanonymization" skills that's a problem. It's the default standars way we share data is capable of undermining privacy, and even military op sec, quite easily, that needs to be changed.
- drstewart 9y agoStrava is opt-in, so I don't know what default standards you mean. You can track activities on other platforms that aren't designed to be social networks.
- maxerickson 9y agoI think I haven't come to a conclusion about it, but I think it is more complicated than Strava just being opt-in. This op-ed makes the argument that it is difficult for users and even the companies offering services to fully understand the impact of their privacy choices: https://www.nytimes.com/2018/01/30/opinion/strava-privacy.html https://www.nytimes.com/2018/01/30/opinion/strava-privacy.ht... A sort of concrete scenario here would be the app asking the user before uploading an activity and whether the user wants the activity and segments to be visible on the public parts of the service. Strava probably doesn't want to introduce that friction into their product, but maybe that is a better balance than having a setting allowing users to opt out.
- contender_x 9y agoIt's too complex, and to keep a govt/ site secure, you'd need every person who runs round it to keep their info locked down. I think Strava will end up having specific "national-state privacy zones" where no runs ever appear in heatmaps and segments cannot be created
- radix07 9y agoThere is a pretty accessible and obvious checkbox on every activity to make it private if you wish.
- wallace_f 9y agoImagine every car accident was treated with the same attitude: "the car has breaks and a steering wheel so I don't know what your problem is." People make mistakes, do things by accident. If the conequences are this bad, we should question the standards which led us to them.
- nradov 9y agoUnlike Facebook, Strava has no "real name" policy so you can be as anonymous as you want.
- jarito 9y agoThis doesn't really seem to be enough. The combination of home / work location and friends is likely enough to allow for the determination of identity, even if you use a fake name on the site.
- nradov 9y agoIt's easy to set privacy zones around home, work, or any other location. And you're not required to have any friends (followers). Activities can also be hidden from the public and made visible only to followers.
- macintux 9y agoThe author covered privacy zones and hidden activities. Neither are as secure as one would hope: privacy zones can be reverse-engineered fairly easily, and private activities can still be leaked.
- mbesto 9y agoYa, I've always been wary of privacy zones' effectiveness, to the extent that I simply just keep the feature off.
- contender_x 9y agoActivities marked as "Private" Don't leak. But in "enhanced privacy" mode your activities can be seen via the segment leaderboards. In any declared privacy zone, you stay off those boards, irrespective of options, and (allegedly) heatmaps. So really, it's "slightly more advanced privacy"
- dracoXT 9y ago
- fortythirteen 9y agoThe best hacks always appear overly simple, or even slightly benign, once explained. You could potentially use the hack the author explained with one of those possible black-sites in Africa to see who's deployed there. A little more research and you can find their home address in the states. Now, tell me an enterprising counter-intel or terrorist organization wouldn't want that info.
- dawhizkid 9y agoI wonder why Uber/Lyft/Waze don't have a feature like this for ridesharing. Seems like it would be useful to find commuters going on the same commute each day.
- contender_x 9y agoI'd say it's advanced in terms of "escalating heatmap information into identifying people running round a submarine base". Yes, you can (should!) use aliases there, at which point the people stay anonymous. Except: in the screenshot I have of that segment before I deleted it, only 2 of the 16 people don't use full names.