7 ms·

For what it's worth, the most private data here is shared to analytics companies for Grindr's only analytical use. My guess is that Grindr's agreement with Appt

by morley 9y ago

For what it's worth, the most private data here is shared to analytics companies for Grindr's only analytical use. My guess is that Grindr's agreement with Apptimize and Localytics asks for the strictest possible protection of that data. If anyone at Apptimize or Localytics has access to that data, I'd be incredibly surprised. This sort of deal isn't the same as sharing the HIV status to Google or Facebook so that advertisers can target or exclude that user information for the purposes of advertising. For people who think this is still wrong, I'm curious what their pragmatic alternative is. How else are app developers supposed to analyze their app performance? The open source, self-hosted pickings are slim. (I can only think of Piwik, which in my experience has a dated feature set and severe performance issues.) Not everyone can afford to perform their own product analysis. Using a third-party analytics saas is kind of the only way to go and seems like a reasonable tradeoff of security for product visibility.

lawnchair_larry 9y ago
As someone who has been working in security for a long time, and has seen how the sausage is made at even the biggest, most reputable companies who “take security very seriously”, the “strictest possible protection of that data” means approximately nothing. The only serious way to protect sensitive data is not to take it in the first place. Hell, not even the NSA can keep a lid on their sensitive data. ”For people who think this is still wrong, I'm curious what their pragmatic alternative is. How else are app developers supposed to analyze their app performance?” Remember, customers first, your “needs” come second. That goes double when they are placing their trust in you by allowing you to be a custodian of their data. Not long ago, desktop software phoning home would have been a scandal. Not long before that, it was offline and couldn’t phone home. Yet, we still had software. Unfortunately, developers have taken the slipperly slope all the way to outright abuse of their privileges in order to collect information that customers don’t know about or understand. This has led us to things like GDPR. It doesn’t matter if your intentions are good or your usage is benign. It isn’t yours to begin with, those aren’t your decisions to make, and developers need to learn to seriously respect that.
hackcasual 9y ago
They have the option of not sending HIV status to any third party.
- geofft 9y ago
  What is the privacy distinction between a third party with a contractual agreement and an employee with a contractual agreement? Remember that Russian intelligence got a spy hired by Microsoft: https://www.theguardian.com/technology/2010/jul/14/russian-spy-worked-for-microsoft https://www.theguardian.com/technology/2010/jul/14/russian-s... Will your interview questions find a foreign spy, or someone who isn't even a spy but is interested in looking at private data for personal amusement?
  - madeofpalk 9y ago
    What? How about "lets just not spend medically sensitive information to third party services"
    - geofft 9y ago
      That seems reasonable, but can we also say, let's not send medically sensiive information to every employee at the first party?
    - kayfox 9y ago
      You could not fill out that part of the profile.
  - mtgx 9y ago
    If Microsoft implemented proper security policies, I imagine that guy didn't have access to all of Microsoft's user data. So that would be the main difference. Virtually all of a company's employees shouldn't have access to user data at all, and those that do would only have access to parts of it.
    - yodon 9y ago
      >If Microsoft implemented proper security policies, I imagine that guy didn't have access to all of Microsoft's user data. This is precisely the sort of thing Microsoft takes incredibly seriously internally. Tim Cook may be a more vocal spokesman for treating user data with care but Microsoft is fanatical about it internally. They recognize the risk they face in the event of compromise and have made just enough mistakes in the past to appreciate how hard it is to actually protect their customers’ information.
shadowtree 9y ago
Why do you need to share HIV/status as part of performance analysis of a web portal or app?
- mackey 9y ago
  So it looks like the requests go to profile.localytics.com which is the API used for https://www.localytics.com/profiles/ https://www.localytics.com/profiles/. So not used for performance, but instead "A people-centered and personalized approach to app marketing and analytics". I am not sure if this is better or worse.
- wiiner 9y ago
  Drugs marketing, supplements? I'm sure there's stuff you can sell more easilly to HIV positive people.
jrlocke 9y ago
The reasonable tradeoff, in this case, would be to continue using the third-party analytics saas, but exclude personally identifiable information, or at the very least, exclude this extremely sensitive information.
- morley 9y ago
  I think it depends on your reasoning for not sharing data to third parties. It seems like you're arguing that sharing data is wrong because, in the wrong hands, the data could be used to personally identify someone. In my mind, these are the ways that can happen: 1. The data is sent to an advertiser who can target based on that data. Seems possible, so it's relevant that this data isn't being shared with an ad firm. 2. The data is sent to a third party, whose employees can access and leak the data. 3. The data is sent to a third party, whose data gets compromised. So the trade-off is, what is the value of having user information in a tool for analytics purposes, versus the chance that (2) or (3) (or any unknowns happen)? My argument is that analytics firms are not in the business of leaking or selling data; their business hinges on their client's data privacy. So to me, this seems like a reasonable trade-off for certain types of data. As for whether HIV status is the type of data that's unreasonable... I can buy that argument either way. I've never used Grindr but I can imagine it being extremely relevant to its users. And any data that has product impact is useful in an analytics setting. For example, if Grindr has some features that make it easier for HIV-positive or negative people to filter, then they'd be interested in understanding whether it's being used in the product. Then again, I can equally see them deciding it's not worth the risk, and removing it. If you think sharing sensitive data is wrong under all circumstances, on principle, then you're entitled to your beliefs, but that would seem to me awfully close to religion.
icelancer 9y ago
>>For people who think this is still wrong, I'm curious what their pragmatic alternative is. Use the services you mentioned but DO NOT SEND HIV DATA TO THE ANALYTICS COMPANIES. Holy hell, how hard is that? Just omit that part.
- kayfox 9y ago
  Or just don't fill out that part of your profile.
  - DoofusOfDeath 9y ago
    Or don't use Grindr.
  - loufe 9y ago
    If one is HIV positive it would probably be a draw of the app to find only others who are also afflicted. Turning it off might result in some illegal decisions.
    - kayfox 9y ago
      Illegal how?
      - throwawayfinal 9y ago
        Depends on the state. The majority of states either have laws relating to disclosing known STDs or laws specifically about disclosing known HIV status, or both.
      - getsugablitz2 9y ago
        I believe in certain places that if you withhold the information of being HIV positive from someone you have sex with and infect them, it's a pretty serious crime. I think it might even be a crime if you don't infect them.
      - bzbarsky 9y ago
88e282102ae2e5b 9y ago
> Not everyone can afford to perform their own product analysis. Just because ethical behavior is expensive doesn't mean you have a license to do whatever you want.
- DoofusOfDeath 9y ago
  I don't think you'll find total agreement on what behavior is considered ethical, particularly in this product space.
arrosenberg 9y ago
This type of data is already protected under HIPAA and HITECH. Expand those protections to cover non-providers.
philipodonnell 9y ago
> My guess is that Grindr's agreement with Apptimize and Localytics asks for the strictest possible protection of that data. If anyone at Apptimize or Localytics has access to that data, I'd be incredibly surprised. Honest question, are you in the SAAS analytics industry or is anyone else that can comment on this? I am not (though I do do data work) and I would actually be surprised if the SAAS company _didn't_ have access to the data. That would require some kind of dedicated setup so that Grindr's data was not at rest with other company's data which is a) super expensive, b) no reason to expect that the SAAS company would not have access for maintenance/troubleshooting and c) kind of defeats the purpose of using SAAS.
- hilbertseries 9y ago
  For startups of their sizes, it's unlikely they have strict data controls. So, probably anyone working on the product side of things, support, engineering, services, has access to their analytics data. Basically, most of the company likely has access to that data. Grindr really shouldn't be sending that data to their analytics providers.
decebalus1 9y ago
1) At least don't send any personal data over http. It's 2018 for fucks sake. I can't believe there are companies out there with such a hand-wavy approach to this. Is it so hard to do https in this day and age? It's so basic wrt to a security audit, my head hurts. The fact that extra data is sent over https shows that they made an active decision to partition this data into non-important/important. 2) Just don't fucking send it to a third party. Every single time you do that you yield control over the data, introduce another party to the mechanics thus doubling the risk of disclosure and they you cry 'breach of trust'. > Not everyone can afford to perform their own product analysis. Then don't do it and don't store sensitive information. You're taking on a risk and if you don't have the money to roll your own analytics then you probably don't belong on the market. This is no longer a playground, this is the real world, especially for this kind of information. People can get killed based on Grindr leaks. It's the big boys game and if you don't have the backing, you shouldn't play in the first place. And this app specifically should not have any problems with funding, give me a break.
wackspurt 9y ago
(Copy-pasting the message I already posted in this thread. Seems more relevant here) I think that adoption of privacy preserving data aggregation/analysis will become the norm. The most immediate applications are 1) telemetry data that is used for monitoring (for example, Google Chrome uses differential privacy for collecting this data), and, 2) services like Google Maps and Tinder-like dating apps. In these applications, essential user information can be represented as integer/boolean values (is user present in location X? True or False. how old is the user? device CPU usage right now? ...) Based on my limited understanding* of differential privacy, it falls short on exactness (of aggregate values) and robustness (against malicious clients). I've lately been studying the literature on function secret sharing and I think it is a better alternative to DP. Take this paper: https://www.henrycg.com/files/academic/pres/nsdi17prio-slide... https://www.henrycg.com/files/academic/pres/nsdi17prio-slide.... Prio: Private, Robust and Scalable Computation of Aggregate Statistics Data collection and aggregation is performed by multiple servers. Every user splits up her response into multiple shares and sends one share to each server. I've understood how private sums can be computed. Let me explain it with a straw-man scheme. Example (slide 26): x_1 (user 1 is on Bay Bridge):- true == 1 == 15 + (-12) + (-2) x_2 (user 2 is on Bay Bridge):- false == 1 == (-10) + 7 + 3 ... If all users send shares of their data to the servers in this manner AND as long as at least one server doesn't reveal the identities of the people who sent it responses, the servers can exchange the sum of the shares they've received. Adding the three responses will allow the servers to infer that there are _ number of users on Bay Bridge without revealing their identities. This system can be made robust by using Secret-shared non-interactive proofs (SNIPs). This allows servers to test if Valid(X) holds without leaking X. The authors also bring up the literature on computing interesting aggregates using private sums: average, variance, most popular (approx.), min and max (approx.), quality of regression model R^2, least-squares regression, stochastic gradient descent. Bottom line: I found the discussion on deployment scenarios very interesting. Data servers with jurisdictional/geographical diversity, app store-app developer collaborations for eliminating risk in telemetry data analysis, enterprises contracting with external auditors for analyzing customer data, etc. * - I understand the randomized response and, to some extent, the RAPPOR technique (used for collecting Chrome telemetry data) but the other literature in that community goes over my head. * * - This technique is a black box to me at the moment.
gorkemcetin 9y ago
> How else are app developers supposed to analyze their app performance? The open source, self-hosted pickings are slim There is Countly Enterprise Edition for this purpose (both mobile and web). Privacy focusing and on-prem installation.

by morley 9y ago

lawnchair_larry 9y ago

As someone who has been working in security for a long time, and has seen how the sausage is made at even the biggest, most reputable companies who “take security very seriously”, the “strictest possible protection of that data” means approximately nothing. The only serious way to protect sensitive data is not to take it in the first place. Hell, not even the NSA can keep a lid on their sensitive data. ”For people who think this is still wrong, I'm curious what their pragmatic alternative is. How else are app developers supposed to analyze their app performance?” Remember, customers first, your “needs” come second. That goes double when they are placing their trust in you by allowing you to be a custodian of their data. Not long ago, desktop software phoning home would have been a scandal. Not long before that, it was offline and couldn’t phone home. Yet, we still had software. Unfortunately, developers have taken the slipperly slope all the way to outright abuse of their privileges in order to collect information that customers don’t know about or understand. This has led us to things like GDPR. It doesn’t matter if your intentions are good or your usage is benign. It isn’t yours to begin with, those aren’t your decisions to make, and developers need to learn to seriously respect that.

hackcasual 9y ago

They have the option of not sending HIV status to any third party.

geofft 9y ago
What is the privacy distinction between a third party with a contractual agreement and an employee with a contractual agreement? Remember that Russian intelligence got a spy hired by Microsoft: https://www.theguardian.com/technology/2010/jul/14/russian-spy-worked-for-microsoft https://www.theguardian.com/technology/2010/jul/14/russian-s... Will your interview questions find a foreign spy, or someone who isn't even a spy but is interested in looking at private data for personal amusement?
- madeofpalk 9y ago
  What? How about "lets just not spend medically sensitive information to third party services"
  - geofft 9y ago
    That seems reasonable, but can we also say, let's not send medically sensiive information to every employee at the first party?
  - kayfox 9y ago
    You could not fill out that part of the profile.
- mtgx 9y ago
  If Microsoft implemented proper security policies, I imagine that guy didn't have access to all of Microsoft's user data. So that would be the main difference. Virtually all of a company's employees shouldn't have access to user data at all, and those that do would only have access to parts of it.
  - yodon 9y ago
    >If Microsoft implemented proper security policies, I imagine that guy didn't have access to all of Microsoft's user data. This is precisely the sort of thing Microsoft takes incredibly seriously internally. Tim Cook may be a more vocal spokesman for treating user data with care but Microsoft is fanatical about it internally. They recognize the risk they face in the event of compromise and have made just enough mistakes in the past to appreciate how hard it is to actually protect their customers’ information.

shadowtree 9y ago

Why do you need to share HIV/status as part of performance analysis of a web portal or app?

mackey 9y ago
So it looks like the requests go to profile.localytics.com which is the API used for https://www.localytics.com/profiles/ https://www.localytics.com/profiles/. So not used for performance, but instead "A people-centered and personalized approach to app marketing and analytics". I am not sure if this is better or worse.
wiiner 9y ago
Drugs marketing, supplements? I'm sure there's stuff you can sell more easilly to HIV positive people.

jrlocke 9y ago

The reasonable tradeoff, in this case, would be to continue using the third-party analytics saas, but exclude personally identifiable information, or at the very least, exclude this extremely sensitive information.

morley 9y ago
I think it depends on your reasoning for not sharing data to third parties. It seems like you're arguing that sharing data is wrong because, in the wrong hands, the data could be used to personally identify someone. In my mind, these are the ways that can happen: 1. The data is sent to an advertiser who can target based on that data. Seems possible, so it's relevant that this data isn't being shared with an ad firm. 2. The data is sent to a third party, whose employees can access and leak the data. 3. The data is sent to a third party, whose data gets compromised. So the trade-off is, what is the value of having user information in a tool for analytics purposes, versus the chance that (2) or (3) (or any unknowns happen)? My argument is that analytics firms are not in the business of leaking or selling data; their business hinges on their client's data privacy. So to me, this seems like a reasonable trade-off for certain types of data. As for whether HIV status is the type of data that's unreasonable... I can buy that argument either way. I've never used Grindr but I can imagine it being extremely relevant to its users. And any data that has product impact is useful in an analytics setting. For example, if Grindr has some features that make it easier for HIV-positive or negative people to filter, then they'd be interested in understanding whether it's being used in the product. Then again, I can equally see them deciding it's not worth the risk, and removing it. If you think sharing sensitive data is wrong under all circumstances, on principle, then you're entitled to your beliefs, but that would seem to me awfully close to religion.

icelancer 9y ago

>>For people who think this is still wrong, I'm curious what their pragmatic alternative is. Use the services you mentioned but DO NOT SEND HIV DATA TO THE ANALYTICS COMPANIES. Holy hell, how hard is that? Just omit that part.

kayfox 9y ago
Or just don't fill out that part of your profile.
- DoofusOfDeath 9y ago
  Or don't use Grindr.
- loufe 9y ago
  If one is HIV positive it would probably be a draw of the app to find only others who are also afflicted. Turning it off might result in some illegal decisions.
  - kayfox 9y ago
    Illegal how?
    - throwawayfinal 9y ago
      Depends on the state. The majority of states either have laws relating to disclosing known STDs or laws specifically about disclosing known HIV status, or both.
    - getsugablitz2 9y ago
      I believe in certain places that if you withhold the information of being HIV positive from someone you have sex with and infect them, it's a pretty serious crime. I think it might even be a crime if you don't infect them.
    - bzbarsky 9y ago

88e282102ae2e5b 9y ago

> Not everyone can afford to perform their own product analysis. Just because ethical behavior is expensive doesn't mean you have a license to do whatever you want.

DoofusOfDeath 9y ago
I don't think you'll find total agreement on what behavior is considered ethical, particularly in this product space.

arrosenberg 9y ago

This type of data is already protected under HIPAA and HITECH. Expand those protections to cover non-providers.

philipodonnell 9y ago

> My guess is that Grindr's agreement with Apptimize and Localytics asks for the strictest possible protection of that data. If anyone at Apptimize or Localytics has access to that data, I'd be incredibly surprised. Honest question, are you in the SAAS analytics industry or is anyone else that can comment on this? I am not (though I do do data work) and I would actually be surprised if the SAAS company _didn't_ have access to the data. That would require some kind of dedicated setup so that Grindr's data was not at rest with other company's data which is a) super expensive, b) no reason to expect that the SAAS company would not have access for maintenance/troubleshooting and c) kind of defeats the purpose of using SAAS.

hilbertseries 9y ago
For startups of their sizes, it's unlikely they have strict data controls. So, probably anyone working on the product side of things, support, engineering, services, has access to their analytics data. Basically, most of the company likely has access to that data. Grindr really shouldn't be sending that data to their analytics providers.

decebalus1 9y ago

1) At least don't send any personal data over http. It's 2018 for fucks sake. I can't believe there are companies out there with such a hand-wavy approach to this. Is it so hard to do https in this day and age? It's so basic wrt to a security audit, my head hurts. The fact that extra data is sent over https shows that they made an active decision to partition this data into non-important/important. 2) Just don't fucking send it to a third party. Every single time you do that you yield control over the data, introduce another party to the mechanics thus doubling the risk of disclosure and they you cry 'breach of trust'. > Not everyone can afford to perform their own product analysis. Then don't do it and don't store sensitive information. You're taking on a risk and if you don't have the money to roll your own analytics then you probably don't belong on the market. This is no longer a playground, this is the real world, especially for this kind of information. People can get killed based on Grindr leaks. It's the big boys game and if you don't have the backing, you shouldn't play in the first place. And this app specifically should not have any problems with funding, give me a break.

wackspurt 9y ago

(Copy-pasting the message I already posted in this thread. Seems more relevant here) I think that adoption of privacy preserving data aggregation/analysis will become the norm. The most immediate applications are 1) telemetry data that is used for monitoring (for example, Google Chrome uses differential privacy for collecting this data), and, 2) services like Google Maps and Tinder-like dating apps. In these applications, essential user information can be represented as integer/boolean values (is user present in location X? True or False. how old is the user? device CPU usage right now? ...) Based on my limited understanding* of differential privacy, it falls short on exactness (of aggregate values) and robustness (against malicious clients). I've lately been studying the literature on function secret sharing and I think it is a better alternative to DP. Take this paper: https://www.henrycg.com/files/academic/pres/nsdi17prio-slide... https://www.henrycg.com/files/academic/pres/nsdi17prio-slide.... Prio: Private, Robust and Scalable Computation of Aggregate Statistics Data collection and aggregation is performed by multiple servers. Every user splits up her response into multiple shares and sends one share to each server. I've understood how private sums can be computed. Let me explain it with a straw-man scheme. Example (slide 26): x_1 (user 1 is on Bay Bridge):- true == 1 == 15 + (-12) + (-2) x_2 (user 2 is on Bay Bridge):- false == 1 == (-10) + 7 + 3 ... If all users send shares of their data to the servers in this manner AND as long as at least one server doesn't reveal the identities of the people who sent it responses, the servers can exchange the sum of the shares they've received. Adding the three responses will allow the servers to infer that there are _ number of users on Bay Bridge without revealing their identities. This system can be made robust by using Secret-shared non-interactive proofs (SNIPs). This allows servers to test if Valid(X) holds without leaking X. The authors also bring up the literature on computing interesting aggregates using private sums: average, variance, most popular (approx.), min and max (approx.), quality of regression model R^2, least-squares regression, stochastic gradient descent. Bottom line: I found the discussion on deployment scenarios very interesting. Data servers with jurisdictional/geographical diversity, app store-app developer collaborations for eliminating risk in telemetry data analysis, enterprises contracting with external auditors for analyzing customer data, etc. * - I understand the randomized response and, to some extent, the RAPPOR technique (used for collecting Chrome telemetry data) but the other literature in that community goes over my head. * * - This technique is a black box to me at the moment.

gorkemcetin 9y ago

> How else are app developers supposed to analyze their app performance? The open source, self-hosted pickings are slim There is Countly Enterprise Edition for this purpose (both mobile and web). Privacy focusing and on-prem installation.