4 ms·
I think they upload the hashes of emails they have, and facebook matches it with the hashes of the emails it has.
by ssvss 8y ago
I think they upload the hashes of emails they have, and facebook matches it with the hashes of the emails it has.
- deleted 8y ago[deleted]
- omeid2 8y agoIn some jurisdictions, that is still, rightly so, considered PII.
- shostack 8y agoCan you share a link with info on some of those specific jurisdictions?
- omeid2 8y agoEuro/GDPR: https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly. The keyword here is indirectly. Australia: https://www.legislation.gov.au/Details/C2019C00025 https://www.legislation.gov.au/Details/C2019C00025 personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable. (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not. The keyword here "reasonably identifiable". So if the purpose of an email hash is to identify me for ads targeting, then it is by definition reasonably identifying me, even if indirectly.
- Jonanin 8y agoIn what way is a cryptographic hash of your email personally identifiable?
- jobigoud 8y agoIf it's not salted and the other site has the same information they can identify you. For example Google Analytics prevents you from uploading hashed emails because it makes them capable of identifying the person and link it new info with all the existing info they have.
- omeid2 8y agoif the purpose of an email hash is to identify me for ads targeting, then it is by definition reasonably identifying me, even if indirectly.
- pdkl95 8y agoDJB on hashing identifying information[1]: > Hashing is magic crypto pixie-dust, which takes personally identifiable information and makes it incomprehensible to the marketing department. When a marketing person looks at random letters and numbers they have no idea what it means. They can't imagine that anybody could possibly understand the information, reverse the hash, correlate the hashes, track them, save them, record them. [1] https://projectbullrun.org/surveillance/2015/video-2015.html#bernstein https://projectbullrun.org/surveillance/2015/video-2015.html...
- omeid2 8y agoIn other words, the fact that it is cryptographically derived from the email is irrelevant. What makes an email PII is not the content of it, because outside of some rare names or personal/family domains, knowing John Doe who uses Yahoo is not enough to identify a person. What makes email address and other unique identifiers like a hash of an email PII is that the given universally unique composition of letters and symbols is associated with a person. john.doe@example.com -> a facebook profile -> Legal Person 836f82d......b39577f -> a facebook profile -> legal person. For identifying a person both 836f82d......b39577f and john.doe@example.com are the same.