4 ms·

I don't want to use a session cookie with an ID to link all events. I don't want any ID because I could potentially link those ID together in the back end based

I don't want to use a session cookie with an ID to link all events. I don't want any ID because I could potentially link those ID together in the back end based on IP (I don't, but I want people not to have to trust me). I want to make sure I don't get any data that my system could use wrong.

JadeNB 8y ago
I think that the problem is, while you have near-total control over the information you collect, and can carefully consider its interactions, you have no control over the interaction of your information with other publicly available information. For example, the famous AOL de-anonymisation (https://techcrunch.com/2006/08/06/aol-proudly-releases-massive-amounts-of-user-search-data https://techcrunch.com/2006/08/06/aol-proudly-releases-massi...) did not (I think it is accurate to say) rely on any metadata attached to the queries, only to the queries themselves.
- harianus 8y ago
  While I can understand this being true for AOL: > The data includes personal names, addresses, social security numbers and everything else someone might type into a search box. I don't think I have a similar issue with page views of one website of one session. I strip all query params and only save the hostname and path of the URL. I think it's nearly impossible to ever link that to a user. Maybe if you have very little amount of users, but then still you don't get personal info.
  - chatmasta 8y ago
    Why do you consider the path of the URL to be any less sensitive than the query parameters? Many websites use dynamic paths that may as well be query parameters.
    - harianus 8y ago
      We are going way off topic here, too bad there is not even one answer to my question: > Do you think this is acceptable from a privacy perspective? But back to your point. Query params contain usually tokens, search queries, and id's. This is not so much the case for paths. I think you agree with that. But indeed, paths can have sensitive information too. How would you prevent that data to be sent to my server?
      - chatmasta 8y ago
        Maybe you should allow the user to provide some sort of regex mask on URLs, or some sort of rule engine for which parts to keep or strip.
vokep 8y ago
I think maybe a good way to go is a compromise - Since you're already taking efforts to protect privacy without needing to trust you, thats already a good start. But maybe you need some kind of ID to tie behavior together, so you do record one temporarily, until you've processed it into an aggregate (anonymized individual behaviors) Basically, train a machine learning model on the data of invididuals. You don't want to overfit or that could be de-anonymizable, but a slightly underfit model could capture most of the important patterns, while throwing out most of any identifying aspects. The hard part then becomes finding a way to demonstrate this actually is happening so that you can be trusted. Unfortunately I can't think of a provable way, since you pretty much either can track users by IDs or not. And if you do..then trust has to be assumed
- harianus 8y ago
  But with my solution in the main Ask HN I don't need any ID. So why should I not do it that way?

JadeNB 8y ago

I think that the problem is, while you have near-total control over the information you collect, and can carefully consider its interactions, you have no control over the interaction of your information with other publicly available information. For example, the famous AOL de-anonymisation (https://techcrunch.com/2006/08/06/aol-proudly-releases-massive-amounts-of-user-search-data https://techcrunch.com/2006/08/06/aol-proudly-releases-massi...) did not (I think it is accurate to say) rely on any metadata attached to the queries, only to the queries themselves.

harianus 8y ago
While I can understand this being true for AOL: > The data includes personal names, addresses, social security numbers and everything else someone might type into a search box. I don't think I have a similar issue with page views of one website of one session. I strip all query params and only save the hostname and path of the URL. I think it's nearly impossible to ever link that to a user. Maybe if you have very little amount of users, but then still you don't get personal info.
- chatmasta 8y ago
  Why do you consider the path of the URL to be any less sensitive than the query parameters? Many websites use dynamic paths that may as well be query parameters.
  - harianus 8y ago
    We are going way off topic here, too bad there is not even one answer to my question: > Do you think this is acceptable from a privacy perspective? But back to your point. Query params contain usually tokens, search queries, and id's. This is not so much the case for paths. I think you agree with that. But indeed, paths can have sensitive information too. How would you prevent that data to be sent to my server?
    - chatmasta 8y ago
      Maybe you should allow the user to provide some sort of regex mask on URLs, or some sort of rule engine for which parts to keep or strip.

vokep 8y ago

I think maybe a good way to go is a compromise - Since you're already taking efforts to protect privacy without needing to trust you, thats already a good start. But maybe you need some kind of ID to tie behavior together, so you do record one temporarily, until you've processed it into an aggregate (anonymized individual behaviors) Basically, train a machine learning model on the data of invididuals. You don't want to overfit or that could be de-anonymizable, but a slightly underfit model could capture most of the important patterns, while throwing out most of any identifying aspects. The hard part then becomes finding a way to demonstrate this actually is happening so that you can be trusted. Unfortunately I can't think of a provable way, since you pretty much either can track users by IDs or not. And if you do..then trust has to be assumed

harianus 8y ago
But with my solution in the main Ask HN I don't need any ID. So why should I not do it that way?