5 ms·

Privacy or Data, a Convenient False Dichotomy

77 points by __ka 7y ago

gfawke5 7y ago
seems to be like day 2 of the advent. from day 1: The world needs more search engines [1]. [1] https://www.0x65.dev/blog/2019-12-01/the-world-needs-cliqz-the-world-needs-more-search-engines.html https://www.0x65.dev/blog/2019-12-01/the-world-needs-cliqz-t...
- pythux 7y ago
  Indeed, the idea is to use each day until Christmas to unveil a new post about search, privacy and security. Today is about opening a discussion about data collection practices. It's often presented as a "all or nothing" (more often than not it's "nothing"). But data is needed to create independent and viable alternatives to the giants so maybe there is a middle ground if it's done with privacy at heart from the ground up. Edit: For those curious about the details, we've started a new page where we gather research, talks and blog posts from the past about these topics: https://0x65.dev/pages/dissemination-cliqz.html https://0x65.dev/pages/dissemination-cliqz.html
nocturnial 7y ago
> Let us start with the need for data, going straight to the point: one cannot build a competitive search without data collected from people. Google had a very good search engine before they started to collect data from everyone, not after. I don't have a metric to decide whether the search results from google got better or worse over the years. Subjectively and for me personally, they've gotten worse. And I'm not the only one who thinks this. I could be (and probably am) wrong, but I think the more personal data a search engine has, the worse the results. When I think about it in that way, it makes senses why it has gotten worse. The search engine pays more attention to the data it think it has collected from me and how it relates to advertisers, etc... instead of paying attention to the actual words I wrote in the query.
- chrmod 7y ago
  Probably lots of people remember the good old days of Google Advance Search. Or the ability to fine tune the results with special operators like +, -, site:, etc. It was probably 2010 when we started to talk about filter bubbles and how "smart" algorithms adjust the data to our liking. No one even though about disasters like Cambridge Analitica. As those days are long gone, there is perspective that is not purely negative. IMAO modern search engines are more approachable. They are easier than ever to use. Specifically for people that don't necessarily know how or have patience to learn how to use it. We are power users and often forget that most people don't have to be ones. They just want to search. Therefore approach that Cliqz takes to its data collection makes even more sense. What Human Web does is extraction of common knowledge (or sense) on what does Web mean to people. Not to you, not to me, but to all of us.
- solso 7y ago
  [Disclaimer, work at Cliqz] Comparisons of quality are relative, Google was good from day one because it was better than the competitors at that moment of time. Problem is that if one starts using X, and that provides an edge, the other have to follow just to keep up. A very unfortunate rabbit hole. I'm with you 100% that personal data makes search worse in in many cases, too much personalization is detrimental. One last thing, which I'd like to stress, is that data from users is not necessarily the same as personal data. For instance, you can use the data from users as if they were just sensors, without trying to build sessions out of it. In a way it's similar to what Google made when they started. Google was the first and only to use anchor text, which is user generated and a less noisier description of the content of the page. (True that they did not use the users themselves but they did the proper automatic crawling). But in a way they collected sensor data from users, not personal data. That's what we should still be doing today. The problem is , however, however, is that is too easy to go beyond "sensor data" and start to collect full sessions and even personal data.
  - deleted 7y ago
    [deleted]
  - nocturnial 7y ago
soumyadeb 7y ago
There should be a way to store data so that aggregate queries like "count how many different people are in a given location" can be answered without compromising individual privacy. Approaches like k-anonymity or L-diversity come to mind The problem is that there is no incentive for businesses to do so. Even regulations like GDPR & CCPA mostly don't touch upon the privacy of first-party data. As long as you give an option to delete the data (which often is hard to implement), you don't have to do anything more.
- kkm 7y ago
  Hi soumyadeb, It is true that there needs to be a way to store the aggregate queries "per user". In the current approach of collection this place happens to be on Server, but aggregation per user can easily be done on client-side by leveraging Browser storage. Approaches like k-anonymity or L-diversity are good but they tackle the problem from a different perspective - making sensitive data available for querying without revealing actual content. The approach suggested in this article talks about methodology which removes the need to collect such data in the first place. You can also check our paper: https://www.0x65.dev/pages/dissemination-cliqz.html#GreenAnalytics https://www.0x65.dev/pages/dissemination-cliqz.html#GreenAna... We will talk in detail about this methodology- Human Web and how we use to collect data for our search, without compromising users privacy and based on client-side aggregation. Disclaimer: I work with Cliqz.
  - soumyadeb 7y ago
    Thanks for the reference. I quickly browsed through the paper. The problem you mention seems to arise from the fact that GA is able to tie the user across different domains (about.me, depressionforum.org etc) using a shared cookie etc. Is it still an issue if 3rd party cookies are blocked and the GA is forced to set a first-party cookie. In that case, the ID GA will get for about.me would be different from depressionforum.org? Assuming the owners for these websites are different and only care about their respective stats (depressionforum doesn't care about about.me analytics), why do we need 3rd party cookies? Am I missing something here? Well, it can probably fingerprint the browser but there is no reason to store that information.
amelius 7y ago
The question is why do companies even have to see our data? In the old days of the internet universities and government institutions dealt with data, the companies were only there to provide the hardware.
- __ka 7y ago
  I understand why universities would get the benefit of the doubt, but I am not sure having search engines be a government service would be a very good idea.
  - amelius 7y ago
    Yeah, many problems to solve here. But let's take another example: Google going into the space of deep learning based health diagnostics. Why does Google need to have access to our medical data when they can sell their solutions as hardware and software to hospitals? Even if they have to use our data for testing purposes, they could sign an NDA so the use of our data would be severly restricted and they would not own our data. And for many other services, owning our data should not be the default, and even the necessity of seeing our data should be questioned.
    - __ka 7y ago
      I agree. That data should stay with their rightful owners - the data subject. I believe that we have fundamental issues with personal data ownership in the web for two reasons: 1. People do not believe web is real life. In the physical world, it is very easy to see how your rights are violated. If there's a person following you for days (when you shop, when you buy your medicine, when you talk to friends), you call the police. The majority of users have no idea of third party trackers. They have no idea what (or rather how much) information they are emitting at each point in time. 2. People have access to amazing products for "free", and they do not know the price of their data. Imagine if you were given a TV, but you would have to babysit a boring kid 2 hours a day for years. I guess not many would want that TV. Force each company to offer two plans (legally): one free + (ads / tracking), one premium (no ads / no tracking), then see how much people care about their data.
summerlight 7y ago
While the approach mentioned in this article seems interesting, there's multiple other approaches to mitigate privacy issues in data collection, cryptographic approaches like homomorphic encryption or decentralized approaches like federated learning. Still wonder what is the differentiation of this approach from the others.
- solso 7y ago
  [Disclaimer: I work at Cliqz] Yes, we are not the only approach. Even when we started collecting data back in 2014 it wasn't the only one. But we did not find any suitable off-the-shelf solution back then. Homomorphic encryption was discarded because some data to be send needs to be on the clear. For instance a url we need to fetch, so cannot transform it. Also, computationally is very expensive. Federated learning is actually closer to what we do, take our approach as federated learning where each node is a single user and where all aggregation of records need to happen there, so that record-linkage on the final collector is impossible. Tomorrow and the day after tomorrow we are releasing the technical details on different blog-posts, this one was more a motivation/introduction to the main dish.
  - strbean 7y ago
    How about differential privacy?
    - omeze 7y ago
      Differential privacy is more about preserving privacy from consumers of data (e.g. a user running a query) -- it doesn't have guarantees around what sort of data is collected (e.g. google could expose a differentially private API, but internally they would still have all of your data). Edit: after considering it more, I realize you can certainly apply some mechanisms from differential privacy to play a part in the data collection schemes.
    - philippclassen 7y ago
      (Disclaimer: I work at Cliqz) Just saw this one. It is an old comment, but let me try to answer as I find the question interesting. The post on Human Web (https://0x65.dev/blog/2019-12-03/human-web-collecting-data-in-a-socially-responsible-manner.html https://0x65.dev/blog/2019-12-03/human-web-collecting-data-i...) has a brief section regarding differential privacy. Maybe check that one out first. My take on it: although we do see value in differential privacy, we do not believe it fits well in our particular case. The critical moment is to decide what data should be sent by the client. Once data it is out, it is out. It is not possible to apply anonymization once it is on the server. If someone knows how it can be done safely, I would be highly interested. We consider our chosen approach - breaking record linkage before sending - safer for our use-case and simpler. Do not underestimate the simplicity argument. Differential privacy is a powerful technique, but it is also very complex; there are lots of pitfalls and it is crucial to make good choices for the parameters. Would be a good topic for another blog post. ;-)
deleted 7y ago
[deleted]
deleted 7y ago
[deleted]

77 points by __ka 7y ago

seems to be like day 2 of the advent. from day 1: The world needs more search engines [1]. [1] https://www.0x65.dev/blog/2019-12-01/the-world-needs-cliqz-the-world-needs-more-search-engines.html https://www.0x65.dev/blog/2019-12-01/the-world-needs-cliqz-t...

pythux 7y ago
Indeed, the idea is to use each day until Christmas to unveil a new post about search, privacy and security. Today is about opening a discussion about data collection practices. It's often presented as a "all or nothing" (more often than not it's "nothing"). But data is needed to create independent and viable alternatives to the giants so maybe there is a middle ground if it's done with privacy at heart from the ground up. Edit: For those curious about the details, we've started a new page where we gather research, talks and blog posts from the past about these topics: https://0x65.dev/pages/dissemination-cliqz.html https://0x65.dev/pages/dissemination-cliqz.html

nocturnial 7y ago

> Let us start with the need for data, going straight to the point: one cannot build a competitive search without data collected from people. Google had a very good search engine before they started to collect data from everyone, not after. I don't have a metric to decide whether the search results from google got better or worse over the years. Subjectively and for me personally, they've gotten worse. And I'm not the only one who thinks this. I could be (and probably am) wrong, but I think the more personal data a search engine has, the worse the results. When I think about it in that way, it makes senses why it has gotten worse. The search engine pays more attention to the data it think it has collected from me and how it relates to advertisers, etc... instead of paying attention to the actual words I wrote in the query.

chrmod 7y ago
Probably lots of people remember the good old days of Google Advance Search. Or the ability to fine tune the results with special operators like +, -, site:, etc. It was probably 2010 when we started to talk about filter bubbles and how "smart" algorithms adjust the data to our liking. No one even though about disasters like Cambridge Analitica. As those days are long gone, there is perspective that is not purely negative. IMAO modern search engines are more approachable. They are easier than ever to use. Specifically for people that don't necessarily know how or have patience to learn how to use it. We are power users and often forget that most people don't have to be ones. They just want to search. Therefore approach that Cliqz takes to its data collection makes even more sense. What Human Web does is extraction of common knowledge (or sense) on what does Web mean to people. Not to you, not to me, but to all of us.
solso 7y ago
[Disclaimer, work at Cliqz] Comparisons of quality are relative, Google was good from day one because it was better than the competitors at that moment of time. Problem is that if one starts using X, and that provides an edge, the other have to follow just to keep up. A very unfortunate rabbit hole. I'm with you 100% that personal data makes search worse in in many cases, too much personalization is detrimental. One last thing, which I'd like to stress, is that data from users is not necessarily the same as personal data. For instance, you can use the data from users as if they were just sensors, without trying to build sessions out of it. In a way it's similar to what Google made when they started. Google was the first and only to use anchor text, which is user generated and a less noisier description of the content of the page. (True that they did not use the users themselves but they did the proper automatic crawling). But in a way they collected sensor data from users, not personal data. That's what we should still be doing today. The problem is , however, however, is that is too easy to go beyond "sensor data" and start to collect full sessions and even personal data.
- deleted 7y ago
  [deleted]
- nocturnial 7y ago

soumyadeb 7y ago

There should be a way to store data so that aggregate queries like "count how many different people are in a given location" can be answered without compromising individual privacy. Approaches like k-anonymity or L-diversity come to mind The problem is that there is no incentive for businesses to do so. Even regulations like GDPR & CCPA mostly don't touch upon the privacy of first-party data. As long as you give an option to delete the data (which often is hard to implement), you don't have to do anything more.

kkm 7y ago
Hi soumyadeb, It is true that there needs to be a way to store the aggregate queries "per user". In the current approach of collection this place happens to be on Server, but aggregation per user can easily be done on client-side by leveraging Browser storage. Approaches like k-anonymity or L-diversity are good but they tackle the problem from a different perspective - making sensitive data available for querying without revealing actual content. The approach suggested in this article talks about methodology which removes the need to collect such data in the first place. You can also check our paper: https://www.0x65.dev/pages/dissemination-cliqz.html#GreenAnalytics https://www.0x65.dev/pages/dissemination-cliqz.html#GreenAna... We will talk in detail about this methodology- Human Web and how we use to collect data for our search, without compromising users privacy and based on client-side aggregation. Disclaimer: I work with Cliqz.
- soumyadeb 7y ago
  Thanks for the reference. I quickly browsed through the paper. The problem you mention seems to arise from the fact that GA is able to tie the user across different domains (about.me, depressionforum.org etc) using a shared cookie etc. Is it still an issue if 3rd party cookies are blocked and the GA is forced to set a first-party cookie. In that case, the ID GA will get for about.me would be different from depressionforum.org? Assuming the owners for these websites are different and only care about their respective stats (depressionforum doesn't care about about.me analytics), why do we need 3rd party cookies? Am I missing something here? Well, it can probably fingerprint the browser but there is no reason to store that information.

amelius 7y ago

The question is why do companies even have to see our data? In the old days of the internet universities and government institutions dealt with data, the companies were only there to provide the hardware.

__ka 7y ago
I understand why universities would get the benefit of the doubt, but I am not sure having search engines be a government service would be a very good idea.
- amelius 7y ago
  Yeah, many problems to solve here. But let's take another example: Google going into the space of deep learning based health diagnostics. Why does Google need to have access to our medical data when they can sell their solutions as hardware and software to hospitals? Even if they have to use our data for testing purposes, they could sign an NDA so the use of our data would be severly restricted and they would not own our data. And for many other services, owning our data should not be the default, and even the necessity of seeing our data should be questioned.
  - __ka 7y ago
    I agree. That data should stay with their rightful owners - the data subject. I believe that we have fundamental issues with personal data ownership in the web for two reasons: 1. People do not believe web is real life. In the physical world, it is very easy to see how your rights are violated. If there's a person following you for days (when you shop, when you buy your medicine, when you talk to friends), you call the police. The majority of users have no idea of third party trackers. They have no idea what (or rather how much) information they are emitting at each point in time. 2. People have access to amazing products for "free", and they do not know the price of their data. Imagine if you were given a TV, but you would have to babysit a boring kid 2 hours a day for years. I guess not many would want that TV. Force each company to offer two plans (legally): one free + (ads / tracking), one premium (no ads / no tracking), then see how much people care about their data.

summerlight 7y ago

While the approach mentioned in this article seems interesting, there's multiple other approaches to mitigate privacy issues in data collection, cryptographic approaches like homomorphic encryption or decentralized approaches like federated learning. Still wonder what is the differentiation of this approach from the others.

solso 7y ago
[Disclaimer: I work at Cliqz] Yes, we are not the only approach. Even when we started collecting data back in 2014 it wasn't the only one. But we did not find any suitable off-the-shelf solution back then. Homomorphic encryption was discarded because some data to be send needs to be on the clear. For instance a url we need to fetch, so cannot transform it. Also, computationally is very expensive. Federated learning is actually closer to what we do, take our approach as federated learning where each node is a single user and where all aggregation of records need to happen there, so that record-linkage on the final collector is impossible. Tomorrow and the day after tomorrow we are releasing the technical details on different blog-posts, this one was more a motivation/introduction to the main dish.
- strbean 7y ago
  How about differential privacy?
  - omeze 7y ago
    Differential privacy is more about preserving privacy from consumers of data (e.g. a user running a query) -- it doesn't have guarantees around what sort of data is collected (e.g. google could expose a differentially private API, but internally they would still have all of your data). Edit: after considering it more, I realize you can certainly apply some mechanisms from differential privacy to play a part in the data collection schemes.
  - philippclassen 7y ago
    (Disclaimer: I work at Cliqz) Just saw this one. It is an old comment, but let me try to answer as I find the question interesting. The post on Human Web (https://0x65.dev/blog/2019-12-03/human-web-collecting-data-in-a-socially-responsible-manner.html https://0x65.dev/blog/2019-12-03/human-web-collecting-data-i...) has a brief section regarding differential privacy. Maybe check that one out first. My take on it: although we do see value in differential privacy, we do not believe it fits well in our particular case. The critical moment is to decide what data should be sent by the client. Once data it is out, it is out. It is not possible to apply anonymization once it is on the server. If someone knows how it can be done safely, I would be highly interested. We consider our chosen approach - breaking record linkage before sending - safer for our use-case and simpler. Do not underestimate the simplicity argument. Differential privacy is a powerful technique, but it is also very complex; there are lots of pitfalls and it is crucial to make good choices for the parameters. Would be a good topic for another blog post. ;-)

deleted 7y ago

[deleted]

deleted 7y ago

[deleted]