3 ms·
> Since PII have not found so far and Microsoft stated privacy principles with no personal content I'm going to have to disagree with the authors
by shakna 7y ago
> Since PII have not found so far and Microsoft stated privacy principles with no personal content
I'm going to have to disagree with the authors of the paper, here.
Whilst the information they've found may not appear to be PII at first, it is very far from anonymous.
It has everything required for active fingerprinting of individual devices - namely, the UIDs of the hardware of the computer. Things that don't regularly change, and things that may show habits.
Combining this dataset with another is all it would take to break from pseudo-anonymous to known individuals. However, enough information is there to uniquely fingerprint most users.
- badrabbit 7y agoStill not legally PII. Correlated assumptions don't qualify. Bad PR but not PII. PII means very specific things,"a person called jack ryan owns this PC" is not PII, "the owner of this PC was born on 01/02/03" is PII. From a PR perspective it sort of looks bad but please look at the comparison table on the paper where similar data is collected in the registry,logs,prefetch,etc... Unlike *nix,windows does a ton of activity logging and it has been this way for a long time. Most people know of application,system and security logs for example but in the same log directory there are usually 100-200 other log files including IE browsing related logs.
- shakna 7y ago> Still not legally PII. Correlated assumptions don't qualify. Bad PR but not PII Which is why I didn't call it PII, but also emphasised that is also not anonymous.
- justinclift 7y agoSure. But most other places (unsure about Apple) don't automatically ship those logs off to the maker of the OS for centralised bulk collection, analysis, and monetisation.
- badrabbit 7y agoDid not say it was nice of them.