4 ms·
Let's say you're one out of 10,000 users in a large network sharing a single public IP address. Anyone trying to identify you just needs to narrow that down fr
by bogwog 6y ago
Let's say you're one out of 10,000 users in a large network sharing a single public IP address.
Anyone trying to identify you just needs to narrow that down from 10,000 to one. This can be done many different ways by combining data sources. You could automate it with algorithms and maybe some machine learning, but it'd also be pretty trivial for a dedicated human to do it.
Browser fingerprint, mac address, software versions, browsing behavior (https doesn't hide URLs), access times, and application hashes will all help narrow down that search.
Maybe your university requires you to install some special software (like one of those locked down browsers for exams), and the attacker knows an approximate range of time when you installed it based on your exam schedule. They could narrow their search by intercepting OCSP requests and filtering for application hashes that match the specific version of the software you most likely downloaded, based on the time you most likely downloaded it.
- user-the-name 6y agoBut why? Why go to these ridiculous lengths to try to extract information from an unreliable source? Apple already has the device identifier and Apple ID. These are reliable. They do not need combining different data sources and algorithm and machine learning. They are the accurate data already. If they wanted it, they could just send it. They don't. Why not? If they wanted this information, why on god's green earth would they not just send it?
- bogwog 6y agoI didn't mention Apple. Anyone intercepting the OCSP traffic (which isn't encrypted) could use it to track you.
- sudosysgen 6y agoIt's quite obvious. That way you can't get nailed for breaching privacy. It's exactly the same concept as the NSA saying that they are only collecting metadata and not doing any spying.
- user-the-name 6y agoIt would do absolutely nothing whatsoever for the legality of any collection they might want to do.
- sudosysgen 6y agoOf course, it would. IPs are required data to be gathered. They can be almost all the time correlated with real identities using other requests, but under many data regulation laws they wouldn't be allowed to send personal identifying information that isn't necessary.
- user-the-name 6y agoGDPR would not agree with you there, I gather.
- sudosysgen 6y agoHow does the GDPR agree with the collection of personally identifying data that is not necessary to operation?