8 ms·

This reminds me of a quote from Eric Schmidt (disclaimer: I work for Google) from last year. The full quote [1] is: > I think judgment matters. If you have som

by cletus 15y ago

This reminds me of a quote from Eric Schmidt (disclaimer: I work for Google) from last year. The full quote [1] is: > I think judgment matters. If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place. If you really need that kind of privacy, the reality is that search engines -- including Google -- do retain this information for some time and it's important, for example, that we are all subject in the United States to the Patriot Act and it is possible that all that information could be made available to the authorities. which is entirely reasonable, yet he gets lambasted in the press as being "creepy" [2] based on a sensationalist snippet. If you really want something to remain hidden, you have to remember that any services you use are subject to law enforcement, security breaches, bankruptcy procedures (there was a case not too long ago where a bankruptcy court judge ruled that the creditors' interests overruled the TOS and allowed the sale of information otherwise prohibited by the TOS; I can't find a link right now), etc. With the ever-decreasing cost of mass computing, you will increasingly see just what an illusion online privacy really is. Another example: some sites use shared avatar sites like Gravatar. I've often thought it would be trivial to crawl the Web and link identities from various forums based on using the exact same Gravatar image. In fact, someone's probably already done this. Facial recognition is just one obvious way this will manifest itself. Another that I don't think has even been explored yet is what I would probably call "textual fingerprinting" meaning that the more you write in one post the more likely you can extract some identifiable style, choice of words and so on and that can be linked to other things you've written. [1]: http://www.schneier.com/blog/archives/2009/12/my_reaction_to.html http://www.schneier.com/blog/archives/2009/12/my_reaction_to... [2]: http://latimesblogs.latimes.com/technology/2011/01/animation-of-google-ex-ceo-schmidts-creepy-lines-hits-dc-streets.html http://latimesblogs.latimes.com/technology/2011/01/animation...

Radim 15y ago
Re. "textual fingerprinting" -- this is a well-established field (decades old), especially in forensics. It more commonly goes under the name "authorship attribution". For a taste, see e.g. http://www.ncfta.ca/papers/emailforensics.pdf http://www.ncfta.ca/papers/emailforensics.pdf or http://ai.arizona.edu/intranet/papers/isi_visualizing_authorship.pdf http://ai.arizona.edu/intranet/papers/isi_visualizing_author... .
mmastrac 15y ago
Even worse, Gravatar images are generally linked via MD5 hash. If you see two Gravatars with the same hash on two different sites, you've found the same person. Combine that with a large spam list of email addresses, or brute force simple addresses from common suffixes like @gmail.com and @hotmail.com and you've got identities.
- jodrellblank 15y ago
  Or combine with another service which uses MD5 hashes differently. You used to be able to copy a Gravatar hash into a Disqus url and see the email address, if that person had ever made any Disqus comments on any blog anywhere using their email address. No brute-force necessary.
- aidos 15y ago
  And worse again, I just discovered that there's no way to delete a Gravatar account. Even if you unlink your email address from the account it still keeps it linked behind the scenes (you can sign in with your "deleted" address).
AJ007 15y ago
While I don't disagree that Eric Schmidt's quote was taken out of context, "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place" is bullshit. There are plenty of things you and I don't want anyone to know. I don't want the world to know when I'm on vacation. I don't want my neighbors to know I left my balcony door open and I just have the screen door closed so I conserve energy. I don't want every girl I meet to know that I collect comic books. The idea that I shouldn't be doing any of those things is completely absurd. In the same fashion, would you like everyone to know what parking spot your teenage daughter parked in, in the back of a mall parking lot Friday night? Or where your kids go to daycare? (hypothetical, I don't have kids but you bet I'd be concerned about them using foursquare) Could we change Eric Schmidt's quote to, "If your kids are doing something you don't want everyone to know, may be they shouldn't be doing it in the first place?" I don't think so. Your kids aren't that much different than your 60 year old mother or 70 year old dad. That is a lot of people. It was hardly 10 years ago that the message was - never meet anyone you first met online. What happened to that? Now the message is, share all your personal private information with the entire world, you have nothing to worry about. We are Facebook/Google and these features are amazing. That is a lie. Perhaps the parallel increase in information access by law enforcement has made us feel safer. The same technology criminals use to exploit us is used to track them. When something bad happens to someone we know more about what happened, quicker. While this may be an acceptable trade off in a first world country I do not believe the same applies in one such as Mexico. Yeah online privacy is nearly non existent. Especially so when you are reckless and use connected identity systems. That doesn't mean the message should be "give up." That is the message Google and Facebook's PR machines are sending because they can make a lot more money from advertising when they do it. As soon as hacker news switches to facebook's commenting system or any other public id, I'll never make another post here again. I have left communities I've been active in because of this. The message to our friends and family, and if we own businesses, the world, should be stop sharing all of this information publicly. There is no reason to. Its not safe for you and its not safe for your family.
- true_religion 15y ago
  > There are plenty of things you and I don't want anyone to know. I don't want the world to know when I'm on vacation. I don't want my neighbors to know I left my balcony door open and I just have the screen door closed so I conserve energy. I don't want every girl I meet to know that I collect comic books. The idea that I shouldn't be doing any of those things is completely absurd. The point is that if the world really wanted to find out about these activities, there is someone in the world with the information who knows of it. Just taking one of your examples: comic books---you buy them from some source, and that source likely knows who you are. Absolute privacy is impossible unless no one is interested in your activities, and your activities don't involve any other human being or leave any trace.
jonnathanson 15y ago
"Another that I don't think has even been explored yet is what I would probably call "textual fingerprinting" meaning that the more you write in one post the more likely you can extract some identifiable style, choice of words and so on and that can be linked to other things you've written." Forensic textual analysis predates the internet, actually, and I can say with near certainty that someone out there is working on this right now. (Probably the CIA, and/or another agency involved in analyzing communications between persons of interest). Back in undergrad, I was involved in a project that used textual analysis to surmise authorship of "anonymous" works of fiction from Shakespeare's day. Additionally, the authorship of a lot of works attributed to Shakespeare is often called into question, and so we tried to map for consistency or inconsistency in his works. (Spoiler alert: he turned up pretty clean; he -- or at least someone using his name -- is most likely the author of his works). Now, obviously, this project was a bit high-touch and involved a lot of attention lavished on a single body of work by a handful of presumed authors. But that was a long time ago, and I'm sure that the technology has grown more scalable and sophisticated by now.
- boredguy8 15y ago
  > Spoiler alert: he turned up pretty clean; he -- or at least someone using his name -- is most likely the author of his works Do you have a handy reference?
- anigbrowl 15y ago
  Forensic textual analysis predates the internet, actually, and I can say with near certainty that someone out there is working on this right now. Plagiarism detection software is increasingly common in education. I've actually been looking for something similar to filter news commentary systems, to get a sense of what %age of comments on political stories are actually astroturf.
  - yanowitz 15y ago
    Please build this. It sound fantastic. You might even find a market for selling information about what AstroTurf campaigns are being run.
neworbit 15y ago
Well, it is kind of creepy. I wouldn't want a "social network helper tool" to out me if I was still in the closet. Some things should be your own decision.
- 5hoom 15y ago
  Thats just it. It's not for someone else to decide what information you project about yourself. Types of information that are of little consequence for one person (eg. religion, sexuality, political-affiliation) could have devastating real world consequences for another if made accessible.
ezy 15y ago
Generally, people who subscribe to the ridiculous notion that "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place.", either lead extremely pedestrian personal lives, or are rich enough to be able to buy their way out of repression. Most big company CEOs are a little of both, in my experience.
- sliverstorm 15y ago
  I usually just take it as a more PC way of saying "If you have something that you don't want anyone to know, either learn to cover it up or don't do it in the first place". I mean, since when has it been somebody else's problem that you couldn't hide your secrets well enough?
  - ezy 15y ago
    That reads the exactly the same. Who are you (rhetorically, not 'you' :-)) to decide that I shouldn't be doing something? It's authoritarian and creepy. Eric's misstep is precisely that addendum. If he said something to the effect that "If you have something you don't want anyone to know, don't put it on the internet". OK, fine -- that's reasonable. The paternalistic addition of an implied judgment on someone's behavior is unneeded. I think it comes from being a top-level employee at company or any nominal leadership position. You get used to speaking with authority in one context -- and sometimes you think you can speak with authority in a larger context -- and you really can't.
    - sliverstorm 15y ago
      I don't understand what the alternative is. If you insist on doing something you don't want people to know about, and you refuse to learn to cover it up,... then what!?
      - ezy 15y ago
        I wrote something up above, but the gist is -- you don't have to do anything to have something you want to hide.
shoham 15y ago
All good points. Where do you stand, on an ethical basis, with how far is too far for any entity to knowingly take this kind of info and manipulate your life for your (and their) 'benefit'. I like Google, but when you mention 'textual fingerprinting' it's already the case that Google does some of this when you search, and for use in Adsense, right? Maybe not reading your texts/posts yet but Google has 100's of millions of people's search and browsing fingerprints, whether they know it or not...
deleted 15y ago
[deleted]
dspillett 15y ago
> which is entirely reasonable, yet he gets lambasted in the press as being "creepy" [2] based on a sensationalist snippet. The creepiness factor in his comment, and in the way advertisers and those selling us to advertisers operate, isn't really about the information being out there. It is about being followed by an entity you don't know and have no particular reason to trust. We don't like being followed like that, there is something in us that takes it as a threat. It is something we share with most animals and is a sensible reaction that evolved by making animals with that reaction less susceptible to certain threats (in the wild, being followed usually means you are a target for something you are not going to like, probably involving claws and teeth). Even in modern life it can be a useful reaction - if someone follows you down an alley you get ready to take action just in case that person turning down the alley after you isn't a perfectly innocent coincidence. Being followed by Facebook/Google/any-one-else-on-the-planet-who-wants-to-sell-info-about-my-life is not the same as the physical risk that being followed in RealLife(tm) could imply, but our brains are not wired to see the difference. Anyway, people knowing more about you that you know about them can be a threat in some circumstances, or at least could put you at a disadvantage. A secondary issue is that people sometimes want/need to hide things because other people's reactions could have unreasonable negative repercussions. If you were a gay man in a place where being so could get you strung up for what local laws (or local vigilantes) consider to be moral deviancy, "just stop being gay then you'll have nothing to hide" simply isn't an option and you wouldn't want the information "leaking" out by virtue of services giving you personalised adverts relevant to it while using facebook (or any other ad funded service) in public. That may be stretching the point a little far, but there are reasons to want to keep things about yourself to yourself (without wanting to completely disconnect that part of yourself from your private online activities) other than it being illegal, which if I remember rightly was what Eric Schmidt was talking about when he said that oft-quoted-out-of-context phrase, and sometimes something being illegal doesn't make it wrong (morality being a lot more subjective than peopel like to think - what is wrong to me might be fine to you).

by cletus 15y ago

Radim 15y ago

Re. "textual fingerprinting" -- this is a well-established field (decades old), especially in forensics. It more commonly goes under the name "authorship attribution". For a taste, see e.g. http://www.ncfta.ca/papers/emailforensics.pdf http://www.ncfta.ca/papers/emailforensics.pdf or http://ai.arizona.edu/intranet/papers/isi_visualizing_authorship.pdf http://ai.arizona.edu/intranet/papers/isi_visualizing_author... .

mmastrac 15y ago

Even worse, Gravatar images are generally linked via MD5 hash. If you see two Gravatars with the same hash on two different sites, you've found the same person. Combine that with a large spam list of email addresses, or brute force simple addresses from common suffixes like @gmail.com and @hotmail.com and you've got identities.

jodrellblank 15y ago
Or combine with another service which uses MD5 hashes differently. You used to be able to copy a Gravatar hash into a Disqus url and see the email address, if that person had ever made any Disqus comments on any blog anywhere using their email address. No brute-force necessary.
aidos 15y ago
And worse again, I just discovered that there's no way to delete a Gravatar account. Even if you unlink your email address from the account it still keeps it linked behind the scenes (you can sign in with your "deleted" address).

AJ007 15y ago

While I don't disagree that Eric Schmidt's quote was taken out of context, "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place" is bullshit. There are plenty of things you and I don't want anyone to know. I don't want the world to know when I'm on vacation. I don't want my neighbors to know I left my balcony door open and I just have the screen door closed so I conserve energy. I don't want every girl I meet to know that I collect comic books. The idea that I shouldn't be doing any of those things is completely absurd. In the same fashion, would you like everyone to know what parking spot your teenage daughter parked in, in the back of a mall parking lot Friday night? Or where your kids go to daycare? (hypothetical, I don't have kids but you bet I'd be concerned about them using foursquare) Could we change Eric Schmidt's quote to, "If your kids are doing something you don't want everyone to know, may be they shouldn't be doing it in the first place?" I don't think so. Your kids aren't that much different than your 60 year old mother or 70 year old dad. That is a lot of people. It was hardly 10 years ago that the message was - never meet anyone you first met online. What happened to that? Now the message is, share all your personal private information with the entire world, you have nothing to worry about. We are Facebook/Google and these features are amazing. That is a lie. Perhaps the parallel increase in information access by law enforcement has made us feel safer. The same technology criminals use to exploit us is used to track them. When something bad happens to someone we know more about what happened, quicker. While this may be an acceptable trade off in a first world country I do not believe the same applies in one such as Mexico. Yeah online privacy is nearly non existent. Especially so when you are reckless and use connected identity systems. That doesn't mean the message should be "give up." That is the message Google and Facebook's PR machines are sending because they can make a lot more money from advertising when they do it. As soon as hacker news switches to facebook's commenting system or any other public id, I'll never make another post here again. I have left communities I've been active in because of this. The message to our friends and family, and if we own businesses, the world, should be stop sharing all of this information publicly. There is no reason to. Its not safe for you and its not safe for your family.

true_religion 15y ago
> There are plenty of things you and I don't want anyone to know. I don't want the world to know when I'm on vacation. I don't want my neighbors to know I left my balcony door open and I just have the screen door closed so I conserve energy. I don't want every girl I meet to know that I collect comic books. The idea that I shouldn't be doing any of those things is completely absurd. The point is that if the world really wanted to find out about these activities, there is someone in the world with the information who knows of it. Just taking one of your examples: comic books---you buy them from some source, and that source likely knows who you are. Absolute privacy is impossible unless no one is interested in your activities, and your activities don't involve any other human being or leave any trace.

jonnathanson 15y ago

"Another that I don't think has even been explored yet is what I would probably call "textual fingerprinting" meaning that the more you write in one post the more likely you can extract some identifiable style, choice of words and so on and that can be linked to other things you've written." Forensic textual analysis predates the internet, actually, and I can say with near certainty that someone out there is working on this right now. (Probably the CIA, and/or another agency involved in analyzing communications between persons of interest). Back in undergrad, I was involved in a project that used textual analysis to surmise authorship of "anonymous" works of fiction from Shakespeare's day. Additionally, the authorship of a lot of works attributed to Shakespeare is often called into question, and so we tried to map for consistency or inconsistency in his works. (Spoiler alert: he turned up pretty clean; he -- or at least someone using his name -- is most likely the author of his works). Now, obviously, this project was a bit high-touch and involved a lot of attention lavished on a single body of work by a handful of presumed authors. But that was a long time ago, and I'm sure that the technology has grown more scalable and sophisticated by now.

boredguy8 15y ago
> Spoiler alert: he turned up pretty clean; he -- or at least someone using his name -- is most likely the author of his works Do you have a handy reference?
anigbrowl 15y ago
Forensic textual analysis predates the internet, actually, and I can say with near certainty that someone out there is working on this right now. Plagiarism detection software is increasingly common in education. I've actually been looking for something similar to filter news commentary systems, to get a sense of what %age of comments on political stories are actually astroturf.
- yanowitz 15y ago
  Please build this. It sound fantastic. You might even find a market for selling information about what AstroTurf campaigns are being run.

neworbit 15y ago

Well, it is kind of creepy. I wouldn't want a "social network helper tool" to out me if I was still in the closet. Some things should be your own decision.

5hoom 15y ago
Thats just it. It's not for someone else to decide what information you project about yourself. Types of information that are of little consequence for one person (eg. religion, sexuality, political-affiliation) could have devastating real world consequences for another if made accessible.

ezy 15y ago

Generally, people who subscribe to the ridiculous notion that "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place.", either lead extremely pedestrian personal lives, or are rich enough to be able to buy their way out of repression. Most big company CEOs are a little of both, in my experience.

sliverstorm 15y ago
I usually just take it as a more PC way of saying "If you have something that you don't want anyone to know, either learn to cover it up or don't do it in the first place". I mean, since when has it been somebody else's problem that you couldn't hide your secrets well enough?
- ezy 15y ago
  That reads the exactly the same. Who are you (rhetorically, not 'you' :-)) to decide that I shouldn't be doing something? It's authoritarian and creepy. Eric's misstep is precisely that addendum. If he said something to the effect that "If you have something you don't want anyone to know, don't put it on the internet". OK, fine -- that's reasonable. The paternalistic addition of an implied judgment on someone's behavior is unneeded. I think it comes from being a top-level employee at company or any nominal leadership position. You get used to speaking with authority in one context -- and sometimes you think you can speak with authority in a larger context -- and you really can't.
  - sliverstorm 15y ago
    I don't understand what the alternative is. If you insist on doing something you don't want people to know about, and you refuse to learn to cover it up,... then what!?
    - ezy 15y ago
      I wrote something up above, but the gist is -- you don't have to do anything to have something you want to hide.

shoham 15y ago

All good points. Where do you stand, on an ethical basis, with how far is too far for any entity to knowingly take this kind of info and manipulate your life for your (and their) 'benefit'. I like Google, but when you mention 'textual fingerprinting' it's already the case that Google does some of this when you search, and for use in Adsense, right? Maybe not reading your texts/posts yet but Google has 100's of millions of people's search and browsing fingerprints, whether they know it or not...

deleted 15y ago

[deleted]

dspillett 15y ago

> which is entirely reasonable, yet he gets lambasted in the press as being "creepy" [2] based on a sensationalist snippet. The creepiness factor in his comment, and in the way advertisers and those selling us to advertisers operate, isn't really about the information being out there. It is about being followed by an entity you don't know and have no particular reason to trust. We don't like being followed like that, there is something in us that takes it as a threat. It is something we share with most animals and is a sensible reaction that evolved by making animals with that reaction less susceptible to certain threats (in the wild, being followed usually means you are a target for something you are not going to like, probably involving claws and teeth). Even in modern life it can be a useful reaction - if someone follows you down an alley you get ready to take action just in case that person turning down the alley after you isn't a perfectly innocent coincidence. Being followed by Facebook/Google/any-one-else-on-the-planet-who-wants-to-sell-info-about-my-life is not the same as the physical risk that being followed in RealLife(tm) could imply, but our brains are not wired to see the difference. Anyway, people knowing more about you that you know about them can be a threat in some circumstances, or at least could put you at a disadvantage. A secondary issue is that people sometimes want/need to hide things because other people's reactions could have unreasonable negative repercussions. If you were a gay man in a place where being so could get you strung up for what local laws (or local vigilantes) consider to be moral deviancy, "just stop being gay then you'll have nothing to hide" simply isn't an option and you wouldn't want the information "leaking" out by virtue of services giving you personalised adverts relevant to it while using facebook (or any other ad funded service) in public. That may be stretching the point a little far, but there are reasons to want to keep things about yourself to yourself (without wanting to completely disconnect that part of yourself from your private online activities) other than it being illegal, which if I remember rightly was what Eric Schmidt was talking about when he said that oft-quoted-out-of-context phrase, and sometimes something being illegal doesn't make it wrong (morality being a lot more subjective than peopel like to think - what is wrong to me might be fine to you).