4 ms·

> in order to get these companies to remove your info, you have to submit an opt out that identifies who you are. I wonder if you could build an opt-out servic

by mawise 5y ago

> in order to get these companies to remove your info, you have to submit an opt out that identifies who you are. I wonder if you could build an opt-out service or protocol where you share a hash of your personal information instead of the info itself. With the hash you can identify matching records but you cannot create a record from the hash. If Optery bought full datasets from databrokers, it could use a hash to identify matching records and submit those back to the brokers for opt-out (this wouldn't work for querying their public APIs...) Probably not a feasible solution, but it's a fun possibility to think about!

joering2 5y ago
> With the hash you can identify matching records but you cannot create a record from the hash. I always chuckle when I see someone saying this. A buddy of mine (email marketer) tried to convince me that his 50 million large email database is "well protected" because they are using "industry standard md5 encryption". Of course its not encryption but rather hashing. He was so sure of his, erm, encryption, that he send me the whole database and said "here, crack it". I found a large hacked Facebook email database online, run few python scripts to weed us most combinations of usernames (name+numbers, numbers+name, numbers+some random chars, etc) and some 1000 generic email domains names (like gmail.com, yahoo.com, etc). It took my regular i9 five days to go thru the whole 50M of md5s and compare each combination of usernames + domains names. Oh boy his shock when I returned some 70% "unencrypted" plain text emails back to him :) Bottom line is, if there is some "industry standard" of hashing data, then there are ways to unhash it. Yes in many cases it may be in millions of years to circle thru all possibilities, but if your standard is first name + last name + email address (and all caps), then you can easily plug database of names and download millions of email records online and narrow down your hashing search greatly.
estaseuropano 5y ago
What's the point? The company a you are asking to remove data will anyway know which dataset you asked to delete. What would work would be a mandatory self block list (e.g. most EU countries have a 'do not call' opt-in list against telemarketers) and then the brokers have to check any new days against the hash of data points in this block list. But that requires government intervention, not startups that bandaid the problem.

by mawise 5y ago

joering2 5y ago

> With the hash you can identify matching records but you cannot create a record from the hash. I always chuckle when I see someone saying this. A buddy of mine (email marketer) tried to convince me that his 50 million large email database is "well protected" because they are using "industry standard md5 encryption". Of course its not encryption but rather hashing. He was so sure of his, erm, encryption, that he send me the whole database and said "here, crack it". I found a large hacked Facebook email database online, run few python scripts to weed us most combinations of usernames (name+numbers, numbers+name, numbers+some random chars, etc) and some 1000 generic email domains names (like gmail.com, yahoo.com, etc). It took my regular i9 five days to go thru the whole 50M of md5s and compare each combination of usernames + domains names. Oh boy his shock when I returned some 70% "unencrypted" plain text emails back to him :) Bottom line is, if there is some "industry standard" of hashing data, then there are ways to unhash it. Yes in many cases it may be in millions of years to circle thru all possibilities, but if your standard is first name + last name + email address (and all caps), then you can easily plug database of names and download millions of email records online and narrow down your hashing search greatly.

estaseuropano 5y ago

What's the point? The company a you are asking to remove data will anyway know which dataset you asked to delete. What would work would be a mandatory self block list (e.g. most EU countries have a 'do not call' opt-in list against telemarketers) and then the brokers have to check any new days against the hash of data points in this block list. But that requires government intervention, not startups that bandaid the problem.