11 ms·

A side note that I found particularly interesting > On March 22, the Reynolds account logged out of Google and less than a second later, the Wiland account log

A side note that I found particularly interesting > On March 22, the Reynolds account logged out of Google and less than a second later, the Wiland account logged in, suggesting the same person was behind both accounts. I've always wondered how often timing analysis is used in practice by surveillence big tech. I suspect that as people become more privacy aware, and start using VPNs, pseudonames, multiple accounts, etc, that big tech will start using timing analysis more and more to correlate traffic and identify users. Like if your friend sends you a Reddit link on WhatsApp, and you immediately open it in your browser, that Reddit session is now linked to you. Another more complex example: let's say Google has already identified your Reddit account. You open a Reddit discussion, and deep in the discussion it links to a Youtube video, and you open it in your browser. Now even if you weren't logged into Youtube, Google could guess that it's you based on the timing of when your Reddit account opened the discussion, and when the linked Youtube video was accessed. And not just that video, but now every Youtube video watched in the same browsing session, is now linked back to you (assuming you have first-party cookies enabled, which is basically required if you ever want to log into anything). Seems a bit paranoid, but I actually suspect this happened to me a few months ago. I was using a FOSS reddit client and clicked a youtube link buried deep in a reddit thread, and opened it in Newpipe (a FOSS youtube client). I wasn't logged in, and was using a VPN, and yet the next day on my Youtube feed I started getting recommendations based on that video (and those recommendations were very different from my usual ones). Scary stuff.

walrus01 4y ago
> I've always wondered how often timing analysis is used in practice by surveillence big tech Books written about the NSA, GCHQ, CSE etc talk about them using things like timestamp logs/traffic analysis/time of day analyzing commercial and government telecom links going back to the 1960s, so in the modern era even if your crypto is absolutely unbreakable, there's a huge amount of analysis and correlation that can be done based on timing analysis. Then you combine your timing analysis with things like correlating geolocation of blocks of IP addresses, netflow and traffic analysis, metadata obtained from other adjacent/nearby users on same ISPs at either end, a whole fire hose of other data that's still useful even if the crypto is solid. > let's say Google has already identified your Reddit account. You open a Reddit discussion, and deep in the discussion it links to a Youtube video, and you open it in your browser. Now even if you weren't logged into Youtube, Google could guess that it's you based on the timing Not just timing but also cookies, client device/browser fingerprinting, IP address/what ISP you're on, and the usage patterns and logged in activity (and app-collected telemetry data on android and ios devices) of all the other persons in your household and neighbors.
- woojoo666 4y ago
  I guess part of my hope was that big tech didn't think timing analysis was worth the effort. But it's rather scary if they are truly scaling up their timing analysis efforts. Now, if you care about privacy, it's not enough to just use a VPN or stay logged out or use anonymous accounts. You have to worry about _when_ you open every webpage. Be wary of immediately opening links that your friend sends you, or sharing webpages that you had just opened to your friends. And that's not even factoring in fingerprinting attacks
  - walrus01 4y ago
    the average residential DHCP-pool-assigned customer on a cablemodem, dsl, gpon line or something doesn't change IP addresses that much, and very often the dhcpd will renew the router/modem's WAN port lease with the same address for months at a time. even if it's not an actual static IP. this alone can be used to correlate a huge number of things since very often you have one household with a whole assortment of people and tablets, phones, laptops, xboxes, playstations, smart speakers etc all behind one IP address and NAT. just having an entity like google know that your ip address is coming from a /24 in a /19 sized IP block that's known to be a comcast dhcp pool in a particular city/metro area is a huge amount of info. other things happen as well. you have other people in your household who installed the facebook app on their phone and left geolocation/GPS permissions set to on? now your IP address has been correlated with a very specific latitude/longitude and the usage patterns of your (spouse, roommate, child, etc) who is using that app.
    - woojoo666 4y ago
      I'm well aware of the issues with IP (I mentioned that I use a VPN), and the general public is becoming more wary too, as can be seen with the rise of VPN usage. Which is why timing analysis is so scary, it bypasses most countermeasures
  - jcims 4y ago
    This sounds more like a forensic analysis than an operational capability.
ta988 4y ago
It is used a lot, also to identify people on TOR. But you usually need something else if you want to use that in court. See: https://resources.infosecinstitute.com/topic/timing-analysis-attacks/ https://resources.infosecinstitute.com/topic/timing-analysis... Or the academic research on the domain https://scholar.google.com/scholar?hl=en&as_sdt=0%2C14&as_vis=1&q=timing+analysis+anonymizing+tor&btnG= https://scholar.google.com/scholar?hl=en&as_sdt=0%2C14&as_vi...
derefr 4y ago
> I've always wondered how often timing analysis is used in practice by surveillence big tech Temporal correlation is the difference between regular network analysis, and dynamic network analysis. Just search "dynamic network analysis" on Google Scholar, and look at who's writing the papers :) But to back up a step — every SaaS company does this on some level. If you have an backend audit-log for e.g. user registrations, and you eyeball it every so often to notice event clusters of people trying to bulk-register accounts in order to block their IPs — well, that's timing analysis!
root_axis 4y ago
In your example how does google correlate your particular reddit account with the link you clicked? YouTube can't access your reddit session cookie so how would google be able to disambiguate your reddit session from arbitrary traffic flowing through the reddit page?
- woojoo666 4y ago
  That's where the timing comes in. The reddit discussion I clicked the link from was an old one, and so was the youtube video (though it did have hundreds of thousands of views). I was probably the only person who opened them up within the same hour
smokeypanda 4y ago
I don't have an expert understanding of how cookies or VPNs function, but these are the two categories of causes that I came up with. Both seem more likely than Google having timing data from a third-party service. Within the first category, possibilities include that the phone logged into your Google account while using the VPN, that there was a Google tracking cookie on your phone and that phone wasn't always connected to the VPN so it related 2 ip addresses, and that your other device on same network shared a VPN session with your phone. The 2nd category I'm including for posterity even if it's unlikely based off your stated usage of FOSS on your phone. That your phone isn't a degoogled OS or other device with Google integration. Smart devices with microphones aren't supposed to collect voice data when not explicitly activated, but it is a potentiality.
- woojoo666 4y ago
  At this point I feel like I should have used a throwaway with how many details I'm giving away here haha, but I have never attached a google account to my phone (I access any google services via browser), and while I don't run a degoogled OS but I have disabled play services and all google features + apps. I'm aware that there's still a chance that Google has trackers, but those trackers would (1) have to detect which reddit account I was using inside my FOSS reddit client (2) detect which video I watched on my FOSS youtube client. It's possible but I decided that this level of surveillance was both more nefarious and less likely than them using timing analysis.
Youden 4y ago
Though worrying if it's done, I doubt that it's done at any scale in the way you're suggesting. Linking accounts is PII and the GDPR would require consent, right to view the information, right to correct the information and so on. I think it was only doable in the end in the article because the data were released as part of a legal process. Regarding your YouTube story, there are lots of examples of things like this (e.g. "I talked to someone about X in person then saw X in Facebook ads") but I haven't yet seen hard evidence. So far I've written it off as coincidence at scale.
- woojoo666 4y ago
  The GDPR considerations are interesting, and it does seem like GDPR can cover things like behavioral data [1]. I'm not sure how it works in regards to Newpipe, the FOSS youtube client I use though. I assume whatever scraper Newpipe uses in the background has already accepted the cookie consent dialog, which would allow Google to start scraping data like IPs and other behavioral data. Not an expert on GDPR law though obviously. As far as it being a coincidence, that's usually something I assume as well. But it really comes down to a game of probabilities. Is it more likely that it's a coincidence, or that Google is doing timing analysis? In this case, a coincidence just felt less likely. I check my youtube feed at least once a day, so I know what my recommendations look like. This recommendation was so out of the ordinary that it stood out to me in a sea of my usual recommendations. And it stood out so much that it prompted me to go back and check my Newpipe history and Reddit history, and spend like an hour investigating and trying to figure out what was most likely. I even wrote down notes about the incident. Also I should probably mention now that earlier I had said that I got those youtube recommendations the next day, but checking my notes now, it was actually within an hour. The video that was recommended to me was not some trending video, it was already a few months old. I also searched my Youtube history to see if I had watched anything else from the same channel, and I had only watched 2 videos from that channel total, and over a year prior. I know that timing analysis seems very nefarious, more high-effort and nefarious that I would expect from even a company like Google. But my guess is that they aren't doing it intentionally, they instead just feed a bunch of analytics data (that they have user consent to collect) into some giant ML model, and that ML model has learned to use timing in its predictions. [1]: https://blog.rsisecurity.com/what-is-considered-pii-under-gdpr/ https://blog.rsisecurity.com/what-is-considered-pii-under-gd...
xiphias2 4y ago
There was an article about how easy it is to find out if 2 of your Facebook friends are dating just by analyzing when your Facebook friends are online, and there isn't any effective way of stopping it from working other than disabling presence notifications.

walrus01 4y ago

> I've always wondered how often timing analysis is used in practice by surveillence big tech Books written about the NSA, GCHQ, CSE etc talk about them using things like timestamp logs/traffic analysis/time of day analyzing commercial and government telecom links going back to the 1960s, so in the modern era even if your crypto is absolutely unbreakable, there's a huge amount of analysis and correlation that can be done based on timing analysis. Then you combine your timing analysis with things like correlating geolocation of blocks of IP addresses, netflow and traffic analysis, metadata obtained from other adjacent/nearby users on same ISPs at either end, a whole fire hose of other data that's still useful even if the crypto is solid. > let's say Google has already identified your Reddit account. You open a Reddit discussion, and deep in the discussion it links to a Youtube video, and you open it in your browser. Now even if you weren't logged into Youtube, Google could guess that it's you based on the timing Not just timing but also cookies, client device/browser fingerprinting, IP address/what ISP you're on, and the usage patterns and logged in activity (and app-collected telemetry data on android and ios devices) of all the other persons in your household and neighbors.

woojoo666 4y ago
I guess part of my hope was that big tech didn't think timing analysis was worth the effort. But it's rather scary if they are truly scaling up their timing analysis efforts. Now, if you care about privacy, it's not enough to just use a VPN or stay logged out or use anonymous accounts. You have to worry about _when_ you open every webpage. Be wary of immediately opening links that your friend sends you, or sharing webpages that you had just opened to your friends. And that's not even factoring in fingerprinting attacks
- walrus01 4y ago
  the average residential DHCP-pool-assigned customer on a cablemodem, dsl, gpon line or something doesn't change IP addresses that much, and very often the dhcpd will renew the router/modem's WAN port lease with the same address for months at a time. even if it's not an actual static IP. this alone can be used to correlate a huge number of things since very often you have one household with a whole assortment of people and tablets, phones, laptops, xboxes, playstations, smart speakers etc all behind one IP address and NAT. just having an entity like google know that your ip address is coming from a /24 in a /19 sized IP block that's known to be a comcast dhcp pool in a particular city/metro area is a huge amount of info. other things happen as well. you have other people in your household who installed the facebook app on their phone and left geolocation/GPS permissions set to on? now your IP address has been correlated with a very specific latitude/longitude and the usage patterns of your (spouse, roommate, child, etc) who is using that app.
  - woojoo666 4y ago
    I'm well aware of the issues with IP (I mentioned that I use a VPN), and the general public is becoming more wary too, as can be seen with the rise of VPN usage. Which is why timing analysis is so scary, it bypasses most countermeasures
- jcims 4y ago
  This sounds more like a forensic analysis than an operational capability.

ta988 4y ago

It is used a lot, also to identify people on TOR. But you usually need something else if you want to use that in court. See: https://resources.infosecinstitute.com/topic/timing-analysis-attacks/ https://resources.infosecinstitute.com/topic/timing-analysis... Or the academic research on the domain https://scholar.google.com/scholar?hl=en&as_sdt=0%2C14&as_vis=1&q=timing+analysis+anonymizing+tor&btnG= https://scholar.google.com/scholar?hl=en&as_sdt=0%2C14&as_vi...

derefr 4y ago

> I've always wondered how often timing analysis is used in practice by surveillence big tech Temporal correlation is the difference between regular network analysis, and dynamic network analysis. Just search "dynamic network analysis" on Google Scholar, and look at who's writing the papers :) But to back up a step — every SaaS company does this on some level. If you have an backend audit-log for e.g. user registrations, and you eyeball it every so often to notice event clusters of people trying to bulk-register accounts in order to block their IPs — well, that's timing analysis!

root_axis 4y ago

In your example how does google correlate your particular reddit account with the link you clicked? YouTube can't access your reddit session cookie so how would google be able to disambiguate your reddit session from arbitrary traffic flowing through the reddit page?

woojoo666 4y ago
That's where the timing comes in. The reddit discussion I clicked the link from was an old one, and so was the youtube video (though it did have hundreds of thousands of views). I was probably the only person who opened them up within the same hour

smokeypanda 4y ago

I don't have an expert understanding of how cookies or VPNs function, but these are the two categories of causes that I came up with. Both seem more likely than Google having timing data from a third-party service. Within the first category, possibilities include that the phone logged into your Google account while using the VPN, that there was a Google tracking cookie on your phone and that phone wasn't always connected to the VPN so it related 2 ip addresses, and that your other device on same network shared a VPN session with your phone. The 2nd category I'm including for posterity even if it's unlikely based off your stated usage of FOSS on your phone. That your phone isn't a degoogled OS or other device with Google integration. Smart devices with microphones aren't supposed to collect voice data when not explicitly activated, but it is a potentiality.

woojoo666 4y ago
At this point I feel like I should have used a throwaway with how many details I'm giving away here haha, but I have never attached a google account to my phone (I access any google services via browser), and while I don't run a degoogled OS but I have disabled play services and all google features + apps. I'm aware that there's still a chance that Google has trackers, but those trackers would (1) have to detect which reddit account I was using inside my FOSS reddit client (2) detect which video I watched on my FOSS youtube client. It's possible but I decided that this level of surveillance was both more nefarious and less likely than them using timing analysis.

Youden 4y ago

Though worrying if it's done, I doubt that it's done at any scale in the way you're suggesting. Linking accounts is PII and the GDPR would require consent, right to view the information, right to correct the information and so on. I think it was only doable in the end in the article because the data were released as part of a legal process. Regarding your YouTube story, there are lots of examples of things like this (e.g. "I talked to someone about X in person then saw X in Facebook ads") but I haven't yet seen hard evidence. So far I've written it off as coincidence at scale.

woojoo666 4y ago
The GDPR considerations are interesting, and it does seem like GDPR can cover things like behavioral data [1]. I'm not sure how it works in regards to Newpipe, the FOSS youtube client I use though. I assume whatever scraper Newpipe uses in the background has already accepted the cookie consent dialog, which would allow Google to start scraping data like IPs and other behavioral data. Not an expert on GDPR law though obviously. As far as it being a coincidence, that's usually something I assume as well. But it really comes down to a game of probabilities. Is it more likely that it's a coincidence, or that Google is doing timing analysis? In this case, a coincidence just felt less likely. I check my youtube feed at least once a day, so I know what my recommendations look like. This recommendation was so out of the ordinary that it stood out to me in a sea of my usual recommendations. And it stood out so much that it prompted me to go back and check my Newpipe history and Reddit history, and spend like an hour investigating and trying to figure out what was most likely. I even wrote down notes about the incident. Also I should probably mention now that earlier I had said that I got those youtube recommendations the next day, but checking my notes now, it was actually within an hour. The video that was recommended to me was not some trending video, it was already a few months old. I also searched my Youtube history to see if I had watched anything else from the same channel, and I had only watched 2 videos from that channel total, and over a year prior. I know that timing analysis seems very nefarious, more high-effort and nefarious that I would expect from even a company like Google. But my guess is that they aren't doing it intentionally, they instead just feed a bunch of analytics data (that they have user consent to collect) into some giant ML model, and that ML model has learned to use timing in its predictions. [1]: https://blog.rsisecurity.com/what-is-considered-pii-under-gdpr/ https://blog.rsisecurity.com/what-is-considered-pii-under-gd...

xiphias2 4y ago

There was an article about how easy it is to find out if 2 of your Facebook friends are dating just by analyzing when your Facebook friends are online, and there isn't any effective way of stopping it from working other than disabling presence notifications.