4 ms·
> I've always wondered how often timing analysis is used in practice by surveillence big tech Books written about the NSA, GCHQ, CSE etc talk about them using
by walrus01 4y ago
> I've always wondered how often timing analysis is used in practice by surveillence big tech
Books written about the NSA, GCHQ, CSE etc talk about them using things like timestamp logs/traffic analysis/time of day analyzing commercial and government telecom links going back to the 1960s, so in the modern era even if your crypto is absolutely unbreakable, there's a huge amount of analysis and correlation that can be done based on timing analysis.
Then you combine your timing analysis with things like correlating geolocation of blocks of IP addresses, netflow and traffic analysis, metadata obtained from other adjacent/nearby users on same ISPs at either end, a whole fire hose of other data that's still useful even if the crypto is solid.
> let's say Google has already identified your Reddit account. You open a Reddit discussion, and deep in the discussion it links to a Youtube video, and you open it in your browser. Now even if you weren't logged into Youtube, Google could guess that it's you based on the timing
Not just timing but also cookies, client device/browser fingerprinting, IP address/what ISP you're on, and the usage patterns and logged in activity (and app-collected telemetry data on android and ios devices) of all the other persons in your household and neighbors.
- woojoo666 4y agoI guess part of my hope was that big tech didn't think timing analysis was worth the effort. But it's rather scary if they are truly scaling up their timing analysis efforts. Now, if you care about privacy, it's not enough to just use a VPN or stay logged out or use anonymous accounts. You have to worry about _when_ you open every webpage. Be wary of immediately opening links that your friend sends you, or sharing webpages that you had just opened to your friends. And that's not even factoring in fingerprinting attacks
- walrus01 4y agothe average residential DHCP-pool-assigned customer on a cablemodem, dsl, gpon line or something doesn't change IP addresses that much, and very often the dhcpd will renew the router/modem's WAN port lease with the same address for months at a time. even if it's not an actual static IP. this alone can be used to correlate a huge number of things since very often you have one household with a whole assortment of people and tablets, phones, laptops, xboxes, playstations, smart speakers etc all behind one IP address and NAT. just having an entity like google know that your ip address is coming from a /24 in a /19 sized IP block that's known to be a comcast dhcp pool in a particular city/metro area is a huge amount of info. other things happen as well. you have other people in your household who installed the facebook app on their phone and left geolocation/GPS permissions set to on? now your IP address has been correlated with a very specific latitude/longitude and the usage patterns of your (spouse, roommate, child, etc) who is using that app.
- woojoo666 4y agoI'm well aware of the issues with IP (I mentioned that I use a VPN), and the general public is becoming more wary too, as can be seen with the rise of VPN usage. Which is why timing analysis is so scary, it bypasses most countermeasures
- jcims 4y agoThis sounds more like a forensic analysis than an operational capability.
- woojoo666 4y agoWell it means that Google logs and preserves all that data for at least a few months. Who knows what they do with it
- ta988 4y agoStore it because nobody knows what to do with it?
- woojoo666 4y agoThat's the optimistic case I guess. But I've already given an example where I suspect Google used timing analysis to figure out a youtube video that I watched (over VPN and using a FOSS youtube client). I think it's plausible that Google is already using timing analysis to track users
- iamacyborg 4y agoThat would explicitly not be in line with the GDPR. Specifically, it would break 5.1(b) - purpose limitation. > collected for specified, explicit and legitimate purposes
- scrollaway 4y agoData about logged in sessions is generally stored for security purposes. If a malicious person had access to your account you want to know for how long they had that access for example.
- iamacyborg 4y agoSure, that seems like it’d be a legitimate purpose, my comment was more a response to this. > Store it because nobody knows what to do with it?
- ChrisMarshallNY 4y agoI can’t easily find the links (but I’m sure they are available), but there’s a [relatively] new science, that ‘fingerprints’ people’s writing style. I think the technique, itself, is decades old, but has been vastly improved, using AI and algorithms. It can be used to match things like anonymous rants, to individuals.
- walrus01 4y agoAs I recall, the Unabomber's brother read a portion of the manifesto and recognized Ted's writing style.
- ChrisMarshallNY 4y agoYes. It used the world’s oldest “AI”; the human brain. But that is exactly how this works. From what I understand, the “enhanced” version of the technique is scarily accurate, able to match, using just a couple of sentences.
- yajjackson 4y agoHave any good links to papers or books covering the state of the art in developing these systems?