6 ms·

I guess part of my hope was that big tech didn't think timing analysis was worth the effort. But it's rather scary if they are truly scaling up their timing ana

I guess part of my hope was that big tech didn't think timing analysis was worth the effort. But it's rather scary if they are truly scaling up their timing analysis efforts. Now, if you care about privacy, it's not enough to just use a VPN or stay logged out or use anonymous accounts. You have to worry about _when_ you open every webpage. Be wary of immediately opening links that your friend sends you, or sharing webpages that you had just opened to your friends. And that's not even factoring in fingerprinting attacks

walrus01 4y ago
the average residential DHCP-pool-assigned customer on a cablemodem, dsl, gpon line or something doesn't change IP addresses that much, and very often the dhcpd will renew the router/modem's WAN port lease with the same address for months at a time. even if it's not an actual static IP. this alone can be used to correlate a huge number of things since very often you have one household with a whole assortment of people and tablets, phones, laptops, xboxes, playstations, smart speakers etc all behind one IP address and NAT. just having an entity like google know that your ip address is coming from a /24 in a /19 sized IP block that's known to be a comcast dhcp pool in a particular city/metro area is a huge amount of info. other things happen as well. you have other people in your household who installed the facebook app on their phone and left geolocation/GPS permissions set to on? now your IP address has been correlated with a very specific latitude/longitude and the usage patterns of your (spouse, roommate, child, etc) who is using that app.
- woojoo666 4y ago
  I'm well aware of the issues with IP (I mentioned that I use a VPN), and the general public is becoming more wary too, as can be seen with the rise of VPN usage. Which is why timing analysis is so scary, it bypasses most countermeasures
jcims 4y ago
This sounds more like a forensic analysis than an operational capability.
- woojoo666 4y ago
  Well it means that Google logs and preserves all that data for at least a few months. Who knows what they do with it
  - ta988 4y ago
    Store it because nobody knows what to do with it?
    - woojoo666 4y ago
      That's the optimistic case I guess. But I've already given an example where I suspect Google used timing analysis to figure out a youtube video that I watched (over VPN and using a FOSS youtube client). I think it's plausible that Google is already using timing analysis to track users
    - iamacyborg 4y ago
      That would explicitly not be in line with the GDPR. Specifically, it would break 5.1(b) - purpose limitation. > collected for specified, explicit and legitimate purposes
      - scrollaway 4y ago
        Data about logged in sessions is generally stored for security purposes. If a malicious person had access to your account you want to know for how long they had that access for example.
        iamacyborg 4y ago
        Sure, that seems like it’d be a legitimate purpose, my comment was more a response to this. > Store it because nobody knows what to do with it?

walrus01 4y ago

the average residential DHCP-pool-assigned customer on a cablemodem, dsl, gpon line or something doesn't change IP addresses that much, and very often the dhcpd will renew the router/modem's WAN port lease with the same address for months at a time. even if it's not an actual static IP. this alone can be used to correlate a huge number of things since very often you have one household with a whole assortment of people and tablets, phones, laptops, xboxes, playstations, smart speakers etc all behind one IP address and NAT. just having an entity like google know that your ip address is coming from a /24 in a /19 sized IP block that's known to be a comcast dhcp pool in a particular city/metro area is a huge amount of info. other things happen as well. you have other people in your household who installed the facebook app on their phone and left geolocation/GPS permissions set to on? now your IP address has been correlated with a very specific latitude/longitude and the usage patterns of your (spouse, roommate, child, etc) who is using that app.

woojoo666 4y ago
I'm well aware of the issues with IP (I mentioned that I use a VPN), and the general public is becoming more wary too, as can be seen with the rise of VPN usage. Which is why timing analysis is so scary, it bypasses most countermeasures

jcims 4y ago

This sounds more like a forensic analysis than an operational capability.

woojoo666 4y ago
Well it means that Google logs and preserves all that data for at least a few months. Who knows what they do with it
- ta988 4y ago
  Store it because nobody knows what to do with it?
  - woojoo666 4y ago
    That's the optimistic case I guess. But I've already given an example where I suspect Google used timing analysis to figure out a youtube video that I watched (over VPN and using a FOSS youtube client). I think it's plausible that Google is already using timing analysis to track users
  - iamacyborg 4y ago
    That would explicitly not be in line with the GDPR. Specifically, it would break 5.1(b) - purpose limitation. > collected for specified, explicit and legitimate purposes
    - scrollaway 4y ago
      Data about logged in sessions is generally stored for security purposes. If a malicious person had access to your account you want to know for how long they had that access for example.
      - iamacyborg 4y ago
        Sure, that seems like it’d be a legitimate purpose, my comment was more a response to this. > Store it because nobody knows what to do with it?