4 ms·
I think a lot about this subject and have a lot to say about this. Rather than nit-pick, I want to showcase this particular item: "I ended up going for the Di
by rsync 4y ago
I think a lot about this subject and have a lot to say about this.
Rather than nit-pick, I want to showcase this particular item:
"I ended up going for the Disney lot, although they learned that they do have license plate readers. I was driving a rental car. Certainly, my name and driver's license are attached to that car, but that's through a different corporate database. A corporation that Disney does not own or have data rights to or share board members with ..."
(and later)
"Here I follow a different rule for obfuscation, which is to store data across corporate databases where the corporations have no prior relationship--or even an antagonistic one. I can be reasonably sure that, failing an acquisition, that data won't migrate."
This is wrong thinking.
Personal identifiers like phone number, license plate, address, etc., are commodities that are collected, digested and sold by many different third party providers.
He's thinking about Disney somehow comparing their license plate reader data with Hertz or something through some unlikely corporate agreement.
Far more likely is that both Disney and Hertz employ a third party data intel provider that gives them enterprise wide coverage and query for these, and other, identifiers while simultaneously acquiring the data to be made available via API to other "partners".
A good example of this is Ekata and their reverse phone product which, until recently, was available via Twilio API lookup:
/usr/local/bin/curl -s -X GET "https://lookups.twilio.com/v1/PhoneNumbers/$number?Type=carrier&Type=caller-name&AddOns=ekata_reverse_phone" -u $accountsid:$authtoken
... and would give you not only a reverse number lookup but also a list of "associated persons" as well as your address and number history.
I feel assured that APIs like this exist for license plates, SSNs, IMEI, etc.
I also strongly suspect that Disney and Hertz are both contributors to, and consumers of these APIs.
- cyberlyra 4y ago(Original author here). Yes I am aware of the identifiers that are sold through a third party data provider. Reading further, I also note that I decided not to care if Disneyland knows that I went, it was more about continuing to obfuscate my family, so I decided that was a risk I would accept. Of course, YMMV.
- matt-attack 4y agoCurious why you consider D+ asking for birthday and gender to be deal breakers? Why would you even consider providing real data to those question? Just simply make up a name, birthday and gender. That's what I do.
- cyberlyra 4y agoIt's not a dealbreaker for practical reasons, it's for moral ones. I don't think they should even ask for or collect that data, given the ability to de-anonymize that the additional information provides them. They don't need it and shouldn't ask. Especially as most people don't know they can just make stuff up, and never do. I'm with you, I make up email addresses, mail addresses, credit card numbers, pseudonyms, genders, birthdates etc...
- matt-attack 4y agoI actually feel better about mis-informing than not being asked. I feel it's an opportunity to actively mangle the data that's being aggregated.