3 ms·

I've advocated this for a long time, with the added proviso that it must be impossible for apps to figure out whether you chose to feed them fake data or not.

dredmorbius 3y ago
An unfortunate characteristic of data fuzzing is that given sufficient alternative sources of information it's actually reasonably easy to filter out the noise. A key issue is whether the noise refers to subjects which are entirely generated or which exist in the world, though even this only incrementally adds to the noise level. Take the case of contacts. If I were to use a random ID generate to create contacts and feed those to an app, then with sufficient independent sources of data the app could choose to reject any contact which appears only once. If you happen to be the One And Only True Friend of an Orphan Hermit, then yes, that rule would exclude that data, but if you happen to be personal BFFs with Beyoncé Giselle Knowles-Carter, the system could not only independently validate that such a person exists, but even that your own reported contact information is, say, directly personal rather than a mass-media point-of-contact. The other problem is that even with generated data, so long as that is intermixed with authentic data, it's often possible to tease out signal from noise. A case here might be with browser history. There are Web browsers which generate spurious traffic. This is "real" in the senses both that it refers to actual online Web resources, and represents traffic generated by your browser, but is generated in the sense that it does not represent volitional activity on your part. However, so long as both activities are present, your actual browsing patterns exist (so that if a concern is that you did in fact visit <https://example.com/xyz https://example.com/xyz>, it would be possible to determine that some entity (genuine or simulated) did so, and that if the URL were simply randomly generated or visited, odds are reasonably low that that URL would appear within a browser history. Similarly, in a combination of actual and faked contacts, if the question is "did the subject include Known Individual in their contacts", that fact can still be determined, and if statistically improbable, particularly amongst a group of individuals all including Known Individual in their contacts, the general inference of an actual relationship is strong. The case of being able to entirely separate actual and generated information changes this dynamic ... slightly, but not overhwhelmingly. My own upshots: - Data chaffing and fuzzing are hard. - The signal one wishes to obscure often leaks. - Entirely-fabricated data is usually reasonably evident, especially in aggregate. - Whilst some degree of chaffing has some value (signalling, protest, cost-increasing), the most effective course of action is likely effective privacy legislation and regulation. I really wish there were more effective individual actions. I increasingly feel that there aren't, other than opting out entirely. (Something I increasingly practice myself, FWIW.)

dredmorbius 3y ago

An unfortunate characteristic of data fuzzing is that given sufficient alternative sources of information it's actually reasonably easy to filter out the noise. A key issue is whether the noise refers to subjects which are entirely generated or which exist in the world, though even this only incrementally adds to the noise level. Take the case of contacts. If I were to use a random ID generate to create contacts and feed those to an app, then with sufficient independent sources of data the app could choose to reject any contact which appears only once. If you happen to be the One And Only True Friend of an Orphan Hermit, then yes, that rule would exclude that data, but if you happen to be personal BFFs with Beyoncé Giselle Knowles-Carter, the system could not only independently validate that such a person exists, but even that your own reported contact information is, say, directly personal rather than a mass-media point-of-contact. The other problem is that even with generated data, so long as that is intermixed with authentic data, it's often possible to tease out signal from noise. A case here might be with browser history. There are Web browsers which generate spurious traffic. This is "real" in the senses both that it refers to actual online Web resources, and represents traffic generated by your browser, but is generated in the sense that it does not represent volitional activity on your part. However, so long as both activities are present, your actual browsing patterns exist (so that if a concern is that you did in fact visit <https://example.com/xyz https://example.com/xyz>, it would be possible to determine that some entity (genuine or simulated) did so, and that if the URL were simply randomly generated or visited, odds are reasonably low that that URL would appear within a browser history. Similarly, in a combination of actual and faked contacts, if the question is "did the subject include Known Individual in their contacts", that fact can still be determined, and if statistically improbable, particularly amongst a group of individuals all including Known Individual in their contacts, the general inference of an actual relationship is strong. The case of being able to entirely separate actual and generated information changes this dynamic ... slightly, but not overhwhelmingly. My own upshots: - Data chaffing and fuzzing are hard. - The signal one wishes to obscure often leaks. - Entirely-fabricated data is usually reasonably evident, especially in aggregate. - Whilst some degree of chaffing has some value (signalling, protest, cost-increasing), the most effective course of action is likely effective privacy legislation and regulation. I really wish there were more effective individual actions. I increasingly feel that there aren't, other than opting out entirely. (Something I increasingly practice myself, FWIW.)