12 ms·
> Fine will be way less than profits What profits were derived from the "sharing" of "millions of taxpayers' data?" I had to do a technical audit of this issu
by roadbuster 3y ago
> Fine will be way less than profits
What profits were derived from the "sharing" of "millions of taxpayers' data?"
I had to do a technical audit of this issue to find out if my company had also been placed at risk. What happened is this:
1. Facebook asks advertisers to place some javascript on their website to help with general measurements (i.e.: whether viewing an ad on a Facebook property ultimately led to a purchase)
2. This javascript may also gather user interactions on the website so an advertiser can see what users engage with, what might be relevant to ad performance measurement, etc
3. These stupid tax prep companies placed the script on pages where users might view, interact with, or submit very private information
4. When users clicked around, tracking data was sent to FB
5. A security/privacy journalist spotted this and said, "gotcha."
Ad Tech companies don't want your SSN, and they really don't know to know if you purchased Plan B. But when tax prep sites and online pharmacies place a tracking script on all their webpages, everyone ends up with egg on their face.
There were no profits here. The journalist's privacy investigation should be appreciated and celebrated, but Elizabeth Warren is just raising a boogeyman so she can keep sticking a knife into the hearts of these large, corporate entities. Election season is coming up, after all.
- throw9away6 3y agoHa well a nice strong fine then to discourage this stupid behavior of adding tracking scripts from 3rd party fines. I’d still like to see the executive that approved this spend 1 night in jail to prove a point that stupid has personal consequences
- roadbuster 3y ago> a nice strong fine Who receives the fine? * The Tax Prep companies? That would be fair: they are obligated to handle private user data in a responsible manner * The ad tech companies? That would not be fair: they didn't want the data, didn't know it was being sent, and almost assuredly didn't use it for any kind of ad serving, measurement, or optimization.
- Eisenstein 3y ago> The ad tech companies? That would not be fair If I send you a video camera and tell you to put it in your retail store and stream me the video and you put in your changing room and send me the data and I don't tell you to stop, am I free from liability?
- circuit10 3y agoIf you were doing that to millions of people and automatically analysing the video streams you get back for general trends then you wouldn’t really have a way to know that’s happening
- deleted 3y ago[deleted]
- throw9away6 3y agoYep so maybe massive fines and jail time would be a good deterrent
- notahacker 3y agoI certainly hope I'm free from liability from you sending me illegal videos of naked people unless I've explicitly requested illegal videos of naked people. More to the point, if companies are required to forensically analyse the hashes sent to their API endpoints to check they haven't received anything sensitive, the internet in its modern form would essentially cease to exist.
- throw9away6 3y agoWhat if your app sucks up all the data from my phone without consent and you get my nudes? I’d like to claw back your bonus for that at the very least
- roadbuster 3y ago> and I don't tell you to stop Alternate analogy: an IoT thermometer vendor sells you a device to track temperature in your room, but you decide to stick it up someone's butt. Will the IoT vendor know the temperature reading is personal and rectal? Should they be held liable for not proactively attempting to scrub-out numbers which may represent gluteal climate?
- notahacker 3y agoI'm not sure jailing the low level employee that pasted some javascript into a footer template, or the low level employee that sent them the link with an email saying "this is the script we need to add to our signup flow" is going to achieve very much. This stuff happens because there isn't an exec approval process...
- Eisenstein 3y agoThen make an example and disband the company and all shareholders lose all equity. Have people realize they will lose money if they don't pay attention to details.
- notahacker 3y agoDisbanding a company for including a Google Analytics tracker on their website, causing $0 worth of losses and damages seems a little excessive.
- Eisenstein 3y agoSo what is the line, then? Inadvertently sucking up people's tax return info and sending to who knows where because they get a few incentives for it is fine? What about a VoIP company sending call metadata? Or a burglar alarm company sending when you are home or not? At what point can we say 'make your money decently and don't sell customer data for a few pennies or you get made an example of'?
- mcpackieh 3y agoIt's far too little. The executives should be given the death penalty for this. They and the rest of the surveillance capitalists have waged war against society and deserve guillotines for it. We need to put a firm stop to this madness before the surveillance industry locks us all into a global panopticon. The stakes couldn't be higher.
- boeingUH60 3y agoAll employees should lose their jobs because an incompetent engineer made a mistake? What’s with some people and irrational mob justice? Does it make them feel good or what…
- cscurmudgeon 3y agoWhat law calls for such a harsh punishment?
- psychlops 3y agoDon't spend money securing customer data...voila! Profit!
- donmcronald 3y ago> Elizabeth Warren is just raising a boogeyman so she can keep sticking a knife into the hearts of these large, corporate entities I’d say what you described at least comes close to being negligent. I’d hardly call that a “boogeyman”. It’s a serious issue that shouldn’t have occurred and there should be some repercussions for that.
- jlarocco 3y agoAnd you have to wonder if they're screwing up something this simple, what else are they screwing up?
- dylan604 3y ago> Ad Tech companies don't want your SSN Where do you get that idea? All they doin the background is to deanonymize as much data as they can get. Why do you think they would not actually want this ultimate deanonymizer of US citizens?
- thumbuddy 3y agoI'm with you on this one Dylan. Of course they do.
- 13of40 3y agoI feel like SSN is a big liability with little benefit over a different primary key like your phone number. SSN would be important if you're signing a mortgage, but these people are tracking how often you buy dogfood and pregnancy tests.
- orthecreedence 3y agoSHA256(<ssn>) ...there, boom, tracking with no liability. These slimy companies will grab every piece of data they can.
- Zak 3y agoThe article discusses hashing being an inadequate method of anonymization.
- TheCoelacanth 3y agoConsidering that there are only 1 billion possible SSNs, that seems like it would be easily reversible simply by pre-computing a lookup table of all 1 billion hashes.
- klyrs 3y ago> I feel like SSN is a big liability with little benefit Your feelings on the matter are quite irrelevant -- they want every bit of data about your financial life as possible. Including your mortgage, income, etc. The SSN it the ultimate primary key. You can't even get a new one if your identity is stolen. The more often they can link that to an email address, phone number, etc, the stronger the signal they get from sources that only have those bits.
- JKCalhoun 3y ago> 1. Facebook asks advertisers to place some javascript on their website : > 3. These stupid tax prep companies placed the script on pages where users might view, interact with, or submit very private information I think you're being far too easy on Facebook.
- noduerme 3y agoI had to spend most of my day doing a technical audit on this as well. I can certainly see how they could have profited from data contained in certain forms that customers submitted on non-facebook websites, potentially confidential data which would be used to flesh out hidden user profiles and thus increase the prices for highly targeted ads.
- kerkeslager 3y agoSeriously? This post strains credulity. 1. This isn't just a gotcha. If you're storing private data, be a fucking responsible human being and do the work to store it securely. Stop downplaying this. 2. Ad tech companies don't want your SSN or to know if you purchased Plan B? Ad tech companies want to know everything about you, especially things that are private because other people don't know that stuff and that's where the competitive advantage lies. > There were no profits here. There were cut costs, which amount to the same thing.