4 ms·

Privacy first is just not collecting the data. Everything else is just a compromise and an excuse.

by SllX 2y ago

dylan604 2y ago
I don't have a problem if the server side is tracking metrics on what queries are being made. When it becomes a problem is trying to associate the queries based on a single user regardless on anonymization attempts. Of course there's no money in that.
- stevenicr 2y ago
  Wasn't like 15? years ago with the AOL search data anonymized release that people found multiple ways to connect dots to whittle it down to just one person or a small subset of people? Wasn't this also shown with anonymized taxi-cab data (released in NY?) many moons ago? Would it not be possible with knowing that you are tracking this data to funnel people into doing searches in a way that would reveal things? Directions to the out of state reproductive health clinic, combined with card data would be all it takes to do serious things to people in some states. Defaults matter. A lot. Anonymized data is not always anonymous, collected server side or otherwise.
  - salawat 2y ago
    Anonymization is effectively not achievable. Limited anonymoty may be possible within the scope of a particular dataset, but all it yakes is one enrichment pipeline to strip that all away. If you don't think that's what places like insurers do on a regular basis, you're a fool.
  - ziddoap 2y ago
    Yes, this is a process called (fittingly) data re-identification. There are many papers on the topic. One of the more popular examples is "Robust De-anonymization of Large Sparse Datasets" using the Netflix Prize Dataset. >We apply our de-anonymization methodology to the Netflix Prize dataset, which contains anonymous movie ratings of 500,000 subscribers of Netflix, the world’s largest online movie rental service. We demonstrate that an adversary who knows only a little bit about an individual subscriber can easily identify this subscriber’s record in the dataset. Using the Internet Movie Database as the source of background knowledge, we successfully identified the Netflix records of known users, uncovering their apparent political preferences and other potentially sensitive information. https://www.cs.utexas.edu/~shmat/shmat_oak08netflix.pdf https://www.cs.utexas.edu/~shmat/shmat_oak08netflix.pdf This paper speaks about AOL in 2006, which I think you are referring to: https://digitalcommons.law.uw.edu/cgi/viewcontent.cgi?article=1075&context=wjlta https://digitalcommons.law.uw.edu/cgi/viewcontent.cgi?articl... However, it should be noted that the AOL dataset had a bunch of stuff that was identifiable by its nature (e.g. people searching for their full names or address), and the dataset wasn't scrubbed of those searches. So the controversy wasn't just re-identification of data, but also just a bunch of already-identifiable data. >Anonymized data is not always anonymous More importantly, in my opinion, is that data that is anonymous now is just one other dataset away from not being anonymous anymore.
  - saghm 2y ago
    > Anonymized data is not always anonymous, collected server side or otherwise If anything, I think it's both safer and more accurate to start from the assumption "anonymized" data can be de-anonymized and and require evidence to refute that rather than starting from a place of assumption that anonymization works and then trying to find a way to attack it. In practice, there's just not a good track record of this being done effectively, and I think people should generally be skeptical of whether this is even possible in many cases.
    - JohnFen 2y ago
      There is only one way that data can really be "anonymized": if the individual data points are aggregated and the original collected data is deleted. Short of that, anonymization is basically illusory. The trouble is that we'd still have to take the word of the entity doing the data collection that they've done this properly, and it's clear that we can't take anyone's word for that.
unethical_ban 2y ago
Do you believe there is no utility in knowledge? Do you believe absolutism is the only philosophy for privacy? I think telemetry and the data software collects can help with usability, design, and product enhancement and that it's very likely this can be done to some extent without harming privacy.
- autoexec 2y ago
  > I think telemetry and the data software collects can help with usability, design, and product enhancement It can, but that's too often little more than a justification to take as much data as possible much of which is misused. In this case, what a person searches for on the internet isn't helping one bit with "usability, design, and product enhancement"
- salawat 2y ago
  You know what? That's fine and good. Ask users to opt-in, and respect the wishes of those who opt-out. Anything short of that is you ignoring the concept of consent entirely, and doing whatever mental gymnastics you can to feel fine with doing so.
  - Barrin92 2y ago
    This has nothing to do with mental gymnastics. Consent isn't a meaningful concept when it comes to each individual setting of a piece of software. You'd have to make 500 decisions every minute if you had to actively consent to everything your software does. In fact cookie banners show this. People hate them because they force meaningless choices on them. If you make a website with tracking as an opt-out option, almost everyone clicks "accept all". If you make a website with tracking as opt-in, almost every one clicks accept all. That shows that opt-in/out or consent does literally nothing ot reflect people's preferences, the act of making a choice completely dominates the actual decision. That means that if you want to respect user preferences you don't actually get around making default choices for them, and it's why consent is pretty much meaningless.
    - bobthecowboy 2y ago

Privacy first is just not collecting the data. Everything else is just a compromise and an excuse.

by SllX 2y ago

Privacy first is just not collecting the data. Everything else is just a compromise and an excuse.

I don't have a problem if the server side is tracking metrics on what queries are being made. When it becomes a problem is trying to associate the queries based on a single user regardless on anonymization attempts. Of course there's no money in that.

stevenicr 2y ago
Wasn't like 15? years ago with the AOL search data anonymized release that people found multiple ways to connect dots to whittle it down to just one person or a small subset of people? Wasn't this also shown with anonymized taxi-cab data (released in NY?) many moons ago? Would it not be possible with knowing that you are tracking this data to funnel people into doing searches in a way that would reveal things? Directions to the out of state reproductive health clinic, combined with card data would be all it takes to do serious things to people in some states. Defaults matter. A lot. Anonymized data is not always anonymous, collected server side or otherwise.
- salawat 2y ago
  Anonymization is effectively not achievable. Limited anonymoty may be possible within the scope of a particular dataset, but all it yakes is one enrichment pipeline to strip that all away. If you don't think that's what places like insurers do on a regular basis, you're a fool.
- ziddoap 2y ago
  Yes, this is a process called (fittingly) data re-identification. There are many papers on the topic. One of the more popular examples is "Robust De-anonymization of Large Sparse Datasets" using the Netflix Prize Dataset. >We apply our de-anonymization methodology to the Netflix Prize dataset, which contains anonymous movie ratings of 500,000 subscribers of Netflix, the world’s largest online movie rental service. We demonstrate that an adversary who knows only a little bit about an individual subscriber can easily identify this subscriber’s record in the dataset. Using the Internet Movie Database as the source of background knowledge, we successfully identified the Netflix records of known users, uncovering their apparent political preferences and other potentially sensitive information. https://www.cs.utexas.edu/~shmat/shmat_oak08netflix.pdf https://www.cs.utexas.edu/~shmat/shmat_oak08netflix.pdf This paper speaks about AOL in 2006, which I think you are referring to: https://digitalcommons.law.uw.edu/cgi/viewcontent.cgi?article=1075&context=wjlta https://digitalcommons.law.uw.edu/cgi/viewcontent.cgi?articl... However, it should be noted that the AOL dataset had a bunch of stuff that was identifiable by its nature (e.g. people searching for their full names or address), and the dataset wasn't scrubbed of those searches. So the controversy wasn't just re-identification of data, but also just a bunch of already-identifiable data. >Anonymized data is not always anonymous More importantly, in my opinion, is that data that is anonymous now is just one other dataset away from not being anonymous anymore.
- saghm 2y ago
  > Anonymized data is not always anonymous, collected server side or otherwise If anything, I think it's both safer and more accurate to start from the assumption "anonymized" data can be de-anonymized and and require evidence to refute that rather than starting from a place of assumption that anonymization works and then trying to find a way to attack it. In practice, there's just not a good track record of this being done effectively, and I think people should generally be skeptical of whether this is even possible in many cases.
  - JohnFen 2y ago
    There is only one way that data can really be "anonymized": if the individual data points are aggregated and the original collected data is deleted. Short of that, anonymization is basically illusory. The trouble is that we'd still have to take the word of the entity doing the data collection that they've done this properly, and it's clear that we can't take anyone's word for that.

unethical_ban 2y ago

Do you believe there is no utility in knowledge? Do you believe absolutism is the only philosophy for privacy? I think telemetry and the data software collects can help with usability, design, and product enhancement and that it's very likely this can be done to some extent without harming privacy.

autoexec 2y ago
> I think telemetry and the data software collects can help with usability, design, and product enhancement It can, but that's too often little more than a justification to take as much data as possible much of which is misused. In this case, what a person searches for on the internet isn't helping one bit with "usability, design, and product enhancement"
salawat 2y ago
You know what? That's fine and good. Ask users to opt-in, and respect the wishes of those who opt-out. Anything short of that is you ignoring the concept of consent entirely, and doing whatever mental gymnastics you can to feel fine with doing so.
- Barrin92 2y ago
  This has nothing to do with mental gymnastics. Consent isn't a meaningful concept when it comes to each individual setting of a piece of software. You'd have to make 500 decisions every minute if you had to actively consent to everything your software does. In fact cookie banners show this. People hate them because they force meaningless choices on them. If you make a website with tracking as an opt-out option, almost everyone clicks "accept all". If you make a website with tracking as opt-in, almost every one clicks accept all. That shows that opt-in/out or consent does literally nothing ot reflect people's preferences, the act of making a choice completely dominates the actual decision. That means that if you want to respect user preferences you don't actually get around making default choices for them, and it's why consent is pretty much meaningless.
  - bobthecowboy 2y ago