11 ms·
The amount and extent of data that is available out there by brokers for purchase by literally any company is *mind-boggling*. However bad you think it is, mult
by leblancfg 1y ago
The amount and extent of data that is available out there by brokers for purchase by literally any company is *mind-boggling*. However bad you think it is, multiply that by 10.
- jeffbee 1y agoI would say that in general the HN crowd doesn't understand the industry at all, and they need to change the direction of their understanding, rather than the magnitude. Your basic hackernews believes that e.g. Google is out there selling all your personal information. But compared to these other industries the tech industry is almost airtight. It has long been possible for someone to pick up the phone and order, in any format they want, transaction data as narrowly targeted as they wish. Credit card line items for 35-year-old dentists living on the 400 block of Elm street in local town? By end of day.
- sofixa 1y ago> Your basic hackernews believes that e.g. Google is out there selling all your personal information To add to this, any mention of "telemetry" is taken to mean your PII being taken by bad actors to abuse, instead of what it is in 99% of cases, which is usage statistics. (X% of our users use feature A, it merits investment). It can be both, but there's usually no place for differentiation, just pitchforks.
- ctoth 1y ago> It can be both, but there's usually no place for differentiation Fool me once, shame on you. Fool me 153,927,861 times, shame on me. The place for differentiation, the place for "oh this is probably fine", the benefit of the doubt is, of course, lost. Because someone (you? people shaped like you?) who misuse telemetry destroyed trust. > It can be both should instead be "it usually is both and you the user have no way to know anyway."
- mvieira38 1y agoThe industry betrayed consumers' trust to the point where no project can be trusted to be mindful of data anymore. Even Proton Mail ended up ratting to the French, and that was just IP and session info, so who can we even trust to get "good telemetry"?
- jeffbee 1y agoI don't think it is common to refer to server logs as "telemetry".
- sofixa 1y ago> Even Proton Mail ended up ratting to the French, Answering to court orders isn't "ratting". You either answer court orders or go to prison.
- aspenmayer 1y agoOr they architect their system better so that they never collect the IP addresses to begin with. I think Privacy Pass and other things Mullvad is doing help in this area, but I am not aware of Proton working with them to implement anything like this. But Proton should do this, because it’s relevant to customers of Proton. https://discuss.privacyguides.net/t/privacy-pass-the-new-protocol-for-private-authentication/26882 https://discuss.privacyguides.net/t/privacy-pass-the-new-pro... Apparently not Privacy Pass related, will keep looking as I seem to remember that Mullvad was doing that implementation, but I may remember incorrectly. https://discuss.privacyguides.net/t/mullvad-has-partnered-with-obscura-vpn/24860 https://discuss.privacyguides.net/t/mullvad-has-partnered-wi...
- some_random 1y agoLogs aren't telemetry and calling a response to a court order "ratting out" is exactly the kind of behavior that makes people increasingly skeptical of privacy advocates.
- everdrive 1y agoI'm also surprised that this is so hidden from everyone. Where are the engineers leaking secrets? Much of the online discourse is pure speculation based on what can be observed from the very end of the chain. (ie, what your computer is giving up) The speculation is not necessarily _incorrect_ but is too vague to be useful to anyone. Where does my data _actually_ go? Does anyone know? Can anyone describe the life of my data as it goes through the whole ecosystem? Does anyone know what mitigations are, and are not effective?
- hinterlands 1y agoBecause what's the headline you're going to get out of it? If the headline is "Mark Zuckerberg is amassing your data and you know it's for evil", it's an easy sell. If it's "there's an ecosystem of little-known companies that sell transaction, location and lifestyle data to marketers, journalists, PIs, and police departments alike", it's not exactly the kind of a message that spurs people to action. And yeah, the newspaper that would be breaking the news is a customer too.
- ujkhsjkdhf234 1y agoDespite being near universally hated externally, data brokering is a boring industry and is seen as very mundane and routine. They don't attract the type of engineers that have a strong moral stance and will go rogue and blow the whistle. They attract the middle age suburbanite just trying to get through the day and make a living.
- supriyo-biswas 1y agoThis is correct; what people fundamentally misunderstand is that data brokers directly sell personal information about people, but Google and Facebook only allow for targeted advertising while keeping personal information within the confines of their company.
- jeffbee 1y agoThe meta-conspiracy-theory would be that the dossier industry whips up conspiracy theories about online advertisers in order to maintain their own low profile.
- andrew_lettuce 1y agoThis isn't misunderstood, just not relevant. Google sells to a funnel that plays a numbers game, not for individuals to be targeted.
- taeric 1y agoIt has been truly frustrating when people will blame the "tech industry" for what is essentially reckless behavior from other industries. For a while, it was often the finance sector that did most of the crazy stuff. With crypto being an obnoxious overlap of the two.
- flossposse 1y agoIt has been truly frustrating when arms dealers are punished for what is essentially reckless behavior from warlords, dictators, and drug cartels.
- taeric 1y agoI'm not entirely sure I follow? Most of the "arms" that people love to complain about aren't created or sold by "big tech." Some of this is that people are rather wrong about just how much smarter some of the big consumer tech companies are.
- kevin_thibedeau 1y agoData brokers are the OG tech industry. They've been around since the late 60s selling consumer data. Just because it's unsexy data storage and query work doesn't make it less tech.
- taeric 1y agoI mean, somewhat fair. But when people decry "big tech," they aren't talking about these companies.
- ck_one 1y agoIs that actually possible? Can we do a live test here? Let's say we want this dataset: Credit card line items for 35-year-old dentists living on the 400 block of Elm street in local town How much do I have to pay you to get it?
- dylan604 1y agoHow much you got? Never ask a sales person how much yo have to pay when the prices are not already clearly stated. Tell them how much you are willing to spend to see if they will do it for that amount. Sales people will always shoot high hoping to not leave money on the table. The price might change depending on how much you squeal and how high they shot. Your initial "willing to spend" should also be lower than you're actually willing to spend for the same but converse reason
- metamet 1y agoBut what type of range are we talking? Tens, hundreds, thousands?
- dylan604 1y agoIt could also mean that if you have to ask... or the first rule of data brokering... Seems like the first thing to do would be to get an account with one of these data brokers. I'd imagine most of these places are "contact us for pricing" so they can play used car salesman games Or, you could ask John Oliver to do it for you and then tell all of us on one of his episodes exactly how in depth it could get. They have the money to do this, and it seems like something right in his team's wheel house
- some_random 1y agoIf you need John Oliver to do it maybe it's not such a big problem? If no one here is able to provide a single concrete example, maybe it's not real?
- Melatonic 1y agoAnyway to opt out of this type of data collection per company? I know for some things you can contact each individual broker and opt out (via some identifier like your email address) of your data being at least publicly available
- southernplaces7 1y agoOkay, and who are these people you contact for this data, and how do they themselves obtain it so precisely? You say the big tech industry is pretty air-tight about sharing data, so how does mysterious X company have on hand the credit ratings of all those youngish dentists on Elm street, among other kinds of information? How o these dynamics work, since you seem to know it internally?
- pdoege 1y agoA mobile provider enters into marketing sharing agreements with credit card companies. It extracts housing information from local property and tax records. It enters into marketing sharing agreements with retailers, payment processors like ADP. Same with license plate reading companies, loan companies, banks, professional organizations, etc. It fills its data lakes with the vectorization and down tilt data that it collects every day. It uses federated batched Hadoop tasks to join the above data lakes into one large data lake. Mid-PB in size. Then it looks for mobile phones that travel to the 400 block at night and stay there, that are buying dentist stuff from Walmart, travel to a dentist office every workday, have an income over $120k, and are a member of the local dentist society. Maybe look for someone with dentist student loans, graduated with a dental degree. None of those data points can identify an individual. Taken together they can ID just about anybody. But maybe there is a chance that you ID their wife/husband. So maybe include/exclude people that regularly visit OBGYN offices. Back in the day we could link cell numbers to credit card purchases in locations to the point of being to identify the name of the person and what they purchased and where it was purchased. For all people in a metro area that were using credit cards and physically visiting stores.
- worik 1y ago> Credit card line items for 35-year-old dentists living on the 400 block of Elm street I do not believe that. I would like evidence before I am convinced If my bank is releasing that data I am horrified. I live in anew Zealand and our privacy laws are clear: it would be illegal
- mixmastamyk 1y agoBackwards in 2025, ask for proof it is not happening. It’s the POS terminal that actually sells the data, btw. NZ may be “behind.”
- worik 1y agoSame comment for PoS We have strict privacy laws That would put us ahead?
- mixmastamyk 1y agoNot an expert in NZ law, but they’d have to be comprehensive to completely stop it. Legislators are not typically savvy in the area as well.
- worik 1y agoThe law is very clear (IANAL but I was responsible once for compliance with this law) If I collect your private information for a purpose, I may only use it for that purpose. I may not sell it So if I have your transaction details I may use them to complete the transaction, no other purpose
- criddell 1y ago> Your basic hackernews believes that e.g. Google is out there selling all your personal information. I think most people here understand that Google sells ads against that data, but they aren't selling the data.
- flossposse 1y agoI think the HN crowd is especially vocal about the tech industry in particular because that's the industry a lot of us have first-hand knowledge of - we know from personal observation that it is anything but airtight
- onlyrealcuzzo 1y agoFurther, they are literally in the business of selling your data for a profit. It should not be surprising that they are selling your data for a profit...
- JohnMakin 1y agoI work in this space - I'd say 1000x.
- OsrsNeedsf2P 1y agoCould you elaborate with specifics? If it's this bad, why haven't we heard anything from a whistleblower or seen a good demo?
- rapind 1y agoWe hear about it all the time but no one cares.
- seplox 1y agoI guess you were just distracted by all of the other house-on-fire crap going on. https://therecord.media/ftc-complaint-against-kochava-unsealed https://therecord.media/ftc-complaint-against-kochava-unseal... Among the additional information Kochava collects and sells are non-anonymized individual home addresses, phone numbers, email addresses, gender, age, ethnicity, yearly income, “economic stability,” marital status, education level, political affiliation and “interests and behaviors,” compiling and selling dossiers on individuals marketed as offering a “360-degree perspective,” the FTC said. ... According to the FTC, Kochava’s data can identify women who visit reproductive clinics by name and address along with, for example, when they visit particular buildings, their names, email and home addresses, number of children, race and app usage. ... Kochava marketing materials tell customers it offers “rich geo data spanning billions of devices globally” and that its location data feed “delivers raw latitude/longitude data with volumes around 94B+ geo-transactions per month, 125 million monthly active users, and 35 million daily active users, on average observing more than 90 daily transactions per device.” ... The complaint also alleges that the company has lax procedures for determining who it is selling data to, saying purchasers are allowed to use a generic personal email address, label an alleged company as “self” and explain they plan to use the data for “business.” And then there's this: https://therecord.media/data-brokers-are-selling-military-secrets https://therecord.media/data-brokers-are-selling-military-se...
- southernplaces7 1y agoMy question here is also how the brokers obtain the data themselves? Wouldn't it be simple for those who buy it from the brokers at a markup to just get it from its original sources themselves? Also, if the data is in any case available, the real at-fault culprits aren't so much the brokers as those who store and so easily sell it in the first instance.
- victorbjorklund 1y agoSellers of the data wanna deal with one or a few buyers that buy bulk. They dont wanna deal with thousands of customers.
- deleted 1y ago[deleted]
- roadside_picnic 1y ago> Wouldn't it be simple for those who buy it from the brokers at a markup to just get it from its original sources themselves? In many cases joining datasets is both labor intensive and creates a surprising amount of new information, and there is also plenty of "free" data that is incredibly tedious to work with. I used to work with real estate data for the government and if you search for any common things you might want to know you often land on a data brokers page even though property assessor data is freely available in most counties. The problem is each county has their own system of storing data and their own process for searching it. It's a lot of work to learn how just this one dataset works, combining this for all counties in the US is a massive project. Whenever I buy a new home I always look up all my neighbors, figure out when they bought the house, how much they paid etc. Some people get freaked out by this, but this information is public in most counties. By joining this data with another public data set, you can actually figure out which lender your neighbors used and what their reported income at time of sale, their age and ethnic background. Of course there are plenty of other ways data brokers come across data, but even cleaning up and joining public data can require a fair bit of time and expertise.
- tonyarkles 1y ago
- trollied 1y agoA colleague created a banner ad that was an image that had the text “told you I could do this mate!” and targeted an individual to prove a point. The general public have no idea how much ad providers and data brokers know about them.
- rvnx 1y agoSeems just like retargeting in that case. Ask “victim” to visit page A. On that page A place a retargeting pixel, then now everywhere on the Internet you can display a message for that user as long as you are willing to pay a high price for that impression (high price is way way way less than 0.1 USD)
- lyton 1y agoReminds me of the time when Signal(the private messaging app) once tried to get ad data from Facebook and show it to users with a high degree of specificity eg “You got this ad because you’re a middle aged woman who enjoys kpop and loves reading about Christopher Nolan” Relevant article: http://archive.today/fzUL4 http://archive.today/fzUL4
- rustcleaner 1y agoI need you to tell me how I do this right now. This will put so much cred into my spiels with people in meatspace. So many bricks will be shat!
- bombcar 1y agoHere’s a write up: https://ghostinfluence.com/the-ultimate-retaliation-pranking-my-roommate-with-targeted-facebook-ads/ https://ghostinfluence.com/the-ultimate-retaliation-pranking... It’s harder to do this now, but think a bit - set the net wider and catch a few more, who cares! All you care is your target gets hit.
- blindriver 1y agoAround 2014 I worked with recruiters and they had a tool that aggregated data on everyone through LinkedIn, yelp, twitter, GitHub, eventbrite, etc. it was breathtaking the amount of information you could get on anyone, over 10+ years ago. I’m guessing with the help of Palantir, the government has even more data and can probably link Reddit posts etc based on styleometry and can even perform psychological analysis on your personality and tendencies, etc.
- kevin_thibedeau 1y agoThe government has been buying and funding R&D with data brokers since before Google existed.
- worik 1y ago> it was breathtaking the amount of information you could get on anyone, over 10+ years ago. After being burnt by things taken from my social media out of context, used to publicly shame me, I locked down my social media Am I "sweetly naive" to think that had an effect? I do think it did Before I stopped using Facebook I noticed, over the last decade, that almost every account I encountered was locked down similarly My point is I suspect it is getting harder, not easier, for data thieves. The golden age of data theft has passed. Maybe.
- slumberlust 1y agoNot sure I agree. FB creates a shadow profile for you even if you no longer have an account. Databrokers respect legal requirements to delete your data then just populate a new profile for you. I'd argue it's easier now than ever to get hands on someone's data in the USA.
- rustcleaner 1y ago>styleometry I really need to start using PocketPal (local LLM on Android) to restate my messages. --- Oh, the places I'd like to send my texts so fine, With PocketPal, a tool that's truly divine, Local LLM on Android, a wondrous device to see, To help me restate my messages with glee! Wheee!
- greenie_beans 1y agowhat are some good cheap sources to get this? i have an art project idea that i've wanted make that would require invasive data profiles, but it's very big project and i have no idea where to start