3 ms·

Oh boy, this is going to end badly. Remember when AOL released a huge anonymized dataset of their searches? People were still identified because naturally peopl

by nivla 14y ago

Oh boy, this is going to end badly. Remember when AOL released a huge anonymized dataset of their searches? People were still identified because naturally people searched for their own names, the names of their friends and families, local businesses, personal websites, etc. This dataset is even worse since it includes both referral and the destination. Keep in mind websites often put the usernames within the URL Eg: http://www.facebook.com/Your.Name http://www.facebook.com/Your.Name http://www.reddit.com/user/USERNAME/ http://www.reddit.com/user/USERNAME/ http://slashdot.org/~USERNAME http://slashdot.org/~USERNAME http://news.ycombinator.com/user?id=USERNAME http://news.ycombinator.com/user?id=USERNAME So no matter how much you think you have it anonymized, a person's browsing history could reveal a lot more than you think.

politician 14y ago
The data doesn't seem to contain enough information to cluster unrelated URLs (e.g. by User Agent). Each record contains 1) a timestamp, 2) the requested URL, 3) the referring URL, 4) a boolean classification of the user agent (browser or bot), 5) a boolean flag for whether the request was generated inside or outside IU. Although you could reconstruct who's looking at Facebook from inside IU, it'd be difficult to further associate them with some other website like Hacker News. On the other hand, the timestamps do leak some information which could potentially be used to identify patterns of activity.
- kordless 14y ago
  You've seen that bit where the user-agent is fairly unique to a particular user, right? https://www.eff.org/deeplinks/2010/01/tracking-by-user-agent https://www.eff.org/deeplinks/2010/01/tracking-by-user-agent
  - politician 14y ago
    Yes, but they aren't sharing the user agent. They're just sharing a boolean derived from the user agent which says whether they think it was a bot or a browser.

by nivla 14y ago

politician 14y ago

The data doesn't seem to contain enough information to cluster unrelated URLs (e.g. by User Agent). Each record contains 1) a timestamp, 2) the requested URL, 3) the referring URL, 4) a boolean classification of the user agent (browser or bot), 5) a boolean flag for whether the request was generated inside or outside IU. Although you could reconstruct who's looking at Facebook from inside IU, it'd be difficult to further associate them with some other website like Hacker News. On the other hand, the timestamps do leak some information which could potentially be used to identify patterns of activity.

kordless 14y ago
You've seen that bit where the user-agent is fairly unique to a particular user, right? https://www.eff.org/deeplinks/2010/01/tracking-by-user-agent https://www.eff.org/deeplinks/2010/01/tracking-by-user-agent
- politician 14y ago
  Yes, but they aren't sharing the user agent. They're just sharing a boolean derived from the user agent which says whether they think it was a bot or a browser.