4 ms·

What Surveillance Valley knows about you

66 points by eggspurt 13y ago

krakensden 13y ago
The Google bait in the lede and the failure to address it at all is wonderfully classic Yasha Levine. Here is the link from the article on the event that caused this- it's slightly more succinct: http://blogs.wsj.com/digits/2013/12/19/data-broker-removes-rape-victims-list-after-journal-inquiry/ http://blogs.wsj.com/digits/2013/12/19/data-broker-removes-r...
- eggspurt 13y ago
  Hmm, would it would be possible to actually detect if Google's got information about a visitor - by creating a web page with google ads and then snooping what targeted ads are getting shown (which is possible through DOM traversal)? This way, information can leak.
  - yetfeo 13y ago
    If the ads are shown in an iframe on a different domain you won't be able to traverse them due to cross origin restrictions.
    - eggspurt 13y ago
      Malware that can hijack the users' cookies can do that, as described in https://news.ycombinator.com/item?id=6950758 https://news.ycombinator.com/item?id=6950758 at 15m40s (http://www.youtube.com/watch?v=xv6K2GqyijM#t=15m40 http://www.youtube.com/watch?v=xv6K2GqyijM#t=15m40)
      - yetfeo 13y ago
        "Malware that can hijack the users' cookies" is a little different to "which is possible through DOM traversal" though. I wanted to address the point in case some got the impression just using the DOM via JS would allow it.
    - lovemenot 13y ago
      The browser itself and its installed plug-ins are not subject to same origin policy. You are thinking of the restrictions on the original site. If this were not the case then the browser woud be unable to download content from any site but the one in the browser's URL. I came here to say that this article is dynamite. I had not followed this story before, but it is at least as important as Snowden / NSA. However, the article loses its force from the middle and the call-out to US liberal politics towards the end is just pathetic. It is as likely that those who need to take action on the data industry are from the right, libertarians, or simply not aligned with parochial US political divisions. Edit: re-reading the thread, the SOP objection is right. A plug-in is required.
  - throwaway_yy2Di 13y ago
    Maybe users could install browser extensions, and coordinate to gather datasets of which ads are displayed to whom. Cross-correlating this with personal information on the users (volunteered to a trustworthy third party, vetted by EFF lawyers), you could make inferences as to what Google probably knows about which user. And may provide a service to warn the user, in a privacy-respecting way, and give advice as to how to avoid further privacy invasions. Ironically enough, it might be illegal to do this, since it would injure Google's corporate privacy ("trade secrets").
yummyfajitas 13y ago
Lets be realistic about how the "rape sufferers" incident happened. They started with some list of standard medical conditions joined against users: condition user dermatititis 1 rape 2 athletes foot 3 Then they did this: SELECT UNIQUE(condition) FROM user_sufferers <h1> Lists for sale </h1> {% for condition in conditions %} <li> {{condition}} sufferers </li> {% endfor %} Fundamentally no different from ["Keep Calm and {{verb}} a Lot" t-shirts for verb in list_of_verbs]: http://singularityhub.com/2013/03/20/keep-calm-and-rape-a-lot-t-shirts-show-automation-growing-pains/ http://singularityhub.com/2013/03/20/keep-calm-and-rape-a-lo... The fact that things like rape, pregnancy [1], etc are detectible by computers makes great headlines. But we shouldn't act as if MedBase was deliberately targeting [{{condition}} sufferers for condition in hot_button_list] - that's fundamentally dishonest. [1] See the case when Target knew some teenager was interested in products X, Y, Z, where the correlation was driven by the underlying causation of pregnancy.
- mortov 13y ago
  Are you saying you know this for a fact or are you speculating a benign explanation without any genuine knowledge of this particular case (by referring to the keep calm t-shirts which are unrelated and irrelevant to this situation) ? edit: Plus I've never heard of "rape" being a diagnosed medical condition - why would that be in a list of conditions ? I find your 'explanation' quite troubling.
  - yummyfajitas 13y ago
    I'm saying this is the most likely explanation. I should have been more clear on this point. Too late to edit, unfortunately. Incidentally, here is a cached list of the things they sell (the site is now not displaying them): http://webcache.googleusercontent.com/search?q=cache:dI3aEj0xkSIJ:www.medbase200.com/ailmentslists.php%3Fpage%3D1%26ipp%3DAll+&cd=1&hl=en&ct=clnk http://webcache.googleusercontent.com/search?q=cache:dI3aEj0... http://webcache.googleusercontent.com/search?q=cache:8T2YX7hPZcwJ:www.medbase200.com/prescriptiondruguserlists.php%3Fpage%3D56%26ipp%3D10+&cd=1&hl=en&ct=clnk http://webcache.googleusercontent.com/search?q=cache:8T2YX7h... http://webcache.googleusercontent.com/search?q=cache:aRARHlll5K8J:www.medbase200.com/ailmentslists.php%3Fpage%3D66%26ipp%3D10+&cd=1&hl=en&ct=clnk http://webcache.googleusercontent.com/search?q=cache:aRARHll... I stand by my claim that they took a list of medical billing codes or something like that. Really, you think a human decided to compile a list of "Bioterrorism sufferers", "Smallpox sufferers", "Bites and Stings sufferers" or "Polio Sufferers"? However, I'm now convinced their first step was less sophisticated than I suggested. I think they didn't take a list of users joined against billing codes, I think they just took a list of billing codes.
gabemart 13y ago
> Normally, such detailed health information would fall under > federal law and could not be disclosed or sold without > consent. But because these data harvesters rely on indirect > sources of information instead of medical records, they’re > able to sidestep regulations put in place to protect the > privacy of people’s health data. What "indirect sources of information" could be used to identify thousands of rape victims?
- thesausageking 13y ago
  One simple way is search data. If you have the data from a browser toolbar, you could mine for searches like "chances rape victim getting pregnant", "what is a rape kit", etc. and visits to certain pages of WebMD. This will be plenty accurate to use for targeting.
navait 13y ago
Is it possible to purchase all the information they have on you? I'm curious to see the extent of what they have on me.
jlgaddis 13y ago
"How Target Figured Out A Teen Girl Was Pregnant Before Her Father Did" --http://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/ http://www.forbes.com/sites/kashmirhill/2012/02/16/how-targe... This event is referenced in TFA. I remember reading it when it first came out and was (a) amazed at the ability to analyze purchasing data and come to conclusions such as this and (b) worried. Previously, I never really cared for carrying cash so I used a credit card for almost everything I purchased -- online, of course, but also in person. Nowadays, I pay cash anytime I can: at the gas station, the supermarket, at restaurants, etc. I also stopped using my "loyalty" card at the supermarket and obtained a new one that was not connected to me in any way. I'm not buying anything I shouldn't be, of course. I'm just of the "it's none of their business" mindset. This has carried over into other parts of my life as well, such as logging as little personal information as possible at work (ISP) and retaining it for as short of a period as possible.

66 points by eggspurt 13y ago

The Google bait in the lede and the failure to address it at all is wonderfully classic Yasha Levine. Here is the link from the article on the event that caused this- it's slightly more succinct: http://blogs.wsj.com/digits/2013/12/19/data-broker-removes-rape-victims-list-after-journal-inquiry/ http://blogs.wsj.com/digits/2013/12/19/data-broker-removes-r...

eggspurt 13y ago
Hmm, would it would be possible to actually detect if Google's got information about a visitor - by creating a web page with google ads and then snooping what targeted ads are getting shown (which is possible through DOM traversal)? This way, information can leak.
- yetfeo 13y ago
  If the ads are shown in an iframe on a different domain you won't be able to traverse them due to cross origin restrictions.
  - eggspurt 13y ago
    Malware that can hijack the users' cookies can do that, as described in https://news.ycombinator.com/item?id=6950758 https://news.ycombinator.com/item?id=6950758 at 15m40s (http://www.youtube.com/watch?v=xv6K2GqyijM#t=15m40 http://www.youtube.com/watch?v=xv6K2GqyijM#t=15m40)
    - yetfeo 13y ago
      "Malware that can hijack the users' cookies" is a little different to "which is possible through DOM traversal" though. I wanted to address the point in case some got the impression just using the DOM via JS would allow it.
  - lovemenot 13y ago
    The browser itself and its installed plug-ins are not subject to same origin policy. You are thinking of the restrictions on the original site. If this were not the case then the browser woud be unable to download content from any site but the one in the browser's URL. I came here to say that this article is dynamite. I had not followed this story before, but it is at least as important as Snowden / NSA. However, the article loses its force from the middle and the call-out to US liberal politics towards the end is just pathetic. It is as likely that those who need to take action on the data industry are from the right, libertarians, or simply not aligned with parochial US political divisions. Edit: re-reading the thread, the SOP objection is right. A plug-in is required.
- throwaway_yy2Di 13y ago
  Maybe users could install browser extensions, and coordinate to gather datasets of which ads are displayed to whom. Cross-correlating this with personal information on the users (volunteered to a trustworthy third party, vetted by EFF lawyers), you could make inferences as to what Google probably knows about which user. And may provide a service to warn the user, in a privacy-respecting way, and give advice as to how to avoid further privacy invasions. Ironically enough, it might be illegal to do this, since it would injure Google's corporate privacy ("trade secrets").

yummyfajitas 13y ago

Lets be realistic about how the "rape sufferers" incident happened. They started with some list of standard medical conditions joined against users: condition user dermatititis 1 rape 2 athletes foot 3 Then they did this: SELECT UNIQUE(condition) FROM user_sufferers <h1> Lists for sale </h1> {% for condition in conditions %} <li> {{condition}} sufferers </li> {% endfor %} Fundamentally no different from ["Keep Calm and {{verb}} a Lot" t-shirts for verb in list_of_verbs]: http://singularityhub.com/2013/03/20/keep-calm-and-rape-a-lot-t-shirts-show-automation-growing-pains/ http://singularityhub.com/2013/03/20/keep-calm-and-rape-a-lo... The fact that things like rape, pregnancy [1], etc are detectible by computers makes great headlines. But we shouldn't act as if MedBase was deliberately targeting [{{condition}} sufferers for condition in hot_button_list] - that's fundamentally dishonest. [1] See the case when Target knew some teenager was interested in products X, Y, Z, where the correlation was driven by the underlying causation of pregnancy.

mortov 13y ago
Are you saying you know this for a fact or are you speculating a benign explanation without any genuine knowledge of this particular case (by referring to the keep calm t-shirts which are unrelated and irrelevant to this situation) ? edit: Plus I've never heard of "rape" being a diagnosed medical condition - why would that be in a list of conditions ? I find your 'explanation' quite troubling.
- yummyfajitas 13y ago
  I'm saying this is the most likely explanation. I should have been more clear on this point. Too late to edit, unfortunately. Incidentally, here is a cached list of the things they sell (the site is now not displaying them): http://webcache.googleusercontent.com/search?q=cache:dI3aEj0xkSIJ:www.medbase200.com/ailmentslists.php%3Fpage%3D1%26ipp%3DAll+&cd=1&hl=en&ct=clnk http://webcache.googleusercontent.com/search?q=cache:dI3aEj0... http://webcache.googleusercontent.com/search?q=cache:8T2YX7hPZcwJ:www.medbase200.com/prescriptiondruguserlists.php%3Fpage%3D56%26ipp%3D10+&cd=1&hl=en&ct=clnk http://webcache.googleusercontent.com/search?q=cache:8T2YX7h... http://webcache.googleusercontent.com/search?q=cache:aRARHlll5K8J:www.medbase200.com/ailmentslists.php%3Fpage%3D66%26ipp%3D10+&cd=1&hl=en&ct=clnk http://webcache.googleusercontent.com/search?q=cache:aRARHll... I stand by my claim that they took a list of medical billing codes or something like that. Really, you think a human decided to compile a list of "Bioterrorism sufferers", "Smallpox sufferers", "Bites and Stings sufferers" or "Polio Sufferers"? However, I'm now convinced their first step was less sophisticated than I suggested. I think they didn't take a list of users joined against billing codes, I think they just took a list of billing codes.

gabemart 13y ago

> Normally, such detailed health information would fall under > federal law and could not be disclosed or sold without > consent. But because these data harvesters rely on indirect > sources of information instead of medical records, they’re > able to sidestep regulations put in place to protect the > privacy of people’s health data. What "indirect sources of information" could be used to identify thousands of rape victims?

thesausageking 13y ago
One simple way is search data. If you have the data from a browser toolbar, you could mine for searches like "chances rape victim getting pregnant", "what is a rape kit", etc. and visits to certain pages of WebMD. This will be plenty accurate to use for targeting.

navait 13y ago

Is it possible to purchase all the information they have on you? I'm curious to see the extent of what they have on me.

jlgaddis 13y ago

"How Target Figured Out A Teen Girl Was Pregnant Before Her Father Did" --http://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/ http://www.forbes.com/sites/kashmirhill/2012/02/16/how-targe... This event is referenced in TFA. I remember reading it when it first came out and was (a) amazed at the ability to analyze purchasing data and come to conclusions such as this and (b) worried. Previously, I never really cared for carrying cash so I used a credit card for almost everything I purchased -- online, of course, but also in person. Nowadays, I pay cash anytime I can: at the gas station, the supermarket, at restaurants, etc. I also stopped using my "loyalty" card at the supermarket and obtained a new one that was not connected to me in any way. I'm not buying anything I shouldn't be, of course. I'm just of the "it's none of their business" mindset. This has carried over into other parts of my life as well, such as logging as little personal information as possible at work (ISP) and retaining it for as short of a period as possible.