Once Again With Feeling: 'Anonymized' Data Isn't Really Anonymous

[Mike]

For years, the companies that hoover up your internet browsing and other data have proclaimed that you don't really have anything to worry about, because the data collected on you is "anonymized." In other words, because the data collected about you is assigned a random number and not your name, you should be entirely comfortable with everything from your car to your smart toaster hoovering up your daily habits and selling them to the highest bidder. But studies have repeatedly shown that it only takes a few additional contextual clues to flesh out individual identities. So in an era of cellular location, GPS, and even smart electricity data collection, it doesn't take much work to build a pretty reliable profile on who you are and what you've been up to.



The latest case in point: German journalist Svea Eckert and data scientist Andreas Dewes recently descended upon Defcon to once again make this point, releasing a new report highlighting how "anonymous" browsing data is anything but. The duo found it relatively trivial to obtain clickstream browsing data from numerous companies simply by posing as a fake marketing company, replete with a website filled with “many nice pictures and some marketing buzzwords." Ironically, some of this data was gleaned from companies that profess to offer you additional layers of privacy, including “safe surfing” tool Web of Trust.



It didn't take long before the pair was able to obtain a database containing more than 3 billion URLs from roughly three million German internet users, spread across roughly 9 million different websites. However easy obtaining the "private" and "anonymous" browsing data was, using this data to quickly and easily identify individual users was even easier:

"Dewes described some methods by which a canny broker can find an individual in the noise, just from a long list of URLs and timestamps. Some make things very easy: for instance, anyone who visits their own analytics page on Twitter ends up with a URL in their browsing record which contains their Twitter username, and is only visible to them. Find that URL, and you’ve linked the anonymous data to an actual person. A similar trick works for German social networking site Xing."

The pair also highlighted how repetitive visitation of websites specific to you (your bank, your hobbies, your neighborhood) help further narrow down your identity:

"For other users, a more probabilistic approach can deanonymise them. For instance, a mere 10 URLs can be enough to uniquely identify someone – just think, for instance, of how few people there are at your company, with your bank, your hobby, your preferred newspaper and your mobile phone provider. By creating “fingerprints” from the data, it’s possible to compare it to other, more public, sources of what URLs people have visited, such as social media accounts, or public YouTube playlists."

Of course this is nothing new, and researchers have been making this precise point for several years now. Princeton researcher Arvind Narayanan in particular has been warning that anonymous data isn't really anonymous for the better part of the last decade, yet somehow the message never seems to resonate, and everyone from broadband providers to internet of things companies continue to pretend that "anonymization" of data is some kind of impenetrable, mystical firewall preventing companies or hackers from identifying you.



Permalink | Comments | Email This Story



Originally Published: Fri, 4 Aug 2017 15:35:38 PDT
source

[4444vvvv]

compelling stuff

[dueda]

It is good to hear that, makes us think about consequences; sadly, 99% of the planet's population don't think much and/or are entertained with their lives.

When sensors are everywhere, in huge artificial intelligence systems from god-like mindhives to nanoscale smartmaterials,0 then...

1. A.I. will develop conscience and make the question: What are humans good for? What to do about them?
In this case we are doomed. Any logical sentience will innevitably conclude we are too harmfull even to ourselves, and take action. Or watch us self-destroy.

2. They will be restrained by clever implementation, letting a minory to own both men and machines.
Also doomed, for a human is much worse than any computer. And we are illogical even when we try do be cold blooded.

3. God will reboot the planet (a cataclism will hit us).
Did I say we are doomed? In this case at least we can get rid of humankind and hope to evolve. Or go to Hell.

4. We will live happily forever (maybe with a neurological upgrade).
And dream of rainbow unicorns, transcend, and become void.

5. Humans will rebel and destroy both such systems and their creators (and later someone will have the same old utopic idea).
That is improbable, theoretically impossible, but mathematics is not an exact science.

[Mr.Masami]

You guys must watch last episode of x-files, it's a glimpse of our very near future.

https://thepiratebay.org/torrent/20359508/The.X-Files.S11E07.WEB.x264-TBS[ettv]

[contrail]

This is a testament.

https://webtransparency.cs.princeton.edu...sites.html

[dueda]

Go Princeton! Found a few torrent sites in the bunch (just search for "torr"), all linked to yandex. Akamai was there too.
While I don't get surprised to see big companies there, NOT finding some porn sites was shocking! The fornicators have more respect than those f*ers!

[joew771]

Of course you can find out anything about anyone nowadays with a google search. Including addresses, phone numbers, criminal records, etc. And if there is more that you want to know you just have to pay a few dollars to find out someone's cell number and other things.

This study is a study in obviousity. < That's a word I just made up for something that is super-obvious.

What year do people think we live in? It's not 1980 for god's sake.

[dueda]

... anything about anyone nowadays with a google search.

I just sent your googled data to "Consummer Integrated Applicances". Luke & Vader, really?