Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is Differential Privacy?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

81–90 of 108 posts

Re: What is Differential Privacy?

#81

Post by Natanael_L »

Twisell wrote: post #26
conradev wrote: post #22

Earlier quoted context omitted.

Even though the technique doesn't require collecting all of the data, Apple still does collect a huge well of data. They store all iCloud sync material (backups, photos, contacts, calendars, mail, documents, etc.) without end to end encryption, and have all of the iMessage metadata.

This is so wrong. The only thing that isn't user-encrypted so far is the iPhone backup on their server (Of course it is encrypted but Apple have the key to decrypt it as needed). The official explanation so far is that if the user forgot the password a user-encrypted backup would just become some useless junk. This is (officially) the sole remaining non user-encrypted personal data on apple server that authority can…

What's wrong? AFAIK the only thing fully end-to-end encrypted is the keychain.

https://support.apple.com/en-us/HT202303

Take note of what the wording leaves out. Apple holds the decryption keys for just about everything.

> iCloud Keychain encryption keys are created on your devices, and Apple can't access those keys. Only encrypted keychain data passes through Apple's servers, and Apple can't access any of the key material that could be used to decrypt that data

This wording is used for nothing else than the keychain.

Fully consistent with the behavior where disconnecting all your devices from your account, to then do a password reset and logging in on a new one device will make all your data available to you again in plaintext format. Including iCloud backups of iMessage chats.

Re: What is Differential Privacy?

#82

Post by [deleted] »

Twisell wrote: post #26
conradev wrote: post #22

Earlier quoted context omitted.

Even though the technique doesn't require collecting all of the data, Apple still does collect a huge well of data. They store all iCloud sync material (backups, photos, contacts, calendars, mail, documents, etc.) without end to end encryption, and have all of the iMessage metadata.

This is so wrong. The only thing that isn't user-encrypted so far is the iPhone backup on their server (Of course it is encrypted but Apple have the key to decrypt it as needed). The official explanation so far is that if the user forgot the password a user-encrypted backup would just become some useless junk. This is (officially) the sole remaining non user-encrypted personal data on apple server that authority can…

[deleted]

Re: What is Differential Privacy?

#83

Post by Natanael_L »

Twisell wrote: post #64
corv wrote: post #54

Earlier quoted context omitted.

Are you saying Notes, Safari Bookmarks, Photos, etc are encrypted on iCloud? How come they are accessible from iCloud.com? Decrypted by the browser on the fly?

It seems so: https://support.apple.com/en-us/HT202303 However I reckon that technically Apple could access data or give data stored on iCloud to NSA/FBI because they actually still hold the keys for that part too (not only backup as I thought). Only the password/creditcard Keychain is now claimed to be fully user-encrypted and can't be recovered by any mean by apple. For anything else than a warrant, they'll "just" h…

AFAICT only storage is encrypted. They decrypt server side.

Re: What is Differential Privacy?

#84

Post by Twisell »

Natanael_L wrote: post #83
Twisell wrote: post #64

Earlier quoted context omitted.

It seems so: https://support.apple.com/en-us/HT202303 However I reckon that technically Apple could access data or give data stored on iCloud to NSA/FBI because they actually still hold the keys for that part too (not only backup as I thought). Only the password/creditcard Keychain is now claimed to be fully user-encrypted and can't be recovered by any mean by apple. For anything else than a warrant, they'll "just" h…

AFAICT only storage is encrypted. They decrypt server side.

Do you suggest that Apple is blatantly lying in the article I just cited?

Re: What is Differential Privacy?

#86

Post by Create »

cyphar wrote: post #66
Create wrote: post #61

Earlier quoted context omitted.

sorry -- please substitute "average" (original was also in quotes) to category or factor, and you still have the bin I am talking about. You can put any label on it you like such as "commonality", as long as you remove details, ie. other bins. But as you say: your "aggregate analysis" NEEDS "many different samples from different stars". Commonality is the result of your analysis based on different samples. But since…

> But since they are common, you can go and sample and have the result without doing mass surveillance on every star. "Mass surveilance" reduces noise and lets you get more data in a shorter period of time (telescopes have large fields of view, but they can't make time pass faster). Stacking (which is what the technique is called in Astrophysics) is very useful in this case. Not to mention that you can also do indivi…

"Not to mention that you can also do individual analysis as well."

This is the key point to argue against in the context of people, privacy and mass surveillance.

It is the touchstone of privacy, anonymity and crowd protection.

Regarding noise suppression: yes, the more queries (available data whether raw or extracted) the more you can filter (ask a Kalman student) to reduce your error bars and margins. This is a reason why DP is overhyped. Also, if there are no differences between queries, then data is redundant. See deduplication (database) or scaling (measurement).

About the analysis pipeline: this is why the mantra "know your detector". Coincidentally, this is why releasing only recorded datasets is next to useless for people outside the given research group. You would need to capture detailed knowledge of your data taking operations and instruments, which happens rarely, if ever. Please cite a thing such as "the NASA pipeline", perhaps you mean a given mission/experiment? In any case, detector recalibration is a usual, almost daily activity...

Re: What is Differential Privacy?

#87

Post by GrumpyYoungMan »

guelo wrote: post #27

Apple backed themselves into a corner by marketing themselves as the super-privacy company in contrast to Google. The problem is that all the data collection lets you do some really useful stuff that benefits the user. So now they're spreading FUD while trying to pretend that they're not collecting the same type of data that Google does. Google has been using differential privacy for a while in different projects.

Agreed. I find it vastly amusing to hear praise for Apple because they're applying some sort of obfuscation to the telemetry they collect ("Proprietary and totally secret, of course. Oh, what telemetry is Apple collecting? That's secret too but, trust us, Apple cares about your privacy.") and yet people are up in arms about Windows 10 telemetry and little, if anything, is ever said about the telemetry collected by Android. How does that work?

Re: What is Differential Privacy?

#88

Post by drdaeman »

Twisell wrote: post #26
conradev wrote: post #22

Earlier quoted context omitted.

Even though the technique doesn't require collecting all of the data, Apple still does collect a huge well of data. They store all iCloud sync material (backups, photos, contacts, calendars, mail, documents, etc.) without end to end encryption, and have all of the iMessage metadata.

This is so wrong. The only thing that isn't user-encrypted so far is the iPhone backup on their server (Of course it is encrypted but Apple have the key to decrypt it as needed). The official explanation so far is that if the user forgot the password a user-encrypted backup would just become some useless junk. This is (officially) the sole remaining non user-encrypted personal data on apple server that authority can…

It's not only encryption, what's important, but proper key management. Just saying.

Re: What is Differential Privacy?

#89

Post by tjl »

bo1024 wrote: post #28
frankmcsherry wrote: post #18

Earlier quoted context omitted.

> The database still has to exist on Apple's servers. It doesn't, which is part of the reason Apple wants to do this. You can still do differential privacy without collecting all the data, you just get less accurate results. See page 232 in [1], re "The Local Model". [1]: http://www.cis.upenn.edu/~aaroth/Papers/privacybook.pdf Edit: the article even says this down when it talks about RAPPOR.

Hi Frank and thanks for responding; you're right of course. If Apple really did implement some sort of randomized response (or more sophisticated variant), I think that would a real breakthrough for user privacy since they'd be giving up control of the data.

According to the State of the Union (where they explain how they're doing differential privacy) there is an overall database, but only in aggregate. It's specifically designed so you don't know the individual answer from each person.

Re: What is Differential Privacy?

#90

Post by cyphar »

Create wrote: post #86
cyphar wrote: post #66

Earlier quoted context omitted.

> But since they are common, you can go and sample and have the result without doing mass surveillance on every star. "Mass surveilance" reduces noise and lets you get more data in a shorter period of time (telescopes have large fields of view, but they can't make time pass faster). Stacking (which is what the technique is called in Astrophysics) is very useful in this case. Not to mention that you can also do indivi…

"Not to mention that you can also do individual analysis as well. " This is the key point to argue against in the context of people, privacy and mass surveillance. It is the touchstone of privacy, anonymity and crowd protection. Regarding noise suppression: yes, the more queries (available data whether raw or extracted) the more you can filter (ask a Kalman student) to reduce your error bars and margins. This is a re…

> Please cite a thing such as "the NASA pipeline", perhaps you mean a given mission/experiment?

The specific pipeline I was referring to is the Kepler pipeline that NASA uses to take their raw pixel data and produce photon counts that everyone uses for their research (this wasn't a detector issue, it was a software bug at the final stage of the data publishing process). The point was not the pipeline issue, it was that noise is everywhere.

But as to your point, yeah okay. Maybe I shouldn't talk about statistics when that's not my field. :D

Post reply on HN