Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook's tentacles reach further than people think

bbc.co.uk

Post reply on HN
Print view View original

21–30 of 302 posts

Re: Facebook's tentacles reach further than people think

#21

Post by poooogles »

jacquesm wrote: post #20
poooogles wrote: post #16

Earlier quoted context omitted.

>IP addresses count as PII, Personally Identifiable Information. One way hashed (that can't be rainbow tabled) are not however PII afaik however, so it's quite easy to turn an IP address into a "net location ID" or something similar that can't be tracked back to a physical IP for analytics.

You could simply enumerate all 32 bits and end up with each and every IP reversed so that trick doesn't really hold water. No need for rainbow tables, the search space is small enough to brute force.

Enumeration through 32 bits of bcrypt doesn't sound that feasible to me.

Given a GPU farm however I'm sure it might be feasible. However at that point surely you just add a salt?

Re: Facebook's tentacles reach further than people think

#22

Post by ghughes »

jacquesm wrote: post #4

The bigger problem for me is how facebook tracks and identifies even people who do not have a facebook account. They simply infer such a person exists from photograps, contacts and other one sided activity and can start to track that person, tie all this information together and then target them with ads even though they never signed up for Facebook. Such shadow profiles are a much larger problem to me than people wh…

Nothing will change until the law cracks down on this. The people who work on these systems are smart enough to comprehend the wider consequences, but they do it anyway because money. Without significant external pressure, there will always be a long line of engineers willing to dial their cognitive dissonance up to 11 and build software that is clearly unethical in exchange for a fat paycheck.

Re: Facebook's tentacles reach further than people think

#24

Post by Crontab »

jacquesm wrote: post #4

The bigger problem for me is how facebook tracks and identifies even people who do not have a facebook account. They simply infer such a person exists from photograps, contacts and other one sided activity and can start to track that person, tie all this information together and then target them with ads even though they never signed up for Facebook. Such shadow profiles are a much larger problem to me than people wh…

Isn't Google doing the same thing to people who email Gmail users?

Re: Facebook's tentacles reach further than people think

#25

Post by drdaeman »

poooogles wrote: post #21
jacquesm wrote: post #20

Earlier quoted context omitted.

You could simply enumerate all 32 bits and end up with each and every IP reversed so that trick doesn't really hold water. No need for rainbow tables, the search space is small enough to brute force.

Enumeration through 32 bits of bcrypt doesn't sound that feasible to me. Given a GPU farm however I'm sure it might be feasible. However at that point surely you just add a salt?

It's enumeration through 32 bits of 0-4294967295. There are only so much IPv4 addresses.

If you add a salt, then that "net location ID" becomes of very limited use. You won't be able to grep through the logs for request from specific IP, you won't be able to tell how many distinct IPs are accessing your services, etc etc. The only use I can see is keeping it in the session to check if IP address had changed, as a security measure.

Re: Facebook's tentacles reach further than people think

#26

Post by jacquesm »

poooogles wrote: post #21
jacquesm wrote: post #20

Earlier quoted context omitted.

You could simply enumerate all 32 bits and end up with each and every IP reversed so that trick doesn't really hold water. No need for rainbow tables, the search space is small enough to brute force.

Enumeration through 32 bits of bcrypt doesn't sound that feasible to me. Given a GPU farm however I'm sure it might be feasible. However at that point surely you just add a salt?

If you're going to add a unique salt every operation you just destroyed the value of that IP address for tracking purposes. Which was the whole point of the discussion to begin with. By your scheme you might as well store a random number. So, either you store the IP in such a way that you can later re-associate a new call with the previous IP or you might as well not have it.

Re: Facebook's tentacles reach further than people think

#27

Post by mali9 »

Crontab wrote: post #24
jacquesm wrote: post #4

The bigger problem for me is how facebook tracks and identifies even people who do not have a facebook account. They simply infer such a person exists from photograps, contacts and other one sided activity and can start to track that person, tie all this information together and then target them with ads even though they never signed up for Facebook. Such shadow profiles are a much larger problem to me than people wh…

Isn't Google doing the same thing to people who email Gmail users?

One small difference is that the activity on GMail or large email providers is generally two-way and it becomes clear when you understand that clicking "Send" sends your mail away to be stored in GMail forever unlike where photos somebody would be taking with their friends are not aware if it is put in Facebook or similar social places.

Re: Facebook's tentacles reach further than people think

#28

Post by jacquesm »

Crontab wrote: post #24
jacquesm wrote: post #4

The bigger problem for me is how facebook tracks and identifies even people who do not have a facebook account. They simply infer such a person exists from photograps, contacts and other one sided activity and can start to track that person, tie all this information together and then target them with ads even though they never signed up for Facebook. Such shadow profiles are a much larger problem to me than people wh…

Isn't Google doing the same thing to people who email Gmail users?

They can build up a graph and they'll see your emails when sent to a gmail recipient or from a gmail originator to you.

With a very large fraction of all email now passing through Google's servers you can expect them to be able to piece together the missing bits with high fidelity.

Re: Facebook's tentacles reach further than people think

#30

Post by jacquesm »

mali9 wrote: post #27
Crontab wrote: post #24

Earlier quoted context omitted.

Isn't Google doing the same thing to people who email Gmail users?

One small difference is that the activity on GMail or large email providers is generally two-way and it becomes clear when you understand that clicking "Send" sends your mail away to be stored in GMail forever unlike where photos somebody would be taking with their friends are not aware if it is put in Facebook or similar social places.

That isn't true. Many domains are routed through Gmail where you have absolutely no way of knowing up front that you are going to be sending that mail through Google. It looks like any other email address on a private server.

https://gsuite.google.com/signup/basic/welcome

Post reply on HN