Live data from Hacker News

Google’s new program to track shoppers sparks a federal privacy complaint

washingtonpost.com

101–110 of 135 posts

Re: Google’s new program to track shoppers sparks a federal privacy complaint

#101
post #12

Earlier quoted context omitted.

Or potentially worse, if they're compromised/hacked in some way and that data simply enters the wild ecosystem.

I still can't see why I should care if some stranger has my purchase history. I suppose some people might feel weird letting strangers or anyone know what they buy, but that's an argument for the ability to opt-out, not for filing a complaint with an agency or starting a lawsuit.

[deleted]

Re: Google’s new program to track shoppers sparks a federal privacy complaint

#102
post #31

> Google called its advertising approach "common" Tragedy of the commons. At this point in time, any and all forms of data collection have become common. When I visit a website, I expect them to collect everything about me - my IP, my mouse movements, what I clicked, how long I took to click it. Just a matter of time, that they start tracking audio and visual cues as well. It's unthinkable today but we will get there…

I wonder if you're using the term as a poetic device, but as far as I know that's not what Tragedy of the Commons means. Commons are properties without private owners. The tragedy is that because no one individual owns it, the people that use it use it without care to its maintenance believing that it is not their responsibility.

This is still sort of the same thing. The blame can't be pinned on one single entity because it is so common.

Re: Google’s new program to track shoppers sparks a federal privacy complaint

#103

Earlier quoted context omitted.

Eventually you just get the gist for who around here works at Google. ;) cromwellian, who responded to one of my comments here, is also a Googler. Arguably, DannyBee is correct that the real issue is that credit card companies are allowed to sell this data at all. But perhaps the danger of this practice is especially highlighted by the fact that Google is now one of the buyers.

I put my disclaimer in my profile and I usually make it obvious from my comment I work for Google, but I really tire of putting a disclaimer in each and every message, it gets tedious after a while. Perhaps HN should implement some kind of badget/sigfile/etc extension for this purpose. But I'll also note that in my response, I didn't comment on whether or not what Google was going is a good thing, or even going about…

And I also upvoted your comment because I thought it was valuable and noteworthy. :) I really wasn't meaning to be critical to you in my response here.

HN seems kind of hesitant to add additional profile tools beyond the usual. I'm not sure if that's part of it's charm or a detriment. I think having a sig line on every comment might be tedious, and FWIW, I don't think it should be obligatory to attach your employer to every comment on every post on HN. There's a lot that's simply not remotely relevant.

Re: Google’s new program to track shoppers sparks a federal privacy complaint

#105

Earlier quoted context omitted.

Yeah, first and foremost, it bothers me that this data can be sold at all in a user-identifiable way. (Presumably for Google to be able to link it to accounts, name and address are included in the data.) Perhaps this offers the opportunity for a product, in the short term: Is anyone offering credit cards which promise not to sell your purchase history? I'd be game for that.

It's actually not given to Google in a user identifiable way. I am not privy to the details, but an overview was presented at a crypto conference: https://www.youtube.com/watch?v=ee7oRsDnNNc&t=10m1s It looks to me like a form of homomorphic encryption where both the aggregate consumer transactions (people bought X at merchant M), and the aggregate Google ad information (people saw ad for X at merchant M) are encrypte…

Assuming the encryption works as advertised, these schemes still allow more de-anonymization than you'd think. If you can compute very specific set intersections you can then get the set size low enough to reveal personal information with 100% certainty. (The set of people that bought X at M and Y at N and saw ad A at P and ad B at Q on a particular day might contain one person)

I do not know of any work in homomorphic encryption that claims to provide privacy guarantees in the face of side-channels from other sources (in this case, the side-channels could be phone location information for brick-and-mortar purchases, or web browsing activity timestamps for online purchases). It's not surprising that such work is hard to find, since merely computing correct query results breaks most reasonably privacy guarantees.

Also, the field of homomorphic encryption encourages people to use horrible cipher-modes like code-book, so guilt-by-association makes me highly suspicious of stuff in that space: https://en.m.wikipedia.org/wiki/Block_cipher_mode_of_operati...

The closest thing I know of that is workable is differential privacy, which (in laymans terms) introduces enough noise to make sure that overly-specific queries return random (but representative) garbage. Apple says they use differential privacy to train models on data that's stored on iPhones without actually giving themselves access to that data. Cool stuff.

Re: Google’s new program to track shoppers sparks a federal privacy complaint

#106

Earlier quoted context omitted.

I've made very clear when i speak for Google and when I don't, and i pretty much never do (except on some licensing issues). If you want official statements from me, go elsewhere. If you want HN to be a place of real discussion and debate, it's stupid to try to tie people to their companies. I think very different from my company on quite a lot of issues, and i happily point that at too. To your point, however, I did…

That's not the problem. The problem is that ones opinions regarding the entity responsible for issuing their paycheck are inherently less valuable, and this context is important for others reading. You might think you are completely objective and unbiased, as do most others, and maybe you are. But, most people are fooling themselves a little. Nobody will admit to themselves, let alone others, that they work for someo…

"he problem is that ones opinions regarding the entity responsible for issuing their paycheck are inherently less valuable"

No, they aren't, and it's horrendously biased to say that.

"So really, if you want a place of real discussion and debate, it's important to tie people to their companies in cases where they are participating in discussions about these companies. " No, it isn't, precisely because your premise is wrong. It's not just wrong, it's startlingly bad to me.

If your default position is "people's opinions are less valuable because they work for X", you really aren't going to do a good job of seeing multiple perspectives.

But given what you've written here, maybe you don't want to?

Re: Google’s new program to track shoppers sparks a federal privacy complaint

#107

Earlier quoted context omitted.

I dunno, either people are there companies or they aren't. I am not my company, and a lot of people elsewhere aren't either. I don't think who we work for is really relevant at all unless they are trying to make offical statements. Either engage on the merits or don't. "Ignore this guy, he works for X" is not a useful line of argumentation. The only thing putting company names next to things would create, IMHO, is an…

One highlight point to me, is that as an employee posting on an identifiable account, you have two options: Convey the same view as your employer, or remain silent lest you risk being fired. (No matter how much a company claims this isn't the case, it pretty much is, particularly revolving around talk about that employer specifically.) I doubt there exists a public post where a Googler says they think Google should b…

"Convey the same view as your employer, or remain silent lest you risk being fired. (No matter how much a company claims this isn't the case, it pretty much is, particularly revolving around talk about that employer specifically.) I doubt there exists a public post where a Googler says they think Google should be broken up Ma Bell style, or where they state that Google's attitude on privacy is broken and wrong"

You are wrong on both points, FWIW :) But it's definitely true at other companies.

" And I do see the concern about people being dismissive of others based on their employers, particularly in comments not directly related to the topic being discussed."

Given another person just literally said to me "the opinion is less valuable because you work for X", i'm much more worried about this attitude than i am the one where people are biased towards their companies.

Most people in tech are not true believers. Most probably like their companies. But that doesn't mean they agree with what their companies do all the time. Especially in a company the size of, say, Google, it's pretty, IMHO, silly to think that among 150k of those people, there is no dissent, or not even a lot of dissent, all the time.

Re: Google’s new program to track shoppers sparks a federal privacy complaint

#108
post #55

Earlier quoted context omitted.

Any data hoarding and/or selling of this kind by anyone—credit card companies, loyalty cards, ISPs, Google, Amazon, creepy phone-wifi location spying in stores, anyone and anything like this—is de facto spying for the government. As has been discussed many times, keeping oneself clean of this spying (nearly impossible, but for the sake of argument) isn't enough because others' data leaks yours. Anyone against governm…

There is an entire industry of data aggregators and consumer profilers that has existed for decades, long before the internet landed on the scene. These players have been funneling data and providing search services to the three letter orgs in exchange for freedom from any legal encumbrance. There is no way to stop this from happening. They are the main reason why the US has such weak data protection laws in the firs…

> "from any legal encumbrance"

Do you have any anecdotes or links where data collectors exchanged favor with ABCs for legal violations?

Re: Google’s new program to track shoppers sparks a federal privacy complaint

#109
post #14

Earlier quoted context omitted.

Visa is working to prevent people from using cash in stores [0]. Currently, they are merely giving merchants an incentive to change, but in the future they may use their immense lobbying power to get preferential legislation enacted. Once cash is gone: 1. your purchases will be available to any company willing to pay for it, and 2. Visa will get a de facto "tax" on all transactions (through 1-2% merchant fees) [0] ht…

Maybe cash should be replaced by zcash.

Which is digital and a pain in the ass to manage compared to physical cash.

Re: Google’s new program to track shoppers sparks a federal privacy complaint

#110

Earlier quoted context omitted.

I've made very clear when i speak for Google and when I don't, and i pretty much never do (except on some licensing issues). If you want official statements from me, go elsewhere. If you want HN to be a place of real discussion and debate, it's stupid to try to tie people to their companies. I think very different from my company on quite a lot of issues, and i happily point that at too. To your point, however, I did…

If you want HN to be a place of real discussion and debate, it's stupid to try to tie people to their companies. When the company is Google (or of a similar scale) -- and that company claims to care about privacy (but sometimes engages in practices that suggest otherwise) -- then clearly that association is quite relevant. (Its not a huge oversight, but really, if you had put a standard disclaimer at the end of your…

"But calling people "stupid" for pointing out that this association matters (when it obviously does) is just... "Google-y", I guess. "

You have not given any reason the association actually matters here[1], nor engaged the argument on the merits Instead, you did precisely what i said would happen - character assassination for no reason. You also assert i called people stupid, which is also clearly false, I instead expressed that the notion that tying people to their companies would do anything useful is stupid.

[[1] It doesn't. You can engage the arguments on the merits whether it had my name or anyone else's. In fact, you'll see i didn't even express an argument past "it sucks they can sell info", and that i didn't give a shit about the complaint itself because it suggests that it's okay to sell it to certain people, when i feel it's not okay to sell it to anyone. I haven't actually seen anyone cogently disagree with this, and it's 100000000% irrelevant to where i work.

Post reply on HN