Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12
1–10 of 42 posts
Re: Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12
#2Could someone please ELI5 how an "intimate" provider (such as Apple, Google or Microsoft) can collect any data ongoingly without eventual loss of privacy?
Re: Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12
#3Could someone please ELI5 how an "intimate" provider (such as Apple, Google or Microsoft) can collect any data ongoingly without eventual loss of privacy?
Let's say i'm collecting a simple yes / no piece of data such as... did this user open Google Chrome today. Every day my analytics engine sends the data back up: yes, no, no, yes, yes, yes, no. Someone could look at this data and know whether you used Chrome or not on a given day, but when Apple sends the data up it randomly flips the answer for a certain number of data points in such a way that the flipping effects will cancel each other out at scale and the overall stats will be more or less the same. Now, even if I were able to look at all the data your computer sent up about your Chrome usage I can't actually be sure which days you used Chrome because I know some of the answers are flipped. The more changes get made, the more privacy the user has.
Re: Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12
#4Could someone please ELI5 how an "intimate" provider (such as Apple, Google or Microsoft) can collect any data ongoingly without eventual loss of privacy?
Let’s say you wanted to count how many of your online friends were dogs, while respecting the maxim that, on the Internet, nobody should know you’re a dog. To do this, you could ask each friend to answer the question “Are you a dog?” in the following way. Each friend should flip a coin in secret, and answer the question truthfully if the coin came up heads; but, if the coin came up tails, that friend should always say “Yes” regardless. Then you could get a good estimate of the true count from the greater-than-half fraction of your friends that answered “Yes”. However, you still wouldn’t know which of your friends was a dog: each answer “Yes” would most likely be due to that friend’s coin flip coming up tails.
Source: Google's RAPPOR project
I pointed to some open source repos on my blog post from 2015 https://www.quantisan.com/a-magical-promise-of-releasing-you...
Re: Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12
#5Could someone please ELI5 how an "intimate" provider (such as Apple, Google or Microsoft) can collect any data ongoingly without eventual loss of privacy?
Let's say i'm collecting a simple yes / no piece of data such as... did this user open Google Chrome today. Every day my analytics engine sends the data back up: yes, no, no, yes, yes, yes, no. Someone could look at this data and know whether you used Chrome or not on a given day, but when Apple sends the data up it randomly flips the answer for a certain number of data points in such a way that the flipping effects…
OK, thanks :)
But still, there are some questions that you'd arguably never want to say "yes" to. Such as, did you visit some verboten site (terrorist, child porn, etc) today?
So how can an algorithm "know" which questions it's safe to use differential privacy with, and which it isn't?
Or would you argue that it's safe enough to use differential privacy with even such questions?
Re: Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12
#6Could someone please ELI5 how an "intimate" provider (such as Apple, Google or Microsoft) can collect any data ongoingly without eventual loss of privacy?
Let’s say you wanted to count how many of your online friends were dogs, while respecting the maxim that, on the Internet, nobody should know you’re a dog. To do this, you could ask each friend to answer the question “Are you a dog?” in the following way. Each friend should flip a coin in secret, and answer the question truthfully if the coin came up heads; but, if the coin came up tails, that friend should always sa…
OK, thanks :)
But ... [please see reply to omarforgotpwd].
Re: Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12
#7Earlier quoted context omitted.
Let's say i'm collecting a simple yes / no piece of data such as... did this user open Google Chrome today. Every day my analytics engine sends the data back up: yes, no, no, yes, yes, yes, no. Someone could look at this data and know whether you used Chrome or not on a given day, but when Apple sends the data up it randomly flips the answer for a certain number of data points in such a way that the flipping effects…
OK, thanks :) But still, there are some questions that you'd arguably never want to say "yes" to. Such as, did you visit some verboten site (terrorist, child porn, etc) today? So how can an algorithm "know" which questions it's safe to use differential privacy with, and which it isn't? Or would you argue that it's safe enough to use differential privacy with even such questions?
I don't think this approach applies in such situations, and wouldn't be a good idea if it did.
It may help with categories of sites, like "did you visit a news site today" or "did you watch porn".
Re: Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12
#8Earlier quoted context omitted.
OK, thanks :) But still, there are some questions that you'd arguably never want to say "yes" to. Such as, did you visit some verboten site (terrorist, child porn, etc) today? So how can an algorithm "know" which questions it's safe to use differential privacy with, and which it isn't? Or would you argue that it's safe enough to use differential privacy with even such questions?
I don't think this approach applies in such situations, and wouldn't be a good idea if it did. It may help with categories of sites, like "did you visit a news site today" or "did you watch porn".
Systems that don't deal well with edge cases aren't so great.
For people who don't really need to care about privacy, I guess that differential privacy is good enough. But there's a gotcha there, for people who ought to care, but are clueless. I'm reminded of that ex cop in Philadelphia, who believed Freenet's claims about plausible deniability.
Edit: A prudent standard for calling something "[foo] privacy" is arguably PGP.
Re: Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12
#9Could someone please ELI5 how an "intimate" provider (such as Apple, Google or Microsoft) can collect any data ongoingly without eventual loss of privacy?
Let’s say you wanted to count how many of your online friends were dogs, while respecting the maxim that, on the Internet, nobody should know you’re a dog. To do this, you could ask each friend to answer the question “Are you a dog?” in the following way. Each friend should flip a coin in secret, and answer the question truthfully if the coin came up heads; but, if the coin came up tails, that friend should always sa…
In that case though, you would know that the "No" friends are definitely not dogs, and the "Yes" friends are possibly a dog, so it seems like the dogs would still not be completely anonymous. Wouldn't the dogs be better off not partaking in the survey and being narrowed down into a group of possible dogs?
Re: Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12
#10Could someone please ELI5 how an "intimate" provider (such as Apple, Google or Microsoft) can collect any data ongoingly without eventual loss of privacy?
Let’s say you wanted to count how many of your online friends were dogs, while respecting the maxim that, on the Internet, nobody should know you’re a dog. To do this, you could ask each friend to answer the question “Are you a dog?” in the following way. Each friend should flip a coin in secret, and answer the question truthfully if the coin came up heads; but, if the coin came up tails, that friend should always sa…
Is there a name for this algorithm?