Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12

Post by korolova » Tue, Sep 12, 2017, 6:07 PM UTC

frankmcsherry wrote: post #39

FlyingLawnmower wrote: post #37

Earlier quoted context omitted.

Do you believe an opt-in in necessary with a (properly implemented) differentially private collection mechanism? Just curious about your take on this.

I think that is the ethical thing to do, yes. Differential privacy does statistically disclose information about you, and whether the quantitative bound used is up to your standards is a decision you should make before it happens. Given that user-level understanding of DP is so low, I don't think defaulting people in to levels chosen by others is a good idea. I 100% guarantee Mozilla doesn't have the background to ma…

And it seems that the "default" values will be increasing further in iOS 11 -- to 43 * days.

Post by ramensea » Wed, Sep 13, 2017, 8:39 PM UTC

frankmcsherry wrote: post #21

While I like this work, the title may be misleading to people who think of "privacy loss" as something distinct from "differential privacy". What they show is that as you use Apple's implementation, the differential privacy parameter grows (providing weaker guarantees as time passes). They don't show that they can bypass the mechanism and it's guarantees, just that Apple has rigged the implementation to decay the gua…

This is a known weakness with differential privacy. Depending on how much noise you inject into your data, your analytics either approach meaninglessness or the privacy decays.

The hype machine surrounding Apple did not want to hear this and were just caught up with the idea "Apple could data mine you while maintaining ur privacy".

Re: Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12

Re: Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12