The GDPR blog post
medium.com
The GDPR blog post
1–10 of 144 posts
Re: The GDPR blog post
#2Is there not any issue with having a hashed version of the email, given the entropy of an email address is quite small?
Re: The GDPR blog post
#3A popup (probably what used to be cookie warning) on Medium says:
> Medium uses browser cookies to give you the best possible experience. To make Medium work, we log user data and share it with processors. To use Medium, you must agree to our Privacy Policy.
I must agree to logging user data and sharing it with processors?
EDIT: come to think of it, it might be a new, GDPR-specific, dark pattern. I can use the site without clicking "I agree", and the existence of that button sort of implies the consent is not assumed. The wording of the message ("you must agree") is just trying to bait consent.
EDIT2: I just read[0] that biggest sites in my country are treating closing the GDPR popup as giving consent to everything. This definitely does not sound as explicit, informed consent. I sincerely hope it'll land them in a world of hurt.
--
[0] - (PL link) https://zaufanatrzeciastrona.pl/post/klikasz-x-w-komunikacie...
Re: The GDPR blog post
#4A popup (probably what used to be cookie warning) on Medium says: > Medium uses browser cookies to give you the best possible experience. To make Medium work, we log user data and share it with processors. To use Medium, you must agree to our Privacy Policy. I must agree to logging user data and sharing it with processors? EDIT: come to think of it, it might be a new, GDPR-specific, dark pattern. I can use the site w…
Nope, the site works fine if you disable cookies. Once Facebook and Google fail I'm sure they'll be next.
Re: The GDPR blog post
#5Is there not any issue with having a hashed version of the email, given the entropy of an email address is quite small?
It cannot be reversed without a significant amount of effort (really, even when you say the "entropy is quite small" it's not actually as small as you would think) and is therefore probably reasonable. Worst case a regulating body will tell you that no, they do not think "this will take 1-10 years to reverse" is quite good enough and then you can work with them on a solution that would be good enough.
Re: The GDPR blog post
#6I got a few dozen gdpr emails today, some from companies I didn't know existed. This law is a fantastic development for end users/consumers.
Re: The GDPR blog post
#7A popup (probably what used to be cookie warning) on Medium says: > Medium uses browser cookies to give you the best possible experience. To make Medium work, we log user data and share it with processors. To use Medium, you must agree to our Privacy Policy. I must agree to logging user data and sharing it with processors? EDIT: come to think of it, it might be a new, GDPR-specific, dark pattern. I can use the site w…
I don't agree. What's the next step? Will they ban me? Is it my responsibility to reach out to them and tell them I disagree? Or am I just expected to never go to Medium again?
Re: The GDPR blog post
#8A popup (probably what used to be cookie warning) on Medium says: > Medium uses browser cookies to give you the best possible experience. To make Medium work, we log user data and share it with processors. To use Medium, you must agree to our Privacy Policy. I must agree to logging user data and sharing it with processors? EDIT: come to think of it, it might be a new, GDPR-specific, dark pattern. I can use the site w…
The most hilarious part of that is that you really don't need to. I've added a blacklist for everything (first party JS, styling, images) on medium.com and everything continues to work just fine. I don't remember specifically why I did that, but it's probably a dark pattern (such as a modal that pops up after one paragraph of reading) that annoyed me in the past.
Re: The GDPR blog post
#9Is there not any issue with having a hashed version of the email, given the entropy of an email address is quite small?
Perhaps use bcrypt to be on the safe side. With correct bcrypt configuration brute-forcing gets infeasible.
Re: The GDPR blog post
#10Is there not any issue with having a hashed version of the email, given the entropy of an email address is quite small?
Maybe, but they have a good reason to keep that data, and they even go out of their way to "hide it" the best they can using a one-way function.
To save the information that a certain email address has explicitly withdrawn consent, they need to store it. The alternative is to send out a new email the next time someone adds then. I think the interpretation of GDPR this particular instance of information storing is still open, but they have done everything possible to keep it safe. Should the list of hashes be leaked, the best an adversary can realistically do is check known emails against the list of hashes.