I have reported as SPAM all the GDPR emails i got from unknown companies, i never asked to receive all this shit (250 GDPR messages just this week)
The GDPR blog post
101–110 of 144 posts
Re: The GDPR blog post
#102Earlier quoted context omitted.
Yup. Today I opened my fridge wondering if I'll see a note about an updated privacy policy inside. It's ironic seeing that the law was in power for the last 2 years, but companies woke up only last week. A lot of those mails are only information, with no (clearly marked) link to a consent panel, so I assume that me ignoring them means they won't be allowed to spam me anymore.
You're joking, but my fridge did hand me a GDPR notice in the morning: https://twitter.com/varjag/status/998496423019778048
That's fairly incredible. A friend bought a Samsung smart TV, but after reading the EULA (which of course they spring on you after powering it on rather than to inform you at the point-of-sale) decided to forego the smarts in the TV. Those things track just about everything, your fridge apparently is still relatively mellow.
Did it open without you clicking 'ok'?
Re: The GDPR blog post
#103Earlier quoted context omitted.
The problem is identification of physical persons. Your e-mail is public, but it also identifies you as a person. This is important, because it allows for correlating different data sets. Touch Surgery sounds like a honest company, so for them this was just some extra burden. But the same law prevents ShadyAdtechCo from getting datasets from several companies and joining them on e-mail column to build a profile of yo…
An email address identifies an email address, not a person. More than a few times I've signed up to newsletters with a distribution list address, that maps to n number of actual people behind the group, who may or may not be fixed members of that group. You could track c_sharp_enthusiasts@myCompany.com, but that is not identifying a person.
No one but us computer supernerds makes that distinction. On the consumer market, an email address is an excellent way to identify a person over a very, very, very long time. No one but the tech-literate change their email too often.
Re: The GDPR blog post
#104Earlier quoted context omitted.
Minutes to days to reverse almost the whole list, depending on budget. It's not a real obstruction except to casual snooping.
Could you walk me through how you come to that conclusion? I admit my estimate was very ballpark, but "minutes" seems so wildly out of line with what I think I must be making a mistake somewhere.
A single AWS GPU server can hash trial passwords on the order of 100 GH/s, which puts a pretty low ceiling on "hashcat as a service" rental costs.
I'm assuming 10^12 tries per second is economical for any business.
there are about a million words, including all likely spellings of all but the rarest first and last names, so all 1 or 2 word addresses, firstname.lastnames, etc. addresses are about 10^12. try those, plus short alphanumerics, for the 1000 most common email domains -> 10^15 addresses
Throw in every name in public leak databases that doesn't meet those patterns as well.
There's on the order of 1 million domains that are likely to be serving mail at all; try the billion most likely names for each of those for another 10^15.
This should capture almost every email address that isn't an intentionally obfuscated one-off and adds up to less than an hour at 10^12/sec. There's a modest overhead to matching against a larger list but it shouldn't matter in practice
Re: The GDPR blog post
#105[deleted]
Re: The GDPR blog post
#106Earlier quoted context omitted.
We'll have to wait til someone got sued into oblivion before we know that
Noone will get sued under the GDPR. That's not how it works.
Article 79 says that each data subject that considers that their rights under GDPR have been violated by a controller or processor has the right to an effective judicial remedy, which may be brought before a court in either the Member State where the data subject resides, or where the controller or processor has an establishment.
This is distinct from administrative and non-judicial remedies.
That sure sounds like suing.
Re: The GDPR blog post
#107We’re still not GDPR compliant and don’t plan to be. So far so good.
Re: The GDPR blog post
#108Earlier quoted context omitted.
Minutes to days to reverse almost the whole list, depending on budget. It's not a real obstruction except to casual snooping.
Could you walk me through how you come to that conclusion? I admit my estimate was very ballpark, but "minutes" seems so wildly out of line with what I think I must be making a mistake somewhere.
A couple of hundred bucks spent on renting GPU instances can speed things up considerably.
Re: The GDPR blog post
#109Earlier quoted context omitted.
I think it's more likely that "to make Medium make money," they engage in tracking for advertising purposes. Medium works perfectly well for my purposes without that banner being displayed. I can open up developer tools and delete that node. If I don't click agree, does that mean that this information isn't collected? Because tracking cookies are still placed. Now what is interesting is that I don't remember being as…
> Now what is interesting is that I don't remember being asked for consent for them to place a cookie to log the number of articles I read in a month as part of their sign-up funnel. They could probably make this compliant by storing the counter in your local storage and never sending it anywhere - just having a piece of JS that essentially does: if(Storage.getItem("visits") > 6) { displaySignnupPopup(); }
Ah, when I used to bother with Proxomitron (https://www.proxomitron.info/), I could rewrite anything that went "over the wire" because it acts as a HTTP-proxy listening at localhost. I remember modifying Javascript lines so adding my own code was possible...
One could add an SSL library and basically MITM HTTPS connections, but I never tried that.
Re: The GDPR blog post
#110Earlier quoted context omitted.
Nope, the site works fine if you disable cookies. Once Facebook and Google fail I'm sure they'll be next.
I didn't click "I Agree" anyway. If they processed the data, I guess they're in violation now. That said, it's not the first time I've seen something like that this week. I wonder if some companies aren't simply testing if they can get away with it.
Yes, they say
To make Medium work, we log user data and share it with processors. To use Medium, you must agree to our Privacy Policy, including cookie policy.
However it seems to work just fine without cookies - when I load the site in lynx, and reject all cookies, it loads just fine.