Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: I made a neural net that analyzes privacy policies

useguard.com

Post reply on HN
Print view View original

41–50 of 122 posts

Re: Show HN: I made a neural net that analyzes privacy policies

#41

Post by the_pwner224 »

I went to the homepage and ctrl-clicked a company card (Mozilla) to open the details in a new tab. Instead, the site jacked my ctrl-click and instead tried to navigate to the link in the same tab. Middle-clicking does not work at all.

It then went to an error page instead of loading the details for Mozilla, but while it's an interesting idea I'm not sure how useful it is. I don't usually create an account on a website unless I have to do so, and the privacy policy is nonnegotiable. So why would I want to check what their privacy policy is?

I only give personal data to websites when I have to (e.g. to services that work or school use) or if I already trust the company to not do anything shady with it (Mozilla has done some sketchy stuff but I believe they won't leak my passwords).

And for websites where participation is more optional, like HN or Reddit, you don't usually need to give much personal data anyway.

Edit: the website is fully working now. Mozilla has had one security breach where emails and hashed passwords were leaked, in 2014. At the bottom the sentence breakdown is 2.5/12/22% concerning/mild/friendly. Meanwhile Reddit has no breaches, but keeps your messages forever and shares data with ad companies. Their sentence breakdown at the bottom is 3.3/23/9%. Overall, the AI rates Mozilla at 33% and Reddit at 41%. That doesn't really make sense to me.

I would really like to see more details about the privacy policy sentences on the website. If 2.5% of Mozilla's privacy policy is very concerning and 12% is mildly bad, I would like to see the actual sentences to know the risks. There is a button to view the full annotated policy, but clicking it says to send an email to you. Edit: this seems like a bug, it shows a few sentences in a WebKit-based browser [Falkon] but in Firefox it just shows the chain link icons.

Finally, I took the A/B test from Guard, and quite of a few A/B choices seemed to not really have anything to do with privacy. If the dataset is kept the same, then I think a different test format would be to rate each A and B snippet as:

- Not about privacy

- Good for privacy # only if the other one is not about privacy

- Bad for privacy # only if the other one is not about privacy

- Better than [A/B] # only if neither is not about privacy

Anyway, the data itself may be somewhat useful to me if I want to learn more about a company's privacy practices. But for normal people, I think it would be helpful for the website to also explain why privacy is important and why people should care.

Re: Show HN: I made a neural net that analyzes privacy policies

#42

Post by simongr3dal »

the_pwner224 wrote: post #41

I went to the homepage and ctrl-clicked a company card (Mozilla) to open the details in a new tab. Instead, the site jacked my ctrl-click and instead tried to navigate to the link in the same tab. Middle-clicking does not work at all. It then went to an error page instead of loading the details for Mozilla, but while it's an interesting idea I'm not sure how useful it is. I don't usually create an account on a websit…

More and more websites are so advanced that they can’t even use an tag anymore. Instead they do some convoluted onclick-scripting that breaks all standard behavior and accessibility functionality.

Re: Show HN: I made a neural net that analyzes privacy policies

#43

Post by Swizec »

the_pwner224 wrote: post #41

I went to the homepage and ctrl-clicked a company card (Mozilla) to open the details in a new tab. Instead, the site jacked my ctrl-click and instead tried to navigate to the link in the same tab. Middle-clicking does not work at all. It then went to an error page instead of loading the details for Mozilla, but while it's an interesting idea I'm not sure how useful it is. I don't usually create an account on a websit…

> I only give personal data to websites when I have to

This is a great policy that I think more people should use. Not everything needs your real name, real birthday, or your real home address. Definitely not your real phone number. You often do need a real email address.

> you don't usually need to give much personal data anyway

This is where it gets tricky. Anonymized aggregate data can be surprisingly identifying. You only need 33 bits of information to uniquely identify any individual in the world. If your IP tells me you're from San Francisco, then I need just 20 bits of information to uniquely identify you.

Data mining 20 yes/no answers about one of your users is ... pretty easy.

Re: Show HN: I made a neural net that analyzes privacy policies

#44

Post by notyourwork »

simongr3dal wrote: post #42
the_pwner224 wrote: post #41

I went to the homepage and ctrl-clicked a company card (Mozilla) to open the details in a new tab. Instead, the site jacked my ctrl-click and instead tried to navigate to the link in the same tab. Middle-clicking does not work at all. It then went to an error page instead of loading the details for Mozilla, but while it's an interesting idea I'm not sure how useful it is. I don't usually create an account on a websit…

More and more websites are so advanced that they can’t even use an tag anymore. Instead they do some convoluted onclick-scripting that breaks all standard behavior and accessibility functionality.

I think complicated is a better choice than advanced. Intentionally complicated without adding value in a lot of cases.

Re: Show HN: I made a neural net that analyzes privacy policies

#45

Post by blondin »

thecleaner wrote: post #21
rameerez wrote: post #2

Hi guys! So as basis for my thesis on AI and NLP I've been working on a RRN-based text classifier that basically reads and analyzes privacy policies. It understands that "we don't share your data with third parties" is privacy friendly while "we may share your data with anyone" is a potential threat. I've then created this website with a bunch of analyzed services to showcase the most relevant info about each service…

Oh my god thank you so much for doing this ! I think its better (for me as a user) if you don't boil things down to a score as different people expect different things when talking privacy. It would help if you could simply highlight the potential problematic clauses in different privacy statements along with some reason why it might be problematic.

well, just checked and i already see the majority of the web gathering around "C". so really, we can argue both ways about this score thing...

Re: Show HN: I made a neural net that analyzes privacy policies

#46

Post by ignoramous »

This is great but like tosdr.org before it, what does it tell people they already don't assume to be true? I use tosdr only to often keep ignoring what it's telling me.

Also, I'm not sure if a majority care abt privacy when the value delivered is super high. They submit to the will of the service provider, as if it was the cost of doing business without realising they could either look for alternative or exercise stricter control over what they share and how [0].

To that end, I like tools that let users take action in addition to showing what's wrong rather than simply point it out. Actions can include:

- Replace: Push the users towards alternatives and help them seamlessly take their data elsewhere.

-- Help change their usage behaviour. Most digital-wellbeing / internet de-centralization tech fall under this category?

-- Translate / Pipe data exported from one service provider and import it into another. For instance, it is tiresome to move away from wordpress to ghost.org; or from WhatsApp to Signal. Emails work great.

- Reduce: Hand-hold them as they grasp various privacy and security settings on offer and exercise them, as appropriate.

-- JumboPrivacy does this for popular social networks.

-- PrivacySettings Firefox plugin for Firefox is another example.

-- Plenty write blog posts to help others navigate arduous settings across popular web properties, and expect nothing in return.

- Restrict: Provide tools that let them control what the services can and cannot collect.

-- Application sandboxes like firejail / sandboxie, firewalls like Snitch / LuLu, DNS based content blockers like pi-hole, in-browser content blockers like uBlockOrigin are some examples.

[0] One of the first questions folks asked after an exodus-privacy (which is super nice and something I use every other month) presentation at fosdem was, 'What can I do now that you've exposed what apps on Android do with the permissions granted to them and the SDKs they embed?' exodus-privacy, as great as it is, doesn't let you take action but presents a nice overview of the dangers to your privacy due to the app you've installed. Instead, you might end up having to independently discover and install Blokada or AdAway or Pi-Hole or NetGuard or XPrivacyLua or microG or GrapheneOS or...

Re: Show HN: I made a neural net that analyzes privacy policies

#48

Post by rameerez »

blondin wrote: post #45
thecleaner wrote: post #21

Earlier quoted context omitted.

Oh my god thank you so much for doing this ! I think its better (for me as a user) if you don't boil things down to a score as different people expect different things when talking privacy. It would help if you could simply highlight the potential problematic clauses in different privacy statements along with some reason why it might be problematic.

well, just checked and i already see the majority of the web gathering around "C". so really, we can argue both ways about this score thing...

The scoring definitely needs some work – I think some factors should have more weight. Also services' data vary a lot so it's difficult to come up with a good measure for everyone. Ex: I try to take into account whether the service has had any recent data breach, so it penalizes a lot if it has but also scores rather low if it hasn't; privacy policies' length vary wildly and I think that also plays a large role... It needs some tweaking but I think with some improvements I'll reach a more accurate scoring

Re: Show HN: I made a neural net that analyzes privacy policies

#49

Post by burtonator »

rameerez wrote: post #2

Hi guys! So as basis for my thesis on AI and NLP I've been working on a RRN-based text classifier that basically reads and analyzes privacy policies. It understands that "we don't share your data with third parties" is privacy friendly while "we may share your data with anyone" is a potential threat. I've then created this website with a bunch of analyzed services to showcase the most relevant info about each service…

Hey... can you reach out to me... I'm kevin ... at datastreamer.io (trying to hide that from spam but I think you can avoid that).

I'm working on something similar at the moment for a client.

Right now I'm just starting out but I've built a privacy policy classifier that is an RNN classifier based on TensorFlow that is just an 'is this a privacy policy' classifier.

I have about 650MB of privacy policies at the moment which I fetched via a crawler. I'm just about to classify the rest of them.

I'm trying to automate the whole thing so that we have a full workflow.

Anyway... ping me to discuss.

Re: Show HN: I made a neural net that analyzes privacy policies

#50

Post by domnomnom »

rameerez wrote: post #2

Hi guys! So as basis for my thesis on AI and NLP I've been working on a RRN-based text classifier that basically reads and analyzes privacy policies. It understands that "we don't share your data with third parties" is privacy friendly while "we may share your data with anyone" is a potential threat. I've then created this website with a bunch of analyzed services to showcase the most relevant info about each service…

How do we know it isn't just people doing the analysis if we can't actually use the AI ourselves?
Post reply on HN