Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla research: Browsing histories are unique enough to identify users

zdnet.com

Post reply on HN
Print view View original

31–40 of 131 posts

Re: Mozilla research: Browsing histories are unique enough to identify users

#31

Post by godelski »

MattGaiser wrote: post #19
LatteLazy wrote: post #14

Here in the UK, date of birth and post code is enough to identify something like 95% of people. Anonymised data sets are not really possible once you have more than a few varriables. Most people don't know this.

Isn’t a postal code about 50-100 houses? It really narrows things down. That particular variable really reduces things.

That's a bit insane. I looked up US numbers to check and got around 8k/zip code[0]

[0] https://www.zip-codes.com/zip-code-statistics.asp

Re: Mozilla research: Browsing histories are unique enough to identify users

#32

Post by throwaway2474 »

the_jeremy wrote: post #3

Who is able to get access to my browser history? I thought it was just my ISP/VPN, which can obviously track me better in other ways.

How do you imagine the ISP/VPN gets your browsing history for https traffic beyond domain names?

Re: Mozilla research: Browsing histories are unique enough to identify users

#33

Post by liability »

the_jeremy wrote: post #3

Who is able to get access to my browser history? I thought it was just my ISP/VPN, which can obviously track me better in other ways.

Does Mozilla Pocket get browsing history if it isn't disabled? Last I heard it's not using E2E encryption and Mozilla still hasn't open sourced the server side of it.

Re: Mozilla research: Browsing histories are unique enough to identify users

#34

Post by liability »

throwaway2474 wrote: post #32
the_jeremy wrote: post #3

Who is able to get access to my browser history? I thought it was just my ISP/VPN, which can obviously track me better in other ways.

How do you imagine the ISP/VPN gets your browsing history for https traffic beyond domain names?

> beyond domain names

"..other than that, how was the play Mrs. Lincoln?"

Re: Mozilla research: Browsing histories are unique enough to identify users

#36

Post by Polylactic_acid »

LatteLazy wrote: post #14

Here in the UK, date of birth and post code is enough to identify something like 95% of people. Anonymised data sets are not really possible once you have more than a few varriables. Most people don't know this.

My local area published "Anonymised" datasets of public transport usage but they gave everyone a unique ID. It was found that if you knew 2 trips the person took you could uniquely identify the person in the dataset and see all of their trips.

Re: Mozilla research: Browsing histories are unique enough to identify users

#37

Post by cma »

laumars wrote: post #26
cma wrote: post #21

Earlier quoted context omitted.

DNS resolve measurement to see if it is cached by the OS can potentially breach that.

Can JavaScript measure DNS resolve time?

I think only indirectly, but if they control the endpoint they can ping you back, subtract rtt from initial request response time and then the difference from that can tell them whether initial request was cached in dns or not.

Re: Mozilla research: Browsing histories are unique enough to identify users

#38

Post by patrickmcnamara »

godelski wrote: post #31
MattGaiser wrote: post #19

Earlier quoted context omitted.

Isn’t a postal code about 50-100 houses? It really narrows things down. That particular variable really reduces things.

That's a bit insane. I looked up US numbers to check and got around 8k/zip code[0] [0] https://www.zip-codes.com/zip-code-statistics.asp

In Ireland, we use Eircode with one house per postcode. This is very handy because you don't need to type in your full address on a lot of websites, just the Eircode.

The first three digits of an Eircode are more like a traditional postcode in that they indicate your area/town but the next four are randomised for each address.

Re: Mozilla research: Browsing histories are unique enough to identify users

#39

Post by SquareWheel »

LatteLazy wrote: post #14

Here in the UK, date of birth and post code is enough to identify something like 95% of people. Anonymised data sets are not really possible once you have more than a few varriables. Most people don't know this.

In this case, proper anonymization would require unlinking those two variables then.

It isn't impossible to anonymize data. It's just hard to do it right.

Post reply on HN