Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla research: Browsing histories are unique enough to identify users

zdnet.com

Post reply on HN
Print view View original

41–50 of 131 posts

Re: Mozilla research: Browsing histories are unique enough to identify users

#41

Post by 3np »

To this me and a friend started sketching on a VPN/HTTP proxy that will have a set of say 100 outgoing IPs, look at the domains being connected to and distribute request destinations over IPs.

So e.g. Google would always see the same IP, which would be different from the one Facebook sees.

While access times cross-references and identification is still theoretically possible, it should be an entirely different game.

Would anyone else reading this be interested in working on this or joining in? I'm not thinking to make it a startup or business per se but 1) reliable IPs are a bit too expensive to make sense for just 1 person 2) anonymity in numbers.

I'm thinking ideal would be something FOSS and easy to self-host and replicate so you can pool together a group of friends for a shared VPN among semi-trusted parties (at least the user should trust the operator to not index requests and sell the data, and the operator should trust users to not run botnets)

Re: Mozilla research: Browsing histories are unique enough to identify users

#42

Post by hanniabu »

patrickmcnamara wrote: post #38
godelski wrote: post #31

Earlier quoted context omitted.

That's a bit insane. I looked up US numbers to check and got around 8k/zip code[0] [0] https://www.zip-codes.com/zip-code-statistics.asp

In Ireland, we use Eircode with one house per postcode. This is very handy because you don't need to type in your full address on a lot of websites, just the Eircode. The first three digits of an Eircode are more like a traditional postcode in that they indicate your area/town but the next four are randomised for each address.

Man, that sounds so convenient. I kind of wish everywhere had that minus the privacy factors

Re: Mozilla research: Browsing histories are unique enough to identify users

#44

Post by mulmen »

Polylactic_acid wrote: post #36
LatteLazy wrote: post #14

Here in the UK, date of birth and post code is enough to identify something like 95% of people. Anonymised data sets are not really possible once you have more than a few varriables. Most people don't know this.

My local area published "Anonymised" datasets of public transport usage but they gave everyone a unique ID. It was found that if you knew 2 trips the person took you could uniquely identify the person in the dataset and see all of their trips.

How does that work? If a friend of mine and I both took the bus to a movie and returned to our start how do you differentiate between us?

Seems like this would come up a lot with commuters.

Re: Mozilla research: Browsing histories are unique enough to identify users

#45

Post by bleepblorp »

slipheen wrote: post #4
the_jeremy wrote: post #3

Who is able to get access to my browser history? I thought it was just my ISP/VPN, which can obviously track me better in other ways.

Consider for example, that many pages use remotely loaded resources. I would think things like Facebook/Twitter like buttons or Google Fonts might make it to assemble this history. Sites like FB are said to maintain "Shadow Profiles" of people, even when those people aren't using their service directly. I suppose in theory any sufficiently shared infrastructures such as AWS/Cloudflare could do so as well, but they ar…

Have there been any indications that AWS broadly captures connection data between AWS tenants and their respective users for illegitimate purposes?

Some AWS services (such as TLS-terminating load balancers) do have access to sensitive cross-site information that could be fed into the adtech panopticon but I wonder if it would be cost-effective for AWS to gather.

I doubt it would be cost effective for AWS to do broad captures for all of its services, however. There's probably not much value in slurping up the IP and SNI data for all HTTPS requests to every EC2 instance, for instance.

Re: Mozilla research: Browsing histories are unique enough to identify users

#46

Post by Polylactic_acid »

mulmen wrote: post #44
Polylactic_acid wrote: post #36

Earlier quoted context omitted.

My local area published "Anonymised" datasets of public transport usage but they gave everyone a unique ID. It was found that if you knew 2 trips the person took you could uniquely identify the person in the dataset and see all of their trips.

How does that work? If a friend of mine and I both took the bus to a movie and returned to our start how do you differentiate between us? Seems like this would come up a lot with commuters.

Of course that case will fail but for almost all cases if you know something like that you took x bus to work and then a week later you took one to the mall its now possible to find all of their trips. For someone you know somewhat well its not hard to find 2 trips they took and then be able to find all of their trips.

Re: Mozilla research: Browsing histories are unique enough to identify users

#48

Post by the_pwner224 »

stefan_ wrote: post #7
the_jeremy wrote: post #3

Who is able to get access to my browser history? I thought it was just my ISP/VPN, which can obviously track me better in other ways.

Malicious extensions are a likely culprit. This is the ultimate irony of the whole WebExtensions debacle; browser vendors wanted to stop the extensions from interacting with the browser because maintaining that interface is work, so now the most trivial extensions will request full access to all websites so they can inject scripts. To bring back "backspace navigates back" I have an extension that needs just that.

On Firefox you can go to about:config and set 'browser.backspace_action' to 0.

Re: Mozilla research: Browsing histories are unique enough to identify users

#50

Post by lostmsu »

afrcnc wrote: post #16
the_jeremy wrote: post #3

Who is able to get access to my browser history? I thought it was just my ISP/VPN, which can obviously track me better in other ways.

Install one shady Android app and it will immediately dump your browsing history, rest assured.

How exactly would it do it? Android permissions prohibit access to other app data, except shared storage.
Post reply on HN