Live data from Hacker News

Mozilla research: Browsing histories are unique enough to identify users

zdnet.com

71–80 of 131 posts

Re: Mozilla research: Browsing histories are unique enough to identify users

#71
post #59
post #51

Earlier quoted context omitted.

Ok, so two trips but not any two trips. It requires a lot more knowledge of the person. For someone you know well why would you even need to look at the data?

One could trivially establish multiple trips that anyone with even slightly public social media has taken.

Ok this is an interesting point. I can’t tell if this is a challenging problem or not. It’s probably worth trying an experiment.

Re: Mozilla research: Browsing histories are unique enough to identify users

#72

Who is able to get access to my browser history? I thought it was just my ISP/VPN, which can obviously track me better in other ways.

Does Mozilla Pocket get browsing history if it isn't disabled? Last I heard it's not using E2E encryption and Mozilla still hasn't open sourced the server side of it.

My understanding of pocket recommendations is that it gets a list of articles from a server every day and uses a local algorithm to match them to your browsing history so your history never leaves the device. Idk if any metadata about which decisions it made is leaked though.

https://help.getpocket.com/article/1142-firefox-new-tab-reco...

Re: Mozilla research: Browsing histories are unique enough to identify users

#73
post #69

Earlier quoted context omitted.

> Did this research... establish better numbers around it or something? >> However, this time around, since the data was collected from Firefox itself and not through a web page performing a time-lengthy CSS test, the data was much more accurate and reliable. Furthermore, the data Mozilla researchers collected is also about the same type of data that today's online analytics companies also collect about users — eithe…

Needs to be specified that this was an opt-in study that you had to agree to.

Is no one in this thread going to read this article? Seriously, it isn't that long. RTFM

>> The new experiment got underway between July 16 and August 13, 2019, when Mozilla prompted Firefox users to take part of this experiment.

>> Mozilla researchers said that more than 52,000 users agreed to take part and agreed to provide anonymous browsing data.

Re: Mozilla research: Browsing histories are unique enough to identify users

#74
post #70
post #41

To this me and a friend started sketching on a VPN/HTTP proxy that will have a set of say 100 outgoing IPs, look at the domains being connected to and distribute request destinations over IPs. So e.g. Google would always see the same IP, which would be different from the one Facebook sees. While access times cross-references and identification is still theoretically possible, it should be an entirely different game.…

> While access times cross-references and identification is still theoretically possible, it should be an entirely different game. How are you planning to handle communicating identity across sites with link decoration?

Could you elaborate on what you mean by this specifically? query params like fbclid? That could be stripped client-side, e.g. via a browser extension.

There are already extensions that do this. Previous discussion:

https://news.ycombinator.com/item?id=22386388

Re: Mozilla research: Browsing histories are unique enough to identify users

#75
post #20
post #4

Earlier quoted context omitted.

Consider for example, that many pages use remotely loaded resources. I would think things like Facebook/Twitter like buttons or Google Fonts might make it to assemble this history. Sites like FB are said to maintain "Shadow Profiles" of people, even when those people aren't using their service directly. I suppose in theory any sufficiently shared infrastructures such as AWS/Cloudflare could do so as well, but they ar…

I've started using decentraleyes, hoping to mitigate this issue

Use LocalCDN. A fork of Decentraleyes with many more resources for cache. https://addons.mozilla.org/en-US/firefox/addon/local-cdn-web...

Re: Mozilla research: Browsing histories are unique enough to identify users

#76
post #69

Earlier quoted context omitted.

Needs to be specified that this was an opt-in study that you had to agree to.

Is no one in this thread going to read this article? Seriously, it isn't that long. RTFM >> The new experiment got underway between July 16 and August 13, 2019, when Mozilla prompted Firefox users to take part of this experiment. >> Mozilla researchers said that more than 52,000 users agreed to take part and agreed to provide anonymous browsing data.

Clearly not actually anonymous browsing data in actuality though... which is why we should always take claims that telemetry data is anonymized with a grain of salt.

Re: Mozilla research: Browsing histories are unique enough to identify users

#77
post #41

To this me and a friend started sketching on a VPN/HTTP proxy that will have a set of say 100 outgoing IPs, look at the domains being connected to and distribute request destinations over IPs. So e.g. Google would always see the same IP, which would be different from the one Facebook sees. While access times cross-references and identification is still theoretically possible, it should be an entirely different game.…

Look up browser fingerprinting. It’s a lot more complicated than just obscuring IPs.

Yes, but the primary identifier is IP address. The detailed profiles built with fingerprinting and other data are attached to the small set of IP addresses a person uses over the course of her lifetime. Most internet users have limited choice when it comes to internet access. A user cannot change her IP address with the same ease as she can change her software fingerprints. If a company is trying to sell online ad services, then having a database of browser fingerprints purportedly representing real people is not very valuable unless the company can link those fingerprints to real physical locations.

Re: Mozilla research: Browsing histories are unique enough to identify users

#78

Earlier quoted context omitted.

Is no one in this thread going to read this article? Seriously, it isn't that long. RTFM >> The new experiment got underway between July 16 and August 13, 2019, when Mozilla prompted Firefox users to take part of this experiment. >> Mozilla researchers said that more than 52,000 users agreed to take part and agreed to provide anonymous browsing data.

Clearly not actually anonymous browsing data in actuality though... which is why we should always take claims that telemetry data is anonymized with a grain of salt.

Anonymous as in the only thing they're getting is a random identifier and browsing data.

Re: Mozilla research: Browsing histories are unique enough to identify users

#80
post #51

Earlier quoted context omitted.

Of course that case will fail but for almost all cases if you know something like that you took x bus to work and then a week later you took one to the mall its now possible to find all of their trips. For someone you know somewhat well its not hard to find 2 trips they took and then be able to find all of their trips.

Ok, so two trips but not any two trips. It requires a lot more knowledge of the person. For someone you know well why would you even need to look at the data?

The thing is, if you know enough trips to unmask them, then you can find out about all their trips in that dataset.

As an employer, maybe I can find out an employee wasn't home sick when they said, but took the bus to a station that only serves a competitor's business. Etc.

Post reply on HN