When an app asks for permissions, it should have a “feed fake data” option

An unfortunate characteristic of data fuzzing is that given sufficient alternative sources of information it's actually reasonably easy to filter out the noise. A key issue is whether the noise refers to subjects which are entirely generated or which exist in the world, though even this only incrementally adds to the noise level.

Take the case of contacts. If I were to use a random ID generate to create contacts and feed those to an app, then with sufficient independent sources of data the app could choose to reject any contact which appears only once. If you happen to be the One And Only True Friend of an Orphan Hermit, then yes, that rule would exclude that data, but if you happen to be personal BFFs with Beyoncé Giselle Knowles-Carter, the system could not only independently validate that such a person exists, but even that your own reported contact information is, say, directly personal rather than a mass-media point-of-contact.

The other problem is that even with generated data, so long as that is intermixed with authentic data, it's often possible to tease out signal from noise. A case here might be with browser history. There are Web browsers which generate spurious traffic. This is "real" in the senses both that it refers to actual online Web resources, and represents traffic generated by your browser, but is generated in the sense that it does not represent volitional activity on your part. However, so long as both activities are present, your actual browsing patterns exist (so that if a concern is that you did in fact visit https://example.com/xyz>, it would be possible to determine that some entity (genuine or simulated) did so, and that if the URL were simply randomly generated or visited, odds are reasonably low that that URL would appear within a browser history.

Similarly, in a combination of actual and faked contacts, if the question is "did the subject include Known Individual in their contacts", that fact can still be determined, and if statistically improbable, particularly amongst a group of individuals all including Known Individual in their contacts, the general inference of an actual relationship is strong.

The case of being able to entirely separate actual and generated information changes this dynamic ... slightly, but not overhwhelmingly.

My own upshots:

- Data chaffing and fuzzing are hard.

- The signal one wishes to obscure often leaks.

- Entirely-fabricated data is usually reasonably evident, especially in aggregate.

- Whilst some degree of chaffing has some value (signalling, protest, cost-increasing), the most effective course of action is likely effective privacy legislation and regulation.

I really wish there were more effective individual actions. I increasingly feel that there aren't, other than opting out entirely. (Something I increasingly practice myself, FWIW.)

You’re being downvoted (clearly by multiple people) for having a valid opposing opinion in a subjective debate. Hate to see that kind of behavior on HN. Upvoted you to balance it out.

Apple already enforces this, at least to some extent. If you just tell the user “you cannot use our app without allowing us to track you”, your app will get denied from the App Store. Apple is incentivized to do this because they get their value charging access to the ecosystem, and so it’s in their incentive to make sure their ecosystem is nice to users.

I don't mind fake personal data, like contacts or photos, but once you get into locations I'm iffy.

If it's being used locally for showing your location on a map, or searching for nearby businesses, sure, give it fake data.

But if you're talking about an app that does internet speed tests and maps the speeds for different cellular providers, or lets users report local weather conditions to improve forecasts, then I have no problem with those apps being able to say "Either give us an accurate location, or give us no location, we don't want your fake location."

The platforms would have to be an adjudicator of which apps get an exemption for users contributing back data that will affect other people rather than just influencing their own browsing experience.

I think Apple has come up with some good middle grounds on this, you don't have to grant an app "precise location," and you can grant photo access via a system provided image picker that only shows the app photos that you've selected.

I think the fake data is more like “block and report spam”. Which is what I do for every email that I don’t want to see. I agree that there is no need to play nice. Companies are not respecting my time so they can suffer the consequences.