Advanced Denanonymization through Strava

Post by jzzskijj » Tue, Jan 30, 2018, 11:39 AM UTC

Post by nradov » Tue, Jan 30, 2018, 11:54 AM UTC

loeg wrote: post #4

taneq wrote: post #3

This isn't even "deanonymization" in the sense of "performing statistical inference to re-associate different pieces of data." It's "you ask the company to give you personally identifiable data, and it does so."

Strava is a public-by-default social networking website that happens to focus on athletics. Given that, it's no surprise some users happen to work in the military (they're also on Facebook). It seems like the various militaries need to do a better job of informing and enforcing social media policy, including auditing websites like Strava. You could also argue that Strava should be private by default, but I don't thin…

Post by rounce » Tue, Jan 30, 2018, 12:00 PM UTC

jzzskijj wrote: post #22

Strava has even a toggle "Include my anonymized public activity data in Strava Metro and the Heatmaps" for controlling does location data from sport activities end up into heatmaps or not. Interesting, that in media this "news" has been mostly about Strava doing something it openly says it does. There hasn't been much critique about military not educating their personnel not to publish the exact locations of military…

Post by jzzskijj » Tue, Jan 30, 2018, 12:22 PM UTC

rounce wrote: post #26

jzzskijj wrote: post #22

Strava has even a toggle "Include my anonymized public activity data in Strava Metro and the Heatmaps" for controlling does location data from sport activities end up into heatmaps or not. Interesting, that in media this "news" has been mostly about Strava doing something it openly says it does. There hasn't been much critique about military not educating their personnel not to publish the exact locations of military…

You're way off. The reason this "news" is news is not because Strava has done anything naughty, it's because people that are tasked with the national security (and often some secrets) of their respective nations have committed such an easily avoidable op-sec failure.

Post by maxerickson » Tue, Jan 30, 2018, 1:29 PM UTC

wallace_f wrote: post #21

abcd_f wrote: post #7

This is neither advanced nor denanonymization (sic). They basically pluck an interesting route from the hotmap (as per other people's recent discovery), pretend that they have also run/biked this route and Strava will show them names of others who run/biked the same way. That's clever, but that's not "advanced" by any means. It's also not a deanonymization as there's really no option in Strava for public _anonymous_…

This is a good example to bring up when people talk about a digital bill of rights. It fundamentally shouldn't be so easy to undermine individual privacy and military op sec, but when you allow private data to be shared recklessly, you get that.