Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Website data leaks pose greater risks than most people realize

seas.harvard.edu

Post reply on HN
Print view View original

21–30 of 33 posts

Re: Website data leaks pose greater risks than most people realize

#21

Post by DataWorker »

ergl wrote: post #10
inciampati wrote: post #6

Differential privacy provides a system that can allow the sharing of databases without allowing an external observer to determine if a particular individual was included. If companies were required to aggregate information in this way and throw away their logs, perhaps leaks would be much less risky for their users. Today this might seem far-fetched, but it could come to pass in the future, when people raised in this…

It's not far-fetched. Differential privacy is going to be used for the US census this year. Here's a report on it: https://arxiv.org/abs/1809.02201 Also, it's not a magical solution. Here's one of the issues from the linked paper (edited for clarity): "The proponents of differential privacy have always maintained that the setting of the [trade-off between privacy loss (ε) and accuracy] is a policy question, not a tec…

“In addition, the historical reasons for having invariants may no longer be consistent with the Census Bureau’s confidentiality mandate.”

us census, RIP

Re: Website data leaks pose greater risks than most people realize

#22

Post by hwbehrens »

akavel wrote: post #20

What does "computer science concentrator" or "statistics concentrator" mean? It's a first time I see such a title (?)

Harvard calls their fields of study "concentrations", not majors [0]. Thus, a CS concentrator is an undergraduate student who is majoring in CS.

[0]: https://en.wikipedia.org/wiki/Academic_major

Re: Website data leaks pose greater risks than most people realize

#23

Post by ravenstine »

ThePhysicist wrote: post #4

Most companies still don’t know what anonymization means and confuse anonymized with pseudonymized or masked data. Part of the problem is that there are still no good criteria available to define anonymity. Concepts like differential privacy are a step in the right direction but they still provide room for error, and in many cases they are either too restrictive (transformed data is not useful anymore) or too lax (tr…

It's not that most of them don't know what anonymization is or are confused about it.

Society is a tapestry of bullshit and low-level swindling is generally tolerated or quickly forgotten about. Thus, there's nothing to prod the unprincipled in charge to do the right thing. As long as something seems to be good(anonymized, in this cage), and problems can be hidden behind the corporate veil long enough, the unwritten rule is to half-ass security solutions because, well, security is boring and there's other things to devote company time and resources to(that will advance upper management).

Security measures, especially those that protect the users, don't make money. At best, they're insurance against the fallout that might occur when it's revealed that your company has been silently screwing people over. Like most human beings, businesses often put off serious consideration of the future in order to enjoy quick and immediate gain.

I wouldn't put it past most companies to screw up an approach like differential privacy. Not enough people actually care that much.

Re: Website data leaks pose greater risks than most people realize

#24

Post by ghostpepper »

ComodoHacker wrote: post #11

Students have found data enrichment techniques exist and can be effectively applied to breach datasets. Good for them.

Yeah, I was a bit surprised when I read this was a project for a first year course Privacy and Technology (CS 105). I don't see it being reported anywhere other than Harvard's own website.

Re: Website data leaks pose greater risks than most people realize

#26

Post by dfxm12 »

ravenstine wrote: post #23
ThePhysicist wrote: post #4

Most companies still don’t know what anonymization means and confuse anonymized with pseudonymized or masked data. Part of the problem is that there are still no good criteria available to define anonymity. Concepts like differential privacy are a step in the right direction but they still provide room for error, and in many cases they are either too restrictive (transformed data is not useful anymore) or too lax (tr…

It's not that most of them don't know what anonymization is or are confused about it. Society is a tapestry of bullshit and low-level swindling is generally tolerated or quickly forgotten about. Thus, there's nothing to prod the unprincipled in charge to do the right thing. As long as something seems to be good(anonymized, in this cage), and problems can be hidden behind the corporate veil long enough, the unwritten…

Security measures, especially those that protect the users, don't make money.

This is why the government has to make regulations with teeth in this space (of course, the government could be the "unprincipled in charge" you referred to).

Re: Website data leaks pose greater risks than most people realize

#27

Post by mattb314 »

bostik wrote: post #8
inciampati wrote: post #6

Differential privacy provides a system that can allow the sharing of databases without allowing an external observer to determine if a particular individual was included. If companies were required to aggregate information in this way and throw away their logs, perhaps leaks would be much less risky for their users. Today this might seem far-fetched, but it could come to pass in the future, when people raised in this…

Differential privacy provides a lot less protection than you would think (or want to believe). A few months ago I saw a talk by E. Kornaropoulos, about his paper "Attacks on Encrypted Databases Beyond the Uniform Query Distribution"[0]. The main take-away from the talk - an in fact all the talks I saw on the same day - was that while DP is touted as a silver bullet and the new hotness, in reality it can not protect a…

Personally I'm not super bullish on differential privacy outside a couple specific use cases, but correlation attacks and cross referencing against external data are exactly the vectors that differential privacy is intended to protect against: it requires that the results of any query or set of queries would be identical with some probability even if a specific person wasn't present in the dataset.

It's possible I'm misreading, but your paper seems to focus on the very anonymization techniques diff privacy was invented to improve on, specifically because these kinds of attacks exist. While I agree it's no silver bullet, the reason is because it's too strong (it's hard to get useful results while providing such powerful guarantees) rather than not strong enough.

I've found the introduction to this textbook on it to be useful and very approachable if others are interested: https://www.cis.upenn.edu/~aaroth/Papers/privacybook.pdf

Re: Website data leaks pose greater risks than most people realize

#28

Post by kube-system »

redis_mlc wrote: post #2

Largely true, but there are HHS rules and guidelines that are accepted in the US healthcare space: https://www.hhs.gov/hipaa/for-professionals/privacy/special-...

HIPAA data is not immune to a data leak... not even the organization that wrote those guidelines are immune:

https://www.deccanchronicle.com/technology/in-other-news/201...

There's tons of PHI on the internet. Your local hospital's online medical chart, your insurance companies bill-pay, etc...

Re: Website data leaks pose greater risks than most people realize

#29

Post by Bartweiss »

ThePhysicist wrote: post #4

Most companies still don’t know what anonymization means and confuse anonymized with pseudonymized or masked data. Part of the problem is that there are still no good criteria available to define anonymity. Concepts like differential privacy are a step in the right direction but they still provide room for error, and in many cases they are either too restrictive (transformed data is not useful anymore) or too lax (tr…

And even the ones who do practice decent anonymization are generally contributing to the problem just by holding a lot of data.

Lots of companies are content to stop at "our data can't be linked back to a person's identity", which doesn't prevent building a uniquely-identifying user profile. (e.g. via browser fingerprinting, plus enough metadata to associate a user's computer and phone accounts.) Even if they do better than that, its typically "our data is not uniquely identifying in isolation", which still isn't enough. If your differential privacy model says that these four pieces of data have a specificity of 10,000 possible individuals, that's a good start. But if someone with an individual's PII and three of those keys comes looking, they can still narrow down information about the fourth value from your aggregates.

And even if no one screws up, what happens when someone queries a half dozen differential datasets for different subsets of a uniquely identifying key? It's something like the file-drawer problem, where one researcher hiding bad data is malicious, but a dozen studies failing to coordinate produces the same result innocently. If outright failures to anonymize become rarer, cross-dataset approaches become more rewarding.

Re: Website data leaks pose greater risks than most people realize

#30

Post by ravenstine »

dfxm12 wrote: post #26
ravenstine wrote: post #23

Earlier quoted context omitted.

It's not that most of them don't know what anonymization is or are confused about it. Society is a tapestry of bullshit and low-level swindling is generally tolerated or quickly forgotten about. Thus, there's nothing to prod the unprincipled in charge to do the right thing. As long as something seems to be good(anonymized, in this cage), and problems can be hidden behind the corporate veil long enough, the unwritten…

Security measures, especially those that protect the users, don't make money. This is why the government has to make regulations with teeth in this space (of course, the government could be the "unprincipled in charge" you referred to).

> of course, the government could be the "unprincipled in charge" you referred to

Not specifically, but I suppose I wouldn't say that politicians are more or less principled than corporate executives. I know some would argue otherwise, but I'm too black pilled at this point to have faith in any "public servant".

Nevertheless, government regulation is probably the way to actually address these issues. Government may lock competence or will, but at least it provides us some leverage, little it may be.

Post reply on HN