Website data leaks pose greater risks than most people realize • Hacker News Board

Re: Website data leaks pose greater risks than most people realize

#31

Post by sarnowski » Wed, Feb 05, 2020, 6:52 PM UTC

ThePhysicist wrote: post #4

Most companies still don’t know what anonymization means and confuse anonymized with pseudonymized or masked data. Part of the problem is that there are still no good criteria available to define anonymity. Concepts like differential privacy are a step in the right direction but they still provide room for error, and in many cases they are either too restrictive (transformed data is not useful anymore) or too lax (tr…

As one step to raise awareness about the differences I really like this overview:

https://fpf.org/wp-content/uploads/2017/06/FPF_Visual-Guide-...

Re: Website data leaks pose greater risks than most people realize

#32

Post by james-imitative » Wed, Feb 05, 2020, 7:30 PM UTC

ThePhysicist wrote: post #4

Most companies still don’t know what anonymization means and confuse anonymized with pseudonymized or masked data. Part of the problem is that there are still no good criteria available to define anonymity. Concepts like differential privacy are a step in the right direction but they still provide room for error, and in many cases they are either too restrictive (transformed data is not useful anymore) or too lax (tr…

Yes. This. Fully anonymised is data is #not the same thing as (fully) pseudonymous data. Thank you for pointing out that very important distinction. :D

Re: Website data leaks pose greater risks than most people realize

#33

Post by stebann » Thu, Feb 06, 2020, 12:57 AM UTC

ThePhysicist wrote: post #4

Most companies still don’t know what anonymization means and confuse anonymized with pseudonymized or masked data. Part of the problem is that there are still no good criteria available to define anonymity. Concepts like differential privacy are a step in the right direction but they still provide room for error, and in many cases they are either too restrictive (transformed data is not useful anymore) or too lax (tr…

Having read about anonymization techniques I have started to believe that definitions of anonymity and pseudo-anonymity are well settle by now but criteria that contributes to the invariants for performing data transformation are not, so the result is that this criteria fail to guide the implementations of the transformations.

You keep data because data is economically valuable, but even when you care enough to implement some techniques that depends on the invariants you still fail to achieve something the better because of scale and because you don't want to refine the techniques. This also means that somehow somebody may have a technique that, provided enough pieces of data, can reverse you transformation.