41–50 of 101 posts
Would differential privacy fix this problem? I heard that new US census will use it.
https://www.schneier.com/blog/archives/2019/07/google_releas...
https://www.microsoft.com/en-us/research/project/microsoft-s...
Earlier quoted context omitted.
do you have some examples?
Of a differentially private algorithm? Frank McSherry (one of the authors of the original differential privacy paper) has a nice blog post introducing the idea and giving many examples with code [1]. Or even more briefly, if you want to know how many people in your database have characteristic X, you can compute that number and add Laplace(1/epsilon) noise [2] and output the result. That's epsilon-differentially priv…
When information you are recieving has been "anonymized", how do you tell it is accurate? If you are the person collecting and storing said sensative information, you will know what is and is not accurate, but nobody else knows. For some kinds of information, like medical records, the information is deadly not to have accurate, but also deadly to have accurate and public. Once the information leaks, employers might d…
That aside, I would like the option that says "do not collect the data". It wouldn't even be hard.
Sure there is knowledge and advantages in that data, but that doesn't even come close to the benefits of privacy. Think the general public opinion about X is pretty stupid? If so, you'll need it too.
If people tell you they're collecting data for statistical purposes, then one of three things: 1. They should deliberately introduce noise into the raw data. Nazis with the raw census data can spend all month trying to find the two 40-something Jews that data says live on this island of 8400 people, but they were just noise. Or were they? No way to know. 2. Bucket everything and discard all raw data immediately. This…
> They shouldn't collect _anything_ personally identifiable Why not just ensure that any personally identifiable data is properly bucketed, and discarded if it is too strongly identifiable. If you are storing someone's height, age, and gender, you can just increase the bucket size for those fields until every combination of identifiable fields occurs several times in the dataset. If there are always a few different r…
> Homogeneity Attack: This attack leverages the case where all the values for a sensitive value within a set of k records are identical. In such cases, even though the data has been k-anonymized, the sensitive value for the set of k records may be exactly predicted.
> Background Knowledge Attack: This attack leverages an association between one or more quasi-identifier attributes with the sensitive attribute to reduce the set of possible values for the sensitive attribute.
Optimal k-anonymization is also computationally hard [2].
Earlier quoted context omitted.
Pseudonymization already refers to reference by pseudonym. Pseudonimization is bad terminology in that it's indistinct from the above, to the point that parent has already mixed the two up while in the process of recommending it. And it'd be worse verbally. "Pseudo-anonymization" could work, but something like "breakable anonymization" or "partial anonymization" might be better in that it's more obvious to a reader a…
'Pseudononymization' is how my brain read it. It's a fairly self-explanatory portmanteau with little chance of confusion on the root.
If they can pick out individuals from the data, then the data is not anonymized. Sure they may have unassociated data spread across unassociated records, but if an algorithm can pick it out, then so could a human (though way more effort). That for me is not anonymized data.
What matters is that this is what most online companies (and their terms of service) would call anonymized data.
Given a source dataset they create a synthetic dataset that has the same statistical properties (as defined at the point the synthetic dataset is created).
I've seen a demo, it's pretty slick https://synthesized.io/
When information you are recieving has been "anonymized", how do you tell it is accurate? If you are the person collecting and storing said sensative information, you will know what is and is not accurate, but nobody else knows. For some kinds of information, like medical records, the information is deadly not to have accurate, but also deadly to have accurate and public. Once the information leaks, employers might d…
You should be able to request any personal data to be deleted. If the company in question leaks anything, they are responsible. Here the bonkers american style punishments might actually be the way to go. That aside, I would like the option that says "do not collect the data". It wouldn't even be hard. Sure there is knowledge and advantages in that data, but that doesn't even come close to the benefits of privacy. Th…
Earlier quoted context omitted.
Nazis used the census because it was there. Were it not, they would have just went house to house - which they then regularly did anyway. The antidote of oppression is not the Index statisticum prohibitorum, but quite the opposite, education, and in particular educating about how different each and every one of us is, and yet it doesn't take much to get along well.
Today's Nazis would probably use machine learning to identify "characteristically Jewish facial features". (Or, of course, simply pass a law that entitles them to deport or hold indefinitely anyone who can't prove they're a real Ayrian with only the papers they have on them at the time)
Earlier quoted context omitted.
Of a differentially private algorithm? Frank McSherry (one of the authors of the original differential privacy paper) has a nice blog post introducing the idea and giving many examples with code [1]. Or even more briefly, if you want to know how many people in your database have characteristic X, you can compute that number and add Laplace(1/epsilon) noise [2] and output the result. That's epsilon-differentially priv…
Thanks for the links. I'm still a little confused by how differential privacy can be applied to non-aggregated fields. Can differentially private algorithms also be applied to mask/anonymise non-aggregated fields?
It's possible to learn something by aggregating a bunch of those individually-privatized statistics. Randomized response [1] is a canonical example. More generally, local differential privacy is a stronger privacy model where users privatize their own data before releasing it for (arbitrary) analysis. As you might expect, the stronger privacy guarantee means worse utility, sometimes much worse [2].