Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Debunking the Myth of "Anonymous" Data

eff.org

Post reply on HN
Print view View original

91–100 of 107 posts

Re: Debunking the Myth of "Anonymous" Data

#91

Post by willseth »

m000 wrote: post #72
willseth wrote: post #16

I work for a data privacy startup, and this article unfortunately groups all forms of anonymization together. It is specifically criticizing forms of anonymization that only treat direct identifiers like names, addresses, and phone numbers. That is usually referred to as "pseudonymization", and they are correct to point out that an only moderately sophisticated attacker can still link people in the dataset using comb…

Sorry to break you the news, but your employer is probably selling snake oil. And this is exactly the point of the TFA: > However, in practice, any attempt at de-identification requires removal not only of your identifiable information, but also of information that can identify you when considered in combination with other information known about you. So, anonymization may be well intended and sophisticated, but is o…

I designed our anonymization systems. You clearly have a misunderstanding of the threat model and the treatment methods.

Re: Debunking the Myth of "Anonymous" Data

#92

Post by __MatrixMan__ »

JohnFen wrote: post #68
__MatrixMan__ wrote: post #59

Earlier quoted context omitted.

> You say "somebody" would need to already know a lot about the user to make use of your database. But from my perspective - perspective of the user - that "somebody" could just as well be your company Well yes, noticing problems in these databases and providing consulting towards their mitigation (ideally before the pain shows up) is more or less what we're selling. Some degree of analysis must remain possible becau…

> My point is just that different situations call for different privacy postures. True. Privacy is a special case of security, and it's only useful to talk about security in terms of what threats are of concern. > "Anonymization = Untrustworthy" glosses over this in a way that doesn't help us find ways to improve the situation. If your concern is to be as anonymous as possible, then "Anonymization = untrustworthy" is…

If their goal is to be anonymous as possible, why did they give you the data in the first place? If they're aware of your practices and still in the loop, then presumably their relationship with you is such that some degree of trade-off is acceptable.

I think the better focus for the article would be on transparency. I didn't write the script because I was conforming to some well defined policy about what's in bounds and what's out. I wrote it because somewhere in my heart I felt a vague duty to improve the situation. I'm getting a little pushback on my defense of the script--which is fair--but better would be to scrutinize the policies under which I had to ask my gut about it in the first place.

Re: Debunking the Myth of "Anonymous" Data

#93

Post by willseth »

jandrewrogers wrote: post #29
jruohonen wrote: post #2

A good popular take, but they, either intentionally or out of ignorance, omit newer, proven techniques like differential privacy.

Techniques like differential privacy do not work for some types of data models, including many of the more interesting/risky ones. I've never seen a technique that can deliver an analytical model at scale that is both analytically effective and anonymous while also robust against sophisticated de-anonymization attacks. There is no good theoretical foundation to suggest that such things are possible. Most modern techn…

Can you give an example? Global DP systems generally offer excellent privacy protection for the analytical distortion cost. Global DP is often not implemented simply due to workflow inconveniences but otherwise it’s great for analytical use cases.

Re: Debunking the Myth of "Anonymous" Data

#94

Post by yowlingcat »

genewitch wrote: post #23
willseth wrote: post #16

I work for a data privacy startup, and this article unfortunately groups all forms of anonymization together. It is specifically criticizing forms of anonymization that only treat direct identifiers like names, addresses, and phone numbers. That is usually referred to as "pseudonymization", and they are correct to point out that an only moderately sophisticated attacker can still link people in the dataset using comb…

In the interest of charitable-ness, can you define "noise" and explain how rudimentary denoising algorithms that have existed since the 1960s can't penetrate it? Time and time again people think they've anonymized data and they're always proven incorrect. Just come to grips with the fact you're participating in the sale of my (or whoever's) private data. Hope you sleep well!

> Just come to grips with the fact you're participating in the sale of my (or whoever's) private data. Hope you sleep well!

I think it's really sad that the open source community has historically cultivated a culture which doesn't recognize this kind of paranoia as a lack of mental wellness. I think it's because the zealotry comports well with the extreme amount of energy needed to bootstrap the ecosystem into existence.

You can care about privacy while being unrealistic about why you don't truly have it and never will, because of how much of a risk it is to the powers that be. You can live in a world ruled by proxy wars between gigantic political superpowers and empires who control the upstream levers of the macroeconomy to ensure that the world will always go in a direction opposite to what you'd prefer it to be. It's been like this for thousands if not tens or hundreds of thousands of years.

But moreover, you can and likely do live in a society, full of people who will always value convenience over the freedom you seem to cherish. But even you likely are willing to give up some freedom and privacy for some convenience, unless you employ private security personnel to guard your private compound. And my guess is that if you were inclined in that direction, you wouldn't really be posting on HN. Short of that, to live in a modern society is to some degree accept this compromise and to accept one's own hypocrisy -- and my heart goes out to you as much as to myself because the existential anguish of this never goes away. Nonetheless, it is generally historically accepted that as we grow older, we are to develop the ability to constructively manage around this and gain the wisdom to do so.

Perhaps the reason you sarcastically asked GP that you "hope you sleep well" is because you are projecting and you know that you yourself do not. My advice to you and those of your ilk: stop obsessing over theoeretical purity and get on with enjoying your life in the scarce time you have left on this planet. You'll have far less regrets at the end. And you will finally sleep well.

Re: Debunking the Myth of "Anonymous" Data

#95

Post by c0pium »

JohnFen wrote: post #87
c0pium wrote: post #75

Earlier quoted context omitted.

> they're always proven incorrect This is pretty obvious survivorship bias. You think that they’re wrong because you only hear about the cases when they were. There are tons of examples of breaches where the anonymization held up, it’s just that it’s not interesting so nobody talks about it.

Umm, yes? If I have a lock on my door that successfully prevented 99 people from breaking in, but one skilled lockpicker subverted it, then my lock has failed.

That’s the wrong analogy. If 99% of locks are resistant to picking but yours wasn’t, it’s ridiculous to then say that locks don’t work.

Re: Debunking the Myth of "Anonymous" Data

#96

Post by Forbo »

yowlingcat wrote: post #94
genewitch wrote: post #23

Earlier quoted context omitted.

In the interest of charitable-ness, can you define "noise" and explain how rudimentary denoising algorithms that have existed since the 1960s can't penetrate it? Time and time again people think they've anonymized data and they're always proven incorrect. Just come to grips with the fact you're participating in the sale of my (or whoever's) private data. Hope you sleep well!

> Just come to grips with the fact you're participating in the sale of my (or whoever's) private data. Hope you sleep well! I think it's really sad that the open source community has historically cultivated a culture which doesn't recognize this kind of paranoia as a lack of mental wellness. I think it's because the zealotry comports well with the extreme amount of energy needed to bootstrap the ecosystem into existe…

I'd rather work on building alternatives that respect their users than pay corporations to abuse me, thanks.

Re: Debunking the Myth of "Anonymous" Data

#97

Post by JohnFen »

c0pium wrote: post #95
JohnFen wrote: post #87

Earlier quoted context omitted.

Umm, yes? If I have a lock on my door that successfully prevented 99 people from breaking in, but one skilled lockpicker subverted it, then my lock has failed.

That’s the wrong analogy. If 99% of locks are resistant to picking but yours wasn’t, it’s ridiculous to then say that locks don’t work.

The analogy isn't that one out of a hundred locks don't work, but the none of the locks work in the face of a skilled attacker that may comprise 1% of the attackers.

This isn't saying that locks are worthless, but it is saying that thinking of them as secure is a false confidence. This sort of truth is why there's a saying in the security field that you're at the greatest risk the moment that you think you're secure.

In terms of data security, the only way to be actually secure from data leakage is to not be in possession of the data.

Re: Debunking the Myth of "Anonymous" Data

#98

Post by c0pium »

JohnFen wrote: post #97
c0pium wrote: post #95

Earlier quoted context omitted.

That’s the wrong analogy. If 99% of locks are resistant to picking but yours wasn’t, it’s ridiculous to then say that locks don’t work.

The analogy isn't that one out of a hundred locks don't work, but the none of the locks work in the face of a skilled attacker that may comprise 1% of the attackers. This isn't saying that locks are worthless, but it is saying that thinking of them as secure is a false confidence. This sort of truth is why there's a saying in the security field that you're at the greatest risk the moment that you think you're secure.…

That’s simply incorrect.

Edit: my source for this is that I have been involved with hundreds of data breaches where the EU was satisfied that the privacy controls were sufficient to say that no personal data was compromised.

Re: Debunking the Myth of "Anonymous" Data

#99

Post by JohnFen »

__MatrixMan__ wrote: post #92
JohnFen wrote: post #68

Earlier quoted context omitted.

> My point is just that different situations call for different privacy postures. True. Privacy is a special case of security, and it's only useful to talk about security in terms of what threats are of concern. > "Anonymization = Untrustworthy" glosses over this in a way that doesn't help us find ways to improve the situation. If your concern is to be as anonymous as possible, then "Anonymization = untrustworthy" is…

If their goal is to be anonymous as possible, why did they give you the data in the first place? If they're aware of your practices and still in the loop, then presumably their relationship with you is such that some degree of trade-off is acceptable. I think the better focus for the article would be on transparency. I didn't write the script because I was conforming to some well defined policy about what's in bounds…

> If their goal is to be anonymous as possible, why did they give you the data in the first place?

Often, it's because there is no other choice. When I'm revealing personal data to companies and such, that's usually why. Very few companies that I'm aware of are actually trustworthy on these matters, but I can't live without doing business with many of them regardless.

I absolutely do decide to reveal data to some companies that are optional, though. Like with all security matters, there's a cost/benefit calculation to be done here.

> I wrote it because somewhere in my heart I felt a vague duty to improve the situation.

Which is entirely laudable, and I think a worthwhile activity. It is, however, an effort that mitigates some risk rather than making things safe. People like the EFF are focused more on the goal of safety. It's almost certainly not a goal that can be fully achieved, but I'm glad that they're shooting that high anyway.

Re: Debunking the Myth of "Anonymous" Data

#100

Post by willseth »

JohnFen wrote: post #87
c0pium wrote: post #75

Earlier quoted context omitted.

> they're always proven incorrect This is pretty obvious survivorship bias. You think that they’re wrong because you only hear about the cases when they were. There are tons of examples of breaches where the anonymization held up, it’s just that it’s not interesting so nobody talks about it.

Umm, yes? If I have a lock on my door that successfully prevented 99 people from breaking in, but one skilled lockpicker subverted it, then my lock has failed.

And yet we all still use door locks, despite the fact that a skilled lock picker could break every standard door lock in minutes. This illustrates the importance of threat modeling.
Post reply on HN