Website data leaks pose greater risks than most people realize
seas.harvard.edu
Website data leaks pose greater risks than most people realize
1–10 of 33 posts
Re: Website data leaks pose greater risks than most people realize
#2Largely true, but there are HHS rules and guidelines that are accepted in the US healthcare space:
https://www.hhs.gov/hipaa/for-professionals/privacy/special-...
Re: Website data leaks pose greater risks than most people realize
#3The title refers to claims by marketing companies that they have appropriately anonymised the data, and is not an attack on the concept of anonymisation itself.
Re: Website data leaks pose greater risks than most people realize
#4Most companies still don’t know what anonymization means and confuse anonymized with pseudonymized or masked data.
Part of the problem is that there are still no good criteria available to define anonymity. Concepts like differential privacy are a step in the right direction but they still provide room for error, and in many cases they are either too restrictive (transformed data is not useful anymore) or too lax (transformed data is useful but can be easily re-identified).
Re: Website data leaks pose greater risks than most people realize
#5I've considered how I would like E.G. GPS / driving apps to anonymize data.
For freeways, lots of small segments, and fuzzing of timestamps to co-mingle users. Where there's a stoplight snap the intersection cross-time to the green light (guess) for anyone in the queue.
The anonymity would come from breaking up both requests and observed telemetry to fragments too small to tie back to a single user or session (and thus form a pattern; I hope).
Do NOT record end-times, only an intended route. Do NOT associate that movement to any particular user or persistent session (ideally in memory on the mobile device only, not saved: though it could save favorite routes locally). Packages of transition times between various freeway exits would generally help add to anonymity.
That would also be part of generally improving the UI for the user. The application on the device should be making most of the decisions, by asking about the traffic in a given region on a grid. I also want it to show me (the driver) the data (heatmap) on the rejected routes so I know what isn't a good option.
Re: Website data leaks pose greater risks than most people realize
#6Differential privacy provides a system that can allow the sharing of databases without allowing an external observer to determine if a particular individual was included.
If companies were required to aggregate information in this way and throw away their logs, perhaps leaks would be much less risky for their users.
Today this might seem far-fetched, but it could come to pass in the future, when people raised in this environment and able to understand the implications and technical aspects come to political power.
Re: Website data leaks pose greater risks than most people realize
#7Differential privacy provides a system that can allow the sharing of databases without allowing an external observer to determine if a particular individual was included. If companies were required to aggregate information in this way and throw away their logs, perhaps leaks would be much less risky for their users. Today this might seem far-fetched, but it could come to pass in the future, when people raised in this…
We're building an analytics system that is based on differential privacy / randomization of data. It's possible but there are many limitations and caveats, at least if you really care about the privacy and not just apply differential privacy as a PR move. Most systems that implement differential privacy use it for simple aggregation queries, for which it works well. It doesn't work well for more complex queries or high-dimensional data though, at least not if you choose a reasonably secure epsilon: Either the data will not be useful anymore or the individual that the data belongs to won't be reliably protected from identification or inference.
After spending three years working on privacy technologies I'm convinced that anonymization of high-dimensional datasets (say more than 1000 bits of information entropy per individual) is simply not possible for information-theoretic reasons, the best we can do for such data is peudonymization or deletion.
Re: Website data leaks pose greater risks than most people realize
#8Differential privacy provides a system that can allow the sharing of databases without allowing an external observer to determine if a particular individual was included. If companies were required to aggregate information in this way and throw away their logs, perhaps leaks would be much less risky for their users. Today this might seem far-fetched, but it could come to pass in the future, when people raised in this…
Differential privacy provides a lot less protection than you would think (or want to believe). A few months ago I saw a talk by E. Kornaropoulos, about his paper "Attacks on Encrypted Databases Beyond the Uniform Query Distribution"[0].
The main take-away from the talk - an in fact all the talks I saw on the same day - was that while DP is touted as a silver bullet and the new hotness, in reality it can not protect against the battery of information theoretical attacks advertisers have been aware of for couple of decades, and intelligence agencies must have been doing for a lot longer. Hiding information is really hard. Cross-correlating data across different sets, even if each set in itself contains nothing but weak proxies, remains a powerful deanonymisation technique.
After all, if you have huge pool of people and dozens or even hundreds of unique subgroups, the Venn-diagram-like intersection of just a handful will carve out a small and very specific population.
Re: Website data leaks pose greater risks than most people realize
#9Differential privacy provides a system that can allow the sharing of databases without allowing an external observer to determine if a particular individual was included. If companies were required to aggregate information in this way and throw away their logs, perhaps leaks would be much less risky for their users. Today this might seem far-fetched, but it could come to pass in the future, when people raised in this…
We're building an analytics system that is based on differential privacy / randomization of data. It's possible but there are many limitations and caveats, at least if you really care about the privacy and not just apply differential privacy as a PR move. Most systems that implement differential privacy use it for simple aggregation queries, for which it works well. It doesn't work well for more complex queries or hi…
You posted your reply while I was writin my own. Do you happen to have pointers to any really good research results and/or papers?
I want to be better equipped to respond to this slowly emerging "DP is a silver bullet" meme and your response implies that you'd have actual research to back the position up.
Re: Website data leaks pose greater risks than most people realize
#10Differential privacy provides a system that can allow the sharing of databases without allowing an external observer to determine if a particular individual was included. If companies were required to aggregate information in this way and throw away their logs, perhaps leaks would be much less risky for their users. Today this might seem far-fetched, but it could come to pass in the future, when people raised in this…
It's not far-fetched. Differential privacy is going to be used for the US census this year. Here's a report on it: https://arxiv.org/abs/1809.02201
Also, it's not a magical solution. Here's one of the issues from the linked paper (edited for clarity):
"The proponents of differential privacy have always maintained that the setting of the [trade-off between privacy loss (ε) and accuracy] is a policy question, not a technical one. [...] To date, the Census committee has set the values of ε far higher than those envisioned by the creators of differential privacy. (In their contemporaneous writings, differential privacy’s creators clearly imply that they expected values of ε that were “much less than one.”)