News for hackers. Stuff that matters.

A comment on You can’t buy Congress’s web history – that's not how any of this works.

Re:You can’t buy Congress’s web history – that's not how any... by avmich on Thursday March 30, 2017 @01:03AM (#13993052)
Of course you can buy a non-identifying information perfectly legal. And then guess what's the definition of non-identifying information? Think again. If ISP thinks it sells you that, nothing stops you to look at that yourself closely - and may be, just may be you'll uncover something which ISP missed. After all, scrubbing data to be perfectly non-identifying could be, you know, expensive. And doesn't exactly fit ISPs business model. So sharing even Congress-related history could be an interesting thing.
[ Parent | on HN ]
Re:You can’t buy Congress’s web history – that's not how any... by pfranz on Thursday March 30, 2017 @01:38AM (#13993190)
You're right. My guess is most "anonymized" data is lazy--stripping out obvious identifying information. There are quite a few cases where you can pinpoint users from correlating to publicly available data. CGPGrey posted a video today showing a layman's example with Social Security Numbers[1].

One cool thing I heard Apple talk about[2] was injecting noise or subsampling to help mask individuals. Although, I don't see that mentioned in their public page on privacy[3] or their whitepaper[4].

[1] https://youtu.be/Erp8IAUouus

[2] https://www.wired.com/2016/06/apples-differential-privacy-co...

[3] http://www.apple.com/privacy/approach-to-privacy/

[4] http://images.apple.com/business/docs/iOS_Security_Guide.pdf

[ Parent | on HN ]
Re:You can’t buy Congress’s web history – that's not how any... by thinkling on Thursday March 30, 2017 @01:36AM (#13993175)
Buy aggregate browsing history for users in DC and nearby area codes. Look for browsing of .gov websites that are effectively government intranet tools. Correlate with access to RNC sites, Infowars, FoxNews, etc. While I'm sure you would both miss people and have some false positives, you'll likely also identify many members of congress and their staff.
[ Parent | on HN ]
Re:You can’t buy Congress’s web history – that's not how any... by hackinthebochs on Thursday March 30, 2017 @01:58AM (#13993259)
Google searches have the query in the URL... probably most "important" people google themselves occasionally.
[ Parent | on HN ]
Re:You can’t buy Congress’s web history – that's not how any... by tedunangst on Thursday March 30, 2017 @02:00AM (#13993267)
Why are important people searching google without https?
[ Parent | on HN ]
Re:You can’t buy Congress’s web history – that's not how any... by daenney on Thursday March 30, 2017 @04:26AM (#13993766)
Important doesn't equal or imply smart nor being good at what you do.
[ Parent | on HN ]
Re:You can’t buy Congress’s web history – that's not how any... by AnkhMorporkian on Thursday March 30, 2017 @06:53AM (#13994316)
They aren't. Google upgrades to HTTPS automatically, and the old method of overriding the DNS to an unsecured Google server stopped working years ago. Same with Bing, Yahoo, DDG, etc. No SSL, no search in today's world.
[ Parent | on HN ]
Re:You can’t buy Congress’s web history – that's not how any... by hexadec0079 on Thursday March 30, 2017 @08:33AM (#13994784)
HTTPS will not protect the URL of the request, just the contents though.
[ Parent | on HN ]
Re:You can’t buy Congress’s web history – that's not how any... by temprature on Thursday March 30, 2017 @09:54AM (#13995334)
This is wrong. The domain name is revealed through SNI but the path of the URL is sent as part of the encrypted HTTP request.
[ Parent | on HN ]
Re:You can’t buy Congress’s web history – that's not how any... by UncleMeat on Thursday March 30, 2017 @05:10PM (#13998885)
HTTPS protects URL parameters. That stuff doesn't go to the DNS request.
[ Parent | on HN ]