> I've always wondered how often timing analysis is used in practice by surveillence big tech

Books written about the NSA, GCHQ, CSE etc talk about them using things like timestamp logs/traffic analysis/time of day analyzing commercial and government telecom links going back to the 1960s, so in the modern era even if your crypto is absolutely unbreakable, there's a huge amount of analysis and correlation that can be done based on timing analysis.

Then you combine your timing analysis with things like correlating geolocation of blocks of IP addresses, netflow and traffic analysis, metadata obtained from other adjacent/nearby users on same ISPs at either end, a whole fire hose of other data that's still useful even if the crypto is solid.

> let's say Google has already identified your Reddit account. You open a Reddit discussion, and deep in the discussion it links to a Youtube video, and you open it in your browser. Now even if you weren't logged into Youtube, Google could guess that it's you based on the timing

Not just timing but also cookies, client device/browser fingerprinting, IP address/what ISP you're on, and the usage patterns and logged in activity (and app-collected telemetry data on android and ios devices) of all the other persons in your household and neighbors.

I guess part of my hope was that big tech didn't think timing analysis was worth the effort. But it's rather scary if they are truly scaling up their timing analysis efforts. Now, if you care about privacy, it's not enough to just use a VPN or stay logged out or use anonymous accounts. You have to worry about _when_ you open every webpage. Be wary of immediately opening links that your friend sends you, or sharing webpages that you had just opened to your friends. And that's not even factoring in fingerprinting attacks

the average residential DHCP-pool-assigned customer on a cablemodem, dsl, gpon line or something doesn't change IP addresses that much, and very often the dhcpd will renew the router/modem's WAN port lease with the same address for months at a time. even if it's not an actual static IP.

this alone can be used to correlate a huge number of things since very often you have one household with a whole assortment of people and tablets, phones, laptops, xboxes, playstations, smart speakers etc all behind one IP address and NAT.

just having an entity like google know that your ip address is coming from a /24 in a /19 sized IP block that's known to be a comcast dhcp pool in a particular city/metro area is a huge amount of info.

other things happen as well. you have other people in your household who installed the facebook app on their phone and left geolocation/GPS permissions set to on? now your IP address has been correlated with a very specific latitude/longitude and the usage patterns of your (spouse, roommate, child, etc) who is using that app.

I'm well aware of the issues with IP (I mentioned that I use a VPN), and the general public is becoming more wary too, as can be seen with the rise of VPN usage. Which is why timing analysis is so scary, it bypasses most countermeasures

This sounds more like a forensic analysis than an operational capability.

Well it means that Google logs and preserves all that data for at least a few months. Who knows what they do with it

Store it because nobody knows what to do with it?

That's the optimistic case I guess. But I've already given an example where I suspect Google used timing analysis to figure out a youtube video that I watched (over VPN and using a FOSS youtube client). I think it's plausible that Google is already using timing analysis to track users

That would explicitly not be in line with the GDPR. Specifically, it would break 5.1(b) - purpose limitation.

> collected for specified, explicit and legitimate purposes

Data about logged in sessions is generally stored for security purposes.

If a malicious person had access to your account you want to know for how long they had that access for example.

Sure, that seems like it’d be a legitimate purpose, my comment was more a response to this.

> Store it because nobody knows what to do with it?

I can’t easily find the links (but I’m sure they are available), but there’s a [relatively] new science, that ‘fingerprints’ people’s writing style.

I think the technique, itself, is decades old, but has been vastly improved, using AI and algorithms.

It can be used to match things like anonymous rants, to individuals.

As I recall, the Unabomber's brother read a portion of the manifesto and recognized Ted's writing style.

Yes. It used the world’s oldest “AI”; the human brain.

But that is exactly how this works. From what I understand, the “enhanced” version of the technique is scarily accurate, able to match, using just a couple of sentences.

Have any good links to papers or books covering the state of the art in developing these systems?

> I've always wondered how often timing analysis is used in practice by surveillence big tech

Temporal correlation is the difference between regular network analysis, and dynamic network analysis. Just search "dynamic network analysis" on Google Scholar, and look at who's writing the papers :)

But to back up a step — every SaaS company does this on some level. If you have an backend audit-log for e.g. user registrations, and you eyeball it every so often to notice event clusters of people trying to bulk-register accounts in order to block their IPs — well, that's timing analysis!

I don't have an expert understanding of how cookies or VPNs function, but these are the two categories of causes that I came up with. Both seem more likely than Google having timing data from a third-party service.

Within the first category, possibilities include that the phone logged into your Google account while using the VPN, that there was a Google tracking cookie on your phone and that phone wasn't always connected to the VPN so it related 2 ip addresses, and that your other device on same network shared a VPN session with your phone.

The 2nd category I'm including for posterity even if it's unlikely based off your stated usage of FOSS on your phone. That your phone isn't a degoogled OS or other device with Google integration. Smart devices with microphones aren't supposed to collect voice data when not explicitly activated, but it is a potentiality.

At this point I feel like I should have used a throwaway with how many details I'm giving away here haha, but I have never attached a google account to my phone (I access any google services via browser), and while I don't run a degoogled OS but I have disabled play services and all google features + apps. I'm aware that there's still a chance that Google has trackers, but those trackers would (1) have to detect which reddit account I was using inside my FOSS reddit client (2) detect which video I watched on my FOSS youtube client. It's possible but I decided that this level of surveillance was both more nefarious and less likely than them using timing analysis.

It is used a lot, also to identify people on TOR. But you usually need something else if you want to use that in court.

See:

https://resources.infosecinstitute.com/topic/timing-analysis...

Or the academic research on the domain https://scholar.google.com/scholar?hl=en&as_sdt=0%2C14&as_vi...

In your example how does google correlate your particular reddit account with the link you clicked? YouTube can't access your reddit session cookie so how would google be able to disambiguate your reddit session from arbitrary traffic flowing through the reddit page?

That's where the timing comes in. The reddit discussion I clicked the link from was an old one, and so was the youtube video (though it did have hundreds of thousands of views). I was probably the only person who opened them up within the same hour

There was an article about how easy it is to find out if 2 of your Facebook friends are dating just by analyzing when your Facebook friends are online, and there isn't any effective way of stopping it from working other than disabling presence notifications.

Though worrying if it's done, I doubt that it's done at any scale in the way you're suggesting. Linking accounts is PII and the GDPR would require consent, right to view the information, right to correct the information and so on.

I think it was only doable in the end in the article because the data were released as part of a legal process.

Regarding your YouTube story, there are lots of examples of things like this (e.g. "I talked to someone about X in person then saw X in Facebook ads") but I haven't yet seen hard evidence. So far I've written it off as coincidence at scale.

The GDPR considerations are interesting, and it does seem like GDPR can cover things like behavioral data [1]. I'm not sure how it works in regards to Newpipe, the FOSS youtube client I use though. I assume whatever scraper Newpipe uses in the background has already accepted the cookie consent dialog, which would allow Google to start scraping data like IPs and other behavioral data. Not an expert on GDPR law though obviously.

As far as it being a coincidence, that's usually something I assume as well. But it really comes down to a game of probabilities. Is it more likely that it's a coincidence, or that Google is doing timing analysis? In this case, a coincidence just felt less likely. I check my youtube feed at least once a day, so I know what my recommendations look like. This recommendation was so out of the ordinary that it stood out to me in a sea of my usual recommendations. And it stood out so much that it prompted me to go back and check my Newpipe history and Reddit history, and spend like an hour investigating and trying to figure out what was most likely. I even wrote down notes about the incident. Also I should probably mention now that earlier I had said that I got those youtube recommendations the next day, but checking my notes now, it was actually within an hour. The video that was recommended to me was not some trending video, it was already a few months old. I also searched my Youtube history to see if I had watched anything else from the same channel, and I had only watched 2 videos from that channel total, and over a year prior.

I know that timing analysis seems very nefarious, more high-effort and nefarious that I would expect from even a company like Google. But my guess is that they aren't doing it intentionally, they instead just feed a bunch of analytics data (that they have user consent to collect) into some giant ML model, and that ML model has learned to use timing in its predictions.

[1]: https://blog.rsisecurity.com/what-is-considered-pii-under-gd...