I guess part of my hope was that big tech didn't think timing analysis was worth the effort. But it's rather scary if they are truly scaling up their timing analysis efforts. Now, if you care about privacy, it's not enough to just use a VPN or stay logged out or use anonymous accounts. You have to worry about _when_ you open every webpage. Be wary of immediately opening links that your friend sends you, or sharing webpages that you had just opened to your friends. And that's not even factoring in fingerprinting attacks

the average residential DHCP-pool-assigned customer on a cablemodem, dsl, gpon line or something doesn't change IP addresses that much, and very often the dhcpd will renew the router/modem's WAN port lease with the same address for months at a time. even if it's not an actual static IP.

this alone can be used to correlate a huge number of things since very often you have one household with a whole assortment of people and tablets, phones, laptops, xboxes, playstations, smart speakers etc all behind one IP address and NAT.

just having an entity like google know that your ip address is coming from a /24 in a /19 sized IP block that's known to be a comcast dhcp pool in a particular city/metro area is a huge amount of info.

other things happen as well. you have other people in your household who installed the facebook app on their phone and left geolocation/GPS permissions set to on? now your IP address has been correlated with a very specific latitude/longitude and the usage patterns of your (spouse, roommate, child, etc) who is using that app.

I'm well aware of the issues with IP (I mentioned that I use a VPN), and the general public is becoming more wary too, as can be seen with the rise of VPN usage. Which is why timing analysis is so scary, it bypasses most countermeasures

This sounds more like a forensic analysis than an operational capability.

Well it means that Google logs and preserves all that data for at least a few months. Who knows what they do with it

Store it because nobody knows what to do with it?

That's the optimistic case I guess. But I've already given an example where I suspect Google used timing analysis to figure out a youtube video that I watched (over VPN and using a FOSS youtube client). I think it's plausible that Google is already using timing analysis to track users

That would explicitly not be in line with the GDPR. Specifically, it would break 5.1(b) - purpose limitation.

> collected for specified, explicit and legitimate purposes

Data about logged in sessions is generally stored for security purposes.

If a malicious person had access to your account you want to know for how long they had that access for example.

Sure, that seems like it’d be a legitimate purpose, my comment was more a response to this.

> Store it because nobody knows what to do with it?

I can’t easily find the links (but I’m sure they are available), but there’s a [relatively] new science, that ‘fingerprints’ people’s writing style.

I think the technique, itself, is decades old, but has been vastly improved, using AI and algorithms.

It can be used to match things like anonymous rants, to individuals.

As I recall, the Unabomber's brother read a portion of the manifesto and recognized Ted's writing style.

Yes. It used the world’s oldest “AI”; the human brain.

But that is exactly how this works. From what I understand, the “enhanced” version of the technique is scarily accurate, able to match, using just a couple of sentences.

Have any good links to papers or books covering the state of the art in developing these systems?