Hacker News Reader

Comment by avmich | Hacker News Reader

Of course you can buy a non-identifying information perfectly legal. And then guess what's the definition of non-identifying information? Think again. If ISP thinks it sells you that, nothing stops you to look at that yourself closely - and may be, just may be you'll uncover something which ISP missed. After all, scrubbing data to be perfectly non-identifying could be, you know, expensive. And doesn't exactly fit ISPs business model. So sharing even Congress-related history could be an interesting thing.

View on HN

You're right. My guess is most "anonymized" data is lazy--stripping out obvious identifying information. There are quite a few cases where you can pinpoint users from correlating to publicly available data. CGPGrey posted a video today showing a layman's example with Social Security Numbers[1].

One cool thing I heard Apple talk about[2] was injecting noise or subsampling to help mask individuals. Although, I don't see that mentioned in their public page on privacy[3] or their whitepaper[4].

[1] https://youtu.be/Erp8IAUouus

[2] https://www.wired.com/2016/06/apples-differential-privacy-co...

[3] http://www.apple.com/privacy/approach-to-privacy/

[4] http://images.apple.com/business/docs/iOS_Security_Guide.pdf

Buy aggregate browsing history for users in DC and nearby area codes. Look for browsing of .gov websites that are effectively government intranet tools. Correlate with access to RNC sites, Infowars, FoxNews, etc. While I'm sure you would both miss people and have some false positives, you'll likely also identify many members of congress and their staff.

Google searches have the query in the URL... probably most "important" people google themselves occasionally.

Why are important people searching google without https?

Important doesn't equal or imply smart nor being good at what you do.

They aren't. Google upgrades to HTTPS automatically, and the old method of overriding the DNS to an unsecured Google server stopped working years ago. Same with Bing, Yahoo, DDG, etc. No SSL, no search in today's world.

HTTPS will not protect the URL of the request, just the contents though.

This is wrong. The domain name is revealed through SNI but the path of the URL is sent as part of the encrypted HTTP request.

HTTPS protects URL parameters. That stuff doesn't go to the DNS request.

Reply on news.ycombinator.com