Hacker News Reader

Hacker News

Comment by user858584 | Hacker News Reader

Parent Full thread

user858584

Edit: so they need to know every URL I access because they what to improve GPU or their drivers?

View on HN

That's not what Intel is collecting. From the article:

> what data is collected and how is it used?

> The categories of websites you visit, but not the URL itself

> If I participate in the program, is there any personal information in the data collected?

> Will not include the URL (web address) for specific sites visited

Unless they're shipping a fairly complete domain -> category map to your machine and doing all categorization offline, unlikely, then they absolutely have the ability to collect it, and will "accidentally" do so at some point. We've all seen this movie now, multiple times.

edit: also the knee-jerk reaction most people are going to have to this, is concern about certain categories of websites.

Third party services (e.g. https://www.webshrinker.com/apis/) exist to perform this kind of classification. They'll be doing the classification API calls from the client (CIP-enrolled) machine, then sending the results (and not the domains or URLs that generated them) back to their own endpoint.

Then webshrinker would know everything you visit right ?

> The information collected includes categorized web browsing history that shows how long and how often you visited specific categories of sites (i.e. social media, personal finance, or news). All site visits are classified into one of 30 categories. We do not collect URLs, web pages titles, or user-specific content without explicit permission from you.

From a technical perspective, how does this work? I can only think of two ways:

(1) Intel downloads a big "map" file containing a huge list of pre-defined domains and categories. This means either the categories are pretty slim or you have a GB's big file

(2) Each URL is sent to Intel (aka "collected"). Maybe they don't "store" it ("We promise") but as soon as it leaves your system you have no control on this

They could use a technique like Google Safe Browsing where you send a partial hash of the url, and they send back the subset of the map containing only urls which could match that hash

They can strip the request down to the domain name, hash that with a OTP to do a fuzzy lookup on their end which would be difficult (not impossible) to reverse per reference, but would require APT to do en masse.

There is probably some flaw with this method... curious if others think there's a "safe enough" way to do something like this...

Yes they can, but they can not

Yes

And intel want it for free

Reply on news.ycombinator.com