Comment by lotharbot | Hacker News Reader

Comment by lotharbot | Hacker News Reader

Over 60%, and potentially up to 87% [0], of the US population can be uniquely identified just from gender, zip code, and birth date. This isn't all that surprising [1]. The EFF's browser fingerprinting (through Panopticlick) shows that a similar percentage of browsers are uniquely identifiable through fonts, plugins, etc. [2] If you're trying to identify someone, every "common" trait they have will still eliminate a large number of people from consideration -- gender eliminates roughly 50% of the population, birth state eliminates 85-99.8% of the population (depending on whether you were born in California or Wyoming), birth date eliminates over 99% of the population and much more if you have a year, and pretty soon you're not one face in 300 million, you're one face in a thousand, and then one face in ten, and then you're just you. And whatever it is that made someone want to try to figure out who you were is now out in the open.

[0] Depending on whether http://www.citeulike.org/user/burd/article/5822736 or http://www.truststc.org/wise/articles2009/articleM3.pdf is more accurate

[1] http://godplaysdice.blogspot.com/2009/12/uniquely-identifyin...

[2] https://panopticlick.eff.org/ and the explanation at https://panopticlick.eff.org/browser-uniqueness.pdf -- particularly sections 4 and 5.2.

I had a doctor that used first name, last name, birth month, and birth day as their primary identifiers. I was checking in one year for my physical, and was asked for these four data points. The next question was about current medication. The receptionist nurse asked me the question, but before I could answer, she got a really, really odd look on her face, then started glancing between me and the computer. Finally, she asked, with a bit of a smirk on her face, what year I was born. When I responded, she chuckled. Turned out the only record that came up was for someone 30 years my senior, and on a medication that only someone that age would be on. The receptionist nurse dug around in the system and was finally able to find my records, but if she hadn't noticed that the listed prescription didn't match my apparent age, my checkup info would have ended up in someone else's record and it could have gotten messy.

That seems like it should violate medical records confidentiality rules (I don't know if it does, but it should).

Based on the interaction, I could obviously deduce that there was someone else with the same four data points that saw the same doctor and was 30 years older. I don't know if that, in and of itself, is breaking confidentiality.

If they had started entering my data into that person's record and subsequently realized the error, then they might have had to break some confidentiality in order to clean up our conjoined record.

False positives are an interesting case, where things can definitely get messy. That doctor may have used the same system for decades without ever seeing a name collision, but if the receptionist hadn't noticed in that instance, both of you might have had significant problems in the future. Likewise, if someone decides to track another person with malicious intent (say, "that guy I saw my ex with in the restaurant who was wearing the [university] shirt and talked about being in [field] and growing up in [place]") and they end up locating the wrong target, things could get ugly. Or if a company starts sending potentially offensive material to someone they've misidentified, it can trigger family drama or even retaliation.

So it's a two-edged sword. People aren't very anonymous, but mistakes in the de-anonymization process can wreak havoc.

At my doctor and pharmacy they look me up by birthdate only in the computer. I assume they only need more data if there is a collision.

When I worked in Medical Records in a capital city in the UK, your date of birth was the primary key of filing: not querying for the year is then a basic procedural error, but then again doctors surgeries have far lower standards than outpatient departments. Incidentally, I have found my experience as a filing clerk to be far more useful to my coding life than any of the other crap jobs I did..

Here in the UK we have an NHS number, which curiously is not the same as your NI number (equiv to an SSN). Unlike the SSN in the US, the NHS number isn't used for anything else, and the NI number is only used for tax.

All this only goes to show that, if we really want to keep a sane degree of democracy, we can never rely on tech to be safe.

Instead, it's thousand times more important to get real transparency an accountability in our governmental structures and money completely out of politics.

At least it is straightforward to be aware of conversations you are trying to anonymize and omit or obscure birth dates and locations (By obscure, I mean lie).

It's also somewhat interesting that text wouldn't necessary be as revealing as the language quiz from the article; when I type "aunt", readers have no idea how I pronounce it (but that is just picking at the specific to ignore the general, identity characteristics leak out all over the place).

> "... when I type "aunt", readers have no idea how I pronounce it ...".

From the language survey, there were quite a few questions dealing with word choice (e.g., coke, soda, pop). There are also algorithms that can predict, with varying levels of accuracy, the writer's gender [1]. Combine these with browser font identification [2], geolocation [3], and other comparable data, and lying or omitting data isn't going to provide much in the way of anonymizing you or your data.

[1] http://www.hackerfactor.com/GenderGuesser.php

[2] https://panopticlick.eff.org/

[3] http://html5demos.com/geo

Why would you trim the majority of my comment which is essentially in agreement with what you have written?

I get that you are just elaborating on data leakage, I just don't understand the style you chose to do it in. "identity characteristics leak out all over the place" isn't exactly a brazen declaration of how easy it is to stay anonymous.

I read your comment as saying that you could lie in text about identifying information and things that might betray you in a f2f interaction, such as regional accents, weren't as important in textual interactions.

My intent was more that it is straightforward to be aware of several of the most blatant leakages. Combating dialect analysis is a lot tougher, but the quiz likely used 25 of the highest value differences (many of the choices are laser specific: http://www4.uwm.edu/FLL/linguistics/dialect/maps.html ).

Context also matters a lot. If there is no obvious path to an IP or browser interaction, all that stuff goes away.

What would be interesting is a look into passive elicitation of information. Its easy to falsify something when you know someone is looking to use a single data-point against you. But tryly powerful social engineering would manipulate your confidence, and extract high-information-content data passively (when you are not expecting it), and to do this they need to instill confidence that you <are not being ovserved or monitored>. Yet they still may need to promt information flow, to feed the analysis. Which is sort of the art of interviewing, but now in a bit more 21st century context.

Reply on news.ycombinator.com