https://nakedsecurity.sophos.com/2017/02/24/twitter-users-do -you-know-whos-spying-on-your-web-surfing-habits/
Twitter users, do you know who’s spying on your web-surfing habits? 24 Feb 2017 by Danny Bradbury <https://nakedsecurity.sophos.com/author/dannybradbury/> If you weren’t already worried about the privacy dangers of online ad tracking, now would be a good time to start. Researchers have found a way to de-anonymise web surfing records, putting a recent US privacy ruling in jeopardy. Online ad networks track your browsing history across multiple sites so that they can serve you more effective advertising. Search for something on an ecommerce site that participates in one of these networks, and you’ll be shown related ads on another site that also participates. This often creeps people out, but the counterargument has always been that the data is anonymous. Instead of linking your real name to your web surfing records, these trackers use a unique customer ID. In this way, they may know that the same person who searched for Christmas getaways on one website is now reading an article about marmosets on another website, but because they don’t know who that person is, they can responsibly litter the marmoset article with holiday advertisements, without anyone on the internet knowing that you’re leaving your house unattended on December 25. That’s all well and good, but what if you could deduce a person’s identity by matching their anonymous web surfing with their social media timeline? What if, instead of a customer ID, you could replace it with their Twitter handle? Sophos Home Free home computer security software for all the family Learn More <https://www.sophos.com/en-us/lp/sophos-home.aspx?cmp=701j0000001eLpnAAE> Academics from Stanford and Princeton have done just that. Their research <http://randomwalker.info/publications/browsing-history-deanonymization.pdf> relies on the idea that people are more likely to follow links showing up on their social media feed, and in particular the links from people they follow on Twitter that show up in their feed. They reasoned that because the set of links in a Twitter feed is often unique, you can match it against links in an anonymous surfing history. The group collected anonymous web browsing histories from almost 400 volunteers, and mined them for links that came from Twitter (marked with the domain name t.co, which Twitter uses to shorten URLs) visited in the last 30 days. It attempted to de-anonymize histories with at least five such links by comparing them against 300m Twitter feeds. The researchers found that they could identify more than 70% of volunteers on average. The more links in someone’s history that originated from Twitter, the more accurate the identification. The team correctly identified 86% of participants in the experiment with between 50 and 75 URLs. So if you follow a lot of links from Twitter, you’re more likely to be identified. This isn’t just a theoretical exercise. The team built a system to de-anonymise web browsing histories in under a minute using the concept, proving that it’s workable in practice. The team at Princeton has a record of exposing flaws in anonymous datasets. Arvind Narayanan, one of the researchers, runs a blog called 33 Bits of Entropy <https://33bits.org/>, named for the fact that there are about 6.6bn people in the world, meaning that you only need 33 bits of information to determine their identity. He has moved on a bit from his de-anonymising research, but in the past he has embarrassed Netflix <https://www.wired.com/2012/06/wmw-arvind-narayanan/> by using its research dataset to work out who was watching what movies. Here’s another tidbit from the research: it points out that the same principles apply to any set of items selected anonymously by someone with an identifiable historical record of selections. For example, anonymous papers might cite other work and could be compared with a broader spectrum of academic papers to see if similarities show up. We wonder if it’s possible to run it against the eight references in the original bitcoin paper <https://bitcoin.org/bitcoin.pdf>, created by the mysterious Satoshi Nakamoto <https://nakedsecurity.sophos.com/2014/09/10/bitcoin-inventors-identity-allegedly-under-threat-after-claimed-satoshi-nakamoto-email-hijack/>, to help track him down, assuming that he had published academic work before? Not necessarily, says Jessica Su, one of the researchers: I wouldn’t be able to tell you without having access to a dataset that included that paper. However, I am currently trying to deanonymize physics papers, and a modification of our method gives us 28% accuracy. If we limit to papers with exactly eight intra-database citations, we get 36% accuracy. These are very preliminary results. A one in three chance of finding Satoshi, maybe? Sounds better <http://www.newsweek.com/newsweeks-statement-bitcoin-story-231242> than most other options <https://www.theguardian.com/technology/2015/dec/10/bitcoin-creator-satoshi-nakamoto-denies-being-craig-wright-maybe> we’ve had. Who is likely to use social media history in combination with ad tracking? The trackers themselves could. The team looked at four such trackers: Google, Facebook, ComScore and AppNexus – and found that they all had enough information to de-anonymize their users. Some of these trackers are already de-anonymizing users by default. Google, which already tracks users across almost 80% of websites, changed its privacy policy around anonymisation <https://www.propublica.org/article/google-has-quietly-dropped-ban-on-personally-identifiable-web-tracking> late last year to match links with Google accounts. Facebook, meanwhile, owns the social network from which its users follow links. Who else might use this information? The NSA, for one. It already tracks Google ads <https://www.cnet.com/news/nsa-tracks-google-ads-to-find-tor-users/> to find Tor users. The research points out that well-resourced adversaries could eavesdrop on network traffic to work out which domains a particular device is visiting (although thankfully HTTPS makes that more difficult). Other potential users could include potential employers, anyone granting credit, or insurance companies who might love to know about your recent search for cancer symptoms or risky pursuits. Anyone who could benefit from knowing what you’re searching for would find this attack useful. The good news is that commercial parties like these could only match your anonymous browsing history against your public social media profile if they had that data. The bad news is that it has long been for sale <http://www.huffingtonpost.com/2013/07/08/att-selling-data_n_3561263.html>. It’s particularly galling for privacy advocates, because the selling of customer data was about to get a lot harder. The FCC in the US issued an order <https://apps.fcc.gov/edocs_public/attachmatch/FCC-16-148A1_Rcd.pdf> restricting ISPs from collecting customers’ sensitive data unless they specifically opted in. Under the order, service providers must get customer permission to sell sensitive personal data, defined as “reasonably linkable” to an individual. Anonymised data may be seen as not reasonably linkable, meaning that it can be collected and used. But clearly, with a bit of automated detective work, it’s pretty easy to make that link. How can you stop this from happening? Tracker-blockers such as Ghostery <https://www.ghostery.com/>, uBlock Origin <https://en.wikipedia.org/wiki/UBlock_Origin> or Privacy Badger <https://www.eff.org/privacybadger>can help, the researchers say, while not revealing your real-world identity on social media profiles is a useful albeit cumbersome form of protection. Given the recent actions of US border guards <http://www.cnbc.com/2017/01/30/trumps-executive-order-spurs-facebook-and-twitter-checks-at-the-border.html>, the latter might be a good idea anyway. ------------------------------ [image: Avast logo] <https://www.avast.com/antivirus> This email has been checked for viruses by Avast antivirus software. www.avast.com <https://www.avast.com/antivirus> __._,_.___ ------------------------------ Posted by: "Beowulf" <[email protected]> ------------------------------ Visit Your Group <https://groups.yahoo.com/neo/groups/grendelreport/info;_ylc=X3oDMTJmdWRnbGp0BF9TAzk3MzU5NzE0BGdycElkAzIwMTk0ODA2BGdycHNwSWQDMTcwNTMyMzY2NwRzZWMDdnRsBHNsawN2Z2hwBHN0aW1lAzE0ODgxNDQ2MzU-> [image: Yahoo! Groups] <https://groups.yahoo.com/neo;_ylc=X3oDMTJlNHBxNXUzBF9TAzk3NDc2NTkwBGdycElkAzIwMTk0ODA2BGdycHNwSWQDMTcwNTMyMzY2NwRzZWMDZnRyBHNsawNnZnAEc3RpbWUDMTQ4ODE0NDYzNQ--> • Privacy <https://info.yahoo.com/privacy/us/yahoo/groups/details.html> • Unsubscribe <[email protected]?subject=Unsubscribe> • Terms of Use <https://info.yahoo.com/legal/us/yahoo/utos/terms/> __,_._,___ -- -- Thanks for being part of "PoliticalForum" at Google Groups. For options & help see http://groups.google.com/group/PoliticalForum * Visit our other community at http://www.PoliticalForum.com/ * It's active and moderated. Register and vote in our polls. * Read the latest breaking news, and more. --- You received this message because you are subscribed to the Google Groups "PoliticalForum" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
