PrivWeeble

9 anni fadiscuss

At least we have some control over the exposures discussed in the paper. Very many companies are exposing (sensitive) information to third-party email delivery services, customer feedback and polling services, etc. Thus creating a privacy issue (and in some cases, a serious one) even before the email arrives at the recipients' server.

PrivWeeble

9 anni fadiscuss

Well normally you wouldn't want one browser extension to interfere with another extension. However, there are contexts where that is very beneficial. Take a security or privacy extension which correctly identifies a harmful resource load. It doesn't matter whether that resource is being loaded in a content tab, loaded by another extension behind the scenes, or is local vs remote. It it still a harmful load. So a protective extension should be able to detect it, then inform the user and/or perform an appropriate blocking action.

This, like some other special powers, is something that the user should have to explicitly grant to an extension via permissions interface.

PrivWeeble

9 anni fadiscuss

And if Google takes steps to prevent third-party ad blockers from working in Chrome? Or renders them worthless through exceptions to the filtering API?

Even if you ignore Google's Funding Choices and its potential to increase adoption of view-ads-or-pay (a lose/lose for privacy, btw) you are very vulnerable if you use Chrome and/or a Google controlled OS. The Coalition for Better Ads won't be helping you by keeping Google in check. It is more or less the same companies you are fighting right now (check membership and note NAI, IAB, DMA, and other trade associations).

PrivWeeble

9 anni fadiscuss

That's like saying antibiotics are only meant to kill the worst of one's infection. Unfortunately, there are foolish people who assume a lower dose/dosage will suffice. Even after an M.D. assesses what they need and tells them exactly what to take! Explicit warnings and education became necessary.

We have a similar problem in the "ad blocking" space. Naive users don't appreciate that there is a big difference between ad-blockers that only block "annoying" ads and ad-blockers that provide more comprehensive blocking (annoying ads and related security threats and related privacy threats). Many who want/need the stronger solution opt for the weaker solution and they are harmed by doing so. The lower efficacy "annoying ad blockers" need black box warnings.

PrivWeeble

9 anni fadiscuss

Which is better than exchanging the raw personal identifiers, but still isn't "safe" from a privacy point of view. One or both parties often hold PII and other personal info, and they know which of that is associated with a given hash. So what they learn through exchanging hashes is also (linked to) PII.

Furthermore, although reversing a one-way hash is problematic, computing hashes for known inputs (such as an email address) is straight-forward. So it is possible to just test or probe datasets for known identifiers and persons. The potential for hash collisions is of little comfort.

PrivWeeble

9 anni fadiscuss

Either side learning that one of their customers is also a customer of the other company would be a significant privacy issue in some scenarios. If comparison identifiers are derived from an email address then there would likely be cases where one party also learns a portion of the login credentials their customer is using at the other company.

comments