Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Could you please point to what I've reworded that you believe is misleading or misconstrued, I will happily edit my comment and fix it - I have more or less directly quoted within context. I have omitted stuff because I didn't feel the need to include the whole privacy policy in a comment (which is why I linked it) but nothing I felt was misleading. If there is a critical point you feel I should include, let me know and I will add it.

As for this not being enough information to identify someone, it really is. Lets assume you use Google's DNS and no google tools, block all trackers, etc. (which the vast majority of people do not do). Lets say the authorities grab your computer, and somehow have access to Google DNS data (CLOUD Act) and want to see what you did online. They can already filter down DNS queries to 1000 people (and thats assuming all 1000 people use google dns, which again they do not). They can figure out what software performed queries based on EDNS data. Timestamps further filter down the dataset if you have a general idea of a person's schedule. With ECS they can further narrow down by service provider. All of sudden those 1000 autonomous ids have been significantly narrowed down using just general techniques, if you're targeting a person you will almost certainly be able to use the rest of the data to tie an ID to machine. If you use other google services or even just visit sites with google analytics that ID is even easier to compromise. Every piece of data collected is a piece of data that can be used to identify you, that's the price of convenience.

EDIT: Would like to mention even the act of an machine going offline, which will occur if an authority confiscates your machine will narrow down IDs as now you only have to look for IDs that stopped communicating with Google's DNS at time of confiscation.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: