Hacker News Reader

Comment by jbooth | Hacker News Reader

I work in the ad industry. We take pains to make sure that everything is hashed as early in the process as possible, so we're basically just correlating hashes with each other. There's nothing personally identifiable.

I understand that it sounds creepy, but it's worth noting that advertising is what pays for all the free content you enjoy on the internet.

EDIT: Downvoted for comments from the industry. Thanks! Let me know if there's any questions I can answer for you guys.

View on HN

The thing I have with collecting data, even if depersonalized, is that it's practically taken without consent. I'm completely fine, for example, with giving detailed, but anonymous usage statistics to Mozilla, because they nicely asked me if they may do that, to improve Firefox. I'm not okay with people just "taking" those statistics from me.

Tracking should be opt-in, not opt-out. I shouldn't have to tell you to stop tracking me, you should need to get my consent to start tracking me.

>it's worth noting that advertising is what pays for all the free content you enjoy on the internet

Which is why I whitelist trustworthy domains I frequent in Adblock Plus. Again, opt-in.

Also, advertisement need not necessarily be targeted. You can run generalized ads just as well. Sure, it might not be as profitable, but if the trade-off for more profit is less privacy, then I'm afraid I'll give priority to the latter.

I can understand your point, although I have a small beef with the consent point (you're visiting the website on your own consent, after all). More importantly though, you're basically pitting your privacy against someone else's money. Of course you're going to rank your privacy higher.

What if it was your privacy vs less content on the internet because more sites go out of business?

Gosh I don't know. Maybe sleazy sites getting pushed to the margins would have to develop non-sleazy business models or die trying. In either case, it's a win for the Internet.

Sleazy sites like the new york times? Come up with a list of your favorite sites and I bet, aside from Ycombinator, all of them sell ads on the exchanges. And the only reason ycombinator doesn't have ads is because it is an ad.

If you visit a website, I don't see how it's such a violation of your rights for them to take a note of your visit.

Targeted advertising makes ad delivery efficient. If you somehow turned off all targeted ads today, the advertisers are getting less bang for their buck. The price they would be willing to pay sites will drop dramatically. How do you compensate for that lost revenue? More ads? "Donate with PayPal" buttons?

Although there are legitimate concerns about everyone tracking everyone, the Internet is less annoying overall as a result of the advertising efficiency of targeted advertising.

You don't need to track people to show them ads and in no case should you track people without their consent.

That's awfully sanctimonious. Do you cut personal checks to websites who's content you enjoy? If not, they need advertising dollars, and advertising can bring in way more money when anonymized tracking is used.

Well, paying for content sounds great but most websites that I visit don't even offer that choice.

Sorry, but you're wrong that tracking is required. TV, Radio and Newspaper have been making money hand over fist for decades without tracking.

Newspapers are making money hand over fist? Funny, I thought they were being massacred and increasing CPMs on their remnant inventory is one of the few bright spots in their finances.

If you visit someone's website, they're not violating your rights by noting that you visited. You're free to not visit, in fact. Or to register yourself on a do-not-track registry, enable ad block, and visit without contributing towards their bottom line. Whatever you want.

I said "TV, Radio and Newspaper" and I also said "for decades" not just the last decade.

> ...they're not violating your rights...

I didn't say squat about "rights". I simply disagreed that tracking is "required" for web sites to make more money on advertising because that is utter hogwash. The ability to track people is a relatively new thing.

Yes, actually. If a web site has content worth consuming, and gives me the option, then I make sure they get money. I know I'm not alone - so why do so few sites make this option available? Probably because of the pervasive attitudes like yours that ads are the _only_ way to make money on the internet.

I don't think hashing by itself means much. Especially when working with tightly-constrained values.

How about k-anonymity?

Can you explain how hashing is insufficient? You're saying someone could use a lookup table of hashcodes for all the URLs on the internet and deanonymize the URLs? The browser's identity is still unrecoverable.

EDIT: Ah, just looked up k anonymity. We don't store any of the information that they're protecting for, like age, sex, any other personal attributes.

If you obtain my gender, DOB and zip code (which is not hard - Google demonstrated that had all of that data even though I never gave it to them directly), you can uniquely identify me 80% of the time.

That's insufficient, in my book.

I'm a little skeptical of this claim in light of the http://en.wikipedia.org/wiki/Birthday_problem

23 people means a 50% chance that 2 of them share a birthday. Assuming that your gender and zip code put you in a pool of people > 23, I'm not sure how your statistic holds up. Do you have a citation?

I believe the previous commentator was referring to the work conducted by Latanya Sweeney

http://dataprivacylab.org/projects/identifiability/paper1.pd...

"In this document, I report on experiments I conducted using 1990 U.S. Census summary data to determine how many individuals within geographically situated populations had combinations of demographic values that occurred infrequently. It was found that combinations of few characteristics often combine in populations to uniquely or nearly uniquely identify some individuals. Clearly, data released containing such information about these individuals should not be considered anonymous. Yet, health and other person-specific data are publicly available in this form. Here are some surprising results using only three fields of information, even though typical data releases contain many more fields. It was found that 87% (216 million of 248 million) of the population in the United States had reported characteristics that likely made them unique based only on {5-digit ZIP, gender, date of birth}. About half of the U.S. population (132 million of 248 million or 53%) are likely to be uniquely identified by only {place, gender, date of birth}, where place is basically the city, town, or municipality in which the person resides. And even at the county level, {county, gender, date of birth} are likely to uniquely identify 18% of the U.S. population. In general, few characteristics are needed to uniquely identify a person."

I'm sure you are looking at more than just URLs.

Say you have a lead form with two fields, email and zip code. You would store a variety of data points besides those two. Referring URL, IP address, useragent, etc. If you just hash everything, and I gain access to your hashed values, it would be easy to make a lookup table reversing the one-way hash, at least for some of the data points.

I haven't had a chance to read the k-anonymity or related papers, but from what I understand it's not specific to data points like age/sex/etc.

> I understand that it sounds creepy, but it's worth noting that advertising is what pays for all the free content you enjoy on the internet.

I found your statement bit cocky, but you may not see it the same way since you work "in the field".

And you are pretty much wrong. Large part of web is free. Wikipedia? Sure they ask for money and every year they come up with just enough, since people appreciate free content and asked are willing to donate. Heck, people even write free software that you can download from websites that are free of ads [Apache is the first thing came to my mind].

I am sure web would look different have Google not based its business model on advertising, etc, but I would never say that the internet fundamentals are based on paid advertise-displaying model. I don't believe Tim thought it will or should as well.

Ok, allow me to amend my sentence:

"It's worth noting that, aside from a few laudable charitable organizations, advertising is what pays for all of the free content you enjoy on the internet".

Wikipedia and Apache are both one of a kind. 95% of the great content out there (and 100% of the shitty content) is supported by ads.

Reply on news.ycombinator.com