Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/342 Thanks!
All right, so thank you for being here to
begin with.
We're going to talk today about divisive
people and this
really almost every device
that you use from mobile phone to your
personal computer to wearable
devices and the list goes on.
You can send me an email if you have
questions or you can use
the question and answer a lot to ask me a
question after the talk.
And you can follow me on Twitter if you
want.
So my name is Sylvia.
I am a software engineer and the
candidate in Barcelona in
telecommunications engineering.
I research mostly
on privacy and website.
And I wanted to talk about the real
dark web and what
I mean by that.
So what is what is this all about?
I'm going to talk about marketing to
begin with privacy use talking
online footprint, identity and control.
Why marketing?
We going to find out in the
next few slides.
So if you think about
the company that started since
the 90s with the new economy and so on to
base the business to begin with, they
sustained a business for a while only on
advertising.
And so we think
of Facebook, if we think of Google,
if we think of Twitter and Instagram
and so on, they let you know in the very
fine print in the agreement
that you signed, that they sell your data
in a way or another.
So the
scope of this is kind of massive.
And the actual objective of
advertising is for you to buy product
and for you to buy products.
They need to suggest your products that
you might be interested in.
And so they want to know
as much as they can about you and
so that they can recommend your product
that they're more likely to buy because
you're already in those things.
And the thing
is that they collect a lot of thought
about people. And this
is personal data and sometimes it's very
personal and very sensitive information.
So
the way this happened is that they
basically track things that you do.
So these are your online activities.
But since the online activity are so
linked with the offline activity,
sometimes also it's offline activities.
So when you subscribe for a
meet up that you like, they know
the D.A.
the topic of that meetup, it can be
technology, can be skateboarding, it can
be theater, literature, whatever it is
they know about it, for example.
So it's not something
that goes into the online world, but
it goes into the offline world.
So your real lives and
this information is analyzed
is induction and it's always available
to the companies that collected.
So what about online privacy,
then, do we have online privacy
to have to speak close?
Yes,
well.
OK, so if
we always aren't tracked and
ruction locked doesn't mean that
we are always controlled under some
entities to always know what we do.
And do we have the right to be
anonymous when we want to?
So the thing is that
I always have to do it.
When I talk about privacy with friends or
family of people that are not concerned
about privacy, they always taught me
there is nothing that I am afraid
that people can know about me.
Is this like I'm not interesting enough
for them to look at me or
I have nothing to hide?
And this is not true because privacy is a
fundamental human right and it's
documented in untaught
and it's kind
of controversial because up to now,
the right to privacy is the right to
information, self determination.
This means that if I give you my data
and I give your consent to use
my data, that is fine.
And you can use them.
But we don't line
data. The thing is that I can give you
access to my location, for example, with
one application. But, you know, when the
location information is used and to do
what?
So
if I don't know what to use this
information for, it doesn't mean I gave
you my consent to use it.
So there is also
another thing that sometimes
he said that privacy is a right to be
forgotten because people
don't care about privacy and people want
to share their lives and they want to put
the photos of the food they eat on
Instagram.
So the information that is shared
online, it's actually
a lot.
And in 2001, it was estimated
that it's 75 percent
of the information that there is on the
Internet that is user created and that
personal information.
So there was some kind of
comic strip a while ago, I think it was
in the 90s on The New Yorker, and he says
it said on the Internet, nobody knows
you're a dog.
But actually it is not true at the moment
because they know
everything about you.
So
sometimes this is the
idea that is presented about the dark
web. That is the Web that is hidden
by search engines.
And
there is scary and it's
not known. And this is usually associated
with TOR, but it's actually
the dark web is any pages
that cannot be crossed because it's
protected by a password, for example.
And that is kind of
strange that they mention the dark web
also because also Facebook is protected
by password and not all before it can be
crowded. But it's not part of the dark
web for some reasons.
So the Dark Web is
the web that companies cannot reach
a controller. They cannot track data on
it, basically because they don't have
access to it in order to crawl it
up. But if we if we think about
this picture in a different way,
we can see that the Web
is the service that everyone uses,
like cloud services, email
shopping, music, maps,
whatever.
And then there is the data.
There are crowded. And I shared these
services.
So this can be called
the dark web of marketing, and
we don't know about this, and we think
this I think this is because
it's it's something we
don't know about it. We cannot control
opinions on devices on which we have no
idea what you're doing.
And the thing is that we are perfectly
fine with it because
we are OK with using these devices and we
don't question the way they access our
information.
So this takes
us to the the
idea of metadata and what
they are.
So there was a lot talk about it
last year and
metadata that basically structured
information and
they can be collected about online
content, offline content, telephone
calls, whatever you
think about it, you can have learned
about it because especially if
you're a programmer, it's not something
different from having
an object and having something that
described this. Just like a car can
be discovered by the part of the mod
or the part of the shell of the car or
whatever.
So
they're always been used by website
in different formats and not only
the website, but by any application.
Basically, like XtremIO
is a very odd format.
And it's it's not it's
not new or it was not invented
by the NSA or anyone.
So it was Jason.
And to make an example
of how this is embedded into a website,
I thought of the Google convention
talking. So basically it's
a set of tools that Google website
to install so that if
you have a campaign on AdWords and
you want to know how many people you have
converting to potential customers,
you don't use your telephone number on
the ads on the page.
But to use a Google Voice number so
that you actually know that those
calls were routed
by an advertiser
and that basically and
when I think about this, I, I think
always at the Yellow Pages,
like maybe 15 years ago
or more, companies used to put
ads on the Web, on the Yellow Pages, and
they might use a different number so that
they knew that the
calls to that number were coming from the
yellow page.
And that was fine
because the information between the
the people, the call the company and the
company itself was contained between
these two entities.
But in this case, if you want if you have
a if you're calling something that you
think it's kind of personal, like
some doctor or something related
to your health or to your personal
belief, that information is also
shared with Google, which is a third
party of with Facebook or
with someone else.
So there was an explanation, basically,
and how it works.
Then there is another kind of metadata,
and for example, I was looking at my
phone network logs
and every
couple of minutes there are some things
that are sent to a
remote server through HGP
call, and these include the network
location, for example, or push of my
contacts and so on.
And I
do not mean only the service
that I have directly authorized, like,
for example, Gmail, Bush, my contacts
into my Gmail contacts.
There are also push, for
example, some some days or other
applications. And
the thing about it is that because
this actually data goes encrypted
now, you have no idea of what
is actually being sent, because in order
to look at this data, you have to
go through a very complex procedure of
doing some kind of a man in the middle
attack onto the data
and see what your device is
sending on your behalf.
And then there is also like other
kind of devices to send data.
And these are like
wearable devices.
They track your weight the amount of
time you're walking every day in your
sleep, for example.
And I
have I have a lot of friends.
There are technical and
they like using these devices, but
they never think that there is a company
that knows how many hours per day you
sleep. And if you've been drinking, your
sleeping partner patterns are kind of
different or whatever.
And there are starting I
have started to read articles about how
this information can be used, for
example, from
health insurance companies to say,
OK, you have cancer or you have you have
had a heart attack.
But we are not going to pay for your
care because you haven't worked enough
in the last five years, things like
this.
And now and then there is stuff,
productivity that says that boost
productivity and therefore they they're
starting to find out all about it.
And and then there is glass,
of course. And
I mean, glass is basically
a come streaming
constantly on the Internet because
you don't know if that is the new video
stuff. I mean, in theory, you know that
it's not. But how do you really know that
is not?
And they also have information about your
blood pressure, for example, or if
you if you're looking at a shop window
or not, and they actually want to do
that, they really want to do that.
I was not tech talk a while
ago in Google and they were explaining
how this can be important to
to push a new kind of advertising
in which if you if they if a shopper
changed their windows, they kind
of know if people liked it.
But if they stopped it and the way they
reacted it by looking at the
the way they are basically
and I mean,
I wouldn't like that.
And then it was
like
there on the market.
I mean, and it just the beginning
and then the website advertising
again.
And this is just
a call to DoubleClick.
And he has embedded some keywords.
For example,
if you look at it, this like neurology
or psychology,
anxiety.
I mean, I'm
looking at the website because maybe I
have a health condition or something or
something, someone in my family or not.
And this is recorded
and it's also recorded
through the keywords that the website
embeds and as has always been this way.
And so because
this happened with a connection,
every connection that you may make
in the browser as some selecter
associated with it, the picture
kind of small, but basically
see if we can zoom for.
No, no.
Well, it's so it says, for
example, that disconnection goes from
Gaetane Forum to Google Analytics
and they track a couple of things
about you.
So, for example, here there is
the screen
resolution and the screen resolution,
for example, use without a combination
of things can be used to uniquely
identify your browser on the
Internet, for example, because
if you if you match that with the browser
plugin you're running and so on, it
can be used to create a unique
identifier of your browser, even if
you're not logged in and any service
that we shouldn't have it
on. So these things of
connected data and metadata takes us
to something that is being
discussed mostly in the API community,
and it's about either data and
hypermedia.
And
so when the Web started,
basically it was about this
concept of the text
and the text was linking to other
text.
Yes, exactly.
And there was
a relationship that the link kind of
expressed between two pages that were
connected.
And this
was used, for example, by search engines
and so on to kind of build
a model of Web pages.
And this
concept is actually evolving
from the web of Web pages
and text to the web of data and
interconnected data.
And
this data is basically anything,
and it can be used also
for personal data.
And this is what
happens, actually, restful architecture
and restful architecture, basically the
architecture of the Web.
And
it's actually a way to represent
Web pages in a way that
you can abstract over them.
And they're not Web pages anymore, but
they are a resource.
And you are you and I that
identified that resource and
the representation of
completely on the protocols that I use or
on the service that I used.
So it's actually only the resource and
that this representation of the resource
that can be any way to represent data
and the way to identify
these resources that you are really you
are right.
And whatever is behind this,
it's kind of connected through the
server with the rest connector so
that the client doesn't know about
it. And this is actually
what happens when we
we interact with data basically on the
Web at this moment.
We have an interface that is uniform
and we request the resource
through the right and
we have the representation of the
resource. You can be a page, you can be
adjacent can be Zemo.
And we use that and we
we have the resources link to
other resource and we search through
them. We have starting this with
hypermedia API and so on.
And so what is motive for privacy
and why is this interesting,
so because up to
no information about
user users that were tracked, well,
does a record in a database,
for example, it was just a log message.
OK, user one has done this
on this page, but now everything
is starting to restructure.
And the way the information can be mined,
it's a lot more efficient and
it's a lot easier basically to
to track users.
Follow the principle in which you would
analyze Web pages.
That is something that, for example,
search engines have been doing for the
last 10 years or more, 15 years
probably.
So if we look at the graph again,
we see that every
action has a selector.
It can be a keyword.
It can be the resource where the
the action has started or
it can be anything about it, really.
And this everything
makes
that action more unique because it can
be search more efficiently, it can be
analyzed more efficiently.
And it takes out this
idea that everything that we do
is connected in a hydrograph.
And it's just an no go for
just a graph.
And where every node is connected
with a set of edges,
there are the links to other entities.
And this is what happens with Web pages
and what happens with the personal
data at this point.
So you have your identity
and you have.
The webpages and the action that you that
you visited, the action that have been
taken on those pages and
you have your post on Twitter,
your post on Facebook, your friends,
your connection and
everything is connected to you basically.
And it's very easy to anodized.
And this is an example
of how it was analyzed, but it
was some document that were leaked on The
Washington Post a few days ago, I think
weeks, and they use
the the Google
Previdi.
They set on a cookie
to actually identify Target
online.
And.
So that's that's how
easy it is, and
I mean, if if everyone
can analyze data every time you visit the
website and it's
at the moment it's happening online,
mostly in JavaScript.
But if one of you worked with
Web application or mobile application,
you might use a set of tools like
third party tools like,
I don't know, the there are like
Google Analytics or other
neurally, for example, McSporran and
so on, used to to track
events.
And this happens in the back end of an
application.
So in this case, you
in this case, you cannot you cannot
know what the application
is actually tracking because Hopkins' in
the back and once you're logged in,
so you're not even able to look at it
as you do with JavaScript HGP calls
because it's the server that does those
calls to send the data that they want to
talk.
Yes,
so I was I was suggesting this
this link, because it's a study from
yes.
Have done in 2011, I think
quite a long time ago before this started
to be mainstream, about how
you can use some statistical
measurement of how your browser is
actually unique.
So to answer the question, how
unique is a footprint?
We can look at a set
of different things.
You can start profiling your activity
and see what kind
of profile
you're sending through the network.
What kinds of keywords you're sending.
For example, you can calculate how many
bits of information you introduce every
time you add something unique to,
for example, your browser
profile on.
Or you can start analyzing how many
unique features you are sharing
across the network.
There are studies, for example, that by
looking at your Twitter profile
and your tweet
frequency across the week
or across the hours, they can know if
you're tweeting more at work or tweeting
more at home or tweeting more in the
weekend and so on.
An application
there are like that.
They know that that
they custom are more likely
to use the application in the weekends.
They increase, for example, advertising
during the weekends or they promote
special offer. And so these are, for
example, applications that
are selling
video streaming services like movies
or magazines, books and so on.
They know that because you're busy,
you're probably likely to do these things
during the night or during the weekend.
So they kind of change their strategy
following these patterns.
So when you profile
over a set of categories, what you are,
you basically count every time
that categories express it.
And you put that in a histogram.
It's it's kind of I mean, it's nothing
very statistical advance.
You just can't and you divide by the
total and you have this diagram
and you can do it to it.
Like I did this for myself and
I was looking at stuff.
And you have yeah.
You have the spike in computers, but
somebody else can have a spike on health,
for example, and.
That might be used for any particular
reason.
So this was a study that is done by
DFS a while ago and I mentioned it
before, and it use
things like the user agent in the
browser, the headers that you send every
time you visit a
Web page in
the time zone and so on and calculate
the actual you
unique is that feature in our set
of what I mean, the cloud
is just a collection of data centers
belonging to some companies.
And
I mean.
OK,
so when we think about this, we think,
OK, we
are giving our data to somebody else
and all the data is safe
basically.
And but I mean, who
owns the cloud? I mean, even if
we use different services, sometimes
the infrastructure behind the cloud
is by somebody else.
So these are the biggest players
in cloud computing infrastructure.
And it's only five, even though, for
example, there are a lot of services.
They use Amazon, for example, but they're
still on Amazon.
Yeah, and it is like
basically for the the revenue for
2013 and
still the players, there are very small
number of them.
They actually have cloud infrastructure,
not that they are selling services.
And if we go beyond cloud providers,
this is like
the cable, the the website that
shows cable up for
submarine cables and all these
cables. They're not public.
They are owned by other companies.
And the way the data
that travels on these cables is so
is treated, we actually have no control
about it because we don't know.
So I started thinking about mobile
communication providers because
sometimes mobile infrastructure
is deployed, especially in Europe,
is deployed with public funds,
with a lot of help from from public
governments. But then they're used by the
companies that they actually can share
those those infrastructure.
And
but so if
if they share the infrastructure
and they actually haven't deployed it,
who owns the infrastructure at the end or
who has done it?
And I mean, like build it.
And the number of companies, again, that
build telecommunication infrastructure
on the market is not the I I
it's actually free and it's
what way ZTE and
Ericsson is OK.
And so it's again, three free companies
mostly.
So
there was this quote that I read a while
ago about Snowden and this idea that the
Internet was free and then it wasn't free
anymore.
And the thing is that the infrastructure
that we have been using,
and that's always
been the same. I mean, the Internet was
built centralized
with a series of layers
of control that are like they're
by design. I mean,
if we look at the protocols, if we look
at the way there is, it was built,
it was built with the idea that was
someone
routing information or controlling the
information, providing the
infrastructure. It was it was top down in
a way. And that is understandable
thinking about how
electronic systems were built a while
ago.
But if we want that
freedom back, the idea was that
I think we be starting
to research and open data and we'd be
starting to do research and open
open source software.
But we haven't to research in open
infrastructure yet.
And I think that's
where we should go in order to
have more and
more access and more control on the
infrastructure that we use, actually.
And
another thing that I think we should do
is also collaborate with researchers
outside of the telecommunication
industry, because there are a lot
of people that want to
to do stuff for privacy from
the political point of view, from the
social point of view, from the point of
view of the law, and I don't know
sometimes where to start.
I don't have all the information.
And the last thing that I suggest
is to be mindful about your footprint.
Like if if
an application wants to know your
sleeping patterns, I mean, you should
question that.
And it.
Thank you, sir. Well, I think
a lot of people have appreciated your
talk. Other questions,
we have some more questions left
of one.
Well, actually, I'm
two interesting points that
you brought up that I'd like to explore a
little further.
You mentioned, of course, people tracking
fitness and sleep.
Are you aware that in the U.S.
right now, there are three court cases
that are using the Fitbit as
part of their subpoenaed evidence?
One of them is for an injury case.
They want to to demonstrate that the
person was as injured as they say
they are by using the fact that they can
no longer exercise.
But the other two are divorce cases
where someone is trying to claim that a
person is not where they said they would
be using the Fitbit tracker.
I actually read something about it.
I, I
read I was using court case.
I didn't know the actual cases.
And the thing that I read mostly was
about health insurance companies.
And yes,
the second thing was regarding
the mobile phone.
It was recently revealed that
both Verizon and AT&T in
the US were adding an
additional tracking
signature to everyone who
used the browser on their mobile phones
so that they could then get a complete
record of every site that you've gone to
once you leave their connection
and has
claimed that they are no longer going to
use it. But Verizon has made no claim
at all that they're going to continue to
collect that information.
But the thing is, that is
I mean, it's very easy to add the
parameter to where you are.
I mean, once the the call goes
through their servers, they can do
whatever they want with it.
And they have that information only.
And it's very difficult for us to find
out that they're actually doing it.
OK, thank you for the work you're doing
is great thing.
Oh, yes. No question.
Yeah, thanks.
My question is what we could do to
redress our web
footprint now?
I mean, we should use all
the time. That was a bundle
we have I mean, in a virtual
machine.
The question is what we can
do about the footprint.
If we can use we can mitigate that we
talk.
Yeah. I mean, tourism is
like I recognizable.
I mean, I actually run the
panoptic, like with Tor
and
OK, so with my usual
setup, the the bit of information
we're about 22
that we're sending and we thought it was
getting down to 12
using our little bundle.
So if you're, if you keep browsing
with the same bundle, although
your location might change and so on,
the information that you you send,
for example, about
the cookies that you store or you decide
not to if you need to, and
DM your profile,
basically the things that you've been
surfing, I mean, after a while,
your problem becomes part
of your footprint. So that's
that's the thing.
Thanks. Thank you so much
for your question, please.
So
sometimes it's not practical to use the
Taubira the bundle because it's just not
fast enough with the routing.
Do you have any other recommendations one
could use to say it's not like
low profile?
Um,
the thing is that once you log in or you
accept cookies,
there isn't much you can do.
I mean, you can you can
stop any JavaScript
calls, for example, to third party,
and you can do that with a number of
browser extension.
But if it is something that it's been
doing, it happens in the
back end of an application.
You have no way to know what information
have been collected.
And we mobile phones is semenovich
because even if you don't use the browser
and use applications
that you if even when you do
not login into anything into an account,
then use the device ID
or the generate an idea for that device
in order to use it to talk to you.
So maybe
a follow up on that one.
Like how
would a like a Web browser, how would it
have to be designed to
actually, you know, prevent
this kind of things happening?
Or is it or maybe is it possible to
design a Web browser the way that so it's
much harder to track you.
So the question is if it's possible to.
The sign up process that is harder to
track.
There are privacy extension
that can help to block calls
and can help you say, OK,
every time I visit, for example, The New
York Times, I make these
calls to these servers and these servers
are located in this location and are
sending this data.
And I could say block this and you're
probably blocking some out and so on.
But again, it's
it's not like everything needs to happen
in the in the client
as a client.
You when you use a client and you can
protect yourself.
But as soon as that goes into the server
and unless you always
kind of send forward information
like you always change the location
through a proxy, you and you always send
like bogus keywords to say
that if I'm searching for something,
for example, basketball,
I'm sending like a set of keywords
through other websites like,
I don't know, a business, economics and
religion or whatever, unless
you do this all the time.
There is always a way that they can talk
to you, because the web, the
infrastructure, the infrastructure
is designed is to collect data.
And the the development
of big data is about data points
that users have generated
and they can help them analyze
stuff.
I don't know from from
if the application is used more from
London or New York or from if
I don't know what magazine is read more
than another one on one article in The
New York Times is more interesting that
another one,
you name it, you can do it, basically.
Thank you.
OK, then there's one question from the
Internet. Another in the room,
the first one from the Internet.
OK. Would it be any hope to randomize
all possible tracking variables, maybe
and by proxy that modifies
so relevant content?
So the question is, if you can use
talking about it and it should be proxy
to to avoid this,
you can certainly use it.
But you are also
aware that your online
experience changes.
And
again, you can use some
you cannot use that all the time when you
use, for example, your mobile
or things like that.
So tracking
and tracking technology exist and
they're starting to be developed.
But in my opinion, they're only in the
client.
And they also need to
be.
We also need an effort for the
from the social point of view, from the
political point of view to to say there
is so much you can do with personal data.
Thank you.
Thanks.
OK, then, that's the last question
there.
I think you have a question concerning
the identity hypergrowth and
if you have any information, if there's
any debate on the strategic value of
that,
since there's the US at
least, is process called a national
strategy for secure transactions
on in cyberspace, where they
basically want to create a marketplace
for identity services?
And I wonder if
the windows that you have knowledge about
participate in that discussion and what
will the hypergrowth place in that?
So the question is
about the ideograph and security
services, the political
value or the strategic value of that.
If you're aware of any discussions or if
you have seen anything that points
to.
OK, and thanks
to the the idea about the
a graph that is part of my
research and thesis and I use it to
analyze data and to not to have
just to carry a database, but to be able
to say, OK, if
this person was interested in
psychology, maybe there are some
interesting anxiety or they also did
something with that.
And
political idea behind this is that
if you know what you're being targeted
for or if you know what information
you're sending on the Internet,
you'll be able to say, OK, I want
to do something about this.
So the idea is that if you posted,
for example, something
on Twitter, Facebook or whatever
that says something that you want about
you, like you,
whatever, you accidentally post something
like Xanax or something
like this, you are able to remove it
and to know that you actually did it.
And
for example, if you know that because
of a number of connections that you have
on on Facebook
or on Twitter, you are actually more
likely to appear of one
or the religion as opposed to another,
or you put your you're more likely to
appear gay or straight or whatever.
You might not want that to be shown.
And you might want you might want to
recognize what is actually being revealed
about you, but your activity.
So the idea of the epigraph that I had
was that that I might
be analyzing the information that I
share. I'm able to know, OK, I need to
delete this.
And if I did it this no, I also
delete all this information about me
politically.
I don't know if this discussion is
happening. I know that.
I mean, the thing is, that is the way the
NSA and the
did the leaked documents talked
about metadata.
There was something about a node
and selectors and that
reminded me of a graph structure and a
link actually went to say, select a
link. And there was it.
I don't know if I answered the question,
thanks, OK?
I don't see any more questions at the
moment. If anybody has another question,
you can just slough off now or
wave doesn't
seem to be the case.
So thank you again for those talk and.