full-disclosure - Re: user data collection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <35263.1362020488@turing-police.cc.vt.edu>
Date: Wed, 27 Feb 2013 22:01:28 -0500
From: Valdis.Kletnieks@...edu
To: "taxakis" <taxakis@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: user data collection

On Tue, 26 Feb 2013 13:28:26 +0100, "taxakis" said:
> I have a simple question to this list:
> Do we have somewhere specified in detail who (Facebook, Apple, etc.)
> collects what exact (data) on users ?
> I do NOT mean 'in general terms' or whatever blurb these companies put on/in
> their web pages, privacy policies, terms and conditions; but the factual
> fields they collect (per company/field).

There's probably not an up to date accurate list, for several reasons:

1) It's a moving target - companies change what they collect.
2) Especially for large companies like Facebook or Google, the data
collected by different business units may be different - that's part of
why Google's privacy policy was so hairy for a while.
3) Some information may be gathered indirectly - for instance, geolocation
information, your ISP/employer (as intuited from IP->ASN translations),
and data collected by third parties (run NoScript sometime, and look at
how many sites load Javascript from tons of other sites).
4) Similar to 3 - third-party cookies and other tracking.  Get the Collusion
plugin for Firefox, and be prepared to be amazed.
5) Keep in mind that many of these companies (and basically 100% of those
who provide any "free" service) consider the data to be valuable business
assets that they intend to monetize and not share - when your business model
depends on being able to correlate the type of music you download with
how often you visit Wikipedia, you're going to try *really* hard to avoid
letting anybody find out that you're tracking music downloads and Wiki hits.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/