• 0 Posts
  • 16 Comments
Joined 1 year ago
cake
Cake day: June 16th, 2023

help-circle

  • My plan was to use asymmetric encryption where the secret key is again encrypted using something like AES

    I think your terminology is off. AES is an example of symmetric encryption: Decryption requires the same key as encryption.

    An example of asymmetric encryption would be public-key cryptography: You encrypt a message with the public key, but only a private key can decrypt the result.

    AES should be fine for encrypting large blocks of data.

    I believe that for systems like TLS, asymmetric encryption is only used briefly to negotiate a symmetric key between client and server.







  • Despite what the length of their privacy policies might suggest, first party sites are a lot stingier with their user data now than they’ve been in the past. The value of knowing who someone is and what they want is derived when you convince them to pull out a credit card, at which point you need to collect their data anyway.

    Thus, I think we’ll see two tiers of data collection: Deep first-party info shared between retailers and data brokers to target advertising on their first party site, and less granular banner advertising based on privacy sandbox, taking the place of drive-by cookie drops. If privacy sandbox is as good for random blogs as industry is expecting (ie, not as perfect as third party cookies, but less impactful than Apple’s ITP was), I don’t think we will see a wave of email signups.


  • I don’t quite understand the leap from “No third party cookies” to “You need to create an account”.

    If you’re visiting a site and they drop a cookie, that’s a first party cookie. You don’t need to log in for that to happen, and they can track you all the same. Taking identifiers from a first party cookie and passing them to advertisers will still be a thing, it’ll just require closer coordination between the site and the advertiser than if the advertiser dropped their own cookie.

    Now yes, that first party cookie won’t follow you around to other websites and track your behavior there, but creating an account wouldn’t enable this anyway. Besides, Google’s Privacy Sandbox product suite is intended to fill this role in a less granular way (associating k-anonymized ids with advertising topics across websites).







  • Happened at my workplace. An phishing email went out to test how likely people were to click the link.

    Anyone who clicked the link had to take phishing training. Anyone who forwarded it to our internal “hey this is a phishing email” service also had to take training… because the internal service would automatically click the link.