Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't assign incremental IDs to scan results #43

Open
ChargingBulle opened this issue Mar 24, 2018 · 3 comments
Open

Don't assign incremental IDs to scan results #43

ChargingBulle opened this issue Mar 24, 2018 · 3 comments

Comments

@ChargingBulle
Copy link

https://privacyscore.org/site/ *

By returning an incremental scan result ID you expose various information about your users.

If someone submits multiple pages to scan they get adjacent IDs => identifiable
The order of the scan requests also expose spread of your service.

For example the first scan result is of uni hamburg (www.uni-hamburg.de/)
https://privacyscore.org/site/1/

followed by various other pages (including subdomains and printing services of uni hamburg, apparently you have studied CS there).

Some companies (i. e. Facebook) have elaborate social graphs that could reconstruct the exact flow of webservice recommendations because of the icnremental ID.

@ChargingBulle
Copy link
Author

thinking of which it might make more sense to have

https://privacyscore.org/site/github.com/

as URL instead of

https://privacyscore.org/site/18489/

@muelli
Copy link
Contributor

muelli commented Mar 24, 2018

yeah, I'm in favour of that approach. We don't mind the exposure part though.
Anyway, sounds like #18, in parts at least.

@ChargingBulle
Copy link
Author

PS implements an open data policy which is great so exposure of all datasets isn't so bad.
Yet it doesn't favour the privacy of the users if you can see (some domain only known to a few) ; pornhub ; (some domain only known to a few)

Many selfhosters have their own domain which means
knowledge of domain=>has connection to the hoster

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants