Schneier on Security

Clive Robinson • January 3, 2025 4:31 AM

@ ALL,

There are two obvious “first glance” reasons for this change,

1, Increase influence/profit
2, Provide new input data for AI

As these would directly benefit Alphabet / Google.

That said there is another issue some will immediately think about. Which is,

3, EU data protection legislation.

This is seen by some as emboldening others in the US. With states like California passing legislation to likewise constrain the rampant surveillance on Internet users.

Thus for the “some” cutting access to “clean input” to just funnel into the input corpus of AI systems[1].

Especially as there is an increasing trend to move from central to federated social media caused by the well observed “blue bird dive of doom”.

Device fingerprinting currently has to be seen like “On Device Scanning” (something Apple apparently desperately wants). It is in effect an artifact of “device use” rather than the device it’s self. Whilst there is little research currently it is not hard to see how a users choices of apps, services and settings is going to be the same or similar across their devices. Thus even if a user separates out their activities across devices to prevent direct linking the fingerprint will cause sufficient similarity to enable correlation thus indirect but probable linking. It is just a variation on what intelligence analysts, investigative journalists, and investigators in law enforcement do.

Now consider this being done on mass, it is something that is actually well within the capabilities of “Current AI” LLM and ML systems. Thus users would in effect be corralled from federated systems back into central systems, so allowing the sorted aggregation of user output into a coherent whole thus vastly increasing it’s value as data for AI training.

I’ve previously warned of this sort of activity,

https://www.schneier.com/blog/archives/2024/06/online-privacy-and-overfishing.html/#comment-437979

As part of the AI business plan of,

“Bedazzle, Beguile, Bewitch, befriend, and Betrayal.”

(Read the thread “overfishing” article as it explains why “the frog gets boiled” in the first place, due to another human failing that is part of “short-termism”).

[1] There is a lot of talk about “synthetic data” that is using one AI to generate input for another AI. For some reason people are not thinking this through very critically or I suspect in some cases at all. AGI output is not human output and is at best a poor facsimile of it in many ways (think randomised or chaotic semantic layers changes). For AGI to make useful output it will need to be filtered through humans to be sanity checked much as the processes for “guiderails” have to be in place. Thus ask just how fast such checking could be done on synthetic data?

Clive Robinson • January 13, 2025 12:42 AM

@ Bruce, Winter, ALL,

Related though technically “off topic”

Above I mentioned the security concerns of failed/failing companies being sold off at “fire sale” pricing and then having the data on/of users being appropriated and monetized.

In the news currently is a company called “Bench” that failed with a lot of users financial records.

According to this article,

https://techcrunch.com/2025/01/10/bench-customers-are-now-being-forced-to-hand-over-their-data-or-risk-losing-it-they-say/

Those who have taken over the remains of Bench are in effect extorting Bench’s customers/users via their data.

It would appear “the moral” of this is,

“If you value your data, ensure you back it up as often as you update it.”

Further you need to,

“Back it up in a ‘universal import’ form not a ‘service proprietary storage’ form.”

Such as a text based form such as CSV or similar, so you can then much more easily move to another provider.

Though in all honesty, perhaps the best thing to do is not to use SaaS or Cloud services, but keep your data firmly under your control not just in an ‘Open Data Format’, but ‘in house’, ‘inside your security perimeter’, and under your ‘disaster recovery plan’ where possible.