<story><title>What is Differential Privacy?</title><url>http://blog.cryptographyengineering.com/2016/06/what-is-differential-privacy.html</url></story><parent_chain></parent_chain><comment><author>ianmiers</author><text>This is something Apple really needs to release all the details of. Even if they got the crypto exactly right, they could have picked a privacy budget&amp;#x2F; security parameters that just leaks everything.&lt;p&gt;And there is every reason to be skeptical about Apple&amp;#x27;s ability to design even mildly complex crypto given iMessage&amp;#x27;s flaws. Although the break in iMessage wasn&amp;#x27;t practically exploitable, that was luck and the fact that the only way to detect  if a mulled ciphertext decrypted required attachment messages. The cryptographic mistakes were bad. Given any way to detect decryption of mulled ciphertexts for standard messages (e.g. sequence numbers, timing, actively synching messages between devices, delivery receipts from iMessage instead of APSD), Apple&amp;#x27;s crypto design bugs would have eliminated nearly all of the E2E security of iMessage.&lt;p&gt;Remember, this isn&amp;#x27;t a boon for user privacy. Apple is now collecting far more invasive data about users under the claim that they have protections in place. At best it preserves the status quo and does so only if Apple both picked the parameters correctly and implemented it correctly.&lt;p&gt;At this point Apple&amp;#x27;s position should be best summed up as: we have drastically reduced your privacy except not because magic that we (i.e. Apple) do not fully understand.</text></comment>
<story><title>What is Differential Privacy?</title><url>http://blog.cryptographyengineering.com/2016/06/what-is-differential-privacy.html</url></story><parent_chain></parent_chain><comment><author>bo1024</author><text>I&amp;#x27;ve read a couple articles and haven&amp;#x27;t seen any details about how they&amp;#x27;re going to apply DP (differential privacy).&lt;p&gt;It&amp;#x27;s important to clearly distinguish what DP can and cannot do. DP is just a technique for taking a database and outputting some statistic or fact about it. The output has some noise added to it.&lt;p&gt;The guarantee of DP is (roughly) that anyone looking at the output alone won&amp;#x27;t learn much about anyone in the database. This also holds for anything you do with that statistic.&lt;p&gt;Think about this carefully when thinking about what DP does and doesn&amp;#x27;t promise. Also think about the difference between &amp;quot;privacy&amp;quot; and &amp;quot;security&amp;quot;.&lt;p&gt;Example of what DP does protect against: If Apple is recommending products to people based on others&amp;#x27; download habits, and this recommendation is based on differentially private statistics, then no other user or group of users can infer anything about my downloads. In fact, even engineers at Apple, if they can only see the statistics and not the original database, cannot infer anything about my downloads.&lt;p&gt;Example of what DP does not protect against: government accessing the data. The database still has to exist on Apple&amp;#x27;s servers. The government can get to it just as easily as before via warrants or so on. DP is not cryptography.&lt;p&gt;My assessment: On one hand it is awesome that Apple is taking a lead in using differential privacy and thinking about mathematical approaches to privacy. On the other, there are many facets of privacy and right now I think people are more concerned about &lt;i&gt;security&lt;/i&gt; of their data and privacy from the government, or else privacy from companies like Apple itself. DP doesn&amp;#x27;t address these; it only addresses the case where Apple has a bunch of data and wants the algorithms it runs not to leak much info about that data to the world at large.</text></comment>