Show simple item record

dc.contributor.authorMarx, Matthias
dc.contributor.authorZimmer, Ephraim
dc.contributor.authorMueller, Tobias
dc.contributor.authorBlochberger, Maximilian
dc.contributor.authorFederrath, Hannes
dc.contributor.editorLangweg, Hanno
dc.contributor.editorMeier, Michael
dc.contributor.editorWitt, Bernhard C.
dc.contributor.editorReinhardt, Delphine
dc.date.accessioned2018-03-22T12:40:43Z
dc.date.available2018-03-22T12:40:43Z
dc.date.issued2018
dc.identifier.isbn978-3-88579-675-6
dc.identifier.issn1617-5468
dc.identifier.urihttp://dl.gi.de/handle/20.500.12116/16294
dc.description.abstractIt is common practice of web tracking services to hash personally identifiable information (PII), e. g., e-mail or IP addresses, in order to avoid linkability between collected data sets of web tracking services and the corresponding users while still preserving the ability to update and merge data sets associated to the very same user over time. Consequently, these services argue to be complying with existing privacy laws as the data sets allegedly have been pseudonymised. In this paper, we show that the finite pre-image space of PII is bounded in such a way, that an attack on these hashes is significantly eased both theoretically as well as in practice. As a result, the inference from PII hashes to the corresponding PII is intrinsically faster than by performing a naive brute-force attack. We support this statement by an empirical study of breaking PII hashes in order to show that hashing of PII is not a sufficient pseudonymisation technique.en
dc.language.isoen
dc.publisherGesellschaft für Informatik e.V.
dc.relation.ispartofSICHERHEIT 2018
dc.relation.ispartofseriesLecture Notes in Informatics (LNI) - Proceedings, Volume P-281
dc.subjectpersonally identifiable information
dc.subjecthashing
dc.subjectpseudonymisation
dc.titleHashing of personally identifiable information is not sufficienten
dc.typeText/Conference Paper
dc.pubPlaceBonn
mci.reference.pages55-68
mci.conference.sessiontitleWissenschaftliche Beiträge
mci.conference.locationKonstanz, Germany
mci.conference.date25.-27. April 2018
dc.identifier.doi10.18420/sicherheit2018_04


Files in this item

Thumbnail

Show simple item record