приватность

В наших публикациях мы уже неоднократно поднимали тему приватности и анонимности при работе в Интернете, а также вопрос доступа к разным видам услуг. В одном из наших предыдущих материалов мы говорили о том, почему пользователи стремятся ограничивать мониторинг своей активности в Интернете. Сегодня мы продолжим тему анонимности и приватности, в частности, мы расскажем о тех случаях, когда чрезмерное стремление к анонимность пользователями прямо или косвенно говорит не о дополнительной защите, а является инструментом для недобросовестного поведения и получения услуг незаконным путем.

monster--1-.jpg

In our publications, we have raised the issue of privacy and anonymity when working on the Internet multiple times, as well as the issue of access to various types of services. In one of our previous articles ([https://juicyscore.com/blog/en/security-vs-privacy-in-search-of-a-fair-balance-en/](/en/security-vs-privacy-in-search-of-a-fair-balance-en/)) we wrote about why users tend to limit monitoring of their online activity. Today we will continue the conversation about anonymity and privacy, in particular, we will talk about cases where the anonymity of the user directly or indirectly does not mean additional protection, but becomes a tool for unfair behaviour and obtaining services illegally.

There is no secret that the development of technology gives companies and financial institutions a lot of tools, including user data collection. Big business traditionally tries to collect as much information as possible about visitors of their web resources (such as web-sites or mobile apps), information about their devices and various behaviour stats in order to improve their services, to provide security / availability and to provide the maximum number of services.

**Why do companies need this?**

Collecting a virtual user digital “trace” or digital profile allows to solve a number of problems: first of all, companies can differentiate the normal traffic created by the real client and the synthetic one; secondly, it reduces the risk of fraud and other operational risks, which are associated with the theft of personal data and digital identity; thirdly, it makes it possible to personalize settings, tips, offer details or to configure advertising in a proper way.

**What are the difficulties in building a digital user profile?**

In this thorough work of building the right mechanism for data collection, there are various difficulties that can be considered in two major aspects, which are essentially two sides of the same coin.

Since the parameters of the software pre-installed by the manufacturer on the device can be virtually identical for one device family, the set of parameters used to build the digital fingerprint should be as large as possible. This allows to secure differences between devices and some limited stability over time.

But if we look even more broadly, the biggest difficulty was born on the intersection of these concepts - a whole layer of software appeared, called device randomizers, the purpose of which was to impede the existing technologies for constructing the device digital profile and to show the device as new one every time. The more users notice an upward trend in the data collection, the more popular are all kinds of tools that give the user the opportunity to keep their behaviour partly private and completely anonymous. This also applies to actions on a particular resource, and even the fact of the user's presence on the site.

**Excessive anonymity: where is the red line?**

First of all, it is quite difficult to be sure in the privacy of the Internet in the age of information technology, although anonymity is achievable. Secondly, due to the use of certain technologies the experiences a lower speed of information downloading from various web resources and low online content rendering quality. Thirdly, such mechanisms of “anonymity” can be often in the “grey” legal zone.

The randomizers themselves can be conditionally classified as follows:

- according to the Internet connection parameters, which are randomized;
- by the method of robotization or copying the virtual users behaviour on the site and / or in mobile applications;
- by the method of randomization, when various anomalies are embedded into the digital profile of the device.

At first glance, the user's desire for excessive anonymity seems harmless, but in practice this opens up a whole layer of problems that lead to fraudulent schemes that are difficult to identify. In pursuit of unattainable privacy, which should not be confused with achievable anonymity, some unscrupulous users cross the line and, unfortunately, try to use other people's digital profiles to disguise themselves. As a result, this can lead to large losses incurred by a financial institution, which will suffer from the wave of a technically well-trained fraudulent attack.

From a technical point of view, a randomized device looks like new, as the digital profile will be tracked as different with each new entry to the site. This case, such device may be used for unlimited number of requests (for example loan applications), from some anonymous user, who in many cases pretends to be another user.

According to statistics, the share of devices with installed randomisers in the application stream is relatively small, it usually ranges from 0.1 to 1%, with possible dangerous bursts of up to 5% - 10% over a short time range.

The current statistics for different countries according to the share of devices with randomizers in the loan applications flow for Q1’20 is presented below.

![](/uploads/image_1_7d3b032001.png)

Such situation leads to two very serious consequences:

- the share of confirmed fraud risk (for example, loan default without payments and contact) is extremely high and ranges from 70 to 95%;
- at the moments of prepared attacks, the percentage of applications with randomized devices jumps from less than 1% to several percent, and tens of percent in some cases.

Thus, even the fact of using a randomizer on devices can already indicate a risk of fraud or a risk of loan default, which means it brings a danger both to a financial institution that does not want to provide a service to an unknown anonymous user with potentially unfair intentions, and to the users whose excessive suspicion and an attempt to anonymize their actions will become an obstacle to obtaining a financial service, a much needed loan or an insurance policy.

**What should financial institutions do in this situation?**

At the beginning of the article we briefly covered typical technological scenarios that are used to build a digital fingerprint. In order to build a digital fingerprint that is robust and stable over time and resistant to various anomalies, it is necessary to use a wide stack of device and Internet connection authentication technologies.

JuicyScore constantly monitors new randomization technologies and software in order to quickly develop and to implement respective techniques into our service and make it possible for our clients to determine these new randomisers and the level of their risk. For example, over the past month, about 10 new techniques for determining such anomalies have been into production mode.

We recommend financial institutions to conduct users digital profile multi-factor research through deep authentication methods which should not be limited to traditional and long-existing profile-building technologies and this will help to reduce the number of fraudulent activities. You should watch for reasonable anonymity, limit the use and processing of direct identifiers and real user personal data and constantly update your technological stack - this will place you one step ahead of the most sophisticated fraudulent schemes and attacks.

In our publications, we have raised the issue of privacy and anonymity when working on the Internet multiple times, as well as the issue of access to various types of services. In one of our previous articles (https://juicyscore.com/blog/en/security-vs-privacy-in-search-of-a-fair-balance-en/) we wrote about why users tend to limit monitoring of their online activity. Today we will continue the conversation about anonymity and privacy, in particular, we will talk about cases where the anonymity of the user directly or indirectly does not mean additional protection, but becomes a tool for unfair behaviour and obtaining services illegally.

Pursuit for unlimited user anonymity vs risks for the online world

Погоня за неограниченной анонимностью пользователей vs риски для онлайн мира

Сколько времени вы сегодня не были в сети?

С 2007 года человечество встало на путь интернет-зависимости. Словами «We have reinvented the phone», прозвучавшими на презентации первого iPhone 12 лет назад, по сути ознаменовалось начало нового мира. Вместе с возможностью неограниченного и постоянного интернет-соединения изменилось не только отношение к информации, но и вся индустрия предоставления услуг. Начался сервисный бум, в котором переизобретается само понятие услуги. Сегодня все происходит онлайн: каждая, хоть немного уважающая себя компания, должна иметь добротный и функциональный веб-сайт, в идеале дополненный мобильным приложением. Развитие Wi-Fi-сетей, улучшение соединения и увеличение его скорости только способствуют непрерывному онлайн-контакту с клиентами.

js_safe-2.jpg

_How long have you not been online today?_

_Since 2007, humanity stood on the path of Internet addiction.The famous “We have reinvented the phone” sounded 12 years ago on the presentation of the first iPhone. That phrase marked the beginning of a new era. The attitude towards information as well as the entire service industry have been changed and reinvented alongside with the possibility of unlimited and permanent Internet connection. Everything happens online today as every even a little self-respecting company should have a solid and functional website, complemented by a mobile application. Wi-Fi-networks development, the connection quality, and speed improvement provide the continual contact with customers._

_But the wonderful new world brings up new problems, which started bothering both users and business every day. For example, few minutes of being online lead to user data availability in the web for a much longer time. As the result, users became focused on their Privacy. At the same time, financial institutions and the online business in general began paying more attention to their Security._

_These two things seemed to have simply improved the lives of both business and users. But pursuing their own needs, the financial institutions security and end-user privacy do not always correspond, and often contradict each other._

_Why is it happening?_

Let’s try to figure out what we mean under“Security”.

Financial services are closer than ever today. In the very beginning, financial institutions expanded their office network to almost every location. Within a number of years this approach gradually converted into expanding the business via online through developing fully operative personal online accounts. Any financial transaction can be made today via constantly improving mobile applications. Common day-to-day operations have become more intuitive and effortless with every newly appeared features of smartphones. We are assured that banking is easy. Those who do not not have at least one bank-app on their phones are left far behind the progress or at least complicate their lives.

As the result of this we have got the illusion that loans (as one of the main financial services provided) are easily accessible. You can get “vacation”, “car”, “smartphone” or some other advertised goods by just one finger snap. Active and attractive marketing campaigns demand attention from even an apathetic client who more and more often replies to such demand. In addition to that, the true hunt for user’s information is always hidden behind these bright images or clips. In order to successfully “offer” a loan, lenders are collecting any possible data regardless how much they really need it; their systems receive all necessary information with every credit application. Analytics and risk policies are based on every new personal and sensitive data requested via questionnaires and other similar stuff. In some cases personal data becomes a separate source of revenue and always becomes a source of additional risk for both the organization and the data owner.

Gigantic questionnaires and forms are compiled and used for data collection; all this information needs to be stored. As the result additional data increases the infrastructure overload, complicates internal and external processes and operating costs. Similar to a demanding child who needs thorough attention and care data security requires even more costs and restrictions. The attitude towards data becomes either pragmatic or extremely cautious; data storage becomes the most protected and inaccessible part of the business, hidden behind many locks.

The process is also complicated due to methods of data storage and security. Data hashing is thought to be one of the most common ways to provide data security. In this case data is depersonalized, converted into an alphanumeric code and stored in a hashed form. Seemed to be convenient and reliable this method may lead to data and business damage. At first, depersonalization algorithms (no matter how sophisticated they are) have a chance of a collision. For example, different data lines may receive the same combination of letters and numbers which will lead to an innacuracy of carefully protected personal data. Secondly, there is always a possibility of a reverse conversion even for hashed data. There is no need to be Turing to break this code. With basics in mathematics and server capacity is is possible[ to convert hashed data to personal again](https://juicyscore.com/en/security-vs-privacy-in-search-of-a-fair-balance/?ref=juicyscore.com#).

Despite all efforts, the most successful and protected companies’ databases suffer from hacks and leaks. Unfortunately, recent scandals with [Marriott](https://juicyscore.com/en/security-vs-privacy-in-search-of-a-fair-balance/?ref=juicyscore.com#), [Facebook](https://juicyscore.com/en/security-vs-privacy-in-search-of-a-fair-balance/?ref=juicyscore.com#) and [Google+](https://juicyscore.com/en/security-vs-privacy-in-search-of-a-fair-balance/?ref=juicyscore.com#) will be replaced by new ones very soon. Despite all protective measures and efforts taken to secure the data it remains a valuable commodity on the [shadow market](https://juicyscore.com/en/security-vs-privacy-in-search-of-a-fair-balance/?ref=juicyscore.com#). Publicity of such scandals brings enormous company brand risks and makes people scared every time they hear about such cases. It becomes clear to users that they have to take Privacy in their own hands as personal data cannot be always entrusted to businesses and IT companies.

Human is being an owner by his nature. Being protective of their personal and sensitive data becomes just one of the aggravated behaviors, especially in the 21st century. Dislike for unnecessary questionings, suspicion of the Internet and great efforts to make the stay on the network as invisible to third parties as possible are the results of protective reaction and privacy thirst. People’s mood is also worsened by stories about the “dark side” of the online existence. A simple distrust of the open Internet transforms into excessive protective actions. My home is my privacy. Hundreds of private browsers, firewalls, anonymizers, VPNs and other services aimed to make online presence private (or create such impression) grew and disappeared within last 10 years. The TOR-browser, which theoretically allows hiding actions on the network, in fact, can lead to getting busted and feeling all the consequences of this “privacy”.

As a result, privacy subsequently became a barrier: turning location phone function off while calling an Uber is minor issue. Financial organizations begin to consider the clients at the stage of their visit on the web-site and everything they have to consider are the “guests” without any information about themselves.

Due to excessive privacy a potential client is considered risky by a financial machine, striving for “cleanliness” and openness. Organizations are not ready to accept additional risk acquiring users who hide themselves without any “understandable” reasons or some reassuring markers; company’s immune system triggers and declines a client at the application stage, baring a direct loss to the business.

Here is a paradox: end-users seek for Privacy in order to save their personal data and companies controversially have to increase the level of Security to protect the business. Everyone would like to receive better conditions for themselves. Both sides are not ready to meet each other’s needs in the current circumstances. Mainly because of the reason that data has to be collected at certain point of time by the financial institutions.

\* \* \*

Within the last several years Juicy Score has been successfully used a solution based on alternative data. This solution allows avoiding personal and sensitive data collection. We process the alternative non-personal data that is many cases sufficient to make a decision on applications for a loan or insurance. So there is no need to start talk to a customer via a questionnaire.

This is only one of many steps. In any new world a code of laws or a code of conduct (even Jack Sparrow … captain Jack Sparrow had a code) is sooner or later arisen. Therefore, we suggest looking at our points, which, in our opinion, will help to establish a mutual understanding between the applicant and the lender. This should help to reduce useless accumulation of personal and sensitive data, which in many cases can be considered excessive in the 21st century.

1) Personal Data

- To reduce the use of personal data to the necessary minimum and to enhance alternative solutions which may simplify the decision-making system and risk policies;
- To stop collecting, storing and transmitting personal data without meaningful need and without user notification, freeing up resources and unloading business processes;
- To develop, maintain and switch to using alternative data that is not valuable for fraudsters and less risky for users.

Sensitive information (for example, disposable income, religion or other socio-demographic data — data that does not carry a material threat to a person, but can cause social damage)

- To form a commonly accepted definition and make a list of such data, recognizing its status;
- To regulate the use (at least at the level of a gentlemen’s agreement or code of ethical online-business conduct) of the data in order to exclude uncomfortable situations for customers and reduce risk.

3) Security & Privacy Balance

- To manage finding a balance between the necessary security of businesses and comfortable end-user privacy;
- To maintain and regulate balance in a dynamically changing online world, responding to changes in the activities of both groups;
- To reach a new level of friendly service, where security does not contradict to respect for privacy.

Having made these small but very important steps, it is possible to transform the businesses and to create a new approach to security: the personal data will no longer be the weak link. The main thing is to start and to remember that this is a goal, that can be achieved only by joint efforts.

We are ready to assist and to support on the way to this transformation, and we invite you to try our service, and will be happy to disclose our capabilities and advantages.

Security VS Privacy: in search of a fair balance

Безопасность vs Приватность: в поисках справедливого баланса

<script>(function(d,u,ac){var s=d.createElement(‘script’);s.type=‘text/javascript’;s.src=’https://a.omappapi.com/app/js/api.min.js';s.async=true;s.dataset.user=u;s.dataset.account=ac;d.getElementsByTagName('head')[0].appendChild(s);})(document,309689,328263);</script>

приватность

A collection of 2 posts

Погоня за неограниченной анонимностью пользователей vs риски для онлайн мира

Безопасность vs Приватность: в поисках справедливого баланса

КОМПАНИЯ

ПРОДУКТЫ

ПРАВИЛА