Ben Kreuter RWC 2017

> Google buys your credit card purchase data. A more accurate explanation of the scare quote: link > IIRC, this was announced as part of a program that uses double-blinded crypto that allows google to perform matching against this data in aggregate (Set intersection knowledge), but not individually identity of what a given user purchased, at the same time preventing the merchants from learning the identities of individuals either. > According to what they presented at a crypto conference, they went to great pains to avoid capturing personally identifiable transactions. The overall strategy is that Google Knows = Set A = (all ads shown for user X at Merchant Y) Merchant/Credit Card Proccessor Knows = Set B = (all $$$ paid by User X at Merchant Y), and that it is possible to cryptographically compute sum($$$ of A intersect B) without either side learning Set(User X). > Now whether you believe in the security of the algorithm and whether there are side channel leaks or attacks is another issue. > Edit: link > About 10 minutes in ▶ this video

IIRC, this was announced as part of a program that uses double-blinded crypto that allows google to perform matching against this data in aggregate (Set intersection knowledge), but not individually identity of what a given user purchased, at the same time preventing the merchants from learning the identities of individuals either. According to what they presented at a crypto conference, they went to great pains to avoid capturing personally identifiable transactions. The overall strategy is that Google Knows = Set A = (all ads shown for user X at Merchant Y) Merchant/Credit Card Proccessor Knows = Set B = (all $$$ paid by User X at Merchant Y), and that it is possible to cryptographically compute sum($$$ of A intersect B) without either side learning Set(User X). Now whether you believe in the security of the algorithm and whether there are side channel leaks or attacks is another issue. Edit: link About 10 minutes in ▶ this video

It's actually not given to Google in a user identifiable way. I am not privy to the details, but an overview was presented at a crypto conference: ▶ this video It looks to me like a form of homomorphic encryption where both the aggregate consumer transactions (people bought X at merchant M), and the aggregate Google ad information (people saw ad for X at merchant M) are encrypted and the set intersection is computed on the ciphertext revealing only the aggregate number of purchases, not the individuals. Now granted, there could be a security hole in this scheme as with any crypto-protocol, so it does need peer review, but the design, as stated in that YouTube presentation, is not to reveal to Google personal purchasing information, nor reveal to merchants, personal profile information. No personal financial data or purchasing information is supposedly transmitted. The problem with this kind of technology is that it is really difficult to explain to the public, and easily demagogued.

A Googler gave a talk at Real World Crypto in January describing a system that might back this. The relevant part of the talk starts around the 10 minute mark: ▶ this video In short, they're able to compute the intersection of the set of users who have viewed an ad with the set of people who purchased a product in a store, without either party disclosing their side of the set.