Would this breach T&C

Hi Duncan!

Just to be clear, would the link then allow e14 members to contribute to your project with their own data? Or would you just be sharing the results of your work thus far?

cstanton what do you think about this?

It won't be exclusive to e14 members, the page is a simple click button which will return the data from your browser. Anyone can feel free to share it. The more data the better.

The collected data I would be able to share, but the findings may not be able to be publicly available due to this project being in partnership with a cyber security company. I would need to check with my industrial supervisor before publishing.

I don't hold any position at Element14 other than being an active member. As a former IT Security Specialist, I caution you on gathering data without a proper security risk assessment. The rules governing privacy are varied across countries. The individuals on this site will give your a very broad geographic representation. Depending on what you are collecting you can find yourself in hot water pretty easily.

I include a recent news story from Canada. https://www.cbc.ca/news/business/privacy-commissioner-loblaws-id-request-25-gift-card-1.5323043

I personally would be reluctant to participate but then again, I'm paranoid.

Sean

I agree with colporteur and caution to trend softly through this. In all probability the security company may want a limited talk and  see approach (Especially if they are partnering in this venture). Being just an active member of Element 14, I hold no status...

Clem

colporteurclem57 Thank you for the input, I haven't thought regarding the legality within certain countries for sharing the data. The page will collect the coordinates as provided by the browser, and the ip of the request sent to the server.

I have written a short blurb on the page explaining what data will be collected and why it it being collected. No data will be sent without clicking submit. I may add that if you are unsure regarding your countries specific laws are not to submit. I will attach a screen grab when i have a minute

Here is the screen grab of the page, I would like to hope that this is more transparent then some website which collect data, whilst stating it at the bottom of a T&C section. and due to the ssl certificates, chrome flags the page as unsafe. It will also only be collecting the data until the beginning of the day monday (gmt)

Please correct me if I am wrong in my understanding.

The project is going to pull the geolocation information that is contained in the browser, along with the IP address assigned to the host. I'm going to speculate this is the same geolocation information retail companies use to identify the nearest store to your location when you purchase products online. Canadian Tire and Home Depot are two companies for Canada that come to mind.

Is the geolocation information a subset of a larger data set or does it stand on its own? I'm not familiar with the browser protocols or architecture so forgive me if my questions are inane. My question is are you collecting a larger data set but extracting only what you need. If this is the case then the privacy concern covers the whole data set, not just the part you are using.

What happens to the data? You indicated it will be made public. Can you describe what the data will be used for and who would have access to the data?

Feel free to tell me to **** off and I won't be offended. You leave the job but the job never seems to leave you. I'm conditioned to think like the black hats. Your data set geolocation/IP address by itself is not an issue. It does provide a data collection , when combined with other publicly available data sets that can be used for nefarious purposes.

I have a bias when it comes to data collection. Being a victim of identity theft some 20 years ago still occasionally comes back to remind me, the value of data. I pass up many "free" offerings simple because I am unwilling to give you data in return for the free stuff.

Sean

Only the IP and the location is collected. No other data is stored or collected other than what is normally send along with any web request.

With regards to the availability of the data, I will most likely post it here and with the possibility of using hit hub along with the source code of the app.

I am unsure how the browser determines the location. However it is available using commonly available code, which is vanalia JavaScript. The latitude and longitude are extracted from this function and placed into two hidden inputs (form inputs which are not displayed on the webpage) which are POSTed to the server. The IP is collected from the request header to the server. Search "w3schools geolocation" and it will show you the same code I used for determining the location.

I would suspect that this is similar to how Google shows you results relative to your location. The browser will also give you a pop up to allow the page access to your location which you have to accept before the app will allow you to submit. They probably have a much more sufisticated method though.

I can't blame you for being suspicious. even some of my close friends where dubious when I had then testing the prototype for the app. Hence why I wanted to get some feedback from the fourm. Ultimately, I want this to be as transparent as to why you are submitting.

I do hope my inquires don't discourage you from perusing your goal.

During my security career, it seemed we were always asked to do a security risk assessment just before the project was to go into production. Any suggestions to meet security requirements were met with the response that security was delaying projects and costing the company money. I failed in my attempts to get people to talk to the security team during development. My goal was to help the team deliver the project with security built right in. Unfortunately, my tin badge was rarely welcomed.

The data you are extracting appears to be common in the market place. Like I indicated, Canadian Tire asks me all the time to allow them to verify my location. I know where I am at. I don't want you to know.

I wish you the best in your endeavour and won't delay you further with superfluous questions. I do appreciate your responses just the same.

Sean

It's up to djfraz  to have appropriate disclosure on what they're collecting, why and how it will be used on their site before it is collected. Appropriate regional laws may apply which they'll have to get their own counsel/advice upon. This's nothing to do with us what they do on their own website.