> The site’s only input fields accept license plate numbers (which are hashed client-side before transmission and cannot be harvested)

License plates are trivially short, hashing them accomplishes no additional level of privacy if the hashes could be bruted in seconds on an antique GPU.

▲

creatonez 3 hours ago | parent | next [-]

This might be referring to k-anonymity where you truncate the hash so that it matches about 1000 hashes, then the client matches against that list. Which makes it so the operator can't really narrow down what exact license plates correspond to which searches.

▲

croes 21 hours ago | parent | prev | next [-]

They have indexed publicly available data. The privacy was long gone before you even entered a license plate number. Or do you think other actors didn’t have the same data but without a frontend to show it to you?

▲

VladVladikoff 14 hours ago | parent [-]

Entering your licence plate into this site gives the operator your geodata/ip address tied back to your licence plate.

	▲	croes 7 hours ago \| parent [-]
		Unless you use a VPN to access the site. Flock has your real location on camera.

▲

hibf a day ago | parent | prev | next [-]

Technically true. Flock could present an unfounded argument that I might be brute-forcing my own security and privacy measures.

I think it'd sound pretty dumb.

	▲	VladVladikoff 4 hours ago \| parent \| next [-]
		What about doing it all client side? Or perhaps let the user type one or two characters then fetch that from the server for all matches and do the remaining matching client side. There are ways you could truly isolate yourself from the PII.
	▲	whatshisface a day ago \| parent \| prev [-]
		If the security depends on the person it's supposed to be secure against not trying to break it...

▲

TheDong a day ago | parent | prev | next [-]

Being able to say "Our server never sees user-input license plate numbers", even though from a technical perspective the hash is just as identifiable, does have value. Even though it offers no additional privacy, it does let non-technically-minded users and so on feel safer, and that's valuable.

▲

rockskon 20 hours ago | parent | next [-]

That "value" here lets them mislead policymakers.

▲

63stack 21 hours ago | parent | prev [-]

The value is being able to mislead your users

	▲	EdwardDiego 16 hours ago \| parent [-]
		Sure, Jan.

▲

mceachen 16 hours ago | parent | prev [-]

https://en.wikipedia.org/wiki/Salt_(cryptography)

(Or https://en.wikipedia.org/wiki/Pepper_(cryptography) off you want to be fancy)

	▲	VladVladikoff 14 hours ago \| parent [-]
		Well aware of these, however that would not benefit in this case. Their main protection is against pre computed lookup tables. But since the operator needs to be able to lookup the license plate within their own database, then they would not be using either of these. If the operator really wanted to do this in a safe way for the user then the whole database should exist client side.