The data analysed by the pair connected a list of sites and links visited to a customer identifier. However, he said, by drawing on public information that people share about their browsing habits, it became possible to connect that entry on a list to an individual.
“With only a few domains you can quickly drill down into the data to just a few users,” he said.
The public information included links people shared via Twitter, YouTube videos they reported watching, news articles they passed on via social media or when they posted online photos of items they bought or places they visited.
In many cases, he said, it was even easier to de-anonymise because the clickstreams contained links to people’s personal social media admin pages which directly revealed their identity.
“The public information available about users is growing so it’s getting easier to find the information to do the de-anonymisation,” he said. “It’s very, very difficult to de-anonymise it even if you have the intention to do so