7 ms·

What is the fear here? I'm not talking about shady apps you downloaded off some dodgy pirated Android app store, or apps where you agree to this sort of tracki

What is the fear here? I'm not talking about shady apps you downloaded off some dodgy pirated Android app store, or apps where you agree to this sort of tracking so you get free apps (e.g. Amazon Underground, which the author is using). I mean - official apps such as Twitter, Snapchat, or say Microsoft or Google applications. Can anybody quantify what they are scared of, if an app tracks how often you use it, or collects anonymised metrics?

pipermerriam 11y ago
This sounds awful similar to the "Nothing to hide argument". People have a right to privacy and shouldn't have to provide a reason why they deserve it. Tracking should always be opt-in. https://en.wikipedia.org/wiki/Nothing_to_hide_argument https://en.wikipedia.org/wiki/Nothing_to_hide_argument
- victorhooi 11y ago
  This isn't so much about nothing to hide - but more about doing a costs/benefits analysis. I mean - most people here use webapps - whether it's HackerNews - or more mainstream ones like Reddit, Instagram etc. We assume that the webapp developers know when we use their services - after all, it's hosted on their servers. If you were super paranoid, you could run your own "cloud" services - your own email service, your own document sharing service, your own image sharing service etc. However, for most people the cost/benefits analysis simply isn't worth it. Apps like Twitter, Instagram, Google Docs, GMail etc are popular precisely because people figure the utility outweights any "fears" they might have over those scary developers tracking their usage. In a comment above, I provided a concrete example of where telemetry data is useful: "I worked at a trading company before, and one of the reasons we pushed out telemetry was due to user's feature requests - users would request features, and we wanted to see if they were actually using them, so that we could prioritise developer time accordingly." Or the same reason most people don't use encrypted email (currently). I mean, come on - you're storing your data on their servers - there's got to be some trust there. So my question remains - what is the fear here?
eps 11y ago
"Scared"? Will I be "scared" if a guest at my house is live-streaming his stay to the Internet without my knowledge or approval? Hell, no. I'll be pissed. Now, that's exactly naive, careless and fundamentally ignorant comment that the erosion of privacy is all about. You seem to genuienly think that tracking is not just acceptable, but a norm in some situatioons. Not just several years ago if an OS or an app phoned home it was a scandal. It was commonly accepted that your gadget was yours, and anything running on it was a guest that had to follow some decency and basic etiquette norms. Theh, the push started - can we report this, just once? Can we report that, weekly? We'll call it a "telemetry", it's less scary that way. Perhaps you are getting tired of pushing OK, shall we do it automatically? OK, so we'll now just default to automatic. and make it hard to disable. Heck, we'll just build it in, because nobody now seems to be giving a fuck anyway. But here's the best part - we now even have users who are campaigning on our behalf to not give a fuck. That's just grand.
- victorhooi 11y ago
  Yes, but you avoided my question - what exactly is the fear here? As in, is there a particular type of data, or information about your app usage that you don't want developers having access to? I worked at a trading company before, and one of the reasons we pushed out telemetry was due to user's feature requests - users would request features, and we wanted to see if they were actually using them, so that we could prioritise developer time accordingly. That is a concrete example of how this data is useful. I am curious about any concrete examples from the other side.
  - thetmkay 11y ago
    Why does it have to be fear, rather than preference? Maybe there's no data you're afraid of leaking, but you would prefer never to leak that data. It's a consumer choice - the problem here is lack of transparency/information to the consumer. The cultural standard is what we accept to be appropriate - do we want to accept a cultural standard of everything you use is tracked and logged by default?
    - 11y ago
forgotmypassw 11y ago
Because the moment you willingly let an application collect your data, you're no longer the user of the application, you're now a product of the company that owns the application. Also what @pipermerriam said: >People have a right to privacy and shouldn't have to provide a reason why they deserve it. Tracking should always be opt-in.
- victorhooi 11y ago
  Yes, but many peopel use webapps - whether they be Gmail, Reddit, Instagram, Twitter and mobile apps. I mean, the damn webapp/apps already have your data. There's an implicit trust there. Why do you think webapps are doing so much better than heavy desktop apps? Because people figure the benefits outweigh the risks. Just off the top of my head: * Reliable distributed backups of your data, without having to do it yourself * Ability to share easily with anybody on the web * No costs for running your own servers * Less technical knowledge required - e.g. have you tried setting up your own email server? And actually sending email reliably? I don't think we should assume, in our ivory towers, that people are somehow "stupid" - is there a concrete fear here? If so, is it something we think they are unaware of?
- hilbertseries 11y ago
  This isn't always true. A lot of companies collect data on their users that they use internally and don't sell to third party sources. Pretty much any large app, even paid apps collects usage data etc in order to better understand their user base and optimize their app.
nitrogen 11y ago
Your repeated use of the word "fear" throughout this thread after numerous commenters have explained why "fear" has nothing to do with it seems manipulative and disingenuous. There are other motivations in life beside fear -- aspiration, ambition, preference, etc. Constantly trying to turn the conversation back to "fear" suggests you are the one who is afraid. And the burden of proof lies with the one making the claim (as you imply) that there is nothing to fear. So what scares you so much about a world in which privacy is a virtue to be embraced?
- victorhooi 11y ago
  Err, what am I "afraid" of? That application developers won't collect usage data about me? =) I have asked numerous times for the use cases that people are worried/fearful/concerned of - this was an honest enquiry. However, nobody seems to be able to answer it. Let me tackle the things you mentioned - aspiration, ambition, preference etc. Yes, it is certainly true that some users would have the aspirations to create their own web-based email (a la Gmail), or file-storage service (a la Dropbox), or their own photo-sharing service (a la Instagram), or their own social network. However, I should point out two things. Firstly, the stark popularity of those services would seem to suggest that for most people, they have done the cost/benefits analysis, and figured out it doesn't make sense. The effort involve simply doesn't make sense for them. The whole point of webapps and most mobile apps is that they store data remotely on some service - I would posit this would be a far greater concern (if you didn't trust the app developers) than whether they knew how often you opened their app, or which features I used. Secondly - let's be honest, most of us couldn't create our own GMail, Dropbox, or Instagram even if we did have "aspirations, ambitions, preferences" to do so. We simply don't have the technical know-how, time and/or experience to do anything remotely approaching their usability, performance, reliability or collaboration features - or their scale. There is an enormous amount of engineering effort that goes into any of these services - and most people are willing to buy into the whole web-based application thing, in order to take advantage of that. I am open to being convinced otherwise - but I have yet to see a reason why the majority of people would buy into web-apps/mobile apps, and have fundamentally miscalculated the cost/benefits.
  - 11y ago
Jach 11y ago
I think a lot of it isn't fear, it's simply the "none of your [the company's] damn business" mentality. Yes your metrics probably help you make a slightly better product (at least measuring by the metrics...) -- but I don't care. Make it better another way, this other thing is none of your damn business, your business is what I'm using you for. I'm skeptical you really need this data, at least from me. (And for many things I've experienced a noticeable decline in the goodness of the thing as it evolves despite all the data and metrics and modelling that I'm sure has been accumulated.) It'd be nice if you [the business] would remember that if I'm using you, you're good enough as-is, and while you may be able to infer some of my pain points that I'm not even aware of, you could just ask me, but realize the act of asking is going to be seen against you because I assume by default my feedback will go ignored or at best be put on some team's P3 backlog/bucket list to never actually get done. I just have no trust in feedback being considered important and acted upon unless I'm in contact with someone with a name and the power to do anything. So we can play cat-and-mouse (I use noscript and ublock on my gentoo box, I find that mostly sufficient), I can feed you bad data, or hey maybe I just accept the state of the world and use chrome beta on my unrooted Samsung phone and buy from amazon and install and use other crap apps because while it's none of your business what my GPS coordinates are pretty much unless you're map related, your main business is still awfully convenient, and this pocket computer is awfully convenient even if it can and should be so much more than the default software ecosystem lets it be. Also because I default to giving you a benefit of the doubt, if not really trusting you, on most things until you betray that placed by me or others (Sony, Lenovo have done so in my book). And at last yeah there's not much that scares me personally about you having most of the data you could have that's not your business. Some examples that might concern others, though, just on unnecessary GPS data: perhaps you have a rogue employee who has made this anonymized data less so for personal reasons (like knowing when I'm away from home to rob me), or perhaps you show me an ad for a business I've walked/driven by but never entered and while such an ad may locally be a net gain for all parties involved it's nevertheless seen as one more brick in the concerning ongoing perverse transformation of the world into a temple for Mammon. [Ed: note this rant is mostly about other data like GPS, but usage any more sophisticated than things like installed, uninstalled, used for x time, no longer used, can pretty quickly get into the territory of "you, game company, have no business knowing I'm playing your game at 2am on a weeknight [in my house?] and thus can arrange an ad for sleeping pills." I love the concept of Underground, knew about the usage tracking on day one, and have several apps.]
greggman 11y ago
How about we try to figure out what things you could possible use this info for. Maybe these are BS or strawmen, I'm just making them up to see if they stick. Please feel free to tell me they don't hold up to scrutiny. If I was the RIAA I might want to know if you use VLC more than someone else. Then I can target your known IP addresses to see if can catch you downloading something you shouldn't If I wanted to hack you email and I could find out which email client you're using I could target known exploits at you. If I saw you used a Tor browser the DEA or NSA or FBI might be more interested in you. If your usage correlated with events in the real world I might want to investigate of there's a connection If I saw you using Tinder and I know you're married I might try to out you or if you're using Ashley Madison I could try to blackmail you. If I saw you were using some financial app a lot I might assume you've got more money than someone who's not, on average. You're better to rob or better to sell to or better to hit up for donations. If I see you're using the RedFin app I can start serving ads for housing loans. If I see you're using the linkedin app app your employer might be interested to see if that means you're considering leaving. I don't know which of those are more of a problem on the phone than on the web in general. Seems to me if I access those services from a website I can try to be anonymous. Use different email addys, maybe use a VPN. But my phone is almost guaranteed to be tied directly to me. Just thinking out loud. Feel free to tell me I'm missing something.
- victorhooi 11y ago
  I appreciate you taking the time to enumerate those examples. Several of them are certainly plausible. However, after reading through them, the majority seem to be from the perspective of an external attacker. That is - the issue here isn't if say, Dropbox knows how you use their app, or Twitter knows how you use their own app - but rather if an external party broke in, and used that data maliciously. I agree that is an issue - but then it becomes more of an InfoSec issue, than one of a company collecting data from its own apps. Then it boils down to - do you trust that company/services security staff, to keep the data they collect secure? I think for most people - if you weigh up the chance of a wide-scale break-in at say, Twitter, or Instagram versus their own data-security hygiene, chances are, it's much easier to hack a user, as opposed to break into a large-scale webapp and steal all of their data. Not impossible - but when was the last time you heard of somebody breaking into say, Github or Instagram, and stealing data? Even something like 2FA isn't that easy to implement securely - and when a company like Google or Github does it for you, I think that's a net-win for security.
krakensden 11y ago
Oh look, a Google employee throwing shade at privacy concerns.
- dang 11y ago
  > Oh look, a Google employee throwing shade at privacy concerns. Personal attacks are not allowed on Hacker News. Please don't do this here.

pipermerriam 11y ago

This sounds awful similar to the "Nothing to hide argument". People have a right to privacy and shouldn't have to provide a reason why they deserve it. Tracking should always be opt-in. https://en.wikipedia.org/wiki/Nothing_to_hide_argument https://en.wikipedia.org/wiki/Nothing_to_hide_argument

victorhooi 11y ago
This isn't so much about nothing to hide - but more about doing a costs/benefits analysis. I mean - most people here use webapps - whether it's HackerNews - or more mainstream ones like Reddit, Instagram etc. We assume that the webapp developers know when we use their services - after all, it's hosted on their servers. If you were super paranoid, you could run your own "cloud" services - your own email service, your own document sharing service, your own image sharing service etc. However, for most people the cost/benefits analysis simply isn't worth it. Apps like Twitter, Instagram, Google Docs, GMail etc are popular precisely because people figure the utility outweights any "fears" they might have over those scary developers tracking their usage. In a comment above, I provided a concrete example of where telemetry data is useful: "I worked at a trading company before, and one of the reasons we pushed out telemetry was due to user's feature requests - users would request features, and we wanted to see if they were actually using them, so that we could prioritise developer time accordingly." Or the same reason most people don't use encrypted email (currently). I mean, come on - you're storing your data on their servers - there's got to be some trust there. So my question remains - what is the fear here?

eps 11y ago

"Scared"? Will I be "scared" if a guest at my house is live-streaming his stay to the Internet without my knowledge or approval? Hell, no. I'll be pissed. Now, that's exactly naive, careless and fundamentally ignorant comment that the erosion of privacy is all about. You seem to genuienly think that tracking is not just acceptable, but a norm in some situatioons. Not just several years ago if an OS or an app phoned home it was a scandal. It was commonly accepted that your gadget was yours, and anything running on it was a guest that had to follow some decency and basic etiquette norms. Theh, the push started - can we report this, just once? Can we report that, weekly? We'll call it a "telemetry", it's less scary that way. Perhaps you are getting tired of pushing OK, shall we do it automatically? OK, so we'll now just default to automatic. and make it hard to disable. Heck, we'll just build it in, because nobody now seems to be giving a fuck anyway. But here's the best part - we now even have users who are campaigning on our behalf to not give a fuck. That's just grand.

victorhooi 11y ago
Yes, but you avoided my question - what exactly is the fear here? As in, is there a particular type of data, or information about your app usage that you don't want developers having access to? I worked at a trading company before, and one of the reasons we pushed out telemetry was due to user's feature requests - users would request features, and we wanted to see if they were actually using them, so that we could prioritise developer time accordingly. That is a concrete example of how this data is useful. I am curious about any concrete examples from the other side.
- thetmkay 11y ago
  Why does it have to be fear, rather than preference? Maybe there's no data you're afraid of leaking, but you would prefer never to leak that data. It's a consumer choice - the problem here is lack of transparency/information to the consumer. The cultural standard is what we accept to be appropriate - do we want to accept a cultural standard of everything you use is tracked and logged by default?
  - 11y ago

forgotmypassw 11y ago

Because the moment you willingly let an application collect your data, you're no longer the user of the application, you're now a product of the company that owns the application. Also what @pipermerriam said: >People have a right to privacy and shouldn't have to provide a reason why they deserve it. Tracking should always be opt-in.

victorhooi 11y ago
Yes, but many peopel use webapps - whether they be Gmail, Reddit, Instagram, Twitter and mobile apps. I mean, the damn webapp/apps already have your data. There's an implicit trust there. Why do you think webapps are doing so much better than heavy desktop apps? Because people figure the benefits outweigh the risks. Just off the top of my head: * Reliable distributed backups of your data, without having to do it yourself * Ability to share easily with anybody on the web * No costs for running your own servers * Less technical knowledge required - e.g. have you tried setting up your own email server? And actually sending email reliably? I don't think we should assume, in our ivory towers, that people are somehow "stupid" - is there a concrete fear here? If so, is it something we think they are unaware of?
hilbertseries 11y ago
This isn't always true. A lot of companies collect data on their users that they use internally and don't sell to third party sources. Pretty much any large app, even paid apps collects usage data etc in order to better understand their user base and optimize their app.

nitrogen 11y ago

Your repeated use of the word "fear" throughout this thread after numerous commenters have explained why "fear" has nothing to do with it seems manipulative and disingenuous. There are other motivations in life beside fear -- aspiration, ambition, preference, etc. Constantly trying to turn the conversation back to "fear" suggests you are the one who is afraid. And the burden of proof lies with the one making the claim (as you imply) that there is nothing to fear. So what scares you so much about a world in which privacy is a virtue to be embraced?

victorhooi 11y ago
Err, what am I "afraid" of? That application developers won't collect usage data about me? =) I have asked numerous times for the use cases that people are worried/fearful/concerned of - this was an honest enquiry. However, nobody seems to be able to answer it. Let me tackle the things you mentioned - aspiration, ambition, preference etc. Yes, it is certainly true that some users would have the aspirations to create their own web-based email (a la Gmail), or file-storage service (a la Dropbox), or their own photo-sharing service (a la Instagram), or their own social network. However, I should point out two things. Firstly, the stark popularity of those services would seem to suggest that for most people, they have done the cost/benefits analysis, and figured out it doesn't make sense. The effort involve simply doesn't make sense for them. The whole point of webapps and most mobile apps is that they store data remotely on some service - I would posit this would be a far greater concern (if you didn't trust the app developers) than whether they knew how often you opened their app, or which features I used. Secondly - let's be honest, most of us couldn't create our own GMail, Dropbox, or Instagram even if we did have "aspirations, ambitions, preferences" to do so. We simply don't have the technical know-how, time and/or experience to do anything remotely approaching their usability, performance, reliability or collaboration features - or their scale. There is an enormous amount of engineering effort that goes into any of these services - and most people are willing to buy into the whole web-based application thing, in order to take advantage of that. I am open to being convinced otherwise - but I have yet to see a reason why the majority of people would buy into web-apps/mobile apps, and have fundamentally miscalculated the cost/benefits.
- 11y ago

Jach 11y ago

I think a lot of it isn't fear, it's simply the "none of your [the company's] damn business" mentality. Yes your metrics probably help you make a slightly better product (at least measuring by the metrics...) -- but I don't care. Make it better another way, this other thing is none of your damn business, your business is what I'm using you for. I'm skeptical you really need this data, at least from me. (And for many things I've experienced a noticeable decline in the goodness of the thing as it evolves despite all the data and metrics and modelling that I'm sure has been accumulated.) It'd be nice if you [the business] would remember that if I'm using you, you're good enough as-is, and while you may be able to infer some of my pain points that I'm not even aware of, you could just ask me, but realize the act of asking is going to be seen against you because I assume by default my feedback will go ignored or at best be put on some team's P3 backlog/bucket list to never actually get done. I just have no trust in feedback being considered important and acted upon unless I'm in contact with someone with a name and the power to do anything. So we can play cat-and-mouse (I use noscript and ublock on my gentoo box, I find that mostly sufficient), I can feed you bad data, or hey maybe I just accept the state of the world and use chrome beta on my unrooted Samsung phone and buy from amazon and install and use other crap apps because while it's none of your business what my GPS coordinates are pretty much unless you're map related, your main business is still awfully convenient, and this pocket computer is awfully convenient even if it can and should be so much more than the default software ecosystem lets it be. Also because I default to giving you a benefit of the doubt, if not really trusting you, on most things until you betray that placed by me or others (Sony, Lenovo have done so in my book). And at last yeah there's not much that scares me personally about you having most of the data you could have that's not your business. Some examples that might concern others, though, just on unnecessary GPS data: perhaps you have a rogue employee who has made this anonymized data less so for personal reasons (like knowing when I'm away from home to rob me), or perhaps you show me an ad for a business I've walked/driven by but never entered and while such an ad may locally be a net gain for all parties involved it's nevertheless seen as one more brick in the concerning ongoing perverse transformation of the world into a temple for Mammon. [Ed: note this rant is mostly about other data like GPS, but usage any more sophisticated than things like installed, uninstalled, used for x time, no longer used, can pretty quickly get into the territory of "you, game company, have no business knowing I'm playing your game at 2am on a weeknight [in my house?] and thus can arrange an ad for sleeping pills." I love the concept of Underground, knew about the usage tracking on day one, and have several apps.]

greggman 11y ago

How about we try to figure out what things you could possible use this info for. Maybe these are BS or strawmen, I'm just making them up to see if they stick. Please feel free to tell me they don't hold up to scrutiny. If I was the RIAA I might want to know if you use VLC more than someone else. Then I can target your known IP addresses to see if can catch you downloading something you shouldn't If I wanted to hack you email and I could find out which email client you're using I could target known exploits at you. If I saw you used a Tor browser the DEA or NSA or FBI might be more interested in you. If your usage correlated with events in the real world I might want to investigate of there's a connection If I saw you using Tinder and I know you're married I might try to out you or if you're using Ashley Madison I could try to blackmail you. If I saw you were using some financial app a lot I might assume you've got more money than someone who's not, on average. You're better to rob or better to sell to or better to hit up for donations. If I see you're using the RedFin app I can start serving ads for housing loans. If I see you're using the linkedin app app your employer might be interested to see if that means you're considering leaving. I don't know which of those are more of a problem on the phone than on the web in general. Seems to me if I access those services from a website I can try to be anonymous. Use different email addys, maybe use a VPN. But my phone is almost guaranteed to be tied directly to me. Just thinking out loud. Feel free to tell me I'm missing something.

victorhooi 11y ago
I appreciate you taking the time to enumerate those examples. Several of them are certainly plausible. However, after reading through them, the majority seem to be from the perspective of an external attacker. That is - the issue here isn't if say, Dropbox knows how you use their app, or Twitter knows how you use their own app - but rather if an external party broke in, and used that data maliciously. I agree that is an issue - but then it becomes more of an InfoSec issue, than one of a company collecting data from its own apps. Then it boils down to - do you trust that company/services security staff, to keep the data they collect secure? I think for most people - if you weigh up the chance of a wide-scale break-in at say, Twitter, or Instagram versus their own data-security hygiene, chances are, it's much easier to hack a user, as opposed to break into a large-scale webapp and steal all of their data. Not impossible - but when was the last time you heard of somebody breaking into say, Github or Instagram, and stealing data? Even something like 2FA isn't that easy to implement securely - and when a company like Google or Github does it for you, I think that's a net-win for security.

krakensden 11y ago

Oh look, a Google employee throwing shade at privacy concerns.

dang 11y ago
> Oh look, a Google employee throwing shade at privacy concerns. Personal attacks are not allowed on Hacker News. Please don't do this here.