5 ms·

But don't companies need to collect and retain data to operate their businesses? Like they need your info to bill you, they need info to login to your account,

by Keverw 11y ago

But don't companies need to collect and retain data to operate their businesses? Like they need your info to bill you, they need info to login to your account, your emails stored if you use their included email, etc.

nitrogen 11y ago
Data can be deleted when it's no longer needed. Sale of data can be forbidden. Old data can be encrypted by the customer's public key so only the customer can initiate access. There are many ways to roll back the madness.
- Tinyyy 11y ago
  >customer’s public key The general public has no concept of what a ‘public key’ is.
  - jkestner 11y ago
    So... give up? Solve that problem through better products or education. The general public needs counterprogramming against the government's idea of encryption.
  - rickycook 11y ago
    a "public key" can also just be a secret. "Apple toothpaste monkey piano" is something someone can write down for recovery. they don't need to know; they just need to remember where they put it (which might be a stretch, yes, but it's better than storing things in plain text)
    - incongruity 11y ago
      Actually... that'd be a private key.
- abawany 11y ago
  +1. The data collection greed of corporations and the accompanying utter loss of control for the hapless consumer who is forced to provide said data is very saddening to see. Unfortunately, consumers in this country seem to not give a whit about the immense loss of control they are willingly undergoing. Witness the EFF/T-Mobile Twitter thread as an example where (seemingly few so far) people are agreeing with the TMob CEO and abusing EFF.
pmorici 11y ago
Not nearly as much if you use a payment method like Bitcoin or cash.
madaxe_again 11y ago
Yes, but they don't need to leave it on the porch for anyone to pick up. We hold the details of over 100M consumers, many of them children. This comprises stuff like their login, order history, etc. We take this shit seriously, keep what's needed only, pentest daily, ids, wargames, strict infosec policy - and when clowns like TW manage shit like this we all get tarred with the same brush. Since the talk-talk hack we have had clients panicking at least twice a week over shit they read in the Newspapers. Black Friday when all the ecommerce sites melt is similar - mass panic, at us - even though we've had 100% uptime since may last, and five nines over the year - and have never had any breach of any variety. There should be steep criminal penalties in place for the officers of a company who allow this to happen. Jail. Business-ending fines.
- tajen 11y ago
  US isn't even threatening VW officers of jail time (They've recently announced that it will be a civil lawsuit, not penal). US isn't even threatening HSBC officers of jail time, after 30 years of so-called "war on drugs"...
  - dickbasedregex 11y ago
    Worst case these companies pay some laughable, trivial fine. That's all that will ever happen in the US. Money talks. EVERYTHING else walks.
treenyc 11y ago
Yes, consider using a company that 1. technologically competent (PCI compliant and more) 2. That company can keep that information along with other financial data. 3. That vendor's code and hardware infrastructure is being periodically audited by a third (independent ) party and expert. Or open sourced! Both hardware and software. 3 is crucial to maintain the operating integrity of the company.

by Keverw 11y ago

nitrogen 11y ago

Data can be deleted when it's no longer needed. Sale of data can be forbidden. Old data can be encrypted by the customer's public key so only the customer can initiate access. There are many ways to roll back the madness.

Tinyyy 11y ago
>customer’s public key The general public has no concept of what a ‘public key’ is.
- jkestner 11y ago
  So... give up? Solve that problem through better products or education. The general public needs counterprogramming against the government's idea of encryption.
- rickycook 11y ago
  a "public key" can also just be a secret. "Apple toothpaste monkey piano" is something someone can write down for recovery. they don't need to know; they just need to remember where they put it (which might be a stretch, yes, but it's better than storing things in plain text)
  - incongruity 11y ago
    Actually... that'd be a private key.
abawany 11y ago
+1. The data collection greed of corporations and the accompanying utter loss of control for the hapless consumer who is forced to provide said data is very saddening to see. Unfortunately, consumers in this country seem to not give a whit about the immense loss of control they are willingly undergoing. Witness the EFF/T-Mobile Twitter thread as an example where (seemingly few so far) people are agreeing with the TMob CEO and abusing EFF.

pmorici 11y ago

Not nearly as much if you use a payment method like Bitcoin or cash.

madaxe_again 11y ago

Yes, but they don't need to leave it on the porch for anyone to pick up. We hold the details of over 100M consumers, many of them children. This comprises stuff like their login, order history, etc. We take this shit seriously, keep what's needed only, pentest daily, ids, wargames, strict infosec policy - and when clowns like TW manage shit like this we all get tarred with the same brush. Since the talk-talk hack we have had clients panicking at least twice a week over shit they read in the Newspapers. Black Friday when all the ecommerce sites melt is similar - mass panic, at us - even though we've had 100% uptime since may last, and five nines over the year - and have never had any breach of any variety. There should be steep criminal penalties in place for the officers of a company who allow this to happen. Jail. Business-ending fines.

tajen 11y ago
US isn't even threatening VW officers of jail time (They've recently announced that it will be a civil lawsuit, not penal). US isn't even threatening HSBC officers of jail time, after 30 years of so-called "war on drugs"...
- dickbasedregex 11y ago
  Worst case these companies pay some laughable, trivial fine. That's all that will ever happen in the US. Money talks. EVERYTHING else walks.

treenyc 11y ago

Yes, consider using a company that 1. technologically competent (PCI compliant and more) 2. That company can keep that information along with other financial data. 3. That vendor's code and hardware infrastructure is being periodically audited by a third (independent ) party and expert. Or open sourced! Both hardware and software. 3 is crucial to maintain the operating integrity of the company.