7 ms·

I don't have a security fatigue, but I sure have 'privacy fatigue'. I should worry about Google knowing this and that about me, I should worry about the stupid

I don't have a security fatigue, but I sure have 'privacy fatigue'. I should worry about Google knowing this and that about me, I should worry about the stupid retargeting and the fact that if I do something online, it follows me through the web with banners and "youtube recommendations". And that everything is saved and googlable and everyone can know everything about me. And I used to be worried, but now, I gave up. The assault of the security sucking companies is too high - Facebook and Google has the best engineers and everyone loves their open source code - and it's just way too convenient. Sorry for unrelated ranting.

Balgair 10y ago
No, it is ok. I think we all feel this way. Most HN readers are familiar with many of the 'leaks' and various 1984-esque things happening in our world. I'd say a lot of us are uncomfortable around the Amazon Alexa devices, let alone the actual govtech face readers. I'm not saying that there is anything to be/not to be 'done' about it. I'm just saying that you are not alone in this feeling.
mastazi 10y ago
> I don't have a security fatigue, but I sure have 'privacy fatigue'. Exactly, it would be good if there was some relevant research about the how perception of privacy issues influences users behaviour, in relation to businesses (e.g. Google, Facebook) and state actors (governments). The linked article explains that security fatigue has a cost on the economy; maybe if there was a similar conclusion about "privacy fatigue", that could lead to a healthy debate and, ultimately, (I know, I'm dreaming here) better privacy laws.
walterbell 10y ago
Some people have not given up. Home broadband now exceeds yesteryear expensive symmetric T1 lines. Cheap virtualization-capable small server hardware (Dell T20, Lenovo TS140) + free hypervisors allow self-hosting of OSS services which can replace/supplement commercial vendors and perform network filtering and DPI/IDS to reduce tracking. A pfSense VPN VM can make self-hosted services and filtering available to mobile devices and laptops. After turning off iCloud and other settings, iOS is reasonably respectful of user policy and informed consent. A one-time admin cost per year (iOS major version lifetime).
- mastazi 10y ago
  True, it is awesome to build your own home-server, as long as you are a bit tech-savvy (and have a good broadband connection). One good place to find self-hosted equivalents of popular online services is https://selfhosted.libhunt.com/ https://selfhosted.libhunt.com/
  - nickpsecurity 10y ago
    Thanks for that! I try to collect these sites.
  - pikzen 10y ago
    As an aside, this website is a direct copy of the content from https://github.com/Kickball/awesome-selfhosted https://github.com/Kickball/awesome-selfhosted and I know the guys over there have a bit of an issue with how libhunt licence things on their website. (See this issue https://github.com/Kickball/awesome-selfhosted/issues/465 https://github.com/Kickball/awesome-selfhosted/issues/465 )
    - mastazi 10y ago
      Ouch, I did not know that! Thanks for sharing. I will start linking this one instead.
iamshs 10y ago
A related Google story:- In Canada, I used to have a rooted nexus device which used to be my daily driver until I choose to switch over to Apple around 2 (maybe 3) or so years back. Before moving to Australia, I totally wiped it all up, and yesterday fired it up and setup a fake email account on Gmail to access Play store. It does not have a SIM card, but the fake email account asked for my Phone Number verification, and had my Canadian number already pre-filled. I was totally creeped out. I am out of explanation, except maybe connecting to my Canadian Wi-Fi address after wiping it all up (But wifi was used by 5 other people too). I have never used it to call anyone up after wiping it, and haven't had SIM card in it since. It runs Cyanogen too. You cannot deceive Google, it is futile. I will just stop at running ublock origin and ghostery in my browser, until they deceive me too. Nowadays, you cannot even create an email account on gmail or outlook without giving away your phone number. The scale is not titled towards us.
- throway4565 10y ago
  easy way to know if they know about your other accounts is if they ask you if it was you who logged into your account when you log in with another ip/device. Say it wasn't you.
- PhantomGremlin 10y ago
  Nowadays, you cannot even create an email account on gmail or outlook without giving away your phone number. Do you plan on staying in one location, using the same IP address, for the rest of your life? If not, then gmail will occasionally force you to use your phone number to "verify" that it's you. Of course, in fact what they really want to confirm is the association between your email and your phone. This just happened to me a few days ago. I flew out of town. I logged in from a different city, Google forced me to verify by sending an SMS to my phone.
  - chupasaurus 10y ago
    Google doesn't block access if you haven't activated 2FA, but that page asking of link to my phone number is annoying me since it's first appearance. Dear devs, sales managers etc.: if your user made a decision respect it and not try to ask him directly if he had changed his mind every single time he uses your product, you have other tools to do that rather than yet another page which I always click "Nope" on it.
unabridged 10y ago
I've just come to accept that my ISP and their backbone providers keep a list every server I've ever connected to. That google keeps a list of everything I've searched, every video I've watched, every link I clicked, and every ip address I've logged in from. That my phone maker, my service provider, and google keep a list of every GPS coordinate I've ever visited. That facebook keeps track of every picture I've looked at. ... And I accept that a high enough ranking employee at these companies can view this information at will. And that the US government has a copy of all this data too.
- throway4565 10y ago
  Don't accept it. Use VPN in a VM with firefox. That way each VM/service has its own ip address and own env. It takes a bit of setting up but you get used to it. Otherwise, those who do use Tor or other anonymity techniques will be targeted.
  - Ar-Curunir 10y ago
    Qubes OS does this, right?
- developer2 10y ago
  >> I accept that a high enough ranking employee at these companies can view this information at will At a huge number of companies, every junior dev on their first day of work gets full access to production database servers. The reality is that once you make any piece of information available to any web server, assume it can be found in anyone's hands within an hour. That's the reality. The secret is to not care, and live life not worrying about it.
  - TheAceOfHearts 10y ago
    Is this true for any of the big tech companies? I have friends at Google and IBM, and they've both told me that getting access to production databases is extremely challenging. I wonder what it's like at Facebook, Twitter, Snapchat, etc.
Bartweiss 10y ago
Learning about browser/machine fingerprinting is what finally broke me. I block ads, fight script execution, and enforce SSL, but it was one bridge too far. I can't conceal every trace of what my browser is sending, no matter what I do, and so I just accept that I'll be tracked. On mobile, I turn off location, but I use Gmail and Android and Google search and I can't pretend I actually have any privacy left. Realistically, I don't see a way out worth taking. And here I am preaching the value of privacy, but that's not the same as being able to make it happen.
- scarmig 10y ago
  I'm not sure the big companies actually track you based on browser/machine fingerprinting. It's certainly entirely possible that they could, but it's relatively expensive to develop and maintain the infrastructure that does so, all to track a bunch of paranoids who aren't lucrative subjects of targeted advertising. Sort of a cold comfort, I know.
  - xenobioticants 10y ago
    Also, you're not fighting for the/your privacy of today- you're fighting for tomorrow's privacy. Facebook is scummy with your data, but Google (who knows hell of a lot more about you) is pretty nice with your data. The problems start when they won't be. Google knows what you buy, what's on your mind, which apps you open during the day and when, which people you have contact with and how often and when, they have your e-mail, they have your location and your usual routes, where you work and live. They also have aggregate data about stuff like traffic flow, festivals, businesses, etc. etc. Now imagine them selling this data to the highest bidders. Insurance will know if you sport or not, if you eat healthy, if you smoke, etc.. Other companies will spring up that buy data to check if you were really sick for work, or just slacking (and businesses then buy this service for a price). Advertisers would sell their kids, mother and grandmother's soul for access to this kind of data. You think impulse-buy-optimization of supermarkets is bad? oh boy.. So yeah, fight the good fight, even if its a bit of a hassle, and slightly more expensive. You can actually find a good balance between privacy and usability. I use Protonmail for my mail, Apple Maps for my mapping needs (Google Maps as backup, sparingly), DuckDuckGo for search, Lastpass for passwords and iOS (Android is mined HARD by Google) + OS X as my OSes. Linux is even better, but you're constantly tweaking or fixing small things.
rrggrr 10y ago
Today Google warned me about re-use of a password And woke me from my absent minded state. I am grateful, impressed and freaked out.
orthagnol 10y ago
The NSA interviews is worth a watch: https://www.youtube.com/watch?v=JtTi867iOlc https://www.youtube.com/watch?v=JtTi867iOlc

Balgair 10y ago

No, it is ok. I think we all feel this way. Most HN readers are familiar with many of the 'leaks' and various 1984-esque things happening in our world. I'd say a lot of us are uncomfortable around the Amazon Alexa devices, let alone the actual govtech face readers. I'm not saying that there is anything to be/not to be 'done' about it. I'm just saying that you are not alone in this feeling.

mastazi 10y ago

> I don't have a security fatigue, but I sure have 'privacy fatigue'. Exactly, it would be good if there was some relevant research about the how perception of privacy issues influences users behaviour, in relation to businesses (e.g. Google, Facebook) and state actors (governments). The linked article explains that security fatigue has a cost on the economy; maybe if there was a similar conclusion about "privacy fatigue", that could lead to a healthy debate and, ultimately, (I know, I'm dreaming here) better privacy laws.

walterbell 10y ago

Some people have not given up. Home broadband now exceeds yesteryear expensive symmetric T1 lines. Cheap virtualization-capable small server hardware (Dell T20, Lenovo TS140) + free hypervisors allow self-hosting of OSS services which can replace/supplement commercial vendors and perform network filtering and DPI/IDS to reduce tracking. A pfSense VPN VM can make self-hosted services and filtering available to mobile devices and laptops. After turning off iCloud and other settings, iOS is reasonably respectful of user policy and informed consent. A one-time admin cost per year (iOS major version lifetime).

mastazi 10y ago
True, it is awesome to build your own home-server, as long as you are a bit tech-savvy (and have a good broadband connection). One good place to find self-hosted equivalents of popular online services is https://selfhosted.libhunt.com/ https://selfhosted.libhunt.com/
- nickpsecurity 10y ago
  Thanks for that! I try to collect these sites.
- pikzen 10y ago
  As an aside, this website is a direct copy of the content from https://github.com/Kickball/awesome-selfhosted https://github.com/Kickball/awesome-selfhosted and I know the guys over there have a bit of an issue with how libhunt licence things on their website. (See this issue https://github.com/Kickball/awesome-selfhosted/issues/465 https://github.com/Kickball/awesome-selfhosted/issues/465 )
  - mastazi 10y ago
    Ouch, I did not know that! Thanks for sharing. I will start linking this one instead.

iamshs 10y ago

A related Google story:- In Canada, I used to have a rooted nexus device which used to be my daily driver until I choose to switch over to Apple around 2 (maybe 3) or so years back. Before moving to Australia, I totally wiped it all up, and yesterday fired it up and setup a fake email account on Gmail to access Play store. It does not have a SIM card, but the fake email account asked for my Phone Number verification, and had my Canadian number already pre-filled. I was totally creeped out. I am out of explanation, except maybe connecting to my Canadian Wi-Fi address after wiping it all up (But wifi was used by 5 other people too). I have never used it to call anyone up after wiping it, and haven't had SIM card in it since. It runs Cyanogen too. You cannot deceive Google, it is futile. I will just stop at running ublock origin and ghostery in my browser, until they deceive me too. Nowadays, you cannot even create an email account on gmail or outlook without giving away your phone number. The scale is not titled towards us.

throway4565 10y ago
easy way to know if they know about your other accounts is if they ask you if it was you who logged into your account when you log in with another ip/device. Say it wasn't you.
PhantomGremlin 10y ago
Nowadays, you cannot even create an email account on gmail or outlook without giving away your phone number. Do you plan on staying in one location, using the same IP address, for the rest of your life? If not, then gmail will occasionally force you to use your phone number to "verify" that it's you. Of course, in fact what they really want to confirm is the association between your email and your phone. This just happened to me a few days ago. I flew out of town. I logged in from a different city, Google forced me to verify by sending an SMS to my phone.
- chupasaurus 10y ago
  Google doesn't block access if you haven't activated 2FA, but that page asking of link to my phone number is annoying me since it's first appearance. Dear devs, sales managers etc.: if your user made a decision respect it and not try to ask him directly if he had changed his mind every single time he uses your product, you have other tools to do that rather than yet another page which I always click "Nope" on it.

unabridged 10y ago

I've just come to accept that my ISP and their backbone providers keep a list every server I've ever connected to. That google keeps a list of everything I've searched, every video I've watched, every link I clicked, and every ip address I've logged in from. That my phone maker, my service provider, and google keep a list of every GPS coordinate I've ever visited. That facebook keeps track of every picture I've looked at. ... And I accept that a high enough ranking employee at these companies can view this information at will. And that the US government has a copy of all this data too.

throway4565 10y ago
Don't accept it. Use VPN in a VM with firefox. That way each VM/service has its own ip address and own env. It takes a bit of setting up but you get used to it. Otherwise, those who do use Tor or other anonymity techniques will be targeted.
- Ar-Curunir 10y ago
  Qubes OS does this, right?
developer2 10y ago
>> I accept that a high enough ranking employee at these companies can view this information at will At a huge number of companies, every junior dev on their first day of work gets full access to production database servers. The reality is that once you make any piece of information available to any web server, assume it can be found in anyone's hands within an hour. That's the reality. The secret is to not care, and live life not worrying about it.
- TheAceOfHearts 10y ago
  Is this true for any of the big tech companies? I have friends at Google and IBM, and they've both told me that getting access to production databases is extremely challenging. I wonder what it's like at Facebook, Twitter, Snapchat, etc.

Bartweiss 10y ago

Learning about browser/machine fingerprinting is what finally broke me. I block ads, fight script execution, and enforce SSL, but it was one bridge too far. I can't conceal every trace of what my browser is sending, no matter what I do, and so I just accept that I'll be tracked. On mobile, I turn off location, but I use Gmail and Android and Google search and I can't pretend I actually have any privacy left. Realistically, I don't see a way out worth taking. And here I am preaching the value of privacy, but that's not the same as being able to make it happen.

scarmig 10y ago
I'm not sure the big companies actually track you based on browser/machine fingerprinting. It's certainly entirely possible that they could, but it's relatively expensive to develop and maintain the infrastructure that does so, all to track a bunch of paranoids who aren't lucrative subjects of targeted advertising. Sort of a cold comfort, I know.
- xenobioticants 10y ago
  Also, you're not fighting for the/your privacy of today- you're fighting for tomorrow's privacy. Facebook is scummy with your data, but Google (who knows hell of a lot more about you) is pretty nice with your data. The problems start when they won't be. Google knows what you buy, what's on your mind, which apps you open during the day and when, which people you have contact with and how often and when, they have your e-mail, they have your location and your usual routes, where you work and live. They also have aggregate data about stuff like traffic flow, festivals, businesses, etc. etc. Now imagine them selling this data to the highest bidders. Insurance will know if you sport or not, if you eat healthy, if you smoke, etc.. Other companies will spring up that buy data to check if you were really sick for work, or just slacking (and businesses then buy this service for a price). Advertisers would sell their kids, mother and grandmother's soul for access to this kind of data. You think impulse-buy-optimization of supermarkets is bad? oh boy.. So yeah, fight the good fight, even if its a bit of a hassle, and slightly more expensive. You can actually find a good balance between privacy and usability. I use Protonmail for my mail, Apple Maps for my mapping needs (Google Maps as backup, sparingly), DuckDuckGo for search, Lastpass for passwords and iOS (Android is mined HARD by Google) + OS X as my OSes. Linux is even better, but you're constantly tweaking or fixing small things.

rrggrr 10y ago

Today Google warned me about re-use of a password And woke me from my absent minded state. I am grateful, impressed and freaked out.

orthagnol 10y ago

The NSA interviews is worth a watch: https://www.youtube.com/watch?v=JtTi867iOlc https://www.youtube.com/watch?v=JtTi867iOlc