4 ms·

The principle of least privilege seems very applicable to keeping user data secure from the government. You cannot hand over data that you do not have. If your

The principle of least privilege seems very applicable to keeping user data secure from the government. You cannot hand over data that you do not have. If your business model requires collecting data that would not be conscionable to hand over to the government upon demand, you should seriously reconsider your business model. I'd strongly prefer something based off that rather than the actual pledge. It's fairly easy to lose a legal defense, go back on your pledge to produce a legal defense, or change owners to one not bound by the pledge. It's much more difficult to retroactively collect data.

lazaroclapp 10y ago
> If your business model requires collecting data that would not be conscionable to hand over to the government upon demand, you should seriously reconsider your business model. This is not reasonable in many cases, though. It is surprisingly hard to build many useful services on top of strong zero-knowledge crypto and have them operate in the real world where things like users forgetting their credentials are common occurrences that consumers expect you to be able to recover from. It is also actually impossible to do so when part of the service happens in the physical world (e-commerce, car dispatching apps, etc). In practice, until we solve a few long standing security and HCI problems, I can't envision a world where a large set of private parties doesn't know more about me, collectively, than what I would be comfortable with a hostile enforcement agency knowing and correlating in a single place. Don't get me wrong, I think there is a lot of value in being mindful of which data we are collecting, why and if we can get away with building our software so that we do not need that data. I also think keeping infinite records just because "big data will make them useful in time" ignores the 'toxicity' of huge troves of private data laying around. But even in a world where every company takes extraordinary data handling measures, even against market incentives, I still would want the companies to be very careful about sharing the data they did absolutely need to collect...

lazaroclapp 10y ago

> If your business model requires collecting data that would not be conscionable to hand over to the government upon demand, you should seriously reconsider your business model. This is not reasonable in many cases, though. It is surprisingly hard to build many useful services on top of strong zero-knowledge crypto and have them operate in the real world where things like users forgetting their credentials are common occurrences that consumers expect you to be able to recover from. It is also actually impossible to do so when part of the service happens in the physical world (e-commerce, car dispatching apps, etc). In practice, until we solve a few long standing security and HCI problems, I can't envision a world where a large set of private parties doesn't know more about me, collectively, than what I would be comfortable with a hostile enforcement agency knowing and correlating in a single place. Don't get me wrong, I think there is a lot of value in being mindful of which data we are collecting, why and if we can get away with building our software so that we do not need that data. I also think keeping infinite records just because "big data will make them useful in time" ignores the 'toxicity' of huge troves of private data laying around. But even in a world where every company takes extraordinary data handling measures, even against market incentives, I still would want the companies to be very careful about sharing the data they did absolutely need to collect...