10 ms·

I think the article touches upon a key problem: even if some people are in principle willing to sacrifice some privacy in order to get a product for free, it sh

I think the article touches upon a key problem: even if some people are in principle willing to sacrifice some privacy in order to get a product for free, it should be required to state what data is shared with whom in clear human language (and not in a 20 page wall of legalese). The relation between the user and a service is now completely asymmetrical: it is hard to know what your data is used for. It does not help that the legalese often boils down to 'you will sell your soul'.

ricw 9y ago
Free means you are trading your privacy for the service. Unfortunately that is not common knowledge, but it's how the largest part of the internet works. Time to spread the word more aggressively...
- wolfgke 9y ago
  > Free means you are trading your privacy for the service. Exactly. It should be well-known that "If you are not paying for the product, you are the product.".
  - cantagi 9y ago
    That is true. Also, if you are paying for the product, you may still be the product.
    - wolfgke 9y ago
      I did not write "if and only if". :-)
      - cantagi 9y ago
        No worries - I'm not arguing with you :)
- snakeanus 9y ago
  I will have to disagree. In general by paying it means that you have to have some sort of account and that means that they can track you easier. To be frank I believe that the actual solution is to avoid any cloud-based services.
  - TeMPOraL 9y ago
    > To be frank I believe that the actual solution is to avoid any butt-based services. It's a good solution for more than one reason. It also helps you avoid vendor lock-in, prevents from getting stuck with services that get gradually dumbed down in their pursuit of growth at the cost of actual usefulness, and most imporantly, shields you from losing something you depend on because the startup running the service finally got their exit.
    - praneshp 9y ago
      Do you have that extension thing that turns cloud into butt? Nice!
      - TeMPOraL 9y ago
        Yes, it's been turning Internet honest for me for many years now. I'm so used to it that I forget about it every now and then ;).
  - stinkytaco 9y ago
    There's still any number of ways to track you, however: ecommerce, credit card, ISP, email provider, etc. It would be very hard to live in the modern world without some of those tools, and few of them have any privacy or data protection guarantee attached.
    - problems 9y ago
      Sure, but you can do a lot. If you pay a dedicated server or colocation provider to host hardware you own, they have a lot less access to your stuff than if you say, use a cloud VM provider, which is in itself at least better than using an SaaS-type solution where you're 1 database query away from fucked and with paid SaaS you're still miles better than free services where selling your data is the only means to pay for the service and to profit. It really depends on what sort of tracking you're most concerned about though. If you're concerned about facebook or similar having your pictures and messages then a solution like this is a good option. Yes, your provider knows it's you, but unless they've invested serious effort backdooring your hardware, they can't tell what you send over SSL'd connections, they can't tell what people visiting that page are seeing and by and large, and most importantly, they don't care, they see no profit from that.
acobster 9y ago
I agree that boiling the "wall of legalese" down to some quick bullet points might be a good approach. Within the existing regulatory framework, the requirement could be that the language be clear and that it accurately reflect the longer, less ambiguous legalese. That said, how much of a culture shift does there need to be on the consumer side? That is, even if privacy policies etc. are boiled down to 3-5 bullet points, how many people will continue to wave them away, and how do we change that?
- clamprecht 9y ago
  I'm thinking about the standardized nutrition information labels required on foods we buy. We can easily pick it up and see how many grams of protein, carbs, sugar it has, and read the ingredients. Something like that for privacy would be great.
  - dhimes 9y ago
    Yes, or maybe a couple of standard licenses from which a company may choose.
  - eric_h 9y ago
    That is an interesting comparison, especially given how long it took to make an average person even read those once they were on the box (I'm not even sure how many people do).
ashark 9y ago
We need laws to set standards at whatever the floor of "what a reasonable person would expect you can do" is. Safe, non-paranoid market participation isn't gonna happen otherwise. Outlaw all the spying. Let non-tracking advertising, community efforts, and regular ol' paying for stuff fill the gap. We'll lose little but regain our privacy, which is gone unless we all do this (see: shadow accounts tracking people because their friends posted about them, Google mining your messages because you sent them to someone who uses Gmail)
frankmcsherry 9y ago
I'm not sure I want to open this can of worm here, but this is one of the appealing properties of differential privacy: there is a quantitative bound you can invoke ("we will mine at most eps-dp from your emails, in exchange for this tasty cookie") and then you don't have to have a complicated discussion about which types of PII they ripped from your email, metadata vs non-, and other increasingly meaningless distinctions. Differential privacy also has the nice property that it works like a fungible currency: it is additive, so even if you hand out x, y, and z units to different folks, they collectively can't spend more than x + y + z units, no matter how clever they are. In principle this could help folks determine a value for their sensitive data, and perhaps set up decent standards for people to value their own privacy (e.g. "selling 0.1 units of differential privacy from your email could shift your health insurance premiums by 10%").
- TeMPOraL 9y ago
  In what state is the field of this differential privacy right now? Is anything useful already deployed / expected to be deployed soon, or does it require much more research?
  - frankmcsherry 9y ago
    Google uses it.[0] I think it mostly needs interested parties; folks who care enough to commit to doing something more interesting with it than just counting things. I've certainly built several tools while at MSFT, they just .. languished. [0]: https://github.com/google/rappor https://github.com/google/rappor
  - physicsyogi 9y ago
    Apple uses it[0] and lets you opt out of sharing your data as well[1]. [0]: https://www.wired.com/2016/06/apples-differential-privacy-collecting-data/ https://www.wired.com/2016/06/apples-differential-privacy-co... [1]: https://www.howtogeek.com/290298/what-is-differential-privacy-and-how-does-it-keep-my-data-anonymous/ https://www.howtogeek.com/290298/what-is-differential-privac...
thomasahle 9y ago
> it should be required to state what data is shared with whom in clear human language (and not in a 20 page wall of legalese). I am not sure there is a human language equivalent of what the legalese says. The company won't even know in advance what ingenious uses of your data they'll be able to cook up. > the legalese often boils down to 'you will sell your soul'. Okay, maybe that works.
_jal 9y ago
As Bruce Schneier used to say, give people the option between security and .gifs of dancing pigs, they will take the pigs every time. As abused as they are, internet users need to build up some healthy "buyer beware" instincts around the tradeoffs. They'll tell Facebook things they'd never physically say in front of strangers due to the bait-and-switch feeling of talking to friends, forgetting the panopticon around them. I think part of this is the mystery surrounding data practices - people fall for come-ons they wouldn't accept if they understood what was actually happening. So more and louder talk about things like unroll.me is good - if people hear more about others feeling burned by the bait-and-switch, they'll hopefully be more careful, because they see the results of accepting that anodyne "may share with trusted partners" language.
- stinkytaco 9y ago
  Though I agree, I also work with users every day who do not have the understanding to build those instincts. They don't understand their email and Facebook passwords might be different and they don't understand why Facebook might lock their account. Some of these users have learning disabilities, some mental health issues, some have simply never had the opportunity to learn how and why things work the way they do. And in my limited interaction, I can't impart that instinct.
- conanbatt 9y ago
  > As abused as they are, internet users need to build up some healthy "buyer beware" instincts around the tradeoffs Not having access to what its done with your personal information is one of the things that prevent such an instict from being developed.
- schoen 9y ago
  > They'll tell Facebook things they'd never physically say in front of strangers That was something Joseph Weizenbaum was surprised by with ELIZA. He expected that people would regard it as trivial, but many people chose to share their deepest feelings with the program and felt an emotional connection to it. It might have been helpful in this regard that they weren't talking directly to another person.
- 9y ago
deleted 9y ago
[deleted]
nobodyorother 9y ago
Hey, sometimes it is "sell your soul:" https://www.geek.com/games/gamestation-eula-collects-7500-souls-from-unsuspecting-customers-1194091/ https://www.geek.com/games/gamestation-eula-collects-7500-so...
cortesoft 9y ago
This isn't going to work; I have no idea what you even mean by "what data is shared with whom." Let's try to imagine how this would work with the example in the article, unroll.me, and the information they sold to Uber. They couldn't have told the people they were going to sell their data to Uber; that deal was certainly made after much of the data was gathered. Even if you restricted it to the future (so you have to know your partners ahead of time, which is practically impossible anyway, but lets go with it) How would you explain that in a non-legalese way, that really captures what you are doing?

ricw 9y ago

Free means you are trading your privacy for the service. Unfortunately that is not common knowledge, but it's how the largest part of the internet works. Time to spread the word more aggressively...

wolfgke 9y ago
> Free means you are trading your privacy for the service. Exactly. It should be well-known that "If you are not paying for the product, you are the product.".
- cantagi 9y ago
  That is true. Also, if you are paying for the product, you may still be the product.
  - wolfgke 9y ago
    I did not write "if and only if". :-)
    - cantagi 9y ago
      No worries - I'm not arguing with you :)
snakeanus 9y ago
I will have to disagree. In general by paying it means that you have to have some sort of account and that means that they can track you easier. To be frank I believe that the actual solution is to avoid any cloud-based services.
- TeMPOraL 9y ago
  > To be frank I believe that the actual solution is to avoid any butt-based services. It's a good solution for more than one reason. It also helps you avoid vendor lock-in, prevents from getting stuck with services that get gradually dumbed down in their pursuit of growth at the cost of actual usefulness, and most imporantly, shields you from losing something you depend on because the startup running the service finally got their exit.
  - praneshp 9y ago
    Do you have that extension thing that turns cloud into butt? Nice!
    - TeMPOraL 9y ago
      Yes, it's been turning Internet honest for me for many years now. I'm so used to it that I forget about it every now and then ;).
- stinkytaco 9y ago
  There's still any number of ways to track you, however: ecommerce, credit card, ISP, email provider, etc. It would be very hard to live in the modern world without some of those tools, and few of them have any privacy or data protection guarantee attached.
  - problems 9y ago
    Sure, but you can do a lot. If you pay a dedicated server or colocation provider to host hardware you own, they have a lot less access to your stuff than if you say, use a cloud VM provider, which is in itself at least better than using an SaaS-type solution where you're 1 database query away from fucked and with paid SaaS you're still miles better than free services where selling your data is the only means to pay for the service and to profit. It really depends on what sort of tracking you're most concerned about though. If you're concerned about facebook or similar having your pictures and messages then a solution like this is a good option. Yes, your provider knows it's you, but unless they've invested serious effort backdooring your hardware, they can't tell what you send over SSL'd connections, they can't tell what people visiting that page are seeing and by and large, and most importantly, they don't care, they see no profit from that.

acobster 9y ago

I agree that boiling the "wall of legalese" down to some quick bullet points might be a good approach. Within the existing regulatory framework, the requirement could be that the language be clear and that it accurately reflect the longer, less ambiguous legalese. That said, how much of a culture shift does there need to be on the consumer side? That is, even if privacy policies etc. are boiled down to 3-5 bullet points, how many people will continue to wave them away, and how do we change that?

clamprecht 9y ago
I'm thinking about the standardized nutrition information labels required on foods we buy. We can easily pick it up and see how many grams of protein, carbs, sugar it has, and read the ingredients. Something like that for privacy would be great.
- dhimes 9y ago
  Yes, or maybe a couple of standard licenses from which a company may choose.
- eric_h 9y ago
  That is an interesting comparison, especially given how long it took to make an average person even read those once they were on the box (I'm not even sure how many people do).

ashark 9y ago

We need laws to set standards at whatever the floor of "what a reasonable person would expect you can do" is. Safe, non-paranoid market participation isn't gonna happen otherwise. Outlaw all the spying. Let non-tracking advertising, community efforts, and regular ol' paying for stuff fill the gap. We'll lose little but regain our privacy, which is gone unless we all do this (see: shadow accounts tracking people because their friends posted about them, Google mining your messages because you sent them to someone who uses Gmail)

frankmcsherry 9y ago

I'm not sure I want to open this can of worm here, but this is one of the appealing properties of differential privacy: there is a quantitative bound you can invoke ("we will mine at most eps-dp from your emails, in exchange for this tasty cookie") and then you don't have to have a complicated discussion about which types of PII they ripped from your email, metadata vs non-, and other increasingly meaningless distinctions. Differential privacy also has the nice property that it works like a fungible currency: it is additive, so even if you hand out x, y, and z units to different folks, they collectively can't spend more than x + y + z units, no matter how clever they are. In principle this could help folks determine a value for their sensitive data, and perhaps set up decent standards for people to value their own privacy (e.g. "selling 0.1 units of differential privacy from your email could shift your health insurance premiums by 10%").

TeMPOraL 9y ago
In what state is the field of this differential privacy right now? Is anything useful already deployed / expected to be deployed soon, or does it require much more research?
- frankmcsherry 9y ago
  Google uses it.[0] I think it mostly needs interested parties; folks who care enough to commit to doing something more interesting with it than just counting things. I've certainly built several tools while at MSFT, they just .. languished. [0]: https://github.com/google/rappor https://github.com/google/rappor
- physicsyogi 9y ago
  Apple uses it[0] and lets you opt out of sharing your data as well[1]. [0]: https://www.wired.com/2016/06/apples-differential-privacy-collecting-data/ https://www.wired.com/2016/06/apples-differential-privacy-co... [1]: https://www.howtogeek.com/290298/what-is-differential-privacy-and-how-does-it-keep-my-data-anonymous/ https://www.howtogeek.com/290298/what-is-differential-privac...

thomasahle 9y ago

> it should be required to state what data is shared with whom in clear human language (and not in a 20 page wall of legalese). I am not sure there is a human language equivalent of what the legalese says. The company won't even know in advance what ingenious uses of your data they'll be able to cook up. > the legalese often boils down to 'you will sell your soul'. Okay, maybe that works.

_jal 9y ago

As Bruce Schneier used to say, give people the option between security and .gifs of dancing pigs, they will take the pigs every time. As abused as they are, internet users need to build up some healthy "buyer beware" instincts around the tradeoffs. They'll tell Facebook things they'd never physically say in front of strangers due to the bait-and-switch feeling of talking to friends, forgetting the panopticon around them. I think part of this is the mystery surrounding data practices - people fall for come-ons they wouldn't accept if they understood what was actually happening. So more and louder talk about things like unroll.me is good - if people hear more about others feeling burned by the bait-and-switch, they'll hopefully be more careful, because they see the results of accepting that anodyne "may share with trusted partners" language.

stinkytaco 9y ago
Though I agree, I also work with users every day who do not have the understanding to build those instincts. They don't understand their email and Facebook passwords might be different and they don't understand why Facebook might lock their account. Some of these users have learning disabilities, some mental health issues, some have simply never had the opportunity to learn how and why things work the way they do. And in my limited interaction, I can't impart that instinct.
conanbatt 9y ago
> As abused as they are, internet users need to build up some healthy "buyer beware" instincts around the tradeoffs Not having access to what its done with your personal information is one of the things that prevent such an instict from being developed.
schoen 9y ago
> They'll tell Facebook things they'd never physically say in front of strangers That was something Joseph Weizenbaum was surprised by with ELIZA. He expected that people would regard it as trivial, but many people chose to share their deepest feelings with the program and felt an emotional connection to it. It might have been helpful in this regard that they weren't talking directly to another person.
9y ago

deleted 9y ago

[deleted]

nobodyorother 9y ago

Hey, sometimes it is "sell your soul:" https://www.geek.com/games/gamestation-eula-collects-7500-souls-from-unsuspecting-customers-1194091/ https://www.geek.com/games/gamestation-eula-collects-7500-so...

cortesoft 9y ago

This isn't going to work; I have no idea what you even mean by "what data is shared with whom." Let's try to imagine how this would work with the example in the article, unroll.me, and the information they sold to Uber. They couldn't have told the people they were going to sell their data to Uber; that deal was certainly made after much of the data was gathered. Even if you restricted it to the future (so you have to know your partners ahead of time, which is practically impossible anyway, but lets go with it) How would you explain that in a non-legalese way, that really captures what you are doing?