3 ms·

I have this theory that the only way regular people will start caring about privacy breaches such as this one is to use that data against them in a malicious wa

I have this theory that the only way regular people will start caring about privacy breaches such as this one is to use that data against them in a malicious way. Tell the average Joe that the data of all US voters has been leaked, "Hmmm. That's bad." and they move on with their lives as if nothing happened. Instead, if this data is used to impersonate the average Joe on social media or if it's used to trick their mobile carrier into porting out their number, then they'll take notice. (I am not suggesting people do this, it was just part of a thought experiment) Unless the company involved is sued to bankruptcy and the people involved are prosecuted, sending a strong message to companies dealing with user data, nothing will change. But that's unlikely to happen as this company is backed by the RNC. While we're on the topic of collecting personal data of people, there's a simple solution : just don't collect it unless it's absolutely necessary. Stop asking me to broadcast my address in my newsletter. Stop asking me to submit my billing address when I make payments online. Stop asking me for my mobile number when I visit a fast food restaurant. Most of the companies that collect this data are not competent enough to keep it secure. The reason companies ask for an address to broadcast in users' newsletters is some anti-spam act which does not prevent the spammers from doing their job. I imagine it's also a requirement for companies to collect a billing address for certain types of online payments. Change the law to remove these poorly thought out legislature. More generally, we need regulations on how user data is used by companies. They should not be allowed to store user data indefinitely. If a user closes an account with a company, retain the data for a short period (eg- 1 year) and then delete the data automatically. Companies should not be allowed to build shadow profiles of users.

ksk 9y ago
>I have this theory that the only way regular people will start caring about privacy breaches such as this one is to use that data against them in a malicious way The other thought experiment is to adopt the opposite point of view that privacy is overrated. You can adopt various worldviews from 'everything is grey' to 'this is good, that is bad" but punishing someone to care about same things you care about is a pretty terrible approach. If you can't convince someone, it doesn't mean they're stupid, it could also mean you just aren't that good at communicating, or that perhaps what you think is important isn't all that important. >Unless the company involved is sued to bankruptcy and the people involved are prosecuted, sending a strong message to companies dealing with user data, nothing will change. Or we can give them tools that make it easier to secure data. I've always found that if you make it easy for someone, they almost always end up doing the right thing. As it stands the security products/services domain is a complicated maze where you have to be an expert to evaluate how various products work internally and which services, if any are worth purchasing.
- dredmorbius 9y ago
  There's a pretty compelling argument though, that people aren't good at making long-term assessments of diffuse, but potent, risks, and/or are willing to, or can be coerced into, arbitraging long-term interests with short-term exigency. Gresham's law, availability hueristics, optimism bias, distribution of cognitive skills, various aspects of game theory, and more, strongly suggest this. Examples: global warming, pollution risks, resource depletion, moral and morale hazard, just off the top of my head.
  - ksk 9y ago
    Yeah, and all those biases apply to people on HN too - You (the proverbial) aren't good at making assessments either. Also, flipping it for arguments sake, how come software companies are never penalized for introducing software bugs? How would you like it if an accountant wanted to send you to jail because you introduced a security bug and their critical data got wiped out and they went out of business? Or should we go back to blaming them for not having backups because we have an a-priori assumption that "shit happens" when it comes to software? Well, the other side could say 'shit happens' too.
    - dredmorbius 9y ago
      Those are actually questions I'm actively exploring. Some recent discussion (from myself and others) on this G+ thread: https://plus.google.com/+YonatanZunger/posts/267XsJzKM5B https://plus.google.com/+YonatanZunger/posts/267XsJzKM5B I've discussed Gresham's Law dynamics numerous times at my subreddit/blog. See particularly: https://www.reddit.com/r/dredmorbius/comments/2h63fp/is_greshams_law_a_special_instance_of_a_more/ https://www.reddit.com/r/dredmorbius/comments/2h63fp/is_gres... I've been meaning to write up a bit expanding market price dynamics beyond the set of goods that Adam Smith defined: labour, capital, commodities, rents, and (indirectly) interest. In particular, the question of risk pricing, which is treated almost wholly as a financial question rather than an economic one. The question of pricing under duress is a key one -- the Backward-'S' bending supply curve is a curious economic anomaly: https://www.reddit.com/r/dredmorbius/comments/53mcxn/backward_s_shaped_supply_curves/ https://www.reddit.com/r/dredmorbius/comments/53mcxn/backwar... Also the behaviour of natural resource stocks under supplier pressure -- the price will fall to the lowest levels possible, and supplied volume will increase, if possible, for a number of highly perverse reasons. The collapse of oil prices following the East Texas oilfield discovery, from ~$1/bbl to first $0.13/bbl, then $0.02/bbl, before wellhead production was siezed at force of arms by the Oklahoma and Texas national guard, and Texas rangers, comes to mind. https://www.reddit.com/r/dredmorbius/comments/6etqey/oil_is_not_a_drug_oil_dependence_is_not_an/ https://www.reddit.com/r/dredmorbius/comments/6etqey/oil_is_...
snerbles 9y ago
I'm sure some SV companies will be more than happy to comb over this leak to fire employees for wrongthink.

ksk 9y ago

>I have this theory that the only way regular people will start caring about privacy breaches such as this one is to use that data against them in a malicious way The other thought experiment is to adopt the opposite point of view that privacy is overrated. You can adopt various worldviews from 'everything is grey' to 'this is good, that is bad" but punishing someone to care about same things you care about is a pretty terrible approach. If you can't convince someone, it doesn't mean they're stupid, it could also mean you just aren't that good at communicating, or that perhaps what you think is important isn't all that important. >Unless the company involved is sued to bankruptcy and the people involved are prosecuted, sending a strong message to companies dealing with user data, nothing will change. Or we can give them tools that make it easier to secure data. I've always found that if you make it easy for someone, they almost always end up doing the right thing. As it stands the security products/services domain is a complicated maze where you have to be an expert to evaluate how various products work internally and which services, if any are worth purchasing.

dredmorbius 9y ago
There's a pretty compelling argument though, that people aren't good at making long-term assessments of diffuse, but potent, risks, and/or are willing to, or can be coerced into, arbitraging long-term interests with short-term exigency. Gresham's law, availability hueristics, optimism bias, distribution of cognitive skills, various aspects of game theory, and more, strongly suggest this. Examples: global warming, pollution risks, resource depletion, moral and morale hazard, just off the top of my head.
- ksk 9y ago
  Yeah, and all those biases apply to people on HN too - You (the proverbial) aren't good at making assessments either. Also, flipping it for arguments sake, how come software companies are never penalized for introducing software bugs? How would you like it if an accountant wanted to send you to jail because you introduced a security bug and their critical data got wiped out and they went out of business? Or should we go back to blaming them for not having backups because we have an a-priori assumption that "shit happens" when it comes to software? Well, the other side could say 'shit happens' too.
  - dredmorbius 9y ago
    Those are actually questions I'm actively exploring. Some recent discussion (from myself and others) on this G+ thread: https://plus.google.com/+YonatanZunger/posts/267XsJzKM5B https://plus.google.com/+YonatanZunger/posts/267XsJzKM5B I've discussed Gresham's Law dynamics numerous times at my subreddit/blog. See particularly: https://www.reddit.com/r/dredmorbius/comments/2h63fp/is_greshams_law_a_special_instance_of_a_more/ https://www.reddit.com/r/dredmorbius/comments/2h63fp/is_gres... I've been meaning to write up a bit expanding market price dynamics beyond the set of goods that Adam Smith defined: labour, capital, commodities, rents, and (indirectly) interest. In particular, the question of risk pricing, which is treated almost wholly as a financial question rather than an economic one. The question of pricing under duress is a key one -- the Backward-'S' bending supply curve is a curious economic anomaly: https://www.reddit.com/r/dredmorbius/comments/53mcxn/backward_s_shaped_supply_curves/ https://www.reddit.com/r/dredmorbius/comments/53mcxn/backwar... Also the behaviour of natural resource stocks under supplier pressure -- the price will fall to the lowest levels possible, and supplied volume will increase, if possible, for a number of highly perverse reasons. The collapse of oil prices following the East Texas oilfield discovery, from ~$1/bbl to first $0.13/bbl, then $0.02/bbl, before wellhead production was siezed at force of arms by the Oklahoma and Texas national guard, and Texas rangers, comes to mind. https://www.reddit.com/r/dredmorbius/comments/6etqey/oil_is_not_a_drug_oil_dependence_is_not_an/ https://www.reddit.com/r/dredmorbius/comments/6etqey/oil_is_...

snerbles 9y ago

I'm sure some SV companies will be more than happy to comb over this leak to fire employees for wrongthink.