4 ms·

>> User accounts? Really? This is Yahoo we’re talking about. You really do need user accounts to run an email service > Exactly, regardless of that companies k

>> User accounts? Really? This is Yahoo we’re talking about. You really do need user accounts to run an email service > Exactly, regardless of that companies keep asking users for a whole collection of personal data, not always making it obvious which fields are actually required You literally don't need any user information to run an email service. You only need a means to identify them which could just amount to giving them a long, randomly generated password. Even the username is only necessary for the purpose of being able to identify them as a recipient, not for login itself.

stordoff 9y ago
Wouldn't the emails themselves count as user information?
- IncRnd 9y ago
  No. User information here means information denoting a user not information from a user.
  - freeflight 9y ago
    That's dangerous schematic games along the same lines of "Metadata is harmless and can't identify anybody". Emails can sometimes contain very detailed and very denoting user information. Trying to differentiate between users "personal information" and users "personal content" is imho a rather dangerous thing to do because who decides where to draw the lines between the two? As a user, I expect my data, regardless of which data, to stay private unless I explicitly intent to publish it to the public or somebody else. I most certainly do not expect some employees reading through my private emails for their lunch-break entertainment.
    - IncRnd 9y ago
      > That's dangerous schematic games along the same lines of "Metadata is harmless and can't identify anybody". That's a complete strawman argument that has nothing to do with what I wrote. The distinction is correct and factual in this exact situation. You are attempting to redefine terms for apparently no reason other than to argue. Whether emails contain detailed information or not is irrelevant to the term "user information" in this context, meaning information about a user. The discussion is about whether an email service requires personal information to operate. > As a user, I expect my data, regardless of which data, to stay private unless I explicitly intent to publish it to the public or somebody else. I most certainly do not expect some employees reading through my private emails for their lunch-break entertainment. In the real-world, you either need to change your expectations or encrypt your data.
freeflight 9y ago
> You literally don't need any user information to run an email service. I know that and you know that the average user does NOT know that and is too good-natured to enter fake information. There are plenty of email services out there, among them many of largest and most established ones, where the real name is a required field during registration. Sure you can always argue "Well just enter fake details" but that's missing the point. The point being that once personal information becomes a liability, instead of something you can just haphazardly hoard as an asset, companies would be much more careful about what kind of information they are asking from the users in the very first place. Companies abuse the goodwill of the average users by asking for more information than they should because it comes at no cost to them while at the same time being a very big asset. Even if they fail to secure these assets and a breach happens, most of the costs of that are externalized onto the users whose data actually got leaked, the consequences for the company are often only cosmetical, some bad PR/stock prices take a little downturn. But the brunt of that will be over after a couple of weeks and after that, it's back to business as usual. That needs to change, companies need to be held liable for: A) Needlessly asking for and hoarding personal information B) Sloppy treatment of information resulting in a leak Yes, this could very well be opening Pandora's box, but something about the current state of things really needs to change.

stordoff 9y ago

Wouldn't the emails themselves count as user information?

IncRnd 9y ago
No. User information here means information denoting a user not information from a user.
- freeflight 9y ago
  That's dangerous schematic games along the same lines of "Metadata is harmless and can't identify anybody". Emails can sometimes contain very detailed and very denoting user information. Trying to differentiate between users "personal information" and users "personal content" is imho a rather dangerous thing to do because who decides where to draw the lines between the two? As a user, I expect my data, regardless of which data, to stay private unless I explicitly intent to publish it to the public or somebody else. I most certainly do not expect some employees reading through my private emails for their lunch-break entertainment.
  - IncRnd 9y ago
    > That's dangerous schematic games along the same lines of "Metadata is harmless and can't identify anybody". That's a complete strawman argument that has nothing to do with what I wrote. The distinction is correct and factual in this exact situation. You are attempting to redefine terms for apparently no reason other than to argue. Whether emails contain detailed information or not is irrelevant to the term "user information" in this context, meaning information about a user. The discussion is about whether an email service requires personal information to operate. > As a user, I expect my data, regardless of which data, to stay private unless I explicitly intent to publish it to the public or somebody else. I most certainly do not expect some employees reading through my private emails for their lunch-break entertainment. In the real-world, you either need to change your expectations or encrypt your data.

freeflight 9y ago

> You literally don't need any user information to run an email service. I know that and you know that the average user does NOT know that and is too good-natured to enter fake information. There are plenty of email services out there, among them many of largest and most established ones, where the real name is a required field during registration. Sure you can always argue "Well just enter fake details" but that's missing the point. The point being that once personal information becomes a liability, instead of something you can just haphazardly hoard as an asset, companies would be much more careful about what kind of information they are asking from the users in the very first place. Companies abuse the goodwill of the average users by asking for more information than they should because it comes at no cost to them while at the same time being a very big asset. Even if they fail to secure these assets and a breach happens, most of the costs of that are externalized onto the users whose data actually got leaked, the consequences for the company are often only cosmetical, some bad PR/stock prices take a little downturn. But the brunt of that will be over after a couple of weeks and after that, it's back to business as usual. That needs to change, companies need to be held liable for: A) Needlessly asking for and hoarding personal information B) Sloppy treatment of information resulting in a leak Yes, this could very well be opening Pandora's box, but something about the current state of things really needs to change.