10 ms·
When will this stop? When's the last straw? If I gave a bank 100 dollars, and they lost it, I'd have avenues with which to pursue some sort of justice. If I
by axaxs 8y ago
When will this stop? When's the last straw? If I gave a bank 100 dollars, and they lost it, I'd have avenues with which to pursue some sort of justice. If I give a company my data, and they lose it, oh well. I wish all personal data was treated like HIPAA, at a minimum.
- paulie_a 8y agoIt won't.
- axaxs 8y agoLet's discuss how we can fix this. I'm actually considering leaving my job of 8 years for a probably to be doomed privacy startup. Either way, I'm interested in solutions and more importantly working towards them, even for free.
- mmiller9 8y agoLegislation. We need legal repercussions for people who wantonly mishandle our personal information. Sorry, but the market can’t help us. This kind of shit needs to be illegal yesterday. It’s just impossible because we have a Congress that is so remarkably out of touch that they won’t do anything about it.
- zeth___ 8y agoHow so many people are convinced the market will save them from the marker given the last 300 years oh history is beyond me.
- extradego 8y agoIn America, they simply do not know the last 300 years of history.
- krageon 8y agoPractically everyone knows about the second world war, but nothing is being done about rising fascism. It has nothing to do with not knowing, it's just stupidity.
- zeth___ 8y agoAnd how many know about the Ludlow Massacre? There is no rising fascism in America, if people really knew anything about the Wiemar Republic, Republican Spain, or March on Rome they would know that the left always loses when it tried to be humane and gain power. The only time the left gains power is when 'tankies' are the ones leading the resistance.
- extradego 8y agoI do not comprehend the actual point you intend to make. But, remember the left chooses the hard road, not because they can but because it is moral. Regardless, Trump is absolutely a fascist. It seems a bit futile to disagree.
- pbhjpbhj 8y agoWhat do you suppose can be done about it?
- krageon 8y agoIf you need a good example, look at Germany. They have very strict laws about it and while there are still fascists there (as there are everywhere), they do not run the country. Edit: On a more practical note, it's always baffled me how normalised it is. People who defend fascists in the US media are still respected and hired. They might be prominent political figures. Somehow calling attention to someone who is fascist is confused by anyone doing something as simple as saying "liberals are evil!", as if the two party system there has anything to do with racial supremacy. As an outsider, you look at it and think "This is the country that helped liberate Europe from the Nazis. How are they not ashamed?". Maybe I think the first step is allowing shame to enter into things when you think about your nation, instead of a quasi-religious patriotism.
- extradego 8y agoGovernment funded elections might solve most of our society’s spiraling issues but we can’t have any clue what the value would be until we try it. And of course we can’t make honest claims to democracy until then either.
- ATsch 8y agoAs an uninformed observer, one of the biggest issues I see is the US two party system. Do you think government funding would help with that? I've always seen it more as a weakness of the general US electoral FPTP system.
- raarts 8y agoUhmm, actually Congress is very much in touch... With corporate interests.
- joering2 8y agoCongress grilled Equifax and nothing. Average person saw Equifax commercial on “hey be smart we will keep your info safe with alerts” and thought “wow this company cares about my data” when its precisely opposite. If the congress is unable or doesnt want to draft a bill to stop predators from milking money off of your data, then that money probably ends up in their pocket some way. Or at least some of it. Please dont quit your job for the sake of your security - food, shelter, etc. Move these assholes out with next election. Vote in young people that are probably as angry about this shit as you are, in hope they won’t sell out their soul.
- axaxs 8y agoIn my ideal mind, I'd keep my job, it's pretty lax as long as I deliver. But I want to fix privacy. I'm working with a guy I respect, who is also all about privacy, but I just don't think his model works. Ideally I'll donate some dev time for free, but if I saw even a glimmer of hope, I'd go all in. We can't trust congress, we need a private sector movement. I'm offering my services for free to anyone in the space, generally speaking.
- malio 8y ago> We need a private sector movement. You should reach out to a venture called Equifax. They are providing customer alerts for data breaches and a premiere data protection service. Your imagination is working against you here. The obvious and well-known reason that congress is ineffective is they work for the private sector, who is the disease; not the cure.
- greglindahl 8y agoDo you have any data to support your claim about what the average person thought about Equifax and Congress? I have a lot of strong opinions about privacy, but I'm also resigned to the fact that most people don't care about it as much as I do. So I don't guess what they're thinking.
- jsjohnst 8y ago
- paulie_a 8y agoFigure out a way to make the data collected useless. You can't hide and block every attempt to track, collect and generally have your privacy invaded. But it may be possible to throw a wrench in the gears by making so much noise the data is low quality.
- dredmorbius 8y agoOr increasing costs of holding, exchanging, or using it.
- malio 8y agoThat is what would be needed in the United States of Anarchy, but everyone is so busy trying to pull off their own scandle that I don’t think this could be done at an effective scale.
- craftyguy 8y ago> When will this stop? When's the last straw? When the top folks in the US government are personally affected. Until then, "congressional hearings" and presidential ambivalence is the most action we'll get out of them. Most people don't really understand what the significance of these events are.
- axaxs 8y agoI hate the fact that I feel so small and insignificant because of the futility of speaking to a representative. I did try to contact Rand Paul last year. He never bothered to reply, but did add me to his mailing list. Great.
- tejtm 8y agoOn the bright side, we do not know that he has leaked it yet :)
- JumpCrisscross 8y ago> When the top folks in the US government are personally affected The OPM breach covered a lot of powerful senior people.
- astura 8y agoNot only that, but the Russian site exposed[dot]su has published personal information, including SSNs, about a lot of powerful people, including Michelle Obama, Robert Mueller, Eric Holder, and Hillary Clinton. https://krebsonsecurity.com/2014/03/who-built-the-id-theft-service-ssndob-ru/ https://krebsonsecurity.com/2014/03/who-built-the-id-theft-s...
- wu-ikkyu 8y agoIndeed, however, the impact of such breaches has yet to be made explicit. It seems only a massive cyber attack would show the public what is possible with such information
- joshmn 8y ago
- SkyMarshal 8y ago>If I give a company my data, In some cases you're not knowingly giving them your data either.
- axaxs 8y agoThat's the depressing part. I usually shop at Meijer because they were the last grocery left without annoying loyalty cards. As of this year, I've began receiving in the mail coupons for specific items I'd bought there. So either my credit card company has sold my data, or it was 'stolen' when they scanned my license to buy beer at some point(they require scanning the license, not DOB entry). I'm tired of this.
- patrickg_zill 8y agoThe credit card info is called "level 3 data" and they in some cases have line item by line item detail. Not just "spend $24.89 at Meijer store #349" but each individual thing, e.g. you bought 2 avocados.
- axaxs 8y agoIs that recent? I just started getting it this year. Is there a way to opt out?
- patrickg_zill 8y agoFrom what I know, it started a few years ago; but not all big stores had the equipment in place to send it (the cc processors give them a discount for sending the line-item level 3 data). With the advent of the chip and pin cards in the USA, it seems logical that just about everyone upgraded to equipment that does support it; which might explain why you are only seeing this in the past year.
- axaxs 8y agoSo, this seems a little opposite of what I meant. Naive me always assumed I pay with a card, the store gets my cc info to charge and we part ways. I'm getting in the mail ads from Meijer, for items I buy frequently. This tells me they were able to extract my home address and name from my credit card. Is that accurate?
- threeseed 8y agoWhy do you think this can be stopped ? Think it through. You can't stop data loss until you can guarantee platform security. You can't do that until you prevent developers from creating bugs and security flaws in the first place. You can only do that unless you have either perfect tools to catch all the issues or a perfect testing regime. It's basically an unsolvable problem.
- axaxs 8y agoThat's a defeatist attitude. If you make companies liable for this, they'll start paying more attention to security. I'm not a trained security expert, but did have to explain this year why not to store plain text passwords in a database. Security is seen as secondary to product across the board. We need penalties to change this.
- shakna 8y agoWe can't prevent builders and architects from making mistakes either, but they are required to comply with regulations, and take out insurance to cover their customers in the event of human failure. If the problem is inevitable on some level, then why isn't insurance to cover that eventuality required?
- hodgesrm 8y agoIt's definitely solvable. You pass laws that make it very costly for businesses to expose personal data. Businesses are rational actors (for the most part) and will adjust accordingly, for example by not collecting the data in the first place.
- DCoder 8y ago> If I give a company my data, and they lose it, oh well. I wish all personal data was treated like HIPAA, at a minimum. And yet, when GDPR tries to address the issue, HN is full of "blocking the damned EU users completely" and "stop stifling honest companies".
- greglindahl 8y agoIt's almost as if the issue is more complicated than the solution represented by the GDPR. I mean, I'm a "tin hat" privacy nut in the USA, but that doesn't mean that I'm a fan of 100% of the GDPR. It has plusses and minuses. It'd be nice to have a conversation about them.
- hodgesrm 8y agoThe question though is what's the alternative? The IT industry has failed spectacularly in protecting citizens' personal data. I'm not a fan of EU bureaucracy, but it looks as if they are on the right side of history on this one.
- JumpCrisscross 8y ago> what's the alternative? Absolute liability for data losses. Exactis lost 360 million peoples' data. They should be able to (a) form a class and (b) extract money damages from Exactis without having to prove specific harm, which is difficult to do with data loss. A good model is Illinois' Biometric Information Privacy Act [1]. Broaden the the definition from "biometric identifier" to a longer--but still specific--list. If you want to get fancy, create a regulator who can add things to the list after a public hearing. (The specificity avoids GDPR's "what's personal data?" mess. The public input mitigates the risk of unintended consequences and corruption.) [1] http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004 http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004
- scarlac 8y agoThat's basically what GDPR does. It broadens the scope of what is considered sensitive info and slaps a fine on people PRIOR to a breach. If a breach is found, then any breach of GDPR means EU can come after that company and hurt them seriously.
- Dolores12 8y agoSame flawed logic as in online piracy. No one lost your data, they still have it, but someone else made a copy.
- thirdsun 8y agoA rather irrelevant nitpick to this discussion. Let's not pretend we didn't know what lost meant in this context. And of course it's the process of making a copy that's the issue.
- pbhjpbhj 8y agoActual I think it's worth picking that nit because it emphasises that the company who leaked the data, allowed its exfiltration, still have the data. That emphasis is twofold: 1) they can do it again, because 2) they didn't lose anything. The corollaries being that their incentives aren't aligned with the people whose data is leaked, the company don't need to spend on avoiding leaks because they're not harmed beyond a little (bad) PR.
- dredmorbius 8y agoWhat was lost wasn't the data, but its confidence and control over it. The pedantism is unhelpful.
- test6554 8y agoThe problem is that you can use data an infinite amount of times, but spend money only once. Data are facts, money is a repository of value. With a bank, you are the customer. With marketing, you are the product.
- dredmorbius 8y agoLiability piercing the corporate veil to executives, shareholders, creditors, vendors, and clients/customers.
- rmc 8y agoYou could do business with places in the EU, where you are covered by EU's stronger data protection law. If an EU based company do stuff with the personal data of US citizens in the US, then the GDPR (etc) applies to that EU company.
- anonymous5133 8y agoI think it can be explained with game theory. Right now customer data is massively valuable to a company for all sorts of reasons. A data breach is unlikely to occur and if it does occur then the financial loses to the company are much less (on a risk-adjusted basis) compared to the benefits. Every company has every incentive to collect as much consumer data as possible. It will only change when consumers demand it to change or outright refuse to give their personal information away. I think everyone should adopt pseudonyms for everything and to be constantly changing their pseudonyms regularly.
- krageon 8y agoIt will not stop, simply because there is a ton of money in not having it stop.
- omginternets 8y ago> my data Data about you is not (necessarily) data you own. I'm not saying it's right, but any reasonable discussion has to take this legal landscape into account.
- wglb 8y agoThat is not the European view. Data about you is owned by you, not by the company that collected or processed it.
- omginternets 8y agoI don't think that's exactly right. You certainly have some say in how it's used, but I don't think it's built on a notion of "ownership".