6 ms·

Tech's most egregious violations of user privacy

52 points by octosphere 8y ago

Arzh 8y ago
Low effort blog
kbos87 8y ago
The last item in this list is really disappointing and gives the rest of the article a lot less credibility, which is too bad. Most of these are good examples of things that users should be outraged about - they are deliberate decisions made by companies or their employees to further their own interests on the backs of and at the expense of their users without their consent. While I’m no Amazon fan, I’m pretty convinced that the last example of an Alexa malfunction really was an unintended bug. Conflating the two types of situations makes it easy for people to write this off as biased.
- xg15 8y ago
  I think it's actually good that's the last point it's on there. Sure, for the company it may make a difference, but a user couldn't care less if a privacy breach was a bug, a "feature", an outside attack or something else. If an enterprise provides a service, it's their responsibility to properly secure it. If they made the decision to use experimental technology or to transfer everything into the cloud, that's their business decision and they should be liable for it.
- octosphere 8y ago
  > The last item in this list Keep in mind I had JavaScript turned on when I visited the page and it was using an 'infinite scroll' mechanism to show me the next article, so you need to watch statements like: "The last item in this list"
- fipple 8y ago
  An unintended action can still cause huge amounts of harm.
- dasil003 8y ago
  Fair, however the fact that it's a totally unintended bug is what makes it all the more terrifying. In fact I would assume the Alexa team has been freaking out pretty hard about this because it has the potential to kill the entire market before it matures.
  - AndrewUnmuted 8y ago
    It’s too late for that. Alexa is bundled in new Sonos units, and anybody with a Fire TV already has it.
wiz21c 8y ago
I've been reading stuff like that for years. But is there, somewhere, a thorough explanation of how these "stolen" data are actually used against us, how they are valued, by whom, etc. ? (I didn't look in Google). Not some ideological explanation ('cos we all understand that the data collection induces weakens us against big-corp), but concrete, such as "this advertiser has done this kind of (horror) stuff using that kind of google collected data". I ask 'cos advertising doesn't look that dangerous to many people; it doesn't have the blood of us customers on its hands.
- kartan 8y ago
  > "this advertiser has done this kind of (horror) stuff using that kind of google collected data" Data collected by Facebook was used to radicalize USA population looking into their political preferences and organizing groups in the extreme of the spectrum. Political ads were used to show lies like "Europe, is negotiating to open borders with Turkey" to people depending on their political orientation during the "Brexit" vote by also Russia. Targetted ads by hostile countries without any electoral supervision are running amok in social networks as ads are private and personalized.
- xg15 8y ago
  At the moment? I'm not sure there are many examples in the US. However, there is enormous potential for future misuse and, giving the current setup of forces in the ecosystem, it's likely that this potential will be realized. I think you can look at china's social credit system as examples: They use clues from all kinds of collected personal data to assign personalized ratings to people and purposely make their life easier or harder based on those ratings. In the end, the goal is not about collection but about control: Drive people into or away from certain behaviors with unprecedented prevision. The US is less centralized, but I cam easily see a more diffuse version of that emerging there as well. There are many businesses offering personalized scoring already and a large market of customers - you could imagine using it by insurances to adjust your premium (or determine when to cancel a contract), employers to vet candidates, landlords to vet tenants, etc. You don't necessarily need a central authority controlling it. (Slightly OT part follows) Other than that, I think the privacy debate is sometimes a symptom of a deeper problem that, I think, is less talked abou as of now: Direct control. With more and more services - and physical goods - being depended on the cloud, the service providers gain a level of control that is unprecedented. 15 years ago, we all were joking that Windows 98 would secretly talk back to Microsoft - today it's commonly accepted practice that devices, appliactions and OSses constantly send telemetry to their vendors and can at any point change functionality if the vendor says so. We're at a point where, it's normal to run experiments on parts of your user base to optimize retention or learn about the emotional effects of a newsfeed. We can have Elon Musk increase the battery capacity of all Teslas in operation in an instant because he is concerned by a hurricane. Or we can have Amazon removing e-books that had already been purchased from all readers because they have a dispute with the publisher. Not to mention that software and device manufacturers in general can restrict in increasingly precise ways how and to what effect their products may be used. So far, you get occasional public outrage about those things, but their seems to be little legal protection against this. I do hope this will change at some point.
throw2016 8y ago
'Improving user experience' is a dead giveaway of shady untenable behavior. They want your data, but they don't want to be transparent about it. Why do highly paid highly educated people get a free pass to behave unethically? If you think users are 'idiots' why go to such lengths to deceive them. You can just imagine the tyrant calmly responding to accusations of tyranny that it's to 'improve the citizens experience'.
- ape4 8y ago
  Agreed, for example Windows 10 could work fine if it didn't do telemetry to "improve user experience".
  - yuhong 8y ago
    Telemetry is a special case I think. An example of some of the problems is Vivaldi, where information like the "screen resolution" actually can help to improve the user experience and data on the number of users can also be useful but none of that makes it necessarily a good idea: https://news.ycombinator.com/item?id=17564877 https://news.ycombinator.com/item?id=17564877
- wereHamster 8y ago
  Just last week I spent a day implementing a small new feature (I'm a web developer). Now that the feature has been published, I'd love to track how many users actually use it. To see if it was worth spending the time, whether we should make that feature available in more places etc. But I can't because we're forbidden to collect any sorts of data. If I was allowed to collect data, as what should I frame it, if not "improving user experience"?
  - ape4 8y ago
    You could say: we're going to count how many users use this page to see if it's popular enough to continue development
  - throw2016 8y ago
    This is an issue of transparency. If you plan to do anything else with that data beyond how many users use it then who is going to communicate that to the user? Is it ok to just keep quiet about it? This is what the issue is here, people are not being told in clear terms what the data is being used for, and that where things become decidedly shady. It's about using the catchall 'improve user experience' to lull users into complacency to conceal what 'else' you are doing with the data. And I suspect that's not what you are trying to defend.
hkai 8y ago
Today was the news that Alibaba wants to share users social credit score with immigration authorities in foreign countries to prevent unreliable people from going abroad. Is this bad enough or can we do worse?
dawnerd 8y ago
The moviepass one is a bit silly. Not to defend them, but if you’re gonna cancel a service you know is pretty shady, don’t go and click accept. All those people should have deleted the app right away. It’s kind of like deleting a Facebook account then logging back in.
- defap 8y ago
  >It’s kind of like deleting a Facebook account then logging back in. It’s not like that, though. You pay for MoviePass up front each month. Cancelling means you don’t want to pay for next month, but you are still able to use it for this month. Deleting the app would just be throwing money away. They’re exploiting users who want to get fair value from their existing purchase.
tzs 8y ago
I don't understand the MoviePass one. It says it is difficult to cancel a membership because accepting TOS updates, which the app requires you to do when you open it, cancels the membership cancellation. That's certainly bad, and is a strong sign of either maliciousness or an incompetent testing department--but I don't see how it is a privacy violation.

52 points by octosphere 8y ago

Arzh 8y ago

Low effort blog

The last item in this list is really disappointing and gives the rest of the article a lot less credibility, which is too bad. Most of these are good examples of things that users should be outraged about - they are deliberate decisions made by companies or their employees to further their own interests on the backs of and at the expense of their users without their consent. While I’m no Amazon fan, I’m pretty convinced that the last example of an Alexa malfunction really was an unintended bug. Conflating the two types of situations makes it easy for people to write this off as biased.

xg15 8y ago
I think it's actually good that's the last point it's on there. Sure, for the company it may make a difference, but a user couldn't care less if a privacy breach was a bug, a "feature", an outside attack or something else. If an enterprise provides a service, it's their responsibility to properly secure it. If they made the decision to use experimental technology or to transfer everything into the cloud, that's their business decision and they should be liable for it.
octosphere 8y ago
> The last item in this list Keep in mind I had JavaScript turned on when I visited the page and it was using an 'infinite scroll' mechanism to show me the next article, so you need to watch statements like: "The last item in this list"
fipple 8y ago
An unintended action can still cause huge amounts of harm.
dasil003 8y ago
Fair, however the fact that it's a totally unintended bug is what makes it all the more terrifying. In fact I would assume the Alexa team has been freaking out pretty hard about this because it has the potential to kill the entire market before it matures.
- AndrewUnmuted 8y ago
  It’s too late for that. Alexa is bundled in new Sonos units, and anybody with a Fire TV already has it.

wiz21c 8y ago

I've been reading stuff like that for years. But is there, somewhere, a thorough explanation of how these "stolen" data are actually used against us, how they are valued, by whom, etc. ? (I didn't look in Google). Not some ideological explanation ('cos we all understand that the data collection induces weakens us against big-corp), but concrete, such as "this advertiser has done this kind of (horror) stuff using that kind of google collected data". I ask 'cos advertising doesn't look that dangerous to many people; it doesn't have the blood of us customers on its hands.

kartan 8y ago
> "this advertiser has done this kind of (horror) stuff using that kind of google collected data" Data collected by Facebook was used to radicalize USA population looking into their political preferences and organizing groups in the extreme of the spectrum. Political ads were used to show lies like "Europe, is negotiating to open borders with Turkey" to people depending on their political orientation during the "Brexit" vote by also Russia. Targetted ads by hostile countries without any electoral supervision are running amok in social networks as ads are private and personalized.
xg15 8y ago
At the moment? I'm not sure there are many examples in the US. However, there is enormous potential for future misuse and, giving the current setup of forces in the ecosystem, it's likely that this potential will be realized. I think you can look at china's social credit system as examples: They use clues from all kinds of collected personal data to assign personalized ratings to people and purposely make their life easier or harder based on those ratings. In the end, the goal is not about collection but about control: Drive people into or away from certain behaviors with unprecedented prevision. The US is less centralized, but I cam easily see a more diffuse version of that emerging there as well. There are many businesses offering personalized scoring already and a large market of customers - you could imagine using it by insurances to adjust your premium (or determine when to cancel a contract), employers to vet candidates, landlords to vet tenants, etc. You don't necessarily need a central authority controlling it. (Slightly OT part follows) Other than that, I think the privacy debate is sometimes a symptom of a deeper problem that, I think, is less talked abou as of now: Direct control. With more and more services - and physical goods - being depended on the cloud, the service providers gain a level of control that is unprecedented. 15 years ago, we all were joking that Windows 98 would secretly talk back to Microsoft - today it's commonly accepted practice that devices, appliactions and OSses constantly send telemetry to their vendors and can at any point change functionality if the vendor says so. We're at a point where, it's normal to run experiments on parts of your user base to optimize retention or learn about the emotional effects of a newsfeed. We can have Elon Musk increase the battery capacity of all Teslas in operation in an instant because he is concerned by a hurricane. Or we can have Amazon removing e-books that had already been purchased from all readers because they have a dispute with the publisher. Not to mention that software and device manufacturers in general can restrict in increasingly precise ways how and to what effect their products may be used. So far, you get occasional public outrage about those things, but their seems to be little legal protection against this. I do hope this will change at some point.

throw2016 8y ago

'Improving user experience' is a dead giveaway of shady untenable behavior. They want your data, but they don't want to be transparent about it. Why do highly paid highly educated people get a free pass to behave unethically? If you think users are 'idiots' why go to such lengths to deceive them. You can just imagine the tyrant calmly responding to accusations of tyranny that it's to 'improve the citizens experience'.

ape4 8y ago
Agreed, for example Windows 10 could work fine if it didn't do telemetry to "improve user experience".
- yuhong 8y ago
  Telemetry is a special case I think. An example of some of the problems is Vivaldi, where information like the "screen resolution" actually can help to improve the user experience and data on the number of users can also be useful but none of that makes it necessarily a good idea: https://news.ycombinator.com/item?id=17564877 https://news.ycombinator.com/item?id=17564877
wereHamster 8y ago
Just last week I spent a day implementing a small new feature (I'm a web developer). Now that the feature has been published, I'd love to track how many users actually use it. To see if it was worth spending the time, whether we should make that feature available in more places etc. But I can't because we're forbidden to collect any sorts of data. If I was allowed to collect data, as what should I frame it, if not "improving user experience"?
- ape4 8y ago
  You could say: we're going to count how many users use this page to see if it's popular enough to continue development
- throw2016 8y ago
  This is an issue of transparency. If you plan to do anything else with that data beyond how many users use it then who is going to communicate that to the user? Is it ok to just keep quiet about it? This is what the issue is here, people are not being told in clear terms what the data is being used for, and that where things become decidedly shady. It's about using the catchall 'improve user experience' to lull users into complacency to conceal what 'else' you are doing with the data. And I suspect that's not what you are trying to defend.

hkai 8y ago

Today was the news that Alibaba wants to share users social credit score with immigration authorities in foreign countries to prevent unreliable people from going abroad. Is this bad enough or can we do worse?

dawnerd 8y ago

The moviepass one is a bit silly. Not to defend them, but if you’re gonna cancel a service you know is pretty shady, don’t go and click accept. All those people should have deleted the app right away. It’s kind of like deleting a Facebook account then logging back in.

defap 8y ago
>It’s kind of like deleting a Facebook account then logging back in. It’s not like that, though. You pay for MoviePass up front each month. Cancelling means you don’t want to pay for next month, but you are still able to use it for this month. Deleting the app would just be throwing money away. They’re exploiting users who want to get fair value from their existing purchase.

tzs 8y ago

I don't understand the MoviePass one. It says it is difficult to cancel a membership because accepting TOS updates, which the app requires you to do when you open it, cancels the membership cancellation. That's certainly bad, and is a strong sign of either maliciousness or an incompetent testing department--but I don't see how it is a privacy violation.