11 ms·
Just my own opinion, but at this point I think it's prudent to assume that pretty much anything you send out into the digital network world is public. If it's n
by bilbo0s 8y ago
Just my own opinion, but at this point I think it's prudent to assume that pretty much anything you send out into the digital network world is public. If it's not something you would want the world knowing you said, don't put it out there. Security breaches happen. Bugs happen. Sometimes law enforcement just comes by and says, "Give me everything that user X has ever done." In short, sh!t happens.
"Everything I do on the net can be authoritatively attributed to me personally."
That's the thought we should all have in our heads before we send any post, or send any text, or send any email, or send any photo, or etc etc etc. We shouldn't rely on some company, that's using us to make money, to protect our privacy.
- throwaway0009 8y ago> That's the thought we should all have in our heads before we send any post, or send any text, or send any email, or send any photo, or etc etc etc. I worked for a large company that had gotten into trouble in the past, with written records used as evidence. All new employees were trained not to write anything down that we would not want to see on the front page of the WSJ. It was stressed that even content on personal devices could be subpoenaed and entered into the public record if issues arose.
- setquk 8y agoTotally agree. But where does that leave us with “The Cloud”?
- bilbo0s 8y agoYou can use the cloud with confidence... for anything that you don't mind being publicly associated with you.
- setquk 8y agoI don't mind that myself. I mind my data being available to someone else when I marked as only for me.
- cbuq 8y ago"The Cloud" is like storing your data with skywriting, you can see it from many locations, but so can your neighbors
- dymk 8y agoA very poor analogy when encryption exists
- mikestew 8y agoWho said skywriting can't use encryption?
- dymk 8y agoWhat skywriting uses encryption? How is that a useful metaphor for describing the downsides of "cloud storage"?
- setquk 8y agoFor the average cloud platform it is totally insufficient to protect you from a bad actor or stupid programmer at the provider. Imagine if IAM had a major vulnerability suddenly...
- agumonkey 8y agohttps://proxy.duckduckgo.com/iu/?u=http%3A%2F%2F2.bp.blogspot.com%2F-ItVTicsayxI%2FU5r-CpqIJLI%2FAAAAAAAANX8%2FjMc6mE7Jdyc%2Fs1600%2Fsmoke-signals.gif&f=1 https://proxy.duckduckgo.com/iu/?u=http%3A%2F%2F2.bp.blogspo...
- ams6110 8y agoNot just the cloud. Any internet connected system, whether in the cloud or on-premises, is vulnerable to intrusion, data breaches, etc. The only system that would be somewhat trustworthy would be a totally air-gapped internal system. This used to be the norm, pre-internet. Few businesses really have this today.
- setquk 8y agoYes I worked for a totally airgapped defence contractor many years ago. It was very boring :)
- bookofjoe 8y ago2015: https://www.techrepublic.com/article/air-gapped-computers-are-no-longer-secure/ https://www.techrepublic.com/article/air-gapped-computers-ar... 2018: https://www.tektonikamag.com/index.php/2018/05/18/your-air-gapped-computers-arent-safe-from-computer-hacking/ https://www.tektonikamag.com/index.php/2018/05/18/your-air-g... 2018: https://www.zdnet.com/article/how-safe-is-your-air-gapped-pc-attackers-can-now-suck-data-out-via-power-lines/ https://www.zdnet.com/article/how-safe-is-your-air-gapped-pc...
- setquk 8y agoIt was an RF tight triple wall secure engineering facility with no windows and power filtering. Vehicles and people searched on entry and exit. They knew very well of these risks a long time ago. To give you an idea, the building was designed in the 1950s where they even had dampers on the water pipes coming on site due to the use of typewriters historically.
- craftyguy 8y ago'The cloud' is really just a bunch of computers owned and operated by other people.
- pkulak 8y agoWith a couple exceptions perhaps, like Signal or iMessage? But I agree; unless the service is part of a very small whitelist, assume it's public.
- jerrysievert 8y agoexcept even those messages can become public, if one party makes them so, so even "secure" messaging should be considered compromised.
- eseehausen 8y agoThat and most users aren't auditing each new version of the apps to make sure they're still doing what they say they're doing to protect data.
- cortesoft 8y agoSo at that point, you are basically saying "assume all communications over any medium is public", because this would apply to every form of communication.
- kvakil 8y agoModern secure messaging systems are typically OTR and have deniability: after the session ends, anybody can forge messages to make it look like they came from you. Sure the messages can become public, but they're no more "proof" than someone saying "X said Y".
- CodeMage 8y agoDeniability is not the same as privacy and can't be used to replace it.
- eugeniub 8y agoThe result of this is the attitude that we shouldn’t even bother trying to make services and products more secure. Why send tweets over HTTPS? It’s all public anyway. Why should WhatsApp use end-to-end encryption given Facebook’s hostility to user privacy?
- deleted 8y ago[deleted]
- Rychard 8y agoWhile the parent has a valid point, I agree with you in the sense that such an attitude doesn't effectively convey the intended message. I think it's unrealistic to expect the average non-technical user to understand the distinction between HTTPS and something being "private". That said, I don't really know of a better way to phrase it; describing this sort of stuff to non-technical users is a bit of a minefield, so I can certainly relate to the solution of "just assume the worst and nothing can go wrong", because if followed, it's unarguably the safest thing to do. It's a solution in the same sense as "teaching abstinence to teenagers to avoid unwanted pregnancies" is, which is to say that it's largely ineffective at solving the problem, despite being the most effective of all options.
- jMyles 8y agoNevertheless, we can meaningfully make distinctions between sending a message via Riot or Signal vs. sending "private" messages on Facebook or Twitter. It's a spectrum and not a binary condition.
- deleted 8y ago[deleted]
- Varcht 8y agoAll our base are belong to them.
- nkkollaw 8y agoWhat you say !!
- yellowapple 8y agoSomeone set us up the data breach
- simion314 8y agoSo how do I send an email or private message if I consider it public? I think your point is almost right just you need to make it more fuzzy(in the sense of using probabilities).
- VikingCoder 8y agoEric Schmidt: "If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place." People have taken this different ways, but personally I think it's sage advice. We've lost our ability to keep secrets. Information wants to be free. We're terrible at digital security. Pretend everything you type into a computer is on the front page of the New York Times.
- whyte_mackay 8y agoA case of "do as I say and not as I do". Besides Eric Schmidt is powerful and rich enough to stop people from talking. Not exactly a level playing field there. Maybe Eric should not have a private Instagram account which follows young models. Maybe Eric should not ask Google to delete results about his political donations.
- blattimwind 8y ago> Eric Schmidt: "If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place." Would he extend this idea to clandestince agencies?
- roywiggins 8y agoOr Google's trade secrets...
- anewguy9000 8y agohow is that advice? if you have x maybe you shouldnt have x lol
- rando444 8y agoUnfortunately we live in a world where authoritarian governments still exist.
- Zarath 8y agoBetter not be openly gay in Russia! Or openly gay 15 years ago and have them scrape old data and find out.
- elorant 8y agoIf you go down this line it won't take long for various actors to assume that you're ok with them knowing everything you do offline too. Either we protect privacy or we don't. There's no middle ground.
- burtonator 8y agoI'm working on an app with some social collaboration features: https://getpolarized.io/ https://getpolarized.io/ These security breaches are really screwing me over. Our user base is really really pissed at Facebook, Twitter, etc. and the pendulum has swung the other direction. I think they're borderline paranoid about sharing their data. I mean whether they are justified or not is one thing but I definitely do not personally have any nefarious goals. This is going to have a very chilling effect for the cloud industry for years go come. People are just going to refuse to share data with newer social platforms and only share it with platforms when they HAVE to because they have pre-established network effects.
- ams6110 8y agoEven a service without nefarious goals can have a breach. The biggest companies that devote huge teams of people to preventing them still have them. Can happen to anyone.
- burtonator 8y agoOh certainly ... I agree. I think the point I'm trying to make is that most of the things we're storing aren't classified docs.
- hombre_fatal 8y agoLooking at your comment history, you link to your website in almost every comment you write. Don't you think that's a bit excessive?
- mrspeaker 8y agoI'm often surprised how much people share via Slack as if it's an impenetrable fortress: perfect for pasting admin passwords, keys, and incriminating opinions and business secrets... if that floodgate ever opens then it will be a crazy time for us devs!
- alexandercrohde 8y agoJust as a heads up on this, slack doesn't even use HTTPS! Your employer can certainly read all private slacks on your work network, even if it's a non-work-slack workspace
- ninkendo 8y agoDo you have a source for this? That sounds very surprising if true.
- teraflop 8y agoThis is absolutely not true, as a cursory examination of your browser's dev tools will reveal.
- ReidZB 8y agoPretty sure it uses HTTPS, but if you're on a corporate network on corporate hardware, there is a real chance that there's a corporate MITM proxy that is capable of reading all of your HTTPS traffic.
- isostatic 8y agoOnly if you have their root certificate trusted
- maxxxxx 8y agoYou have to do that if you want to do any work.
- doesnt_know 8y ago
- duxup 8y agoAs for caution, I agree. As for advocacy and laws I'd like to see a lot more assurance that ... that isn't the case. I'm kinda going both ways with it.
- shittyadmin 8y ago> That's the thought we should all have in our heads before we send any post, or send any text, or send any email, or send any photo, or etc etc etc. We shouldn't rely on some company, that's using us to make money, to protect our privacy. So don't, but that doesn't mean that everything can be attributed to you personally - even attributing something to a relatively dissociated username is difficult. At best you'll get an IP and that IP could belong to one or many people. Anything you idiotically attribute to yourself (including private messages on your accounts) is attributable to you personally - assume all cloud services are fully compromised or extremely willing to misbehave. Act accordingly. Never provide real information online, use shared IPs, VPNs, Tor in cases where repercussions could be significant. If you want privacy, don't expect it to be provided, take personal responsibility for it.
- odorousrex 8y agoThis is what I have been teaching my kids and their cousins: 1) Everything you do on the internet is public 2) Everything you post on the internet is forever 3) Everything above can be traced back to you I also showed them how easy it is to save private and public snaps without sending a screenshot notification (including video!) and how easy it is to fake. It's hard to know if it's sinking in or not, but I hope so. I wish I could show parents who are not tech saavy how to get these points across to their children.
- marcosdumay 8y agoAll those lines would be better with ", except when you want it to" appended at the end.
- vollmond 8y agoThe entire point of the post is that "what you want" doesn't apply to this.
- lotyrin 8y agoGP's point was, I think, that if you wish for something to be permanent, then it won't be (have backups). Not exactly relevant but not contrary to the core concept we're discussing (being pessimistic about the quality of service).
- pmlnr 8y ago> Everything you post on the internet is forever I wish it was. Anything on social media maybe, but the broader internet dies in ~10 years.
- mlindner 8y agoA lot of my forum posts from 2004 are still around. Also web archive exists meaning that all those sites are being archived even if the site hosting that content disappears.
- menzoic 8y agoThis brings to mind the popular Blind app where co-workers feel safe enough about their anonymity to put things online that they never would have otherwise. https://www.teamblind.com https://www.teamblind.com
- lukejduncan 8y agoDefinitely agree. I remember a long time ago Facebook profile pictures used to be private. And then one day without notice they became public. For some reason, I can't find any news articles about when this happened. Maybe I'm crazy or maybe the Internet is gaslighting me. Either way, I had friends who grew up in very conservative muslim families who no longer wore the Hijab but hadn't "come out" to their parents yet. Then one day they woke up to their facebook profile pictures being public where they weren't wearing a hijab and they haven't talked to their parents since. Anything you put online has a non-zero probability that it will be 1) hacked 2) released as a bug or 3) released as a change in policy.
- ladzoppelin 8y agoIn 2007/2008 as I quit Facebook after this happened and a bunch of other settings would without notice.
- deleted 8y ago[deleted]
- hrktb 8y agoI think there is a line between accepting that accidents happens, and assuming that it does. Imagine assuming that every time you cross the street you’ll get hit by a car. Assuming every time you see someone it will be the last time ever. Assuming ever day you live might be the last one. That’s no way to live, I find it incredibly mentally taxing and insane if actually followed. Sure security breach can happen in any service, we should still treat most of them as reasonably private for any casual use.
- modzu 8y agono, its worse than that. everything you do [period] will be available to the public. the reason the twitter story is news is because they were private tweets. yes on an "internet service" but do you think your operating system is your own anymore? microsoft uses MS accounts for default windows installs, onedrive is installed automatically, icloud backup, etc etc. this is still in the purview of the "digital" world but the privacy concern is indeed larger than the "internet" world. beyond this we have the IoT. your google home devices (or if not yours, someone elses) recording everything you do when not even digitally engaged. we had best be ready for it. i really hope it doesnt turn into self-censorship. i hope it turns into more open mindedness and acceptance (oh, my neighbour isn't perfect either??)
- paulddraper 8y ago> at this point I think it's prudent to assume that pretty much anything you send out into the digital network world is public So....what? I can't do my banking online? I can't send private correspondence? I can't file my taxes electronically? I can't pay my medical bills online? (Actually all my medical information are put online my insurance co.; I'm pretty sure I can't do anything about that.) I'm not saying you're wrong; I just don't see how that prudence as leads to any practical conclusions or advice.
- TeMPOraL 8y agoIt leads to a very practical conclusion: don't be surprised when you find out that some or all of the above data is known by third parties.
- yingw787 8y agoI don't think this is a healthy assumption to make. Even if you are not embarrassed by the possibility that any message you send could end up on the New York Times, things like industrial espionage (aided in large part by state actors), corporate politics, or even operational security (e.g. identity theft) could grind your life to a halt. The threat space is too large, and it'd be an eventuality that your life will grind to a halt. You shouldn't rely on a company to look out for you. You have to have laws and official, proven avenues of redress for assured privacy. For example, I trust the USPS Inspector General to protect the privacy of my mail. Somebody might tamper with it and succeed once or twice, but I'm not going to have a paradigm shift and think my mail will always be broken into.
- dgzl 8y ago> it's prudent to assume that pretty much anything you send out into the digital network world is public Interestingly enough, this is how I used to justify piracy when I was young. Since digital data almost seems liquid, if an artist doesn't want their content spread, better not make it digital in the first place.
- badrabbit 8y agoThe problem is the "digital world" is not a separate world but an integral part of every day world. I know what you say is true,but I still would behave as if some aspects of my digital behavior is private. Otherwise I'd be allowing this lack of privacy to shape and mold who I am as a person.
- shiven 8y agoProphetic (2013) & very relevant today: https://www.rooshv.com/the-most-insidious-method-of-control-never-devised https://www.rooshv.com/the-most-insidious-method-of-control-...
- prawn 8y agoOne good thing about this is that it encourages me to write charitably if I would otherwise speak of someone critically. I write and do anything as if it might end up in court as evidence basically. Could be tiresome but I’d like to think that it motivates me to be more positive or careful.
- rhizome 8y agoSo in other words, stop holding business accountable for data leaks?