3 ms·

Schneier is (as usual) right. It is far too easy (in fact, the default) to store every little detail about customers interacting with services you control. Only

Schneier is (as usual) right. It is far too easy (in fact, the default) to store every little detail about customers interacting with services you control. Only some of this data can be justified for business or technical reasons. The rest is dead weight and an actual liability. A simple example relevant to readers here: every web server I know of logs information about each request and retains those logs for a long period of time (because, who cares? Disk space is cheap). But those logs contain IP addresses and possibly other identifying information. Web servers get broken into all the time - if those logs get leaked people can use those logs to build profiles of your visitors and possibly correlate with other data sets to tease out information about specific visitors. On my website it would be easy to spot the admin IP address for further attacks. Paranoid? Perhaps. During WWII the slogan was "Loose Lips Sink Ships" - any slip of information could be the final piece of data that gives the enemy a fatal advantage. We are effectively at war with criminals and actual foreign states (not to mention corporate interests) who are continually looking for similar advantages. Even random script kiddies want your data. One of the things I like about the GDPR is that it force companies (and individuals) to recognize the danger and act accordingly. A longer essay I wrote along the same lines[0] [0] https://sheep.horse/2018/6/the_eu_general_data_protection_regulation_and_me_%28.html https://sheep.horse/2018/6/the_eu_general_data_protection_re...

jiveturkey 7y ago
> Schneier is (as usual) right. It's easy to be right when you argue both sides! https://www.schneier.com/blog/archives/2018/01/security_breach.html https://www.schneier.com/blog/archives/2018/01/security_brea...
- AndrewStephens 7y ago
  Not sure what you are trying to say here. The original article and the one you posted are not inconsistent - in your link Schneier quotes some research that the stock market doesn't care about data breaches, probably because there is little direct financial damage. Hence there is little incentive for companies to stop stockpiling every scrap of data. Schneier is arguing that the risk to individuals and society at large is greater than any benefit this data could provide. One way to remove the incentives to gather and store data is through regulation and fines - then the stockmarket would care.
  - jiveturkey 7y ago
    > Schneier is arguing that the risk to individuals and society at large is greater than any benefit this data could provide. I don't think we read the same (2016) article. In the one I read, he is claiming that holding onto personal data is about banking it for future revenue (he actually says profitability, but I think he is just not being savvy here). Where he specifically talks about risks, he talks about risks to the company, to PR. Nothing, not a chirp, about damage to the individuals or society at large. Earlier in the article he actually cites Anthem and Target, the 2 biggest breaches to date (as of 2016). Ironic because these breaches did no damage to the companies. Also, not a well formed argument because those companies weren't monetizing personal data in the way that we think of as privacy invasive, or "user as the product". Whether or not personal data is a toxic thing to be avoided, those companies needed to take that data. In the 2016 article I read, Schneier is claiming that the risk analysis is flawed and the damage to a company from the eventual breach/loss of personal data, outweighs the financial gain to be realized from that data. He's trying to appeal to market wisdom, not social good. "protect your bottom line", not "think of the children". Which is a fine thesis. But the 2 primary examples he gives in the same article prove himself wrong, and an academic study in 2018 further proves this to be wrong. > One way to remove the incentives to gather and store data is through regulation and fines - then the stockmarket would care. Yep, only then. It's a bit like a class action. Each individual person that is caught up in a privacy breach, suffers just this little bit and doesn't have an individual voice for redress at all. "The market" will thus do as it will with such data. We need a big hammer to fix it. GDPR has been a huge benefit for privacy, as partly evidenced by all the naysayers using implementation cost as their argument. In the US, when the dust finally settles around Equifax, we may move the needle. To finally answer your first point, I'm saying that Schneier was wrong in 2016 and he corrected himself in 2018.
    - AndrewStephens 7y ago
      I think Schneier is trying to say in both cases that it is not worth the risks, but I'll concede that we are arguing a very fine point. In any case, I agree with Schneier in this latest post and have argued along these lines myself.

jiveturkey 7y ago

> Schneier is (as usual) right. It's easy to be right when you argue both sides! https://www.schneier.com/blog/archives/2018/01/security_breach.html https://www.schneier.com/blog/archives/2018/01/security_brea...

AndrewStephens 7y ago
Not sure what you are trying to say here. The original article and the one you posted are not inconsistent - in your link Schneier quotes some research that the stock market doesn't care about data breaches, probably because there is little direct financial damage. Hence there is little incentive for companies to stop stockpiling every scrap of data. Schneier is arguing that the risk to individuals and society at large is greater than any benefit this data could provide. One way to remove the incentives to gather and store data is through regulation and fines - then the stockmarket would care.
- jiveturkey 7y ago
  > Schneier is arguing that the risk to individuals and society at large is greater than any benefit this data could provide. I don't think we read the same (2016) article. In the one I read, he is claiming that holding onto personal data is about banking it for future revenue (he actually says profitability, but I think he is just not being savvy here). Where he specifically talks about risks, he talks about risks to the company, to PR. Nothing, not a chirp, about damage to the individuals or society at large. Earlier in the article he actually cites Anthem and Target, the 2 biggest breaches to date (as of 2016). Ironic because these breaches did no damage to the companies. Also, not a well formed argument because those companies weren't monetizing personal data in the way that we think of as privacy invasive, or "user as the product". Whether or not personal data is a toxic thing to be avoided, those companies needed to take that data. In the 2016 article I read, Schneier is claiming that the risk analysis is flawed and the damage to a company from the eventual breach/loss of personal data, outweighs the financial gain to be realized from that data. He's trying to appeal to market wisdom, not social good. "protect your bottom line", not "think of the children". Which is a fine thesis. But the 2 primary examples he gives in the same article prove himself wrong, and an academic study in 2018 further proves this to be wrong. > One way to remove the incentives to gather and store data is through regulation and fines - then the stockmarket would care. Yep, only then. It's a bit like a class action. Each individual person that is caught up in a privacy breach, suffers just this little bit and doesn't have an individual voice for redress at all. "The market" will thus do as it will with such data. We need a big hammer to fix it. GDPR has been a huge benefit for privacy, as partly evidenced by all the naysayers using implementation cost as their argument. In the US, when the dust finally settles around Equifax, we may move the needle. To finally answer your first point, I'm saying that Schneier was wrong in 2016 and he corrected himself in 2018.
  - AndrewStephens 7y ago
    I think Schneier is trying to say in both cases that it is not worth the risks, but I'll concede that we are arguing a very fine point. In any case, I agree with Schneier in this latest post and have argued along these lines myself.