8 ms·

Why we can't have privacy on the internet (2018)

47 points by tikhonj 7y ago

api 7y ago
"People won't pay for privacy" is it, and it's really a subset of the larger truth that it's hard to get people or businesses to pay for security. (Privacy is a part of security.) I worked with a serial entrepreneur once who refused to tell his tech people to spend any time on security. He said "no company ever failed because of bad security... nobody cares about anything except UX and price." I dont think he was 100% right but I do think he was like 98% right. Privacy is like legroom on flights. Everyone complains about it being taken away but nobody will pay even a little bit for it. Price signals say nobody really cares. Meanwhile advertisers, governments, and political propagandists will pay handsomely for user data. If anything the price signals say to minimize privacy and maximize surveillance surface area.
- TeMPOraL 7y ago
  It's not like nobody will pay for it - usually, the option isn't available. When the market doesn't offer an option, or offers it bundled with a lot of other unrelated options, then you can't claim people "voted with their wallets" - much for the same reason you can't claim people voted for issue X in a typical democracy, given that they only had a choice between whole political parties. WRT. legroom - don't know the history here, but I doubt it was ever an isolated issue by which people could differentiate otherwise equivalent flights. Plus, there's the "boiling frog effect" involved, in which you remove conveniences in very small increment that at every point sounds like a reasonable trade-off, but it wouldn't if 20 years worth of changes were to happen immediately.
- saagarjha 7y ago
  Many people will pay a premium for privacy if you bundle it with the other things, though: see Apple’s market strategy.
  - themacguffinman 7y ago
    So, in other words, they're not paying a premium for privacy, they're paying a premium for the other things you bundle.
- joefourier 7y ago
  > Privacy is like legroom on flights. Everyone complains about it being taken away but nobody will pay even a little bit for it. Price signals say nobody really cares. That's not true at all, otherwise first class, business class and even premium economy would not exist. I've personally paid extra for a seat with more legroom on 2 hour Ryanair flights. It's just a question of what you value (and can afford). The same goes for privacy - there is definitely a portion of users out there willing to pay extra for services and companies that, at the very least, exploit your user data less than the others. See Apple's latest stance - they are basically packaging privacy as a luxury good. Or the VPN market, paid email providers instead of Gmail, chat applications such as Signal, Riot, Telegram...
- jstarfish 7y ago
  He is wrong in that quite a few (smaller) companies have gone defunct due to bad security, but he was right in that the hare that cuts every corner, rushes its product to market and (maybe!) gets breached will outperform the turtle that gets hamstrung by the governance, security and bureaucracy within its shell and doesn't produce anything.
- FridgeSeal 7y ago
  People can’t pay for privacy if it’s not offered as an option, because most solutions are being offered by groups who have a vested interested in not offering privacy options.
  - black_bird 7y ago
    If these options do not exist - which is not true - it is because there is not enough consumer demand. No one produces wine in an abstemious society for obvious reasons.
verisimilitudes 7y ago
This article is drivel. >how many of you pay at least 500rs/month for services that give you privacy It's my understanding that's between $7.00 and $8.00; I pay less than half of that to have an entire server I use for things such as hosting my own email server for my personal use. >Instead of paying for it, many of the people at the panel wanted the government to mandate it. Moreover, many people seemed to think it would somehow be free to provide. I can understand why this would be looked down upon, but isn't this the manner of thing a government is intended to do? If we're going to pretend democracy is so great, then people wanting the government to outlaw certain business models is perfectly reasonable. >Will you pay $20-50 a month to replace your free online services with privacy preserving ones? I'll pay for a server and that's all. If I can no longer read some articles online because of a pay wall, then I won't, but I may if it's otherwise available to me gratis, but I still won't allow any JavaScript to run and so won't see any advertisements. If they dislike people not viewing advertisements, they should have a pay wall, but many of these organizations are aware people won't pay for what they offer. >User tracking enables product managers/UI designers to figure out exactly what customers want, and give it to them. They can go to Hell. >A special case of fraud which also relates to the problem of paying for services with advertising is display network fraud. Here's how it works. I run "My Cool Awesome Website About Celebrities", and engage in all the trappings of a legitimate website - creating content, hiring editors, etc. Then I pay some kids in Ukraine to build bots that browse the site and click the ads. Instant money, at the expense of the advertisers. This never ceases to amuse me, so far. >To prevent this, the ad network demands the ability to spy on users in order to distinguish between bots and humans. They can also go to Hell. >Question: What does the government call a payment platform that provides privacy to it's users? >Answer: Money laundering. Money laundering is a made-up crime, just as with jaywalking and copyright infringement. >In many cases, censorship authorities require social networks and others to track and notify them about people posting illegal content (Nazi imagery, child pornography, Savita Bhabhi, anti-Islamic content). Oh, so the government makes rules that make something illegal, so the illegal thing is bad. Yes, I can't run a service that transfers money and is unmoderated, because it's illegal. I'm American and I'm well aware this ''freedom'' I enjoy is a lie. >This is a fundamental collective action problem, and no player in the game seems to have the ability change things. Right, governments conspire against their citizens, but this is an intractable problem. >There are bad actors out there - fraudsters/scammers, terrorists laundering money, legal gun manufacturers moving money around, child pornographers, people who believe in evolution (even among humans), people advocating abandoning Islam, Russians posting Pepe memes, and journalists/revenge pornographers revealing truthful information that people want kept hidden. Any privacy preserving network, at it's core, allows these people to engage in these actions without interference. Many of these things aren't like the others. What utter foolishness.
saagarjha 7y ago
> There are bad actors out there - fraudsters/scammers, terrorists laundering money, legal gun manufacturers moving money around, child pornographers, people who believe in evolution (even among humans), people advocating abandoning Islam, Russians posting Pepe memes, and journalists/revenge pornographers revealing truthful information that people want kept hidden. I can think of maybe two of these that are are “bad actors”.
cosmodisk 7y ago
I think this is because of the assumed level of risk. People don't think it'd happen to them.My colleague's house was nearly burgled. Once that happened, he invested in intrusion detection system and etc.So his level of assumed risk has gone off the charts. Some years ago I made a suggestion to the company owners that we should ramp up on security,at least starting with getting an antivirus. One said he'd use the insurance from the bank if we get robbed,while the other said it slows down his PC( an avid player)...While now we do have much more than just an antivirus, the assumed level of risk is still pretty low. People simply don't care...
- umvi 7y ago
  I hate anti-virus software. I have yet to be convinced it is worth the CPU cycles it eats. I would rather reformat my hard drive if there is a malware issue than have McAfee running 24/7
  - jstarfish 7y ago
    The better ones will alert you before you detonate anything, so having an agent can be useful for preventing less savvy users from getting infected with viruses last seen in 1992.
- pirocks 7y ago
  Not sure exactly how to phrase this comment. If I see a computer with an antivirus on it(besides the default windows defender thing), I assume it is less secure than something with an antivirus. Most often it was installed by someone who was either mislead about the benefits of an antivirus and/or tricked into installing it. Getting adblock is an massively better way of making a computer secure.
  - ACow_Adonis 7y ago
    I admit, if I see a computer with anti-virus software running on it these days, my first assumption is that its the anti-virus software that's the scam/payload...
danShumway 7y ago
> If we built a privacy preserving payment network, it would be used for money laundering, drug sales and ransomware. Like cash! > There are privacy preserving/censorship resistant social networks. They're full of Nazis. Oh crud, has anyone told Mastodon yet? This seems like the sort of thing they'd want to know. I guess it's time to go back to safer, Nazi-free networks like Twitter.
- pessimizer 7y ago
  Or the telephone network
xfitm3 7y ago
Classic fear mongering. The so called risks of these bad actors are part of life, and something we must accept. There will always be evil.
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
jakelazaroff 7y ago
> Every online service costs money to provide. [...] Since most people are unwilling to pay for online services, the way to cover these costs is by advertising to the users. Why does it follow that we should be okay with privacy intrusions? Companies don't have a right to their business model. If we as a society decide to limit how companies can collect and use our data, and it forces some to start charging their users or go out of business, that's okay! Just because that's a sustainable way to run a business right now doesn't mean it should be.
- enitihas 7y ago
  How would we as a society decide that? The majority of society is more concerned with putting food on the table and paying their rent, and would have zero interest in deciding to get rid of "paid by data" products. Unless we as a society can provide everyone the basic amenities first(food,home,maybe a job), I am not sure people are willing to let go these seemingly free services. Getting control of your data is very important, but the vast majority of humans have many far more pressing concerns.
  - kekebo 7y ago
    The assumption that most of western society is busy with securing basic survival seems like a constructed knockout argument. The fact that you are here to discuss the matter indicates that doesn't apply to yourself for instance. As for how society would decide it, I see consumer pressure as decisive, the more ethical handling of data becomes a selling point, the more financial incentives companies have to implement and market it. It's visible right now in how Apple positions itself against Google as the more privacy minded company with enough public appraisal to challenge, if not invalidate, your assumption.
  - deogeo 7y ago
    "Do nothing until we've solved poverty." And there are many assumptions in your post that are not necessarily true: 1. Services could still be free to most users, with paid versions that provide more functionality. 2. Privacy invasion and advertising has a cost, that those very people worrying about food have to pay. They don't have to pay 2$/month for e-mail, but then will spend N$ for the expertly marketed toy/cereal their child is throwing a tantrum over, and their own purchasing choices will also be affected adversely - advertising works.
earenndil 7y ago
The only reason that private/censorship-free platforms end up filled with nazis, is that they have nowhere else to go. If all the platforms are private/censorship-free, then the problem is mitigated.
miki123211 7y ago
When I see things like this, I just wish HN had a superupvote button. Definitely adding this to my "favorite, underappreciated articles that everyone should read" list. I think a solution to the problems outlined in the article is sneakily smuggling privacy with something else (Apple sort of does that) or making government resistant solutions. I mean systems that you don't even run, that you release to the world and you have no control over. Solutions that communicate in ways hard to detect, and have no central points of failure. Solutions that are hard to shut down, that never die unless the last two computers using them die. They must be tampering and censorship resistant, no matter if you call the censorship censorship, protection against terrorism or preventing copyright infringement. Yes, it is hard, especially that, for any hope of success, the solutions must be as good (or better) than centralized ones. If they are not (if their UX is not), people won't flock to them. That is our only hope of winning in this war. The fight will be hard. It laready is, but that's the only way forward, if we don't want to live in an Orwellian state in twenty years.
novok 7y ago
I did some napkin math on ad revenues arpu for the big 5 ad supported tech companies and came to the conclusion that you could cover all of their revenues if you could charge $7-10/month for every user, which is netflix money for a set of services that are far more useful than netflix itself. So I forsee something like 'setapp/netflix for privacy' that could cover it all for $10/month with enough scale. Because honestly, paying $10 for each subservice quickly adds up to $100s/month
- johnchristopher 7y ago
  I strongly believe it's doable and there's a market - although small - for that. WhatsApp used to be $1 a year and it was profitable. > https://www.investopedia.com/articles/personal-finance/040915/how-whatsapp-makes-money.asp https://www.investopedia.com/articles/personal-finance/04091... The short answer used to be $1 at a time. In some countries, the app used to cost about $1 to download; in others, the first year is free, but each subsequent year costs $1 – in other words, WhatsApp had a subscription model. At the peak under this model it has about 700 million users worldwide; yearly revenue can be estimated at $700 million per year at this time. There's no reason we couldn't get a $10 a month budget that would give users mail, instant messaging, file sharing or hosting of some kind. But there wouldn't be any of the perspective of the spectacular kind of growth the adtech bubble is trying to sell or integrated software solutions à-la Google that monopolies like so much.
  - novok 7y ago
    Most whatsapp users didn't pay the $1/year over several years I've heard.

47 points by tikhonj 7y ago

api 7y ago

"People won't pay for privacy" is it, and it's really a subset of the larger truth that it's hard to get people or businesses to pay for security. (Privacy is a part of security.) I worked with a serial entrepreneur once who refused to tell his tech people to spend any time on security. He said "no company ever failed because of bad security... nobody cares about anything except UX and price." I dont think he was 100% right but I do think he was like 98% right. Privacy is like legroom on flights. Everyone complains about it being taken away but nobody will pay even a little bit for it. Price signals say nobody really cares. Meanwhile advertisers, governments, and political propagandists will pay handsomely for user data. If anything the price signals say to minimize privacy and maximize surveillance surface area.

TeMPOraL 7y ago
It's not like nobody will pay for it - usually, the option isn't available. When the market doesn't offer an option, or offers it bundled with a lot of other unrelated options, then you can't claim people "voted with their wallets" - much for the same reason you can't claim people voted for issue X in a typical democracy, given that they only had a choice between whole political parties. WRT. legroom - don't know the history here, but I doubt it was ever an isolated issue by which people could differentiate otherwise equivalent flights. Plus, there's the "boiling frog effect" involved, in which you remove conveniences in very small increment that at every point sounds like a reasonable trade-off, but it wouldn't if 20 years worth of changes were to happen immediately.
saagarjha 7y ago
Many people will pay a premium for privacy if you bundle it with the other things, though: see Apple’s market strategy.
- themacguffinman 7y ago
  So, in other words, they're not paying a premium for privacy, they're paying a premium for the other things you bundle.
joefourier 7y ago
> Privacy is like legroom on flights. Everyone complains about it being taken away but nobody will pay even a little bit for it. Price signals say nobody really cares. That's not true at all, otherwise first class, business class and even premium economy would not exist. I've personally paid extra for a seat with more legroom on 2 hour Ryanair flights. It's just a question of what you value (and can afford). The same goes for privacy - there is definitely a portion of users out there willing to pay extra for services and companies that, at the very least, exploit your user data less than the others. See Apple's latest stance - they are basically packaging privacy as a luxury good. Or the VPN market, paid email providers instead of Gmail, chat applications such as Signal, Riot, Telegram...
jstarfish 7y ago
He is wrong in that quite a few (smaller) companies have gone defunct due to bad security, but he was right in that the hare that cuts every corner, rushes its product to market and (maybe!) gets breached will outperform the turtle that gets hamstrung by the governance, security and bureaucracy within its shell and doesn't produce anything.
FridgeSeal 7y ago
People can’t pay for privacy if it’s not offered as an option, because most solutions are being offered by groups who have a vested interested in not offering privacy options.
- black_bird 7y ago
  If these options do not exist - which is not true - it is because there is not enough consumer demand. No one produces wine in an abstemious society for obvious reasons.

verisimilitudes 7y ago

This article is drivel. >how many of you pay at least 500rs/month for services that give you privacy It's my understanding that's between $7.00 and $8.00; I pay less than half of that to have an entire server I use for things such as hosting my own email server for my personal use. >Instead of paying for it, many of the people at the panel wanted the government to mandate it. Moreover, many people seemed to think it would somehow be free to provide. I can understand why this would be looked down upon, but isn't this the manner of thing a government is intended to do? If we're going to pretend democracy is so great, then people wanting the government to outlaw certain business models is perfectly reasonable. >Will you pay $20-50 a month to replace your free online services with privacy preserving ones? I'll pay for a server and that's all. If I can no longer read some articles online because of a pay wall, then I won't, but I may if it's otherwise available to me gratis, but I still won't allow any JavaScript to run and so won't see any advertisements. If they dislike people not viewing advertisements, they should have a pay wall, but many of these organizations are aware people won't pay for what they offer. >User tracking enables product managers/UI designers to figure out exactly what customers want, and give it to them. They can go to Hell. >A special case of fraud which also relates to the problem of paying for services with advertising is display network fraud. Here's how it works. I run "My Cool Awesome Website About Celebrities", and engage in all the trappings of a legitimate website - creating content, hiring editors, etc. Then I pay some kids in Ukraine to build bots that browse the site and click the ads. Instant money, at the expense of the advertisers. This never ceases to amuse me, so far. >To prevent this, the ad network demands the ability to spy on users in order to distinguish between bots and humans. They can also go to Hell. >Question: What does the government call a payment platform that provides privacy to it's users? >Answer: Money laundering. Money laundering is a made-up crime, just as with jaywalking and copyright infringement. >In many cases, censorship authorities require social networks and others to track and notify them about people posting illegal content (Nazi imagery, child pornography, Savita Bhabhi, anti-Islamic content). Oh, so the government makes rules that make something illegal, so the illegal thing is bad. Yes, I can't run a service that transfers money and is unmoderated, because it's illegal. I'm American and I'm well aware this ''freedom'' I enjoy is a lie. >This is a fundamental collective action problem, and no player in the game seems to have the ability change things. Right, governments conspire against their citizens, but this is an intractable problem. >There are bad actors out there - fraudsters/scammers, terrorists laundering money, legal gun manufacturers moving money around, child pornographers, people who believe in evolution (even among humans), people advocating abandoning Islam, Russians posting Pepe memes, and journalists/revenge pornographers revealing truthful information that people want kept hidden. Any privacy preserving network, at it's core, allows these people to engage in these actions without interference. Many of these things aren't like the others. What utter foolishness.

saagarjha 7y ago

> There are bad actors out there - fraudsters/scammers, terrorists laundering money, legal gun manufacturers moving money around, child pornographers, people who believe in evolution (even among humans), people advocating abandoning Islam, Russians posting Pepe memes, and journalists/revenge pornographers revealing truthful information that people want kept hidden. I can think of maybe two of these that are are “bad actors”.

cosmodisk 7y ago

I think this is because of the assumed level of risk. People don't think it'd happen to them.My colleague's house was nearly burgled. Once that happened, he invested in intrusion detection system and etc.So his level of assumed risk has gone off the charts. Some years ago I made a suggestion to the company owners that we should ramp up on security,at least starting with getting an antivirus. One said he'd use the insurance from the bank if we get robbed,while the other said it slows down his PC( an avid player)...While now we do have much more than just an antivirus, the assumed level of risk is still pretty low. People simply don't care...

umvi 7y ago
I hate anti-virus software. I have yet to be convinced it is worth the CPU cycles it eats. I would rather reformat my hard drive if there is a malware issue than have McAfee running 24/7
- jstarfish 7y ago
  The better ones will alert you before you detonate anything, so having an agent can be useful for preventing less savvy users from getting infected with viruses last seen in 1992.
pirocks 7y ago
Not sure exactly how to phrase this comment. If I see a computer with an antivirus on it(besides the default windows defender thing), I assume it is less secure than something with an antivirus. Most often it was installed by someone who was either mislead about the benefits of an antivirus and/or tricked into installing it. Getting adblock is an massively better way of making a computer secure.
- ACow_Adonis 7y ago
  I admit, if I see a computer with anti-virus software running on it these days, my first assumption is that its the anti-virus software that's the scam/payload...

danShumway 7y ago

> If we built a privacy preserving payment network, it would be used for money laundering, drug sales and ransomware. Like cash! > There are privacy preserving/censorship resistant social networks. They're full of Nazis. Oh crud, has anyone told Mastodon yet? This seems like the sort of thing they'd want to know. I guess it's time to go back to safer, Nazi-free networks like Twitter.

pessimizer 7y ago
Or the telephone network

xfitm3 7y ago

Classic fear mongering. The so called risks of these bad actors are part of life, and something we must accept. There will always be evil.

deleted 7y ago
[deleted]
deleted 7y ago
[deleted]

jakelazaroff 7y ago

> Every online service costs money to provide. [...] Since most people are unwilling to pay for online services, the way to cover these costs is by advertising to the users. Why does it follow that we should be okay with privacy intrusions? Companies don't have a right to their business model. If we as a society decide to limit how companies can collect and use our data, and it forces some to start charging their users or go out of business, that's okay! Just because that's a sustainable way to run a business right now doesn't mean it should be.

enitihas 7y ago
How would we as a society decide that? The majority of society is more concerned with putting food on the table and paying their rent, and would have zero interest in deciding to get rid of "paid by data" products. Unless we as a society can provide everyone the basic amenities first(food,home,maybe a job), I am not sure people are willing to let go these seemingly free services. Getting control of your data is very important, but the vast majority of humans have many far more pressing concerns.
- kekebo 7y ago
  The assumption that most of western society is busy with securing basic survival seems like a constructed knockout argument. The fact that you are here to discuss the matter indicates that doesn't apply to yourself for instance. As for how society would decide it, I see consumer pressure as decisive, the more ethical handling of data becomes a selling point, the more financial incentives companies have to implement and market it. It's visible right now in how Apple positions itself against Google as the more privacy minded company with enough public appraisal to challenge, if not invalidate, your assumption.
- deogeo 7y ago
  "Do nothing until we've solved poverty." And there are many assumptions in your post that are not necessarily true: 1. Services could still be free to most users, with paid versions that provide more functionality. 2. Privacy invasion and advertising has a cost, that those very people worrying about food have to pay. They don't have to pay 2$/month for e-mail, but then will spend N$ for the expertly marketed toy/cereal their child is throwing a tantrum over, and their own purchasing choices will also be affected adversely - advertising works.

earenndil 7y ago

The only reason that private/censorship-free platforms end up filled with nazis, is that they have nowhere else to go. If all the platforms are private/censorship-free, then the problem is mitigated.

miki123211 7y ago

When I see things like this, I just wish HN had a superupvote button. Definitely adding this to my "favorite, underappreciated articles that everyone should read" list. I think a solution to the problems outlined in the article is sneakily smuggling privacy with something else (Apple sort of does that) or making government resistant solutions. I mean systems that you don't even run, that you release to the world and you have no control over. Solutions that communicate in ways hard to detect, and have no central points of failure. Solutions that are hard to shut down, that never die unless the last two computers using them die. They must be tampering and censorship resistant, no matter if you call the censorship censorship, protection against terrorism or preventing copyright infringement. Yes, it is hard, especially that, for any hope of success, the solutions must be as good (or better) than centralized ones. If they are not (if their UX is not), people won't flock to them. That is our only hope of winning in this war. The fight will be hard. It laready is, but that's the only way forward, if we don't want to live in an Orwellian state in twenty years.

novok 7y ago

I did some napkin math on ad revenues arpu for the big 5 ad supported tech companies and came to the conclusion that you could cover all of their revenues if you could charge $7-10/month for every user, which is netflix money for a set of services that are far more useful than netflix itself. So I forsee something like 'setapp/netflix for privacy' that could cover it all for $10/month with enough scale. Because honestly, paying $10 for each subservice quickly adds up to $100s/month

johnchristopher 7y ago
I strongly believe it's doable and there's a market - although small - for that. WhatsApp used to be $1 a year and it was profitable. > https://www.investopedia.com/articles/personal-finance/040915/how-whatsapp-makes-money.asp https://www.investopedia.com/articles/personal-finance/04091... The short answer used to be $1 at a time. In some countries, the app used to cost about $1 to download; in others, the first year is free, but each subsequent year costs $1 – in other words, WhatsApp had a subscription model. At the peak under this model it has about 700 million users worldwide; yearly revenue can be estimated at $700 million per year at this time. There's no reason we couldn't get a $10 a month budget that would give users mail, instant messaging, file sharing or hosting of some kind. But there wouldn't be any of the perspective of the spectacular kind of growth the adtech bubble is trying to sell or integrated software solutions à-la Google that monopolies like so much.
- novok 7y ago
  Most whatsapp users didn't pay the $1/year over several years I've heard.