13 ms·

> It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web st

by __jal 7y ago

> It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web still talk about the value of personal data (source: I ran Facebook’s ads backend for years). That may be the case for some people, but that is not my complaint, nor that of many folks I know. I simply don't care how FB, Google and other surveillance outfits make money. I don't care about marketers' careers or their CTRs. I don't even care about putting a dollar value on my LTV to them. I care about denying them visibility into my datastream. It is zero-sum. They have no right to it, and I have every right to try to limit their visibility. Why? None of your business. Seriously - nobody is owed an explanation for not wanting robots watching. But I will answer anyway. It is because of future risks. These professional panty sniffers already have the raw material for many thousands of lawsuits, divorces and less legal outcomes in their databases. Who knows what particular bits of information will leak in 10 years, or when FB goes bankrupt? I have no desire to be part of what I suspect will become a massive clusterfuck within our lifetimes. If you're correct that this data has so little value, then it is more likely it will leak. FB and Google are the equivalent of Superfund sites waiting to happen, and storing that data should be considered criminal.

benreesman 7y ago
You could either stop using these services or (as I suspect) you find them too valuable to dismiss entirely quarantine them to a VPN/incognito interaction in less time than it took to type that comment. I don’t want to single you out personally but there’s a broad trend on HN of bitter-sounding commentary on the surveillance powers of these companies by people who can easily defeat any tracking that it’s economical for them to even attempt let alone execute that reeks of sour grapes that a mediocre employee at one of these places makes 3-20x what anyone makes (as a rank and file employee) anywhere else. Again, you’re not likely part of that group, but seriously who hangs out on HN and can’t configure a VPN?
- saagarjha 7y ago
  > reeks of sour grapes that a mediocre employee at one of these places makes 3-20x what anyone makes (as a rank and file employee) anywhere else This is not an argument and moreover not even true: there are companies that pay well and don’t collect reams of data on their users.
  - benreesman 7y ago
    You didn’t address my argument and unless you’ve been on more comp committees than me then I would annotate that as sources needed.
    - saagarjha 7y ago
      Like I said: it’s not an argument, it’s an attack. Plus I’m sure that there’d be many people here able to counter your claim regardless of the compensation number you drop.
    - laughinghan 7y ago
      What argument? What possible position could "if you can't configure a VPN, you're probably mediocre" be an argument for?
- bad_user 7y ago
  How about our friends and family? Should we configure a VPN for them too? Btw the argument you just made applies to any form of surveillance or censorship. Just because your can still find functional VPN services for China, is China's great firewall OK? And what happens when web services start blocking VPNs? Netflix does it quite successfully. And I'm sure Cloudflare could provide such a service for free.
  - benreesman 7y ago
    I’m not making a moral argument for the surveillance state, I wear Curve25519 on one arm and the word “citizenfour” on the other. I agree that there is a vast and almost impossible to regulate overreach by these companies. Your argument is extremely compelling. But when HN users complain about being spied on I smell a FAANG rejection letter.
    - saagarjha 7y ago
      > when HN users complain about being spied on I smell a FAANG rejection letter I work at a FAANG: here’s my complaint about being spied on.
      - benreesman 7y ago
        So your comments should be at the top. You’re knowledgeable on the subject and even if we disagree that should be upweighted in a perfect world.
        saagarjha 7y ago
        :/
    - stOneskull 7y ago
      People care about others, not just themselves.
      - xg15 7y ago
- luckylion 7y ago
  > Again, you’re not likely part of that group, but seriously who hangs out on HN and can’t configure a VPN? Recaptcha tracks users / devices, not IPs. A VPN won't help, it'll only lower your score. At that point: not allowing them to track you just means you can't use large parts of the web. "You don't want that GPS tracker installed into your skull? Well, we won't force you, of course, but public transportation, government services and most grocery stores can only be used by GPS-skull-people"
  - benreesman 7y ago
    Wild speculative hyperbole hurts the case of people like you and I who care about doing something positive on the ground today.
    - bongobongo 7y ago
      It is not "wild speculative hyperbole" not to give the benefit of the doubt to companies that have repeatedly demonstrated that they are not entitled to the benefit of the doubt.
      - benreesman 7y ago
        GPS tracker installed in people’s skull sounds hyperbolic to me.
        deleted 7y ago
        [deleted]
        whenchamenia 7y ago
        How about peoples pockets? Its hyperbole, but not a huge reach.
    - luckylion 7y ago
      Is it though? I'm somewhat lucky, because my government is generally technologically behind and loves literal paper trails, but yours isn't. Plenty of .gov sites use recaptcha. Sure, you can still visit those sites, it's just that, unless you pass a captcha test, they can't verify that you're actually a person (and not a Russian bot) and can't let you do certain things. If you want to use those government services, you need to allow Google to track you, or maybe they'll add a "sign in with Facebook" option so you have a choice. With invisible captchas, you can't even sit down and solve a higher number of riddles to prove that you're really human and know what a fire hydrant looks like even though you look kinda strange. If Google doesn't believe that you are human, tough luck. Unless you have a personal connection or a solid Twitter following that an amplify your concerns, nobody at Google cares. Does your government care? It makes their life easier and normal citizens never really had problems with it. DHL makes me solve a captcha to login and buy postage stamps. There probably are, or will be, public transportation companies that use recaptcha. It helps them to combat voter fraud (crime, abuse, election meddling, fake news, lots of things) if they know where (on the web, for now) you've been in the last 6 months. You don't like the "implanting" part, because that's unrealistic? Just wait 20 years, and it may not be your head, but an RFID chip in your hand (yeah, those exist already). Until then, carry your gps tracker around and install their software on it, so it can collect data on your behavior to make sure that you're not a criminal.
- amenod 7y ago
  > You could either stop using these services or ... Are you serious? Have you tried not using their services? Try blocking Google Analytics, Tag Manager, ReCaptcha, fonts, gstatic,... What you will see is that you can no longer access much of the Internet. Want to participate in StackOverflow? Good luck if you block Google. My beef is not with them trying to find my data when I'm on their site(s). They are however everywhere, on almost every site I visit. Coupled with their (impressive) technical provess it is beyond creepy, and there is simply no way one can avoid them. I don't know what the solution is or will be, but as far as I'm concerned, this should be illegal.
  - benreesman 7y ago
    Unfortunately politically acceptable regulation only deters new ventures because it makes the costs of compliance too high. The right vehicle for this is antitrust, but if you think you can sell that in this climate then I’ve got a great deal for you on the London Bridge.
    - dmitriid 7y ago
      The costs of compliance are not too high. Compliance is actually ridiculously easy for new companies: they need to collect only the data they need. That is all there is
      - benreesman 7y ago
        https://en.m.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.m.wikipedia.org/wiki/General_Data_Protection_Regu...
        dmitriid 7y ago
        Yes. Your point? It’s actually ridiculously easy to be compliant with GDPR. Edit: That is, ridiculously easy for new companies. Incumbents have been hoarding data for too long and it was actually harder for existing companies to become compliant.
- losteric 7y ago
  Most people here can avoid the impact of climate change - do you think we shouldn't talk about that either? These are societal problems. It's good to care about people beyond yourself, and to talk about the professional ethical responsibilities of software engineers with regards to corporate mass-surveillance.
- heartbreak 7y ago
  This is a ridiculous argument. Advanced technical competency can not be a prerequisite for maintaining personal privacy.
  - benreesman 7y ago
    We’re on a site premised on entrepreneurship, and you’re pointing out what sounds like a big market gap. I angel invest now and then, if you have a plausible way to make two billion people care about something that we agree could be better my email is in my profile. Even from the inside I didn’t see a way, but I’ve been wrong before.
    - FabHK 7y ago
      Yes, looks like the industry cannot solve that problem alone, just like the electricity and chemical industries somehow didn't achieve clean air and water out of the goodness of their hearts. Another market gap. Or, wait, a case for government regulation.
    - laughinghan 7y ago
      Your HN profile appears to be blank, actually. Is this you? https://github.com/benreesman https://github.com/benreesman
- kbenson 7y ago
  > You could either stop using these services or How do you stop using a service when you have little or no indication that it does something like this before hand, and afterwards the privacy is already gone? If I use a site and view my profile page and the url contains aa account id or username and some google or facebook analytics is loaded, or a like button is sitting somewhere, how am I to know that before the page is loaded? What if I'm visiting the site for the first time after it's been added? It doesn't even matter if I have an account on Google or Facebook, they'll create profiles for me aggregating my data anyway. > quarantine them to a VPN/incognito interaction Which does very little. I spent a few hours this morning trying to get a system non-unique on panopticlick, but the canvas and WebGL hashing is enough to dwarf all the other metrics. There are extensions to help with that, but for the purpose I was attempting, were sub-optimal (and the one that seemed to do time-based salting of the hashes wasn't working right). So, I don't have any confidence that a VPN and incognito really does much at all.
  - benreesman 7y ago
    I assure you that a clean browser and IP will break any surveillance that I know about.
    - kbenson 7y ago
      No, a clean browser and IP with the combination of what fonts I have installed, how my video card renders a canvas and WebGL instance (which may be affected not just by the video card you have, but the driver version used with it), my screen size, and a few other system level items that come through may or may or may not be enough to uniquely identify you. Along with linking to a prior profile if you screw up one time (or load a URL that has identifying information they can use), and you're busted. So, sure, a clean browser and IP and never logging into a site you're previously visiting might be enough, but who does that, and doesn't that halfway defeat the purpose?
      - benreesman 7y ago
        I appreciate the information-theoretic validity of your argument, but if you think that one of these firms cares enough about your buying preferences to burn enough compute to find that correlation then you either work for the CIA or are mistaken.
- davidgerard 7y ago
  > sour grapes seriously?
  - benreesman 7y ago
    search “HN levels.fyi”
    - dang 7y ago
      I appreciate your comments in this thread. But could you please stop baiting people on this point? If there's one thing I've learned from running HN it's that the generalizations about the community that people come up with are invariably wrong. They're overgeneralized from a small sample of what the generalizer happened to notice—and since we're far more likely to notice what rubs us the wrong way, the results always have have sharp edges. In other words, people remember most the things they most dislike, then tar the whole with it. To borrow your phrase, the actual TLDR is less interesting.
      - benreesman 7y ago
        Thanks for the mild rebuke dang, I think you do a great job meta-moderating this community. I wish I had stayed out of this from the beginning, I see no merit in arguing about whether HN has some themes. I’ve been watching it daily for a long time as you can tell from the age of the account. If you want to do something that would be both a good call as a mod and a favor to a longtime user, just whack this whole thread. I was trying to chime in with some knowledge but just wound up pissing everyone off.
        dang 7y ago
        I have to say I strongly disagree—I thought your contributions were excellent, and HN lucky to have you contributing on a topic that you know a ton about. If I contributed to your feeling otherwise then I wish I hadn't posted! One thing I can offer from years here is: never underestimate the silent readership (I'd say silent majority but...associations). The vast majority of readers don't comment and most don't vote either. It doesn't mean they aren't following and getting a lot out of what you wrote. Usually it's only the most-provoked segment of the long tail that is motivated to respond. That's fine, it's the cycle of life on the internet—but it doesn't represent the whole community. Please comment more.
- 13415 7y ago
  A VPN will not help you against advanced behavioral browser fingerprinting like in this new Captcha. Not only do they have lists of VPN servers anyway, if you inadvertently log into your Google account once from the VPN (e.g. by launching your browser from your normal account), then the VPN IP(s) will be forever associated with your account and normal IPs, and they already know from the Captcha data that you're one and the same person. All the VPN does is adding the information that you sometimes use VPN servers of company such-and-such.
- deleted 7y ago
  [deleted]
- deckard1 7y ago
  > You could either stop using these services No you can't. Facebook creates shadow profiles for every single person in the world. If any single one of your friends has WhatsApp, Facebook has your phone number. They have your phone number and the entire address book of your friend, who probably has friends in common. If two of your friends have WhatsApp and they both have your number... You see where I'm going here? There are pictures of me on Facebook that I did not put there. From friends or friends of friends. I'm not even scratching the surface of what Google knows with GPS and WiFi connections. No one consented to any of this bullshit.
  - benreesman 7y ago
    There’s a reasonable argument in there, but it applies to any world in which digital cameras are cheap. This is in a sense the worst kind of argument: superficially correct but really meant to tap into a popular groundswell of sentiment. The question isn’t “can FB use an off-the-shelf CNN to identify me personally” but rather: “If it weren’t FB who would be doing it instead?” and: “Should cheap digital cameras be illegal?”
    - cyphar 7y ago
      > The question is “If it weren’t FB who would be doing it instead?” [...] “Should cheap digital cameras be illegal?” Those are a complete non-sequitur. Facebook (and Google) analyse every single photo that goes through their system with state-of-the-art ML (it's so good that it almost beat humans at matching faces ~5 years ago). This is a scale of surveillance which the human race has never encountered before in our history[+], and is a serious problem that we (as a society) need to make a decision on. In many countries, car license plates are OCR'd and automatically tracked whenever they travel on almost any main public road. Facial recognition in public places and on public transport is becoming a prevalent problem. And wearing masks is illegal in many countries -- meaning there is no way of "opting out" of the pervasive surveillance in the physical world. None of these things were nearly as commonplace (or even technologically plausible) ~30 years ago. Cheap digital cameras are a completely unrelated topic. And if such large-scale surveillance was made illegal then nobody would be doing it legally, and those doing it would be held accountable for the public health risk they pose. We don't let people build buildings with asbestos any more. [+] The Stazi and KGB only really had filing cabinets for tracking people and physical surveillance measures. The Gestapo didn't even have that (the Third Reich had census data which was tabulated using IBM machines in order to track who was Jewish within the Third Reich).
- __jal 7y ago
  > or (as I suspect) you find them too valuable to dismiss entirely quarantine You are wrong. I block the known IP blocks of the big surveillance shops and a lot of the small ones[1]. > sour grapes that a mediocre employee at one of these places makes 3-20x what anyone makes Are you sincerely saying you believe people who are uneasy about surveillance are just jealous? [1] Twitter is currently an exception, I was playing with something. But I'm going back to blocking them soon.
- laughinghan 7y ago
  It takes less time to lock my front door than to configure a VPN, but burglarizing an unlocked house still is and should be illegal.
stickfigure 7y ago
They have no right to it, and I have every right to try to limit their visibility. That's entirely fair! But also: You have no right to use my website, and I have every right to limit your access. Recaptcha is simply part of this negotiation.
- __jal 7y ago
  > You have no right to use my website Of course. > Recaptcha is simply part of this negotiation. It is only a negotiation if I know it is there.
  - benreesman 7y ago
    You’re commenting on HN, you know it’s there.
    - saagarjha 7y ago
      I do, and I can make an informed choice. Unless your website has a very eclectic audience, I’m not the only one using your services.
    - zcid 7y ago
      And what about the other 99.99999% of people that use the web? Do they also understand what is going on behind the scenes?
    - snlnspc 7y ago
      I didn't, but assume this is the case with everything. I mostly care about giving my data away for free (cut me in please), but none of my non-HN commenting roommates knew. Is their privacy less important than mine?
    - smt88 7y ago
      I'm commenting on HN. I've been developing for the web for 24 years. I don't know how and when my data is collected or shared most of the time. The idea that FB and Google are openly making a trade with users is ludicrous. I'm horrified that you either sincerely believe that there's a fair negotiation happening or that you don't care (given your employment history).
ajxs 7y ago
If I could upvote this comment twice, I would. This succinctly summarises my views on the subject. We shouldn't have to justify _why_ we don't want our private information harvested by these companies. I would still feel remarkably uneasy even _if_ Facebook and Google were demonstrably benevolent citizens of the online world, but we've seen time and time again how invasive and malicious they can be. The fact that both of these companies have political ambition makes the entire situation much scarier. Count me out.
dvdkhlng 7y ago
> FB and Google are the equivalent of Superfund sites waiting to happen, and storing that data should be considered criminal. I would think, that in the EU, under GDPR, collecting, transmitting and storing that data is in fact criminal, or at least subject to heavy fines. And under GDPR it won't help to just note the data collection in the TOS or ask the user for permission (under threat to not allow access to the service). So I really wonder how google plans to run this in europe.
pushpop 7y ago
This. Absolutely this! Do I think Facebook/Google/etc are abusing my data right now? Probably not. But do I think that large scale collection of my data could be abused in the future? Most definitely. If the Cambridge Analytica scandal has taught us anything, it’s that having access to this data is rife for abuse and often it might happen in unexpected ways. And do I owe an explanation for wanting some basic privacy? Absolutely not. If a random stranger stopped me in the street and asked me lots of personal questions there wouldn’t be an expectation that I have to respond. Yet the likes of Facebook and Google seem he’ll bent on turning the discussion around when it’s data collected online.
deleted 7y ago
[deleted]
Mirioron 7y ago
And you never know what those corporations could do with the data politically. Recently there has been a lot of talk about how these types of companies seem to favor certain politics. Who's to say that they won't use this data in the future for influence?
webmobdev 7y ago
Exactly! And this is my problem with Apple too - sure , they do some things right and are more conscious of "user privacy" than others, but at the same time they have also started abusing this to further spy on their users. What use is "we are transparent with our users about the data we collect" when the user does not want you to collect the data in the first place? And they give you no option to opt out of such data collection? (And for what - just so that they can create a better ad network that can better exploit us with our own data?) (And don't get me started on Safari spying and all their "anonymous" cookie collection crap without giving the user any choice in the matter, essentially forcing everyone of their users to opt-in to be profiled through their browsing history).

by __jal 7y ago

benreesman 7y ago

You could either stop using these services or (as I suspect) you find them too valuable to dismiss entirely quarantine them to a VPN/incognito interaction in less time than it took to type that comment. I don’t want to single you out personally but there’s a broad trend on HN of bitter-sounding commentary on the surveillance powers of these companies by people who can easily defeat any tracking that it’s economical for them to even attempt let alone execute that reeks of sour grapes that a mediocre employee at one of these places makes 3-20x what anyone makes (as a rank and file employee) anywhere else. Again, you’re not likely part of that group, but seriously who hangs out on HN and can’t configure a VPN?

saagarjha 7y ago
> reeks of sour grapes that a mediocre employee at one of these places makes 3-20x what anyone makes (as a rank and file employee) anywhere else This is not an argument and moreover not even true: there are companies that pay well and don’t collect reams of data on their users.
- benreesman 7y ago
  You didn’t address my argument and unless you’ve been on more comp committees than me then I would annotate that as sources needed.
  - saagarjha 7y ago
    Like I said: it’s not an argument, it’s an attack. Plus I’m sure that there’d be many people here able to counter your claim regardless of the compensation number you drop.
  - laughinghan 7y ago
    What argument? What possible position could "if you can't configure a VPN, you're probably mediocre" be an argument for?
bad_user 7y ago
How about our friends and family? Should we configure a VPN for them too? Btw the argument you just made applies to any form of surveillance or censorship. Just because your can still find functional VPN services for China, is China's great firewall OK? And what happens when web services start blocking VPNs? Netflix does it quite successfully. And I'm sure Cloudflare could provide such a service for free.
- benreesman 7y ago
  I’m not making a moral argument for the surveillance state, I wear Curve25519 on one arm and the word “citizenfour” on the other. I agree that there is a vast and almost impossible to regulate overreach by these companies. Your argument is extremely compelling. But when HN users complain about being spied on I smell a FAANG rejection letter.
  - saagarjha 7y ago
    > when HN users complain about being spied on I smell a FAANG rejection letter I work at a FAANG: here’s my complaint about being spied on.
    - benreesman 7y ago
      So your comments should be at the top. You’re knowledgeable on the subject and even if we disagree that should be upweighted in a perfect world.
      - saagarjha 7y ago
        :/
  - stOneskull 7y ago
    People care about others, not just themselves.
    - xg15 7y ago
luckylion 7y ago
> Again, you’re not likely part of that group, but seriously who hangs out on HN and can’t configure a VPN? Recaptcha tracks users / devices, not IPs. A VPN won't help, it'll only lower your score. At that point: not allowing them to track you just means you can't use large parts of the web. "You don't want that GPS tracker installed into your skull? Well, we won't force you, of course, but public transportation, government services and most grocery stores can only be used by GPS-skull-people"
- benreesman 7y ago
  Wild speculative hyperbole hurts the case of people like you and I who care about doing something positive on the ground today.
  - bongobongo 7y ago
    It is not "wild speculative hyperbole" not to give the benefit of the doubt to companies that have repeatedly demonstrated that they are not entitled to the benefit of the doubt.
    - benreesman 7y ago
      GPS tracker installed in people’s skull sounds hyperbolic to me.
      - deleted 7y ago
        [deleted]
      - whenchamenia 7y ago
        How about peoples pockets? Its hyperbole, but not a huge reach.
  - luckylion 7y ago
    Is it though? I'm somewhat lucky, because my government is generally technologically behind and loves literal paper trails, but yours isn't. Plenty of .gov sites use recaptcha. Sure, you can still visit those sites, it's just that, unless you pass a captcha test, they can't verify that you're actually a person (and not a Russian bot) and can't let you do certain things. If you want to use those government services, you need to allow Google to track you, or maybe they'll add a "sign in with Facebook" option so you have a choice. With invisible captchas, you can't even sit down and solve a higher number of riddles to prove that you're really human and know what a fire hydrant looks like even though you look kinda strange. If Google doesn't believe that you are human, tough luck. Unless you have a personal connection or a solid Twitter following that an amplify your concerns, nobody at Google cares. Does your government care? It makes their life easier and normal citizens never really had problems with it. DHL makes me solve a captcha to login and buy postage stamps. There probably are, or will be, public transportation companies that use recaptcha. It helps them to combat voter fraud (crime, abuse, election meddling, fake news, lots of things) if they know where (on the web, for now) you've been in the last 6 months. You don't like the "implanting" part, because that's unrealistic? Just wait 20 years, and it may not be your head, but an RFID chip in your hand (yeah, those exist already). Until then, carry your gps tracker around and install their software on it, so it can collect data on your behavior to make sure that you're not a criminal.
amenod 7y ago
> You could either stop using these services or ... Are you serious? Have you tried not using their services? Try blocking Google Analytics, Tag Manager, ReCaptcha, fonts, gstatic,... What you will see is that you can no longer access much of the Internet. Want to participate in StackOverflow? Good luck if you block Google. My beef is not with them trying to find my data when I'm on their site(s). They are however everywhere, on almost every site I visit. Coupled with their (impressive) technical provess it is beyond creepy, and there is simply no way one can avoid them. I don't know what the solution is or will be, but as far as I'm concerned, this should be illegal.
- benreesman 7y ago
  Unfortunately politically acceptable regulation only deters new ventures because it makes the costs of compliance too high. The right vehicle for this is antitrust, but if you think you can sell that in this climate then I’ve got a great deal for you on the London Bridge.
  - dmitriid 7y ago
    The costs of compliance are not too high. Compliance is actually ridiculously easy for new companies: they need to collect only the data they need. That is all there is
    - benreesman 7y ago
      https://en.m.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.m.wikipedia.org/wiki/General_Data_Protection_Regu...
      - dmitriid 7y ago
        Yes. Your point? It’s actually ridiculously easy to be compliant with GDPR. Edit: That is, ridiculously easy for new companies. Incumbents have been hoarding data for too long and it was actually harder for existing companies to become compliant.
losteric 7y ago
Most people here can avoid the impact of climate change - do you think we shouldn't talk about that either? These are societal problems. It's good to care about people beyond yourself, and to talk about the professional ethical responsibilities of software engineers with regards to corporate mass-surveillance.
heartbreak 7y ago
This is a ridiculous argument. Advanced technical competency can not be a prerequisite for maintaining personal privacy.
- benreesman 7y ago
  We’re on a site premised on entrepreneurship, and you’re pointing out what sounds like a big market gap. I angel invest now and then, if you have a plausible way to make two billion people care about something that we agree could be better my email is in my profile. Even from the inside I didn’t see a way, but I’ve been wrong before.
  - FabHK 7y ago
    Yes, looks like the industry cannot solve that problem alone, just like the electricity and chemical industries somehow didn't achieve clean air and water out of the goodness of their hearts. Another market gap. Or, wait, a case for government regulation.
  - laughinghan 7y ago
    Your HN profile appears to be blank, actually. Is this you? https://github.com/benreesman https://github.com/benreesman
kbenson 7y ago
> You could either stop using these services or How do you stop using a service when you have little or no indication that it does something like this before hand, and afterwards the privacy is already gone? If I use a site and view my profile page and the url contains aa account id or username and some google or facebook analytics is loaded, or a like button is sitting somewhere, how am I to know that before the page is loaded? What if I'm visiting the site for the first time after it's been added? It doesn't even matter if I have an account on Google or Facebook, they'll create profiles for me aggregating my data anyway. > quarantine them to a VPN/incognito interaction Which does very little. I spent a few hours this morning trying to get a system non-unique on panopticlick, but the canvas and WebGL hashing is enough to dwarf all the other metrics. There are extensions to help with that, but for the purpose I was attempting, were sub-optimal (and the one that seemed to do time-based salting of the hashes wasn't working right). So, I don't have any confidence that a VPN and incognito really does much at all.
- benreesman 7y ago
  I assure you that a clean browser and IP will break any surveillance that I know about.
  - kbenson 7y ago
    No, a clean browser and IP with the combination of what fonts I have installed, how my video card renders a canvas and WebGL instance (which may be affected not just by the video card you have, but the driver version used with it), my screen size, and a few other system level items that come through may or may or may not be enough to uniquely identify you. Along with linking to a prior profile if you screw up one time (or load a URL that has identifying information they can use), and you're busted. So, sure, a clean browser and IP and never logging into a site you're previously visiting might be enough, but who does that, and doesn't that halfway defeat the purpose?
    - benreesman 7y ago
      I appreciate the information-theoretic validity of your argument, but if you think that one of these firms cares enough about your buying preferences to burn enough compute to find that correlation then you either work for the CIA or are mistaken.
davidgerard 7y ago
> sour grapes seriously?
- benreesman 7y ago
  search “HN levels.fyi”
  - dang 7y ago
    I appreciate your comments in this thread. But could you please stop baiting people on this point? If there's one thing I've learned from running HN it's that the generalizations about the community that people come up with are invariably wrong. They're overgeneralized from a small sample of what the generalizer happened to notice—and since we're far more likely to notice what rubs us the wrong way, the results always have have sharp edges. In other words, people remember most the things they most dislike, then tar the whole with it. To borrow your phrase, the actual TLDR is less interesting.
    - benreesman 7y ago
      Thanks for the mild rebuke dang, I think you do a great job meta-moderating this community. I wish I had stayed out of this from the beginning, I see no merit in arguing about whether HN has some themes. I’ve been watching it daily for a long time as you can tell from the age of the account. If you want to do something that would be both a good call as a mod and a favor to a longtime user, just whack this whole thread. I was trying to chime in with some knowledge but just wound up pissing everyone off.
      - dang 7y ago
        I have to say I strongly disagree—I thought your contributions were excellent, and HN lucky to have you contributing on a topic that you know a ton about. If I contributed to your feeling otherwise then I wish I hadn't posted! One thing I can offer from years here is: never underestimate the silent readership (I'd say silent majority but...associations). The vast majority of readers don't comment and most don't vote either. It doesn't mean they aren't following and getting a lot out of what you wrote. Usually it's only the most-provoked segment of the long tail that is motivated to respond. That's fine, it's the cycle of life on the internet—but it doesn't represent the whole community. Please comment more.
13415 7y ago
A VPN will not help you against advanced behavioral browser fingerprinting like in this new Captcha. Not only do they have lists of VPN servers anyway, if you inadvertently log into your Google account once from the VPN (e.g. by launching your browser from your normal account), then the VPN IP(s) will be forever associated with your account and normal IPs, and they already know from the Captcha data that you're one and the same person. All the VPN does is adding the information that you sometimes use VPN servers of company such-and-such.
deleted 7y ago
[deleted]
deckard1 7y ago
> You could either stop using these services No you can't. Facebook creates shadow profiles for every single person in the world. If any single one of your friends has WhatsApp, Facebook has your phone number. They have your phone number and the entire address book of your friend, who probably has friends in common. If two of your friends have WhatsApp and they both have your number... You see where I'm going here? There are pictures of me on Facebook that I did not put there. From friends or friends of friends. I'm not even scratching the surface of what Google knows with GPS and WiFi connections. No one consented to any of this bullshit.
- benreesman 7y ago
  There’s a reasonable argument in there, but it applies to any world in which digital cameras are cheap. This is in a sense the worst kind of argument: superficially correct but really meant to tap into a popular groundswell of sentiment. The question isn’t “can FB use an off-the-shelf CNN to identify me personally” but rather: “If it weren’t FB who would be doing it instead?” and: “Should cheap digital cameras be illegal?”
  - cyphar 7y ago
    > The question is “If it weren’t FB who would be doing it instead?” [...] “Should cheap digital cameras be illegal?” Those are a complete non-sequitur. Facebook (and Google) analyse every single photo that goes through their system with state-of-the-art ML (it's so good that it almost beat humans at matching faces ~5 years ago). This is a scale of surveillance which the human race has never encountered before in our history[+], and is a serious problem that we (as a society) need to make a decision on. In many countries, car license plates are OCR'd and automatically tracked whenever they travel on almost any main public road. Facial recognition in public places and on public transport is becoming a prevalent problem. And wearing masks is illegal in many countries -- meaning there is no way of "opting out" of the pervasive surveillance in the physical world. None of these things were nearly as commonplace (or even technologically plausible) ~30 years ago. Cheap digital cameras are a completely unrelated topic. And if such large-scale surveillance was made illegal then nobody would be doing it legally, and those doing it would be held accountable for the public health risk they pose. We don't let people build buildings with asbestos any more. [+] The Stazi and KGB only really had filing cabinets for tracking people and physical surveillance measures. The Gestapo didn't even have that (the Third Reich had census data which was tabulated using IBM machines in order to track who was Jewish within the Third Reich).
__jal 7y ago
> or (as I suspect) you find them too valuable to dismiss entirely quarantine You are wrong. I block the known IP blocks of the big surveillance shops and a lot of the small ones[1]. > sour grapes that a mediocre employee at one of these places makes 3-20x what anyone makes Are you sincerely saying you believe people who are uneasy about surveillance are just jealous? [1] Twitter is currently an exception, I was playing with something. But I'm going back to blocking them soon.
laughinghan 7y ago
It takes less time to lock my front door than to configure a VPN, but burglarizing an unlocked house still is and should be illegal.

stickfigure 7y ago

They have no right to it, and I have every right to try to limit their visibility. That's entirely fair! But also: You have no right to use my website, and I have every right to limit your access. Recaptcha is simply part of this negotiation.

__jal 7y ago
> You have no right to use my website Of course. > Recaptcha is simply part of this negotiation. It is only a negotiation if I know it is there.
- benreesman 7y ago
  You’re commenting on HN, you know it’s there.
  - saagarjha 7y ago
    I do, and I can make an informed choice. Unless your website has a very eclectic audience, I’m not the only one using your services.
  - zcid 7y ago
    And what about the other 99.99999% of people that use the web? Do they also understand what is going on behind the scenes?
  - snlnspc 7y ago
    I didn't, but assume this is the case with everything. I mostly care about giving my data away for free (cut me in please), but none of my non-HN commenting roommates knew. Is their privacy less important than mine?
  - smt88 7y ago
    I'm commenting on HN. I've been developing for the web for 24 years. I don't know how and when my data is collected or shared most of the time. The idea that FB and Google are openly making a trade with users is ludicrous. I'm horrified that you either sincerely believe that there's a fair negotiation happening or that you don't care (given your employment history).

ajxs 7y ago

If I could upvote this comment twice, I would. This succinctly summarises my views on the subject. We shouldn't have to justify _why_ we don't want our private information harvested by these companies. I would still feel remarkably uneasy even _if_ Facebook and Google were demonstrably benevolent citizens of the online world, but we've seen time and time again how invasive and malicious they can be. The fact that both of these companies have political ambition makes the entire situation much scarier. Count me out.

dvdkhlng 7y ago

> FB and Google are the equivalent of Superfund sites waiting to happen, and storing that data should be considered criminal. I would think, that in the EU, under GDPR, collecting, transmitting and storing that data is in fact criminal, or at least subject to heavy fines. And under GDPR it won't help to just note the data collection in the TOS or ask the user for permission (under threat to not allow access to the service). So I really wonder how google plans to run this in europe.

pushpop 7y ago

This. Absolutely this! Do I think Facebook/Google/etc are abusing my data right now? Probably not. But do I think that large scale collection of my data could be abused in the future? Most definitely. If the Cambridge Analytica scandal has taught us anything, it’s that having access to this data is rife for abuse and often it might happen in unexpected ways. And do I owe an explanation for wanting some basic privacy? Absolutely not. If a random stranger stopped me in the street and asked me lots of personal questions there wouldn’t be an expectation that I have to respond. Yet the likes of Facebook and Google seem he’ll bent on turning the discussion around when it’s data collected online.

deleted 7y ago

[deleted]

Mirioron 7y ago

And you never know what those corporations could do with the data politically. Recently there has been a lot of talk about how these types of companies seem to favor certain politics. Who's to say that they won't use this data in the future for influence?

webmobdev 7y ago

Exactly! And this is my problem with Apple too - sure , they do some things right and are more conscious of "user privacy" than others, but at the same time they have also started abusing this to further spy on their users. What use is "we are transparent with our users about the data we collect" when the user does not want you to collect the data in the first place? And they give you no option to opt out of such data collection? (And for what - just so that they can create a better ad network that can better exploit us with our own data?) (And don't get me started on Safari spying and all their "anonymous" cookie collection crap without giving the user any choice in the matter, essentially forcing everyone of their users to opt-in to be profiled through their browsing history).