7 ms·

We keep harping on about privacy, and then shit like this happens. There are two possible conclusions to draw. One is that the general public actually doesn’t

We keep harping on about privacy, and then shit like this happens. There are two possible conclusions to draw. One is that the general public actually doesn’t care about privacy at all. It’s a niche concern. The other is that the general public cares but is completely and utterly clueless about how to defend themselves, to the point that an app can literally say “give us your name and face and we can do whatever we want with it in perpetuity throughout the universe” and people will happily oblige. I don’t know which one is correct but neither one is great.

the_seraphim 7y ago
Consider the stupidity of the average human. Then consider that half of the population is stupider than that
Voloskaya 7y ago
Option 3: No one read the terms of services, and 99% of the app users are not even aware of that, didn't even give it a passing thought.
- swsieber 7y ago
  This. Caught me by surprise but in retrospect, of course an app is going to slip this in.
- mikeash 7y ago
  That falls under the second option. Being capable of defending your privacy means understanding that you shouldn’t willingly give your personal info to random apps.
  - Voloskaya 7y ago
    They didn't 'willingly' give anything. Like any app, you launch it and you accept the EULA. Then it asks you for permission to use your camera and for your contacts: it makes sense you want to take selfies and share them. That's it, now all your data belong to them. There is no functional difference between an app that will siphon all your private data and an app that won't. for the vast majority of users, at no point did they stop and ponder whether they were ok giving up their 'face' for a filter app. The only way to know would be to read the terms, and even then if you are not a lawyer you won't see the traps (e.g. understanding that "User Content" actually refers to your face).
    - fnordsensei 7y ago
      Assuming that the app is available in the EU, I wonder how this squares with the GDPR.
    - mikeash 7y ago
      This still lines up exactly with what I’m saying. Defending your privacy means you need to stop and ponder these things. People don’t know that they need to do this. You don’t need to read the terms. You “just” need to assume nefarious intent unless demonstrated otherwise.
      - somatic 7y ago
        People have reasonable expectations of privacy. They expect their phone calls not to be recorded. They expect that their emails are treated with the same inviolability as their letters were. They expect their letters to be as they were before the advent of technologies that governments are now using to mass record the contents of letters without opening them, of which technologies and practices they have no knowledge. All of these expectations, and many more, are now ritually violated in the most outrageous manner. It isn’t the responsibility of the individual to combat every violation of his person. Not only is it an unreasonable expectation for society’s “default setting” to be the casual violation of its citizens, but it’s also literally impossible for even the richest, smartest, and most diligent among us to avoid getting screwed... in some way... when there are so, so, SO many ways to get screwed. Because, in 2019, if your highest priority is NOT getting screwed, you might literally have to live alone in a cabin in the mountains. Which is why you can take your atomic-individual libertarian “oh you “just” need to somehow avoid every omnipresent feature of contemporary life” and take a fucking hike. I demand the right to walk to the grocery, buy a sandwich, walk to the park, eat the sandwich, and walk home, without having my minute-by-minute location invisibly and undetectably recorded and sent to ANY corp/gov, my purchase recorded and sent to ANY corp/gov, my face/gait/person scanned and analyzed by ANY corp/gov, etc. and so forth. And I should have to take no special action for any of this, because this is the default setting.
- tictoc 7y ago
  Are terms of service somewhat consistent in their language? And if that's the case, couldn't someone build something that scans Terms across products and summarize what exactly it is you are giving up by accepting the Terms?
  - etxm 7y ago
    It sounds like you got a product idea. I know my uncle Doug would pay for it.
  - zarq 7y ago
    https://tosdr.org/ https://tosdr.org/ -- it's not automated, but it's a start. Also FaceApp isn't listed.
- godelski 7y ago
  Option 4: what can you do with my face and name? That's just like you taking a picture of me in public. I know plenty of people that think this way.
- MisterTea 7y ago
  I think the problem is these systems are much more complex than the people realize. Technically minded people like those of us here understand the implications but they might not. That or they have too much trust in an increasingly untrustworthy world. It's just naivety really.
- everdev 7y ago
  Even if they did read it, there's no legal recourse for a state sponsored company that decides to write a good looking ToS and then just ignore it completely. Or, it's not hard to imagine this even bring a completely legit company. I'm sure it's easy enough now for the Russian government to find something wrong they did and demand to see all the data they collected. And finally, even if it's a legit company and they somehow have enough legal protection in Russia to about sharing data with the government, they're probably not the hardest security target in the world for any rogue operator to steal their data. Bottom line, don't put all your trust in a ToS.
  - trevyn 7y ago
    Is there evidence they are actually state sponsored?
- hanniabu 7y ago
  There should be a rule that if a ToS is longer than 200 words then it requires a bullet point summary list at the top.
  - mikeash 7y ago
    The trouble is, what happens when the summary is inaccurate or incomplete? If the summary takes precedence in that case, then the full ToS is meaningless and can be omitted, so you could simplify this to a rule requiring ToSs to be under 200 words. If the ToS takes precedence then the summary is meaningless.
    - etbebl 7y ago
      Instead of summarizing the terms, it could be like nutrition facts warnings. Cross certain lines in the actual terms and you're required to put "See full terms for what your personal data can be used for" or something. If the terms cross lines without putting the warnings, they can't be enforced. It would have to be not overly restrictive limits, or you'd end up with a prop-65-like scenario. Or hell, just make a standardized "Privacy Facts" panel.
JoshuaRLi 7y ago
> the general public actually doesn’t care about privacy at all It's not that people don't care; privacy is probably undervalued in the context of making privacy vs. convenience/utility decisions. (Digital) privacy's value isn't really tangible until it's actively used against you.
snarf21 7y ago
Or option 3. They care about privacy but only when terrible thing X happens. They post their name and picture to Instagram 12 times a day. Most people have public profiles so there is no new risk. Of course by the time every street corner has facial recognition running "for our safety", it will be too late. Even as someone who knows the risks, this doesn't scare me as much as DNA testing. Even worse is that if any of my relatives do it, I'm just as screwed. There is also the "let's all install hackable video cameras on our front doors" problem. Clever fear mongering to prevent a random package being stolen that is already insured and will be resent automatically. Instead we paid to create our own surveillance state.
ryanSrich 7y ago
It’s somewhere in the middle. The cultural shift is happening though. And once the market is ready, they’ll need tools. Right now it’s simply too complicated to not only understand what an application can do with your data, but then taking actions on that data (right to be forgotten, etc.) in the future. If you’re at all interested in this space feel free to email me. I’m working on something that isn’t quite ready to discuss publicly yet.
Cthulhu_ 7y ago
It's because there's not been a lot of scary things happening yet. Or if they have, it's been on individuals - like someone seeing themselves on a billboard or advert. But because the datasets are so massive, people are reduced to statistics which is a lot less scary. Of course, if you look at history that can change overnight. Or actually it won't, it's more likely a "boiling frog" kinda thing where nobody's aware of anything bad happening until it's too late.
- magashna 7y ago
  No need to pay someone for their likeness when you can generate the average face of your targeted market
- easyat 7y ago
  The psyops conducted by Cambridge Analytica and similar organizations in the US, England, and around the world is pretty scary
- T1glober 7y ago
  > someone seeing themselves on a billboard or advert I just pictured 4chan hacking into a photo database and putting people's faces on a bunch of billboards. Surely if this happened to more people, the public would become more privacy-conscious, no?
asveikau 7y ago
It's the updated version of the dancing pigs phenomenon. https://en.wikipedia.org/wiki/Dancing_pigs https://en.wikipedia.org/wiki/Dancing_pigs The smartphone is giving them funny shit. Any permissions prompts or legalese that occur in the meantime are incidental.
idop 7y ago
The general public doesn't have the knowledge or even imagination to understand that sharing your information with nameless/faceless organizations may have downsides re: privacy. The others have been brainwashed well enough to believe that only criminals need privacy, so they don't care. By now using the "I have nothing to hide" example is cliche but it's literally the response I _always_ get when I bring up privacy concerns. Takes me about 12 seconds to prove to them how wrong they are.
- skizm 7y ago
  What argument do you use to prove them wrong?
  - idop 7y ago
    I usually say something to the tune of "everyone has something to hide, that's why we put clothes on; that's why we don't go around broadcasting our medical test results; that's why we don't reveal our salaries and benefits to our colleagues (or anyone); that's why we don't give our address to anyone that asks for it. It doesn't mean we've done something bad or we're criminals, it just means we're human. But if you have a gmail account, you've probably given one of the world's largest corporation all this knowledge." Usually the medical test thing is enough to shut them up. Anyway there are many such example arguments around the internet, just DuckDuckGo "nothing to hide". There's even a Wikipedia article about it [1]. Edit: Oh, I often give Uber's deleted posts about how they know their users had one-night stands as an example too. See [2] and [3] for one of the deleted posts. [1] https://en.wikipedia.org/wiki/Nothing_to_hide_argument https://en.wikipedia.org/wiki/Nothing_to_hide_argument [2] https://money.cnn.com/2014/11/25/technology/uber-prostitutes/index.html https://money.cnn.com/2014/11/25/technology/uber-prostitutes... [3] https://web.archive.org/web/20140827195715/http://blog.uber.com/ridesofglory https://web.archive.org/web/20140827195715/http://blog.uber....
    - deleted 7y ago
      [deleted]
    - ebg13 7y ago
throwawaymanbot 7y ago
In fairness, when you use an app like this, why would you (as the avg user) ever think they would be doing something nefarious with it? Especially digital products where the "magic" happens out of sight in the bg. People DO want privacy and I bet there will be lawsuits about this.
nixpulvis 7y ago
I'd say it's a lot more like an addict that, while smoking a cigarette, says things like "yea I know these things are killing me". No harm, no foul until the signs are visible, and it's probably too late.
JustSomeNobody 7y ago
The general public doesn't understand. They're not steeped in it like we are. And we're failing to simplify the discussion to the level in which they will understand. Until then, they'll use apps like this. I think the devs of this app need a slap on the wrist for being party to this nonsense as well.
koolba 7y ago
It’s both but the second one scares me more than the first as nothing stops one of your friends from giving access to a trove of photos and information about you. It could be as easy as granting access to your camera roll (oh there’s tags! We’ll take those too!) or just holding up your photo to the camera.
matchagaucho 7y ago
How soon the public forgets about Equifax data breaches, but goes into a panic when they opt-in for face filters.
- mikeash 7y ago
  People got very upset about Equifax, it’s just that there’s approximately nothing we can do about them. Our choice is for Equifax to have all our info, or refrain from partitipating in the modern financial system.
envy2 7y ago
I think we're not giving the general public enough credit. These discussions always seem to come down to "no one cares about privacy" or "they care but they're idiots." I think many people care about privacy and generally understand the issues, but are making conscious trade-offs that make sense for them. For the vast majority of people—who are boring, non-activist, law-abiding citizens—the value they assign to privacy of things like name/face/products they're interested in is nonzero, but very low. They know their name/face, along with far more sensitive information, is already in a lot of databases that matter more than anything some random app developer can do, and they get some greater value from the marginal privacy impact of that same information ending up in one more place. There's a good bit of research to support this. For example, there is a study showing you'd have to pay someone on average $1,000+ [1] to give up their Facebook account for year, suggesting that's the value they assign to the service. At the same time, if you ask them how much they'd be willing to pay for an ads-free, more privacy conscious version of Facebook, studies show only a small fraction would pay even $15/month [2]. In other words, people are making a conscious assessment that their privacy is less valuable than the services they can get by giving it up. We make these kind of trade-offs and decisions every day. It's much the same reason people can be both deeply concerned about child labor in the Global South, but still make the decision to buy the cheaper version of a product rather than the one they know is ethically sourced, even if they could afford the latter. These decisions certainly have societal impacts that are worth contemplating and being concerned about, but it's wrong and infantilizing to simply dismiss people's conscious and rational (for them) choices. [1] https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0207101 https://journals.plos.org/plosone/article?id=10.1371/journal... [2] https://www.vox.com/2018/4/11/17225328/facebook-ads-free-paid-service-mark-zuckerberg https://www.vox.com/2018/4/11/17225328/facebook-ads-free-pai...
- mikeash 7y ago
  What is the difference between “people don’t care about privacy” and “people value Facebook highly, wouldn’t pay much of anything for an ad-free, privacy conscious version of Facebook, and are making a conscious assessment that their privacy is less valuable than the service,” other than the additional detail? It seems to me that you’re complaining about infantilizing people’s choices while simultaneously telling us that, yes, people indeed don’t care about privacy very much.
pbhjpbhj 7y ago
Bit if A, bit of B. People don't care that much, but also don't realise the implications that would make them care marginally more in some instances. Google already have millions of face tags from Picasa, etc.; Facebook has had image tagging for ages; ... governments already have all that data from passports and driving licensee and ID cards ... so why not give it up again. It's a drop in the ocean situation. Russia having my face data is likely to make much less difference to me than someone in UK having it, which might also make people not care. [But of course they can sell the data on.]
cmiles74 7y ago
The general public didn't know that the application was saying "give us your name and face and we can do whatever we want with it..." They had no idea that this was even a thing. I would bet hard earned money that the average person installed this application because a friend told them and they were curious. This bit about what happens to their image and what data does the app save locally verses pushing out to the network, etc. is something that never even crossed their mind. If there was a window with legalese they ignored it as they have been trained to do (by Microsoft, Apple and every other commercial software product they ever purchased). Certainly they didn't go clicking around and looking for it.
- phkahler 7y ago
  >> The general public didn't know that the application was saying "give us your name and face and we can do whatever we want with it..." They had no idea that this was even a thing. Because EULAs and "terms of service" and "privacy policy" are all bullshit that nobody reads and should not have legally binding consequences or obligations. Peope have come to treat those things like a simple OK button but the law says otherwise. This company could produce deep-fakes with users heads on them and claim it's OK by their ToS and they might be right.
eeeeeeeeeeeee 7y ago
I don’t think the general public cares in the same way people on this forum do. But, I do think they would care if their photos ended up on a billboard or used in marketing material without their explicit permission. Most understand that the company needs some kind of access to photos for the app to actually do anything, but there is a limit.
tdb7893 7y ago
I think as with most things it's a little of both. HN as a whole is concerned about a lot of privacy stuff that just doesn't bother everyone. Also privacy is hard, even if you buy things in cash companies can still track you if they want, they use cookies and fingerprinting techniques that even most people in tech don't really understand. It's not really possible to counteract tracking if large companies and governments make an effort for it.
gioele 7y ago
> One is that the general public actually doesn’t care about privacy at all. It’s a niche concern. There is an established term for this innate human trait: "dancing pigs". > In computer security, the "dancing pigs" is a term or problem that describes computer users' attitudes to computer security. It states that users will continue to pick an amusing graphic even if they receive a warning from security software that it is potentially dangerous. In other words, users choose their primary desire features without considering the security. https://en.wikipedia.org/wiki/Dancing_pigs https://en.wikipedia.org/wiki/Dancing_pigs
GCA10 7y ago
In aggregate, people's desire to be noticed is vastly larger than their desire for privacy. The latest case -- going beyond anything I can parody -- is this first-person NYTimes tell-all about a married couple being overheard in the midst of a sexual morning. https://www.nytimes.com/2019/07/12/well/family/when-our-daughter-walked-in-on-us.html https://www.nytimes.com/2019/07/12/well/family/when-our-daug... Why bother sounding alarms about Alexa, Google Voice, etc. perhaps listening to our bedroom conversations? There's a slice of the public that will go to a lot of trouble (write article, etc.) to make sure that such moments become public.
DisruptiveDave 7y ago
Another: The general public cares about privacy but not more than they care about the perception of belonging and being a part of any sensation that has to do with social media.
asdff 7y ago
People probably don't even realize that stuff moves to a server at all. People may think this is all happening and contained within their local app and therefore private and in their control. They probably also assume snapchats go from their phone to the recipient directly and aren't held anywhere in between. This is I think the most scary possibility. If you think faceapp is processing this in the app with your phone's hardware, learning that they save all pictures sounds like a vast conspiracy and not so believable. However, if you understand the technology and that most things online are not processed client side, the privacy implications are suddenly obvious because of course the company will keep that data that passes through their hardware. No shareholder will let money be left on the table so all data you put online should be assumed to be kept for later profit. People have to be better educated on how the software they use every day actually works, at least in broad strokes. This can come in a high school media/technology literacy class or something. Until that day comes, we have two classes of people: those who understand how the tech they use works and makes a company money, and those who will be forever manipulated by the first group so long as they have a dollar or a right to vote. It's a hard problem to overcome when so many technology companies are entirely dependent on profit from people's continued ignorance and tech illiteracy.
lone_haxx0r 7y ago
I care about privacy, but the state already knows my face, my fingerprint, etc. A private institution is, by definition, less hostile than the state of my country, so it's kind of pointless to try to hide my face.

the_seraphim 7y ago

Consider the stupidity of the average human. Then consider that half of the population is stupider than that

Voloskaya 7y ago

Option 3: No one read the terms of services, and 99% of the app users are not even aware of that, didn't even give it a passing thought.

swsieber 7y ago
This. Caught me by surprise but in retrospect, of course an app is going to slip this in.
mikeash 7y ago
That falls under the second option. Being capable of defending your privacy means understanding that you shouldn’t willingly give your personal info to random apps.
- Voloskaya 7y ago
  They didn't 'willingly' give anything. Like any app, you launch it and you accept the EULA. Then it asks you for permission to use your camera and for your contacts: it makes sense you want to take selfies and share them. That's it, now all your data belong to them. There is no functional difference between an app that will siphon all your private data and an app that won't. for the vast majority of users, at no point did they stop and ponder whether they were ok giving up their 'face' for a filter app. The only way to know would be to read the terms, and even then if you are not a lawyer you won't see the traps (e.g. understanding that "User Content" actually refers to your face).
  - fnordsensei 7y ago
    Assuming that the app is available in the EU, I wonder how this squares with the GDPR.
  - mikeash 7y ago
    This still lines up exactly with what I’m saying. Defending your privacy means you need to stop and ponder these things. People don’t know that they need to do this. You don’t need to read the terms. You “just” need to assume nefarious intent unless demonstrated otherwise.
    - somatic 7y ago
      People have reasonable expectations of privacy. They expect their phone calls not to be recorded. They expect that their emails are treated with the same inviolability as their letters were. They expect their letters to be as they were before the advent of technologies that governments are now using to mass record the contents of letters without opening them, of which technologies and practices they have no knowledge. All of these expectations, and many more, are now ritually violated in the most outrageous manner. It isn’t the responsibility of the individual to combat every violation of his person. Not only is it an unreasonable expectation for society’s “default setting” to be the casual violation of its citizens, but it’s also literally impossible for even the richest, smartest, and most diligent among us to avoid getting screwed... in some way... when there are so, so, SO many ways to get screwed. Because, in 2019, if your highest priority is NOT getting screwed, you might literally have to live alone in a cabin in the mountains. Which is why you can take your atomic-individual libertarian “oh you “just” need to somehow avoid every omnipresent feature of contemporary life” and take a fucking hike. I demand the right to walk to the grocery, buy a sandwich, walk to the park, eat the sandwich, and walk home, without having my minute-by-minute location invisibly and undetectably recorded and sent to ANY corp/gov, my purchase recorded and sent to ANY corp/gov, my face/gait/person scanned and analyzed by ANY corp/gov, etc. and so forth. And I should have to take no special action for any of this, because this is the default setting.
tictoc 7y ago
Are terms of service somewhat consistent in their language? And if that's the case, couldn't someone build something that scans Terms across products and summarize what exactly it is you are giving up by accepting the Terms?
- etxm 7y ago
  It sounds like you got a product idea. I know my uncle Doug would pay for it.
- zarq 7y ago
  https://tosdr.org/ https://tosdr.org/ -- it's not automated, but it's a start. Also FaceApp isn't listed.
godelski 7y ago
Option 4: what can you do with my face and name? That's just like you taking a picture of me in public. I know plenty of people that think this way.
MisterTea 7y ago
I think the problem is these systems are much more complex than the people realize. Technically minded people like those of us here understand the implications but they might not. That or they have too much trust in an increasingly untrustworthy world. It's just naivety really.
everdev 7y ago
Even if they did read it, there's no legal recourse for a state sponsored company that decides to write a good looking ToS and then just ignore it completely. Or, it's not hard to imagine this even bring a completely legit company. I'm sure it's easy enough now for the Russian government to find something wrong they did and demand to see all the data they collected. And finally, even if it's a legit company and they somehow have enough legal protection in Russia to about sharing data with the government, they're probably not the hardest security target in the world for any rogue operator to steal their data. Bottom line, don't put all your trust in a ToS.
- trevyn 7y ago
  Is there evidence they are actually state sponsored?
hanniabu 7y ago
There should be a rule that if a ToS is longer than 200 words then it requires a bullet point summary list at the top.
- mikeash 7y ago
  The trouble is, what happens when the summary is inaccurate or incomplete? If the summary takes precedence in that case, then the full ToS is meaningless and can be omitted, so you could simplify this to a rule requiring ToSs to be under 200 words. If the ToS takes precedence then the summary is meaningless.
  - etbebl 7y ago
    Instead of summarizing the terms, it could be like nutrition facts warnings. Cross certain lines in the actual terms and you're required to put "See full terms for what your personal data can be used for" or something. If the terms cross lines without putting the warnings, they can't be enforced. It would have to be not overly restrictive limits, or you'd end up with a prop-65-like scenario. Or hell, just make a standardized "Privacy Facts" panel.

JoshuaRLi 7y ago

> the general public actually doesn’t care about privacy at all It's not that people don't care; privacy is probably undervalued in the context of making privacy vs. convenience/utility decisions. (Digital) privacy's value isn't really tangible until it's actively used against you.

snarf21 7y ago

Or option 3. They care about privacy but only when terrible thing X happens. They post their name and picture to Instagram 12 times a day. Most people have public profiles so there is no new risk. Of course by the time every street corner has facial recognition running "for our safety", it will be too late. Even as someone who knows the risks, this doesn't scare me as much as DNA testing. Even worse is that if any of my relatives do it, I'm just as screwed. There is also the "let's all install hackable video cameras on our front doors" problem. Clever fear mongering to prevent a random package being stolen that is already insured and will be resent automatically. Instead we paid to create our own surveillance state.

ryanSrich 7y ago

It’s somewhere in the middle. The cultural shift is happening though. And once the market is ready, they’ll need tools. Right now it’s simply too complicated to not only understand what an application can do with your data, but then taking actions on that data (right to be forgotten, etc.) in the future. If you’re at all interested in this space feel free to email me. I’m working on something that isn’t quite ready to discuss publicly yet.

Cthulhu_ 7y ago

It's because there's not been a lot of scary things happening yet. Or if they have, it's been on individuals - like someone seeing themselves on a billboard or advert. But because the datasets are so massive, people are reduced to statistics which is a lot less scary. Of course, if you look at history that can change overnight. Or actually it won't, it's more likely a "boiling frog" kinda thing where nobody's aware of anything bad happening until it's too late.

magashna 7y ago
No need to pay someone for their likeness when you can generate the average face of your targeted market
easyat 7y ago
The psyops conducted by Cambridge Analytica and similar organizations in the US, England, and around the world is pretty scary
T1glober 7y ago
> someone seeing themselves on a billboard or advert I just pictured 4chan hacking into a photo database and putting people's faces on a bunch of billboards. Surely if this happened to more people, the public would become more privacy-conscious, no?

asveikau 7y ago

It's the updated version of the dancing pigs phenomenon. https://en.wikipedia.org/wiki/Dancing_pigs https://en.wikipedia.org/wiki/Dancing_pigs The smartphone is giving them funny shit. Any permissions prompts or legalese that occur in the meantime are incidental.

idop 7y ago

The general public doesn't have the knowledge or even imagination to understand that sharing your information with nameless/faceless organizations may have downsides re: privacy. The others have been brainwashed well enough to believe that only criminals need privacy, so they don't care. By now using the "I have nothing to hide" example is cliche but it's literally the response I _always_ get when I bring up privacy concerns. Takes me about 12 seconds to prove to them how wrong they are.

skizm 7y ago
What argument do you use to prove them wrong?
- idop 7y ago
  I usually say something to the tune of "everyone has something to hide, that's why we put clothes on; that's why we don't go around broadcasting our medical test results; that's why we don't reveal our salaries and benefits to our colleagues (or anyone); that's why we don't give our address to anyone that asks for it. It doesn't mean we've done something bad or we're criminals, it just means we're human. But if you have a gmail account, you've probably given one of the world's largest corporation all this knowledge." Usually the medical test thing is enough to shut them up. Anyway there are many such example arguments around the internet, just DuckDuckGo "nothing to hide". There's even a Wikipedia article about it [1]. Edit: Oh, I often give Uber's deleted posts about how they know their users had one-night stands as an example too. See [2] and [3] for one of the deleted posts. [1] https://en.wikipedia.org/wiki/Nothing_to_hide_argument https://en.wikipedia.org/wiki/Nothing_to_hide_argument [2] https://money.cnn.com/2014/11/25/technology/uber-prostitutes/index.html https://money.cnn.com/2014/11/25/technology/uber-prostitutes... [3] https://web.archive.org/web/20140827195715/http://blog.uber.com/ridesofglory https://web.archive.org/web/20140827195715/http://blog.uber....
  - deleted 7y ago
    [deleted]
  - ebg13 7y ago

throwawaymanbot 7y ago

In fairness, when you use an app like this, why would you (as the avg user) ever think they would be doing something nefarious with it? Especially digital products where the "magic" happens out of sight in the bg. People DO want privacy and I bet there will be lawsuits about this.

nixpulvis 7y ago

I'd say it's a lot more like an addict that, while smoking a cigarette, says things like "yea I know these things are killing me". No harm, no foul until the signs are visible, and it's probably too late.

JustSomeNobody 7y ago

The general public doesn't understand. They're not steeped in it like we are. And we're failing to simplify the discussion to the level in which they will understand. Until then, they'll use apps like this. I think the devs of this app need a slap on the wrist for being party to this nonsense as well.

koolba 7y ago

It’s both but the second one scares me more than the first as nothing stops one of your friends from giving access to a trove of photos and information about you. It could be as easy as granting access to your camera roll (oh there’s tags! We’ll take those too!) or just holding up your photo to the camera.

matchagaucho 7y ago

How soon the public forgets about Equifax data breaches, but goes into a panic when they opt-in for face filters.

mikeash 7y ago
People got very upset about Equifax, it’s just that there’s approximately nothing we can do about them. Our choice is for Equifax to have all our info, or refrain from partitipating in the modern financial system.

envy2 7y ago

I think we're not giving the general public enough credit. These discussions always seem to come down to "no one cares about privacy" or "they care but they're idiots." I think many people care about privacy and generally understand the issues, but are making conscious trade-offs that make sense for them. For the vast majority of people—who are boring, non-activist, law-abiding citizens—the value they assign to privacy of things like name/face/products they're interested in is nonzero, but very low. They know their name/face, along with far more sensitive information, is already in a lot of databases that matter more than anything some random app developer can do, and they get some greater value from the marginal privacy impact of that same information ending up in one more place. There's a good bit of research to support this. For example, there is a study showing you'd have to pay someone on average $1,000+ [1] to give up their Facebook account for year, suggesting that's the value they assign to the service. At the same time, if you ask them how much they'd be willing to pay for an ads-free, more privacy conscious version of Facebook, studies show only a small fraction would pay even $15/month [2]. In other words, people are making a conscious assessment that their privacy is less valuable than the services they can get by giving it up. We make these kind of trade-offs and decisions every day. It's much the same reason people can be both deeply concerned about child labor in the Global South, but still make the decision to buy the cheaper version of a product rather than the one they know is ethically sourced, even if they could afford the latter. These decisions certainly have societal impacts that are worth contemplating and being concerned about, but it's wrong and infantilizing to simply dismiss people's conscious and rational (for them) choices. [1] https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0207101 https://journals.plos.org/plosone/article?id=10.1371/journal... [2] https://www.vox.com/2018/4/11/17225328/facebook-ads-free-paid-service-mark-zuckerberg https://www.vox.com/2018/4/11/17225328/facebook-ads-free-pai...

mikeash 7y ago
What is the difference between “people don’t care about privacy” and “people value Facebook highly, wouldn’t pay much of anything for an ad-free, privacy conscious version of Facebook, and are making a conscious assessment that their privacy is less valuable than the service,” other than the additional detail? It seems to me that you’re complaining about infantilizing people’s choices while simultaneously telling us that, yes, people indeed don’t care about privacy very much.

pbhjpbhj 7y ago

Bit if A, bit of B. People don't care that much, but also don't realise the implications that would make them care marginally more in some instances. Google already have millions of face tags from Picasa, etc.; Facebook has had image tagging for ages; ... governments already have all that data from passports and driving licensee and ID cards ... so why not give it up again. It's a drop in the ocean situation. Russia having my face data is likely to make much less difference to me than someone in UK having it, which might also make people not care. [But of course they can sell the data on.]

cmiles74 7y ago

The general public didn't know that the application was saying "give us your name and face and we can do whatever we want with it..." They had no idea that this was even a thing. I would bet hard earned money that the average person installed this application because a friend told them and they were curious. This bit about what happens to their image and what data does the app save locally verses pushing out to the network, etc. is something that never even crossed their mind. If there was a window with legalese they ignored it as they have been trained to do (by Microsoft, Apple and every other commercial software product they ever purchased). Certainly they didn't go clicking around and looking for it.

phkahler 7y ago
>> The general public didn't know that the application was saying "give us your name and face and we can do whatever we want with it..." They had no idea that this was even a thing. Because EULAs and "terms of service" and "privacy policy" are all bullshit that nobody reads and should not have legally binding consequences or obligations. Peope have come to treat those things like a simple OK button but the law says otherwise. This company could produce deep-fakes with users heads on them and claim it's OK by their ToS and they might be right.

eeeeeeeeeeeee 7y ago

I don’t think the general public cares in the same way people on this forum do. But, I do think they would care if their photos ended up on a billboard or used in marketing material without their explicit permission. Most understand that the company needs some kind of access to photos for the app to actually do anything, but there is a limit.

tdb7893 7y ago

I think as with most things it's a little of both. HN as a whole is concerned about a lot of privacy stuff that just doesn't bother everyone. Also privacy is hard, even if you buy things in cash companies can still track you if they want, they use cookies and fingerprinting techniques that even most people in tech don't really understand. It's not really possible to counteract tracking if large companies and governments make an effort for it.

gioele 7y ago

> One is that the general public actually doesn’t care about privacy at all. It’s a niche concern. There is an established term for this innate human trait: "dancing pigs". > In computer security, the "dancing pigs" is a term or problem that describes computer users' attitudes to computer security. It states that users will continue to pick an amusing graphic even if they receive a warning from security software that it is potentially dangerous. In other words, users choose their primary desire features without considering the security. https://en.wikipedia.org/wiki/Dancing_pigs https://en.wikipedia.org/wiki/Dancing_pigs

GCA10 7y ago

In aggregate, people's desire to be noticed is vastly larger than their desire for privacy. The latest case -- going beyond anything I can parody -- is this first-person NYTimes tell-all about a married couple being overheard in the midst of a sexual morning. https://www.nytimes.com/2019/07/12/well/family/when-our-daughter-walked-in-on-us.html https://www.nytimes.com/2019/07/12/well/family/when-our-daug... Why bother sounding alarms about Alexa, Google Voice, etc. perhaps listening to our bedroom conversations? There's a slice of the public that will go to a lot of trouble (write article, etc.) to make sure that such moments become public.

DisruptiveDave 7y ago

Another: The general public cares about privacy but not more than they care about the perception of belonging and being a part of any sensation that has to do with social media.

asdff 7y ago

People probably don't even realize that stuff moves to a server at all. People may think this is all happening and contained within their local app and therefore private and in their control. They probably also assume snapchats go from their phone to the recipient directly and aren't held anywhere in between. This is I think the most scary possibility. If you think faceapp is processing this in the app with your phone's hardware, learning that they save all pictures sounds like a vast conspiracy and not so believable. However, if you understand the technology and that most things online are not processed client side, the privacy implications are suddenly obvious because of course the company will keep that data that passes through their hardware. No shareholder will let money be left on the table so all data you put online should be assumed to be kept for later profit. People have to be better educated on how the software they use every day actually works, at least in broad strokes. This can come in a high school media/technology literacy class or something. Until that day comes, we have two classes of people: those who understand how the tech they use works and makes a company money, and those who will be forever manipulated by the first group so long as they have a dollar or a right to vote. It's a hard problem to overcome when so many technology companies are entirely dependent on profit from people's continued ignorance and tech illiteracy.

lone_haxx0r 7y ago

I care about privacy, but the state already knows my face, my fingerprint, etc. A private institution is, by definition, less hostile than the state of my country, so it's kind of pointless to try to hide my face.