5 ms·

I truly believe the era of privacy is over. There are zero consequences to anyone important when a data breach happens; therefore there is no incentive for com

I truly believe the era of privacy is over. There are zero consequences to anyone important when a data breach happens; therefore there is no incentive for companies to protect their user data and the number of breaches will continue to grow for the foreseeable future. By 2025 at the latest, there will effectively be no such thing as privacy anymore. All personal data belonging to everyone will have been exfiltrated and will be available for sale. You will be able to purchase the full medical history, all financial transactions, all addresses, phone numbers, location history (often with photo/video evidence), all account numbers, ID numbers (government and otherwise), biometric data, browser/search history, every email, sms or chat message they ever sent or received and any other information you can think of for the vast majority of people on earth.

mathdev 7y ago
I hope not. Much too late, I recently realised that I probably would not survive my WhatsApp history getting out.
- rhizome 7y ago
  Better start coffin shopping, because it's going to happen...some day.
- tialaramex 7y ago
  Because WhatsApp uses the Signal protocol design nobody ends up able to prove anything useful about the message history. To any outsider, including the WhatsApp server operators, the messages are opaque. To a participant, including you, the system delivers authenticated messages but deliberately doesn't sign them. So: Alice knows she didn't send this message, so it's from Bob, but she can't prove to anyone else that she didn't just fake it. Bob knows he sent the message but he can deny it and there's no proof. Eve has no idea what the message was, even if Alice or Bob show her the real message she can't verify they aren't lying.
  - vunie 7y ago
    What about those messages before the signal protocol was adopted?
- saiya-jin 7y ago
  maybe take it as a wake up call to start acting morally/honestly/whatever positive opposite to what you did?
  - tripzilch 7y ago
    there are lots of reasons someone can fear for their lives if their whatsapp history became public, that do not involve unethical behaviour by that person. usually involves unethical behaviour by other persons, though. probably wise not to judge as quickly without knowledge of the entire picture.
rhizome 7y ago
>There are zero consequences Maybe more thought could be put into why this is, rather than normalizing it? How many people on this here web site pay their bills with the fruits of these breaches?
ajdlinux 7y ago
> By 2025 at the latest, there will effectively be no such thing as privacy anymore. All personal data belonging to everyone will have been exfiltrated and will be available for sale. Does your 2025 prediction apply to black market sale or legal market sale?
- incompatible 7y ago
  "Exfiltrated" implies black market, but for the prediction come true, data would have to be leaked by the vast majority of organizations, including most of the banks. Possible, I suppose, given the difficulty of protecting data against all possible attacks, including release by insiders.
- pndy 7y ago
  > Does your 2025 prediction apply to black market sale or legal market sale? Your comment bring back Microsoft's Project Bali news from my memory [1]; this supposed data bank allows users to "manage, control, share and monetize the data.". That was bit than year ago and it seems they abandoned the idea as page doesn't load anymore (at least for me). [1] - https://www.zdnet.com/article/microsoft-is-privately-testing-bali-a-way-to-give-users-control-of-data-collected-about-them/ https://www.zdnet.com/article/microsoft-is-privately-testing...
- deepspace 7y ago
  Black market, but I am think a substantial portion of the data (specifically the stuff not protected by privacy laws) will be available legally too.
josephg 7y ago
I've been long arguing that there should be severe legal consequences for companies who leak data. Right now there's almost no legal repercussions for this sort of thing. I expect better from Microsoft, but I really don't expect any better from the thousands of tiny startups out there. Unless the people involved suffer any serious consequences for leaking their customer's data, they won't bother spending the time and money to do a good job and these breaches will continue to be commonplace. As much as I love the free market, we're completely failing to protect consumers. I think we need the government to step in and align incentives. I don't know if we need engineers to be personally liable in the case of data breaches, but I'm serious enough about this that I wouldn't take it off the table. Medicine has malpractice suits. Engineers have a professional duty of care. Builders have building codes. We need an equivalent for software engineering. Its not the wild west anymore when we didn't know how to do this right. For almost all modern software, best practices are out there and well known. The way you secure a password database hasn't changed much in the last decade. Apparently people just don't care enough to learn and apply those techniques. Bootcamps don't even bother to teach any security practices. Given how much the world relies on our industry's ability and knowledge, that needs to change in a hurry.
- logicchains 7y ago
  >As much as I love the free market, we're completely failing to protect consumers. I think we need the government to step in and align incentives. >Medicine has malpractice suits. Engineers have a professional duty of care. Builders have building codes. We need an equivalent for software engineering. The key difference is that when a doctor or engineer screws up, people die. The burden is on the people calling for regulation to show the tangible, measurable harm to peoples' health or finances resulting from these data breaches, otherwise the average person won't take them seriously. It's also the case that doctors and engineers aren't dealing with adversarial input. If somebody blows up a bridge nobody blames the engineer, and if a patient deliberately harms themselves nobody blames the doctor. Yet web infrastructure is constantly dealing with adversaries across the world trying to breach it.
  - hnuser123456 7y ago
mceachen 7y ago
Some of us are working on solutions that keep one of the biggest metadata streams, your photos and videos, off the FAANG. At least it's a choice you can make, even today. That still leaves medical and financial records, which is a tangle substantially more herculean.
d10r 7y ago
> There are zero consequences to anyone important when a data breach happens probably not in the EU - at least not if some kind of negligence, as specified by the GDPR, took place.

mathdev 7y ago

I hope not. Much too late, I recently realised that I probably would not survive my WhatsApp history getting out.

rhizome 7y ago
Better start coffin shopping, because it's going to happen...some day.
tialaramex 7y ago
Because WhatsApp uses the Signal protocol design nobody ends up able to prove anything useful about the message history. To any outsider, including the WhatsApp server operators, the messages are opaque. To a participant, including you, the system delivers authenticated messages but deliberately doesn't sign them. So: Alice knows she didn't send this message, so it's from Bob, but she can't prove to anyone else that she didn't just fake it. Bob knows he sent the message but he can deny it and there's no proof. Eve has no idea what the message was, even if Alice or Bob show her the real message she can't verify they aren't lying.
- vunie 7y ago
  What about those messages before the signal protocol was adopted?
saiya-jin 7y ago
maybe take it as a wake up call to start acting morally/honestly/whatever positive opposite to what you did?
- tripzilch 7y ago
  there are lots of reasons someone can fear for their lives if their whatsapp history became public, that do not involve unethical behaviour by that person. usually involves unethical behaviour by other persons, though. probably wise not to judge as quickly without knowledge of the entire picture.

rhizome 7y ago

>There are zero consequences Maybe more thought could be put into why this is, rather than normalizing it? How many people on this here web site pay their bills with the fruits of these breaches?

ajdlinux 7y ago

> By 2025 at the latest, there will effectively be no such thing as privacy anymore. All personal data belonging to everyone will have been exfiltrated and will be available for sale. Does your 2025 prediction apply to black market sale or legal market sale?

incompatible 7y ago
"Exfiltrated" implies black market, but for the prediction come true, data would have to be leaked by the vast majority of organizations, including most of the banks. Possible, I suppose, given the difficulty of protecting data against all possible attacks, including release by insiders.
pndy 7y ago
> Does your 2025 prediction apply to black market sale or legal market sale? Your comment bring back Microsoft's Project Bali news from my memory [1]; this supposed data bank allows users to "manage, control, share and monetize the data.". That was bit than year ago and it seems they abandoned the idea as page doesn't load anymore (at least for me). [1] - https://www.zdnet.com/article/microsoft-is-privately-testing-bali-a-way-to-give-users-control-of-data-collected-about-them/ https://www.zdnet.com/article/microsoft-is-privately-testing...
deepspace 7y ago
Black market, but I am think a substantial portion of the data (specifically the stuff not protected by privacy laws) will be available legally too.

josephg 7y ago

I've been long arguing that there should be severe legal consequences for companies who leak data. Right now there's almost no legal repercussions for this sort of thing. I expect better from Microsoft, but I really don't expect any better from the thousands of tiny startups out there. Unless the people involved suffer any serious consequences for leaking their customer's data, they won't bother spending the time and money to do a good job and these breaches will continue to be commonplace. As much as I love the free market, we're completely failing to protect consumers. I think we need the government to step in and align incentives. I don't know if we need engineers to be personally liable in the case of data breaches, but I'm serious enough about this that I wouldn't take it off the table. Medicine has malpractice suits. Engineers have a professional duty of care. Builders have building codes. We need an equivalent for software engineering. Its not the wild west anymore when we didn't know how to do this right. For almost all modern software, best practices are out there and well known. The way you secure a password database hasn't changed much in the last decade. Apparently people just don't care enough to learn and apply those techniques. Bootcamps don't even bother to teach any security practices. Given how much the world relies on our industry's ability and knowledge, that needs to change in a hurry.

logicchains 7y ago
>As much as I love the free market, we're completely failing to protect consumers. I think we need the government to step in and align incentives. >Medicine has malpractice suits. Engineers have a professional duty of care. Builders have building codes. We need an equivalent for software engineering. The key difference is that when a doctor or engineer screws up, people die. The burden is on the people calling for regulation to show the tangible, measurable harm to peoples' health or finances resulting from these data breaches, otherwise the average person won't take them seriously. It's also the case that doctors and engineers aren't dealing with adversarial input. If somebody blows up a bridge nobody blames the engineer, and if a patient deliberately harms themselves nobody blames the doctor. Yet web infrastructure is constantly dealing with adversaries across the world trying to breach it.
- hnuser123456 7y ago

mceachen 7y ago

Some of us are working on solutions that keep one of the biggest metadata streams, your photos and videos, off the FAANG. At least it's a choice you can make, even today. That still leaves medical and financial records, which is a tangle substantially more herculean.

d10r 7y ago

> There are zero consequences to anyone important when a data breach happens probably not in the EU - at least not if some kind of negligence, as specified by the GDPR, took place.