6 ms·

Sure, and this is the consequence of living in a digital world. In the days of yore, all of your private information was sitting in paper ledgers in every busin

by bhupy 6y ago

Sure, and this is the consequence of living in a digital world. In the days of yore, all of your private information was sitting in paper ledgers in every business you ever interacted with. Even back then, you were susceptible to receiving promotional spam and marketing, and law enforcement regularly perused a business's books during criminal investigations. It's perhaps a bit easier today, in the digital world, but in principle not much has changed. Even in the digital realm, your financial data is mostly safe on account of PCI-DSS compliance requirements. So even in our connected world, a company isn't going to (legally) get your credit card information unless they're storing it in an HSM. Your personal health data is mostly safe on account of HIPAA. Even though a business you interface with might have a BAA with Amazon to store your healthcare data in an S3 bucket, Amazon is prohibited by law from actually doing anything with that data. Any serious digital business that wants to grow beyond a certain size needs to be SOC-2 Type 2 certified, which all of the major cloud providers happen to be. The implication of being unable to "live without tech giants" as extending to being unable to prevent others from living without them is a bit of a stretch. The fact that you can't prevent others from interacting with "Tech Giants" (be they individuals or businesses) has been true for forever, and for any type of business. The idea this necessarily means that one ought to be able to prevent other individuals or businesses from interacting with them also is a more recent, but flawed idea.

deleted 6y ago
[deleted]
Silhouette 6y ago
In the days of yore, all of your private information was sitting in paper ledgers in every business you ever interacted with. Even back then, you were susceptible to receiving promotional spam and marketing, and law enforcement regularly perused a business's books during criminal investigations. It's perhaps a bit easier today, in the digital world, but in principle not much has changed. I respectfully disagree. When things were done that way, surveillance was possible but it was expensive. Someone would have to physically open every letter you sent, or visit the properties of organisations you dealt with to check their records. It is extremely unlikely that your national postal service was routinely opening all of the correspondence you sent to a wide range of other parties, reading and analysing it, comparing it to who knows what, and using this information to their advantage but not necessarily yours. It is similarly unlikely that, back in the days of cash and cheques, anyone was monitoring every purchase you made and compiling a profile of you without your knowledge or consent, again to be used for their advantage but not necessarily yours. However, in the digital world with service providers like Google or the big payment networks, this is more or less exactly what is done routinely, every day, to everyone. Given the obvious risks involved, it is no unreasonable to question whether this is appropriate or whether those organisations should be subject to laws restricting what they can do. Even in the digital realm, your financial data is mostly safe on account of PCI-DSS compliance requirements. PCI-DSS is violated all the time by huge numbers of businesses, often without them realising. In any case, card payments are insecure by design, so I don't think citing them as an example of good policy here is a great idea. And of course PCI-DSS only affects card payments, not the many other payment methods used routinely by billions of people around the world. Your personal health data is mostly safe on account of HIPAA. I'm not from the US, so HIPAA isn't much use to me. From various criticisms I've read, it might not be as useful as they think to those who are from the US either, which is a separate issue. The implication of being unable to "live without tech giants" as extending to being unable to prevent others from living without them is a bit of a stretch. Is it, though? Many of the dangers posed by the modern world and the tech giants that run it come precisely from the fact that there are two sides to many interactions and they only need to monitor one of them to get the full story. You might choose not to use any Google services, but many people you contact may be using GMail, in some cases without your knowledge. You might choose not to upload your photos to Facebook, but you can't prevent the people who were around you on your holiday uploading theirs that show you clearly enough for Facebook's facial recognition technology to identify you. You might choose not to have a digital assistant on your phone uploading your voice to Google or Apple, but in a restaurant you are probably surrounded by people whose phones can pick up your voice from a much greater distance than any human would normally notice it and upload that. Then there are all those modern camera systems in cars and homes and offices that are Internet-enabled rather than CCTV. The list goes on. And on the other end of this vast data harvesting infrastructure are a relatively small number of awesomely powerful organisations, who are building up all kinds of profiles on you, without your knowledge or consent, to use for purposes that might not be in your interests, over which you have no say. This is a perfect example of the saying that just because we can do something, it doesn't necessarily mean that we should.
- bhupy 6y ago
  > When things were done that way, surveillance was possible but it was expensive. Yes, I mean I didn't suggest otherwise. What you're describing is a difference in degree, not kind. In principle not much has changed. > It is extremely unlikely that your national postal service was routinely opening all of the correspondence you sent to a wide range of other parties, reading and analysing it, comparing it to who knows what, and using this information to their advantage but not necessarily yours. This is historically incorrect: the US government is known to have used its vast resources on expansive surveillance, even before the age of information. The FBI was known to listen in on telephone lines, and was known to have run a sophisticated operation of deploying surveillance vehicles all over the US. If your argument is that surveillance was once more expensive, the counterargument is that state actors have always been the entities most capable of bearing this expense. On the flip side, today, in the age of information, the market has produced tools that allow us to communicate via end-to-end encryption that has finally become somewhat insurmountable by even state actors. This is why the US government is actively[1] trying to outlaw warrant-proof encryption. > PCI-DSS is violated all the time by huge numbers of businesses, often without them realising. PCI-DSS is absolutely not violated "all the time", that's a really bold and baseless claim. Yes, you're right that from time to time, it can be violated, but quarterly unannounced audits are the norm. > In any case, card payments are insecure by design, so I don't think citing them as an example of good policy here is a great idea. I'm not sure that I agree. The EMV standard for payment cards is fairly robust. > And of course PCI-DSS only affects card payments, not the many other payment methods used routinely by billions of people around the world. This is...factually incorrect. What "many other payments" are you talking about? Outside of cash, card payments (either physical or card-not-present) constitute the vast majority of payments for the billions of people on the planet. If your argument is that most people use cash, then that's orthogonal to a discussion about the risks of digital systems. > I'm not from the US, so HIPAA isn't much use to me. From various criticisms I've read, it might not be as useful as they think to those who are from the US either, which is a separate issue. Then your beef isn't with the "Tech Giants", all of whom are American companies, under US jurisdiction. [1] https://www.judiciary.senate.gov/press/rep/releases/graham-cotton-blackburn-introduce-balanced-solution-to-bolster-national-security-end-use-of-warrant-proof-encryption-that-shields-criminal-activity https://www.judiciary.senate.gov/press/rep/releases/graham-c...

by bhupy 6y ago

deleted 6y ago

[deleted]

Silhouette 6y ago

In the days of yore, all of your private information was sitting in paper ledgers in every business you ever interacted with. Even back then, you were susceptible to receiving promotional spam and marketing, and law enforcement regularly perused a business's books during criminal investigations. It's perhaps a bit easier today, in the digital world, but in principle not much has changed. I respectfully disagree. When things were done that way, surveillance was possible but it was expensive. Someone would have to physically open every letter you sent, or visit the properties of organisations you dealt with to check their records. It is extremely unlikely that your national postal service was routinely opening all of the correspondence you sent to a wide range of other parties, reading and analysing it, comparing it to who knows what, and using this information to their advantage but not necessarily yours. It is similarly unlikely that, back in the days of cash and cheques, anyone was monitoring every purchase you made and compiling a profile of you without your knowledge or consent, again to be used for their advantage but not necessarily yours. However, in the digital world with service providers like Google or the big payment networks, this is more or less exactly what is done routinely, every day, to everyone. Given the obvious risks involved, it is no unreasonable to question whether this is appropriate or whether those organisations should be subject to laws restricting what they can do. Even in the digital realm, your financial data is mostly safe on account of PCI-DSS compliance requirements. PCI-DSS is violated all the time by huge numbers of businesses, often without them realising. In any case, card payments are insecure by design, so I don't think citing them as an example of good policy here is a great idea. And of course PCI-DSS only affects card payments, not the many other payment methods used routinely by billions of people around the world. Your personal health data is mostly safe on account of HIPAA. I'm not from the US, so HIPAA isn't much use to me. From various criticisms I've read, it might not be as useful as they think to those who are from the US either, which is a separate issue. The implication of being unable to "live without tech giants" as extending to being unable to prevent others from living without them is a bit of a stretch. Is it, though? Many of the dangers posed by the modern world and the tech giants that run it come precisely from the fact that there are two sides to many interactions and they only need to monitor one of them to get the full story. You might choose not to use any Google services, but many people you contact may be using GMail, in some cases without your knowledge. You might choose not to upload your photos to Facebook, but you can't prevent the people who were around you on your holiday uploading theirs that show you clearly enough for Facebook's facial recognition technology to identify you. You might choose not to have a digital assistant on your phone uploading your voice to Google or Apple, but in a restaurant you are probably surrounded by people whose phones can pick up your voice from a much greater distance than any human would normally notice it and upload that. Then there are all those modern camera systems in cars and homes and offices that are Internet-enabled rather than CCTV. The list goes on. And on the other end of this vast data harvesting infrastructure are a relatively small number of awesomely powerful organisations, who are building up all kinds of profiles on you, without your knowledge or consent, to use for purposes that might not be in your interests, over which you have no say. This is a perfect example of the saying that just because we can do something, it doesn't necessarily mean that we should.

bhupy 6y ago
> When things were done that way, surveillance was possible but it was expensive. Yes, I mean I didn't suggest otherwise. What you're describing is a difference in degree, not kind. In principle not much has changed. > It is extremely unlikely that your national postal service was routinely opening all of the correspondence you sent to a wide range of other parties, reading and analysing it, comparing it to who knows what, and using this information to their advantage but not necessarily yours. This is historically incorrect: the US government is known to have used its vast resources on expansive surveillance, even before the age of information. The FBI was known to listen in on telephone lines, and was known to have run a sophisticated operation of deploying surveillance vehicles all over the US. If your argument is that surveillance was once more expensive, the counterargument is that state actors have always been the entities most capable of bearing this expense. On the flip side, today, in the age of information, the market has produced tools that allow us to communicate via end-to-end encryption that has finally become somewhat insurmountable by even state actors. This is why the US government is actively[1] trying to outlaw warrant-proof encryption. > PCI-DSS is violated all the time by huge numbers of businesses, often without them realising. PCI-DSS is absolutely not violated "all the time", that's a really bold and baseless claim. Yes, you're right that from time to time, it can be violated, but quarterly unannounced audits are the norm. > In any case, card payments are insecure by design, so I don't think citing them as an example of good policy here is a great idea. I'm not sure that I agree. The EMV standard for payment cards is fairly robust. > And of course PCI-DSS only affects card payments, not the many other payment methods used routinely by billions of people around the world. This is...factually incorrect. What "many other payments" are you talking about? Outside of cash, card payments (either physical or card-not-present) constitute the vast majority of payments for the billions of people on the planet. If your argument is that most people use cash, then that's orthogonal to a discussion about the risks of digital systems. > I'm not from the US, so HIPAA isn't much use to me. From various criticisms I've read, it might not be as useful as they think to those who are from the US either, which is a separate issue. Then your beef isn't with the "Tech Giants", all of whom are American companies, under US jurisdiction. [1] https://www.judiciary.senate.gov/press/rep/releases/graham-cotton-blackburn-introduce-balanced-solution-to-bolster-national-security-end-use-of-warrant-proof-encryption-that-shields-criminal-activity https://www.judiciary.senate.gov/press/rep/releases/graham-c...