5 ms·

The root of the problem is not the privacy policy or the system security. The root of the problem is the collection itself. All large businesses, health care

The root of the problem is not the privacy policy or the system security. The root of the problem is the collection itself. All large businesses, health care providers, and governments maintain databases. Every one of them will eventually be leaked. All it takes is a corruptible trusted insider.

HenryKissinger 6y ago
> Every one of them will eventually be leaked. [X] Doubt
- HighlandSpring 6y ago
  On a long enough timeline everything and everyone can be compromised (or the institution fails before then)
  - hobs 6y ago
    Exactly - either the data is basically not valuable at all (the category for which PII rarely fits) or else when the company collapses or is bought, the data moves too. There's always an incentive to steal or leak it to other companies for money; so as long as the incentives are aligned with GATHER ALL DATA and KEEP IT FOREVER then yes, it will just be a matter of a time before each data store is compromised by mistake or purposefully.
- BobbyJo 6y ago
  I doubt the claim, but the sentiment I think is valid. If you think about what data these entities are holding, it's not unique to a single database or entity. Your name/address/phone/ssn/etc. Is likely stored in so many places that the probability it gets leaked from at least one eventually I'd say is very nearly, if not 100%.
- allworknoplay 6y ago
  Why on earth did you pick this username
tomComb 6y ago
Google has a huge number of activist (and surely some corruptible) employees, and yet the incidents of users data getting out are very close to zero. I think this demonstrates that user data can be managed safely and effectively. Usually the incidents reports on user data leaks show that the company seemed to barely be trying - We need laws that force them (even small companies) to put serious effort into it.
- varispeed 6y ago
  You don't know that. While the publicly available data leaks are indeed rare, you cannot know if they don't use the data for trading or other purposes for their personal gain without disclosing it to the public.
  - tomComb 6y ago
    There are infinite things we can't know - opening the discussion up to that really makes anything possible, but the discussion wasn't even about what they might do with the data beyond leaking or selling it.
  - Judgmentality 6y ago
    Sure, but if you have no evidence of it happening you have a fairly weak argument.
    - varispeed 6y ago
      People do have access to privileged information and that will influence their decisions on both conscious and unconscious levels. It's not possible to detach yourself from work completely and asses your thinking whether it is influenced by something you saw or not on an objective level. It will also be difficult to prove. For example if an employee hobby is trading, how do you prove that the trades they made are based on their own independent research or based on what they saw? If they saw something that could make them money, they could easily create a trail of evidence that they researched the matter on their own - it will be difficult to prove that it originated from looking up the privileged information and unless someone is going to be making millions, it's frankly not economical to commit resources to. It is also in the interest of the company that such incidents don't see the light of day.
TheRealDunkirk 6y ago
> Every one of them will eventually be leaked. Equifax has more at stake than most. And they've been hacked. Repeatedly. The government has been hacked. Yahoo was COMPLETELY owned. I mean, if someone would put together a list, it would make for shocking reading. It's become so common, that we go, "Oh no! Anyway."
- dunham 6y ago
  Yeah, both my health insurance company and the company that eventually bought my mortgage have both sent me letters. And this point I just dump them in a folder in the filing cabinet with the rest.
xtracto 6y ago
This. I don't trust in the government, but I think digital "personal data" should be only available for "confirmation" to companies that need it. Say, a government entity could have an API that allow you to send hashed personal data that they can verify is right. This way companies will ask the user for their data and hash it client-side. Then they can send the hashes (hashed with a custom provided salt to the entity (government, maybe private) who will basically reply with a True or False on the verification of the different data. It may even be an interesting use case for a public blockcahin, where your personal data is stored in a Merkle Tree type of data structure, so that one can verify that certain pesonal data of a person is true, without disclosing the data.
- spondyl 6y ago
  Wouldn't this fall down as soon as someone enters your details with the wrong casing or uses a +country code rather than a localised phone number and so on? Humans will error and enter data incorrectly so the hash would be different every time potentially despite being "correct" to a human at a glance? You could standardise everything (lowercase etc) but I imagine there are country and regional edge cases such as capitalisation having meaning in a given language (I can imagine it being a thing but I don't know it for sure)
  - webinvest 6y ago
    There could be instructions in place to specify only all lowercase or just use .toLowercase() when sending. Also there could be a specified format for phone numbers or a function that turns all input into the desired format by stripping all special characters. Possibly only hashing the last 9 digits of the phone number for non mission critical applications instead of the full 10 digits. This sounds like a good use case for short brief documentation.
- sdfhbdf 6y ago
  It's probably not implemented as closely as what you described but check out Europe, this small continent across the pond and the tech scene in the smaller countries. For example Estonia has had famously and online identity stuff linked via a federal ID (in europe there are more republics then federations so it's easier to manage country-wise) [0] [1] Or more familiar to me with a bigger sample is a movement in Poland which is gaining popularity - mojeID (myID) which is a Single Sign On system with major banks as providers (they really regligiously check the identities when you open a bank account) or the statebacked login.gov. The mojeID system allows other entities to use your actual identity as an authentication factor without having to keep that much data and pose risks - for example an online alcohol shop can verify the age. [2] [3] [0]: https://en.wikipedia.org/wiki/Estonian_identity_card https://en.wikipedia.org/wiki/Estonian_identity_card [1]: https://e-estonia.com/solutions/e-identity/id-card/ https://e-estonia.com/solutions/e-identity/id-card/ [2]: https://www.kir.pl/en/administration/mojeid/ https://www.kir.pl/en/administration/mojeid/ [3]: https://www.mojeid.pl/#zastosowanie https://www.mojeid.pl/#zastosowanie
edanm 6y ago
I mean, yes, but.. what's the solution? Never collect data? In at least some of those cases (and arguably all), that data does need to be collected and stored. What is the government going to do, not maintain birth registries, tax registries, land owner registries etc? What is a big business like a bank going to do, not collect customer data like your name and address?
- lovecg 6y ago
  I have a different view: it’s not the collection that’s the problem, it’s the firehose attached to the database. For the applications you mention, make aggregation over all records prohibitively expensive by design.
  - edanm 6y ago
    A good idea, but again, there are plenty of cases where that fails (depending on what you mean by "aggregate"). - "How much money is currently owed in taxes to the government?" - "Can't tell you that, we're not allowed to aggregate data".
    - lovecg 6y ago
      I still think there might be something here. You can allow certain aggregations (like “sum of the tax column”), but they have to be explicitly permitted; otherwise shuffle and hash everything enough times to make a single lookup sort of cheap, while a scan very expensive (plus distribute over enough physical servers and make the network between them low bandwidth to thwart lower level attacks). With enough regulatory or legal pressure on companies to lock down their data, paying this premium might start to look attractive; one could even found a startup peddling the World’s Slowest Database™! Edit: what I was thinking originally was that in the world of paper-only archives, these massive leaks were all but impossible, yet business could still be done. It should be possible to combine this slowness with the convenience of computers.
      - edanm 6y ago

HenryKissinger 6y ago

> Every one of them will eventually be leaked. [X] Doubt

HighlandSpring 6y ago
On a long enough timeline everything and everyone can be compromised (or the institution fails before then)
- hobs 6y ago
  Exactly - either the data is basically not valuable at all (the category for which PII rarely fits) or else when the company collapses or is bought, the data moves too. There's always an incentive to steal or leak it to other companies for money; so as long as the incentives are aligned with GATHER ALL DATA and KEEP IT FOREVER then yes, it will just be a matter of a time before each data store is compromised by mistake or purposefully.
BobbyJo 6y ago
I doubt the claim, but the sentiment I think is valid. If you think about what data these entities are holding, it's not unique to a single database or entity. Your name/address/phone/ssn/etc. Is likely stored in so many places that the probability it gets leaked from at least one eventually I'd say is very nearly, if not 100%.
allworknoplay 6y ago
Why on earth did you pick this username

tomComb 6y ago

Google has a huge number of activist (and surely some corruptible) employees, and yet the incidents of users data getting out are very close to zero. I think this demonstrates that user data can be managed safely and effectively. Usually the incidents reports on user data leaks show that the company seemed to barely be trying - We need laws that force them (even small companies) to put serious effort into it.

varispeed 6y ago
You don't know that. While the publicly available data leaks are indeed rare, you cannot know if they don't use the data for trading or other purposes for their personal gain without disclosing it to the public.
- tomComb 6y ago
  There are infinite things we can't know - opening the discussion up to that really makes anything possible, but the discussion wasn't even about what they might do with the data beyond leaking or selling it.
- Judgmentality 6y ago
  Sure, but if you have no evidence of it happening you have a fairly weak argument.
  - varispeed 6y ago
    People do have access to privileged information and that will influence their decisions on both conscious and unconscious levels. It's not possible to detach yourself from work completely and asses your thinking whether it is influenced by something you saw or not on an objective level. It will also be difficult to prove. For example if an employee hobby is trading, how do you prove that the trades they made are based on their own independent research or based on what they saw? If they saw something that could make them money, they could easily create a trail of evidence that they researched the matter on their own - it will be difficult to prove that it originated from looking up the privileged information and unless someone is going to be making millions, it's frankly not economical to commit resources to. It is also in the interest of the company that such incidents don't see the light of day.

TheRealDunkirk 6y ago

> Every one of them will eventually be leaked. Equifax has more at stake than most. And they've been hacked. Repeatedly. The government has been hacked. Yahoo was COMPLETELY owned. I mean, if someone would put together a list, it would make for shocking reading. It's become so common, that we go, "Oh no! Anyway."

dunham 6y ago
Yeah, both my health insurance company and the company that eventually bought my mortgage have both sent me letters. And this point I just dump them in a folder in the filing cabinet with the rest.

xtracto 6y ago

This. I don't trust in the government, but I think digital "personal data" should be only available for "confirmation" to companies that need it. Say, a government entity could have an API that allow you to send hashed personal data that they can verify is right. This way companies will ask the user for their data and hash it client-side. Then they can send the hashes (hashed with a custom provided salt to the entity (government, maybe private) who will basically reply with a True or False on the verification of the different data. It may even be an interesting use case for a public blockcahin, where your personal data is stored in a Merkle Tree type of data structure, so that one can verify that certain pesonal data of a person is true, without disclosing the data.

spondyl 6y ago
Wouldn't this fall down as soon as someone enters your details with the wrong casing or uses a +country code rather than a localised phone number and so on? Humans will error and enter data incorrectly so the hash would be different every time potentially despite being "correct" to a human at a glance? You could standardise everything (lowercase etc) but I imagine there are country and regional edge cases such as capitalisation having meaning in a given language (I can imagine it being a thing but I don't know it for sure)
- webinvest 6y ago
  There could be instructions in place to specify only all lowercase or just use .toLowercase() when sending. Also there could be a specified format for phone numbers or a function that turns all input into the desired format by stripping all special characters. Possibly only hashing the last 9 digits of the phone number for non mission critical applications instead of the full 10 digits. This sounds like a good use case for short brief documentation.
sdfhbdf 6y ago
It's probably not implemented as closely as what you described but check out Europe, this small continent across the pond and the tech scene in the smaller countries. For example Estonia has had famously and online identity stuff linked via a federal ID (in europe there are more republics then federations so it's easier to manage country-wise) [0] [1] Or more familiar to me with a bigger sample is a movement in Poland which is gaining popularity - mojeID (myID) which is a Single Sign On system with major banks as providers (they really regligiously check the identities when you open a bank account) or the statebacked login.gov. The mojeID system allows other entities to use your actual identity as an authentication factor without having to keep that much data and pose risks - for example an online alcohol shop can verify the age. [2] [3] [0]: https://en.wikipedia.org/wiki/Estonian_identity_card https://en.wikipedia.org/wiki/Estonian_identity_card [1]: https://e-estonia.com/solutions/e-identity/id-card/ https://e-estonia.com/solutions/e-identity/id-card/ [2]: https://www.kir.pl/en/administration/mojeid/ https://www.kir.pl/en/administration/mojeid/ [3]: https://www.mojeid.pl/#zastosowanie https://www.mojeid.pl/#zastosowanie

edanm 6y ago

I mean, yes, but.. what's the solution? Never collect data? In at least some of those cases (and arguably all), that data does need to be collected and stored. What is the government going to do, not maintain birth registries, tax registries, land owner registries etc? What is a big business like a bank going to do, not collect customer data like your name and address?

lovecg 6y ago
I have a different view: it’s not the collection that’s the problem, it’s the firehose attached to the database. For the applications you mention, make aggregation over all records prohibitively expensive by design.
- edanm 6y ago
  A good idea, but again, there are plenty of cases where that fails (depending on what you mean by "aggregate"). - "How much money is currently owed in taxes to the government?" - "Can't tell you that, we're not allowed to aggregate data".
  - lovecg 6y ago
    I still think there might be something here. You can allow certain aggregations (like “sum of the tax column”), but they have to be explicitly permitted; otherwise shuffle and hash everything enough times to make a single lookup sort of cheap, while a scan very expensive (plus distribute over enough physical servers and make the network between them low bandwidth to thwart lower level attacks). With enough regulatory or legal pressure on companies to lock down their data, paying this premium might start to look attractive; one could even found a startup peddling the World’s Slowest Database™! Edit: what I was thinking originally was that in the world of paper-only archives, these massive leaks were all but impossible, yet business could still be done. It should be possible to combine this slowness with the convenience of computers.
    - edanm 6y ago