5 ms·

Don't privacy and security go hand in hand?

natpalmer1776 5y ago
I think the distinction is such that with a private (but not secure) application, the only person getting my data is a malicious actor. With a secure (but not private) application, the only person getting my data is the owner of the code & anyone they are willing to share it with (Governments, Ad-tech, etc.) So if your hard requirement is 'nobody can know anything about what I do with this software' you are correct. However in-practice, security requirements often exist somewhere between the above two scenarios.
- grifball 5y ago
  Yeah. Mostly, the difference is whether you're protecting against big tech or smaller hackers. The only other difference is that computersecurity also protects your computer as a resource say against mining trojans.
Saris 5y ago
I see it as: Private = not sending data out of my device unless I want it to. Secure = resistant to someone trying to get into my device. They do overlap a bit, to be private a device needs some base level of security. But a device can be very secure and still not be private as it's sending data out for analytics, tracking, etc.
corty 5y ago
No. First, there are security measures that wreck privacy, e.g. sending all your data to some company's servers for virus scanning. Routing all your traffic through some filtering VPN provider. That kind of stuff. There are privacy measures that wreck security, e.g. not using personalized user accounts for certain things. Security is also mostly up to definition, a secure computer system is a system that only does what it is defined to do. What this definition entails is up to the vendor, which isn't necessarily the same definition a user might want for security or privacy. But generally, there is a large overlap between privacy and security.
- chme 5y ago
  > No. First, there are security measures that wreck privacy, e.g. sending all your data to some company's servers for virus scanning. Routing all your traffic through some filtering VPN provider. That kind of stuff. There are privacy measures that wreck security, e.g. not using personalized user accounts for certain things. Aren't those examples more examples of bad security by introducing single points of failure?
  - corty 5y ago
    Maybe, but there are more examples along those lines that don't introduce single points of failure. E.g. very all-encompassing logging is generally good for security, and if the logs are stored in a secure fashion, there is also no security problem created. However, privacy suffers because one might log things one shouldn't log. In the other direction, file and traffic encryption is good for privacy, and the less "permeable" you make it, i.e. the less readable for admins, system task, scanners, the better for privacy. However, for security, encrypting just for the user's eyes is a huge problem, because you cannot do malware scanning, you cannot do exfiltration prevention. Having users bring their own device into a work network is good for privacy, because those devices don't have central admin access, but bad for security, because same reason.
valiant-comma 5y ago
Another way of looking at it: Privacy is what about you're trying to protect, security is about how you are protecting it.
aryamaan 5y ago
They don't go hand in hand in real life. Can imagine that happening in digital world too.
strcat 5y ago
Yes, they do, and GrapheneOS is heavily focused on both. The purpose of the project and what it provides is being heavily misrepresented by the comment above. GrapheneOS treats bypasses of privacy features as security vulnerabilities. It offers substantial privacy advantages of CalyxOS and doesn't come with the privacy drawbacks it introduces. See https://news.ycombinator.com/item?id=28095033 https://news.ycombinator.com/item?id=28095033 (above) for a more in-depth explanation.
- tentacleuno 5y ago
  Disclaimer: strcat is the GrapheneOS developer.
  - strcat 5y ago
    Disclaimer: tentacleuno is a member of a community engaged in harassment and bullying. GrapheneOS has a development team with a dozen developers and several of those are having their work funded. It's not a single person project. Please stop spreading your malicious talking points.
  - FieryBinary 5y ago
    He's not "the GrapheneOS developer", he's the lead developer and one of many developers. It's a collaborative open-source project which has made a production-grade OS and whose contributions have been upsteamed for AOSP.
- GekkePrutser 5y ago
  I actually praised you here for pioneering important security features into AOSP :) Please don't view my comments as attacks or Calyx fanboi-ism. I'm not using either and I think you're doing great work. I just wanted to highlight the difference in approach as I saw it as a potential user when I was considering buying a pixel phone.
temptemptemp111 5y ago
Very. People can't think.

I think the distinction is such that with a private (but not secure) application, the only person getting my data is a malicious actor. With a secure (but not private) application, the only person getting my data is the owner of the code & anyone they are willing to share it with (Governments, Ad-tech, etc.) So if your hard requirement is 'nobody can know anything about what I do with this software' you are correct. However in-practice, security requirements often exist somewhere between the above two scenarios.

grifball 5y ago
Yeah. Mostly, the difference is whether you're protecting against big tech or smaller hackers. The only other difference is that computersecurity also protects your computer as a resource say against mining trojans.

Saris 5y ago

I see it as: Private = not sending data out of my device unless I want it to. Secure = resistant to someone trying to get into my device. They do overlap a bit, to be private a device needs some base level of security. But a device can be very secure and still not be private as it's sending data out for analytics, tracking, etc.

corty 5y ago

No. First, there are security measures that wreck privacy, e.g. sending all your data to some company's servers for virus scanning. Routing all your traffic through some filtering VPN provider. That kind of stuff. There are privacy measures that wreck security, e.g. not using personalized user accounts for certain things. Security is also mostly up to definition, a secure computer system is a system that only does what it is defined to do. What this definition entails is up to the vendor, which isn't necessarily the same definition a user might want for security or privacy. But generally, there is a large overlap between privacy and security.

chme 5y ago
> No. First, there are security measures that wreck privacy, e.g. sending all your data to some company's servers for virus scanning. Routing all your traffic through some filtering VPN provider. That kind of stuff. There are privacy measures that wreck security, e.g. not using personalized user accounts for certain things. Aren't those examples more examples of bad security by introducing single points of failure?
- corty 5y ago
  Maybe, but there are more examples along those lines that don't introduce single points of failure. E.g. very all-encompassing logging is generally good for security, and if the logs are stored in a secure fashion, there is also no security problem created. However, privacy suffers because one might log things one shouldn't log. In the other direction, file and traffic encryption is good for privacy, and the less "permeable" you make it, i.e. the less readable for admins, system task, scanners, the better for privacy. However, for security, encrypting just for the user's eyes is a huge problem, because you cannot do malware scanning, you cannot do exfiltration prevention. Having users bring their own device into a work network is good for privacy, because those devices don't have central admin access, but bad for security, because same reason.

valiant-comma 5y ago

Another way of looking at it: Privacy is what about you're trying to protect, security is about how you are protecting it.

aryamaan 5y ago

They don't go hand in hand in real life. Can imagine that happening in digital world too.

strcat 5y ago

Yes, they do, and GrapheneOS is heavily focused on both. The purpose of the project and what it provides is being heavily misrepresented by the comment above. GrapheneOS treats bypasses of privacy features as security vulnerabilities. It offers substantial privacy advantages of CalyxOS and doesn't come with the privacy drawbacks it introduces. See https://news.ycombinator.com/item?id=28095033 https://news.ycombinator.com/item?id=28095033 (above) for a more in-depth explanation.

tentacleuno 5y ago
Disclaimer: strcat is the GrapheneOS developer.
- strcat 5y ago
  Disclaimer: tentacleuno is a member of a community engaged in harassment and bullying. GrapheneOS has a development team with a dozen developers and several of those are having their work funded. It's not a single person project. Please stop spreading your malicious talking points.
- FieryBinary 5y ago
  He's not "the GrapheneOS developer", he's the lead developer and one of many developers. It's a collaborative open-source project which has made a production-grade OS and whose contributions have been upsteamed for AOSP.
GekkePrutser 5y ago
I actually praised you here for pioneering important security features into AOSP :) Please don't view my comments as attacks or Calyx fanboi-ism. I'm not using either and I think you're doing great work. I just wanted to highlight the difference in approach as I saw it as a potential user when I was considering buying a pixel phone.

temptemptemp111 5y ago

Very. People can't think.