7 ms·
I agree it might turn out to be worthwhile, but don't underestimate the difficulty. Building a system where all user data is encrypted with keys only the users
by tlb 4y ago
I agree it might turn out to be worthwhile, but don't underestimate the difficulty. Building a system where all user data is encrypted with keys only the users have is an order of magnitude harder than the regular way. You can't debug anything from server logs. You can't change database schemas server-side. Otherwise simple things like migrating accounts to a new device become an ordeal.
It's only in the last few years that some messenger services have probably (?) got secure group chat right. That's how hard it is for a well-studied application. Expecting developers to do this for lifestyle trackers is asking a lot.
It would be much more efficient for society if the government didn't criminalize common behaviors, requiring regular citizens to have nation-state-proof opsec.
- lazide 4y agoOr we could go back to on prem and customer owned machines I guess.
- the_other 4y agoWhy is this getting down-voted? It seems worthy of a little discussion.
- robonerd 4y agoPaycheck induced blindness to the premise of not writing spyware.
- shrimpx 4y agoCan you elaborate?
- robonerd 4y ago"It is difficult to get a man to understand something, when his salary depends on his not understanding it." - Upton Sinclair
- danaris 4y agoPeople whose livelihood currently comes from businesses whose primary source of income is in selling people's data don't want to even think about the idea that doing something else might be a better idea. There are a lot of people in tech (and, quite likely, on HN) who work for companies with such a profile. (Just for instance, everyone working for Google, Facebook, etc.) I doubt it's a majority, which is why the comment appears to have returned to a positive score, but there's certainly a strong contingent that could very well feel threatened by the idea that we might, as a society, have to abandon profiting off other people's data as a business model.
- fragmede 4y agoBecause it’s a lazy insubstantial dismissal and doesn’t stimulate interesting discussion
- phtrivier 4y agoIronically, "on prem" means you're one "strangely clean burglary" away from law enforcement getting all your data :D Better yet, though, why "on prem" when virtually everyone has a supercomputer in their pocket all the time ?
- lazide 4y agoNo one says you wouldn’t encrypt on prem too. It just adds the extra layer of difficulty slurping everyone’s info all in one go. Someone would need to actually walk to the customers site and all to take their servers, potentially. Remote access is a good point, but most commercial sensitive data (medical, manufacturing, etc) is location use restricted anyway.
- choeger 4y agoMaybe, just maybe, we should stop building lifestyle trackers outright?
- kstenerud 4y agoThe point is that this is only the beginning of a deluge that will build over time. For example, defense-in-depth was once an academic notion that nobody seriously considered due to the difficulty of implementing it. Far better if the operators would only be more vigilent or the perimeter were just made stronger. Then the threat model began to morph and the legal liability framework changed and suddenly nobody was laughing anymore. Talking in terms of "people should" and "people shouldn't" and "if only this group would" is avoiding reality. And reality doesn't care if you're ready for it. Personal data is a liability. We can profit from it now because we're still in the heyday, but that's going to end.
- shrimpx 4y agoI’m super attracted to the idea of going back to client-only software with nothing (or minimal amounts of stuff) on the server. If you can make money with a model like that, it’s ideal. You host nothing, so you have nothing to lose sleep over. Except having airtight updates, but I’d rather worry about my code than users' data.
- jimmydorry 4y agoExisting national security legislation in many countries already allows governments to compel individual to push updates with comprisimised updates and to implement backdoors.
- em-bee 4y agodoesn't that only work with distribution systems that can target individual accounts? since that legislation does not allow pushing a backdoor to all users instead of the one being targeted? hence f-droid would not be able to comply with such an order since it doesn't even have a concept of user acounts. same goes for most linux distributions
- jimmydorry 4y agoThe Australian legislation makes no such distinction. If the government wants to spy on someone or requires you to make a backdoor, you must do it, no matter the consequences (or even compatibility if they are providing the backdoor software). This legislation applies to all citizens, even if they have migrated to another country, btw. I'm sure other developed nations have similar power to compel their citizens.
- shrimpx 4y agoWhat happens if you can't comply due to sheer difficulty? Like if your design simply does not allow you to target a specific user at a technical level. Are you forced to shut down your company or something?
- davedx 4y agoI've worked with a system that went from pre-GDPR compliance to post-GRPR compliance. What are your reasons that it's "an order of magnitude harder"? You don't need to have personal data in your server logs. You don't need to see the production data of your users in your database tables to make migrations that work. (You do have a staging environment, right?)
- lazide 4y agoWhen you have a bug in your migration that only production data tickles (which is not uncommon), it gets a whole lot harder. When you’re trying to debug a data corruption issue in user data, not being able to log data related to it makes it harder. Also, keeping track of all the GDPR type sensitive data everywhere is harder than just YOLO’ing it, of course.
- davedx 4y agoSure. But does any of that increase development by a magnitude? I don’t think so. Extraordinary claims require extraordinary evidence. Parent provides 0, just hyperbole.
- usrn 4y agoOpen source tools are already built this way. If it weren't for the pathological attack on users that are mobile OSes this would hardly even be a discussion.