24 ms·
Online privacy: to what extent should you try to go dark?
- TylerE 4y agoI don't bother. Not worth the effort. I assume everything I do is (potentially) seen by someone, and the typical approaches are only going to make me look more suspicious.
- Minor49er 4y agoLook suspicious in what way?
- throwamon 4y agoWhat are your other social media handles?
- brewdad 4y agoYou're going to have to put in the effort. No one said OP has to make it easy and cross-index everything for you. That's why we have computers to do the work.
- 0daystock 4y agoPrivacy allows you to live without this fear of someone watching you and your thoughts. It's worth investigating.
- nunorbatista 4y agoOP Here. Don't forget the great majority of data breaches are due to very basic issues i.e. unsecure passwords, shared credentials, unsecure API endpoints, etc. When hackers try to find their target, unless very specific cases, they start with the easiest path. This is where you have a word to say. They may come for you, but with the right settings, it might not be worth the hassle.
- kornhole 4y agoAuthor does not mention the major reason I care which is that allowing others to know what we are doing, thinking, saying, where we are going.. either individually or collectively anonymously or not, gives them power over us in many ways to predict, manipulate, dispossess.. which leads to the imbalances we have today of the haves and have nots of data. The people who say big tech already has so much data on them so why care are missing the valence of time. What you did, thought, said.. last year is much less valuable and useful than what you are doing today.
- Barrin92 4y ago>either individually or collectively anonymously or not, gives them power over us in many ways to predict, manipulate, dispossess The thing is, is that actually true? What always comes to mind for me is the Cambridge Analytica scandal, which involved their self-declared 'psychometric targeting', which it turned out, after scientists did some studies had a measurable effect of zero on people's behaviour[1]. People love this idea of 'big data' as some powerful ominous tool, even big companies themselves seem to push it explicitly to seem more towering than they are. It's much more boring and unfashionable to think that people are a little more complex and have more agency and that companies push it because it makes them sound more sophisticated than they are. [1]https://www.vox.com/science-and-health/2018/3/23/17152564/cambridge-analytica-psychographic-microtargeting-what https://www.vox.com/science-and-health/2018/3/23/17152564/ca...
- imachine1980_ 4y agoYes and no, cross source info allows people to know bulneravility that help change behaviors,much time big data means better and cheaper data tools, like easy accea to optimize internal proces or better ui
- fragmede 4y agoIf you think you're not being manipulated, you're deluded. Advertising works. It worked before the Internet and there's even more of it now. We do still have individual agency but don't you want a cool refreshing Coca-Cola right about now?
- superb-owl 4y agoI think it's mostly pointless to put more than a basic minimum amount of effort into protecting your own privacy (e.g. sensible social media settings). There are too many surreptitious means of getting your info. Instead we need to focus our efforts on political action. Privacy is not something that can be controlled at the individual level when you're up against billion dollar budgets.
- wolverine876 4y agoI wouldn't call it pointless. You can use Signal and essentially have your communications disappear. Technological tools being available make the legal solutions practical. But I agree that the legal solution is certainly necessary and most essential.
- kornhole 4y agoI agree that political action is needed, but I have almost no hope that any substantive legal changes will pass in near future. Big money and power prevent proposals from getting anywhere. It is up to us to protect ourselves and loved ones. It is a fun sport to evade the surveillance state.
- wolverine876 4y ago> I have almost no hope that any substantive legal changes will pass in near future This is the most popular move against action, to convince people it is hopeless. In fact, when the people want something strongly enough, it certainly happens. There is a long, well-established history of it.
- kornhole 4y agoI encourage everybody to continue trying, but I am also realistic. I often write my senators and congress people here in California about these issues and proposed bills. They send me back canned letters telling me to pound sand, save the children, blah blah. They are heavily funded by the surveillance capitalists, and the intelligence agencies rely on that data.
- DoreenMichele 4y agoThese articles frequently err on the side of assuming that online security is entirely about worrying about random internet strangers taking advantage of you. For many people, the primary concern is an abusive SO, ex or relative, getting fired from their current job et al. Some articles do address such things but they have something of a tendency to be addressed as a separate issue from "online privacy" rather than one element of the issue and a bigger issue for some individuals than others.
- AussieWog93 4y agoThank you, Doreen, for being Doreen. Always an interesting take.
- nunorbatista 4y agoOP here. It is true, and a missing part of the article. Took note of it, thanks.
- encryptluks2 4y agoI guess it really depends on what country you live in. In America, history has taught me people with enough money and power can destroy your life with immunity and that you could be one election away from 1984 or Hunger Games.
- a1369209993 4y ago> it really depends on what country you live in. No, it's like that in countries without pretenses of democracy or civil rights too. If anything it's a fair bit worse.
- wolverine876 4y agoThey can only do it if you do nothing. It's a system that requires the people to act. What are you doing about it?
- encryptluks2 4y agoDefinitely not participating in a failed coup like January 6.
- timbit42 4y agoSo you're going to participate in a successful coup instead?
- encryptluks2 4y agoDoubtful but the separation from Britain was a coup by those standards and it even has its own holiday.
- wolverine876 4y agoYou're comparing establishing democracy with overthrowing it?
- amatecha 4y agoIf you are interested in this subject you may like to check out EFF's "Surveillance Self-Defense" site, which has tons of guides and useful info: https://ssd.eff.org https://ssd.eff.org Another excellent site is Privacy Tools at https://www.privacytools.io/ https://www.privacytools.io/
- yubiox 4y agoEven just basic malware blocking disables a lot of websites. I can't use some air and hotel sites (aa.com, ihg.com for example) anymore, plus unsubscribing from somewhat normal spam is almost impossible because the unsub links have trackers or something.
- Gigachad 4y agoI don’t bother unsubscribing. Just filter to spam and ignore.
- yubiox 4y agoRight, for pure spam, yes. I want to know about my hotel or air reservation but not get their junk email. So I can't go scorched earth on them, but I can't unsub from the junk either due to my tracker dns blackhole.
- derwiki 4y agoI batch unsubscribes to once a month and disable pihole for ~5 minutes
- rkagerer 4y agoPeople ask why should they care? Unfortunately the average person tends to be less concerned about invasions of privacy they cannot see. Like when you go through a scanner at the airport which let's someone in another room basically see through your clothes, vs. the way you feel if someone standing in front of you says to strip naked.
- charcircuit 4y agoI care even less about when it's just computers looking at the data which is pretty much the case for online advertisement.
- night-rider 4y agoThe extent can mean doing basic things like installing and AD blocker, using a password manager, surfing in isolated sessions (incognito mode) to stop cookie tracking and to leave no forensic artefact on your device, always posting with pseudonyms, using privacy-aware operating systems like Linux, etc Then you have the extreme options available like Tor, using Qubes, GrapheneOS on your phone, changing your legal name, using burner phones, Faraday sleeves, VPNs for public Wi-Fi, network segmentation for IOT devices, disabling Intel Management Engine. Having multiple operating systems for compartmentation purposes, etc There is a privacy rabbit-hole to get lost in. Luckily I’ve found a reasonable middle ground and am not one of those LARPer types who take it all too seriously.
- ambrose2 4y agoIs your middle ground the same as what you listed in basic things? You always surf in incognito mode?
- night-rider 4y agoI use incognito mode sometimes for NSFW stuff and when I don’t want to be tracked with cookies. I have a browser profile for when I need to be logged into something, like Amazon for example.
- nunorbatista 4y agoOP Here. I'm interested in the balance you found. Happy to include it in the part 2 and reference you.
- night-rider 4y agoBy balance I mean I don’t go full LARPer when doing basic stuff like online banking and buying stuff from Amazon. LARPer means Live Action Role Play and refers to someone overly paranoid about every little thing. In other words, their threat model is wrongly applied to basic things. If you’re a journalist you may want to use Qubes and use disposable VMs to open PDF documents, for example. Most people would be fine just opening the PDF in Google Docs. The extreme options I mentioned can be used if you’re a target of harassment, like changing your legal name, or if you’re a prominent activist you may need a burner phone to attend a protest. It’s all about your threat model. Also: disabling Intel Management Engine could be useful for protecting your business secrets and intellectual property, but for most people doing mundane things it’s an extreme step to take.
- defrost 4y agoFWiW Greg Egan has had a good run - 40 years online, 10+ novels, many short stories, Hugo and Campbell awards (and others) . . . and yet: No verified images nor any evidence that is indeed his real name.
- doubleunplussed 4y agoI always assumed it was his real name, but I suppose that was just an unexamined assumption. Gwern Branwen is a prolific [1] netizen who is also completely anonymous. I don't know how people like him [2] do it. Surely the people who know him IRL are aware of what he's working on day-to-day and someone would be able to connect the dots. Unless he lives alone or his housemates are completely offline - and he doesn't talk to anyone IRL about what he does at home. [1] Sometimes on Twitter or Hacker News I legitimately just scan my eyes around the screen expecting a comment from or link to Gwern to be already in my field of vision. [2] I have seen since-scrubbed evidence Gwern is a "him" though he now seems to hide that too
- woojoo666 4y agoiirc lots of Japanese manga artists are also anonymous. Like the author of the recently popular Jujutsu Kaisen series [1], who appeared on TV wearing a mask of one of his characters [2] [1]: https://en.wikipedia.org/wiki/Gege_Akutami https://en.wikipedia.org/wiki/Gege_Akutami [2]: https://www.animenewsnetwork.com/interest/2021-01-27/gege-akutami-to-cosplay-as-mechamaru-in-first-tv-appearance/.168805 https://www.animenewsnetwork.com/interest/2021-01-27/gege-ak...
- philliphaydon 4y agoApparently getting into manga is really difficult in Japan. Most start out doing hentai. To make money until they get a break and their manga becomes popular. (I don’t know how true this is, something I read many years ago cos I’ve been watching anime for 25 years)
- defrost 4y agoLike Greg I'm also a circa 60 year old W.Australian STEM arena coder/weddings/parties/anything person. It's a bit of a state wide trait to be general while leaving a semi challenging last mile problem. Having a capital city described by early US personnal in orbit as "the most remote city in the world" leads to a mild village syndrome when outsiders come asking for <insert specific name> .. who wants to know & how come you don't know already? As for gender, roughly a third of the math | physics | comp sci staff were female in the early 1980s (Cheryl E Praeger and others) and a number spent the early Usenet days with nome de guerra to sidestep the complications.
- ghaff 4y agoIt's a bit hard for me to understand what's being argued for here. For many people in publicly visible positions, it's not practical to avoid having an online identity under your real name. This is not even exclusively a white collar issue for someone who speaks at conferences etc., how about a contractor who needs an online presence to find clients? Certainly there are steps someone can take to be make themselves invisible online but it severely limits career and other options.
- nunorbatista 4y agoOP Here. I'm arguing the *why* you should care and *what* can happen. The article is a reflection on how I can explain my mother that she should care. Going invisible online doesn't mean you have to limit your presence - it really depends. That's why I think there are some fair criticism about the last paragraph of the article, that really doesn't tell you what to do.
- fsflover 4y ago> The article is a reflection on how I can explain my mother that she should care. I think you forgot one important point. Lack of privacy harms journalism and activism, making the government too powerful and not accountable. If only activists and journalists will try to have the privacy, it will be much easier to target them. Everyone should have privacy to protect them. It’s sort of like freedom of speech is necessary not just for journalists, but for everyone, even if you have nothing to say.
- nunorbatista 4y agoI find your argument to be true, but the idea is to discuss what we can do versus the standards which I find them to be GDPR and Apple. The first because it came out with a set of rules that didn't exist anywhere else in the world and the second because it prevented millions of people to be tracked when they navigate (obviously a commercial stunt, but still). I would question if anyone else made more for privacy in the last few years than these two (Maybe Firefox?) Maybe the whole world must push for GDPR-like regulation or for Android to block third-party cookies. Until then, the responsibility is on each individual.
- AlexanderTheGr8 4y agoI have a different perspective and a question for HN. We always ask how to prevent corporations from surveilling us. How about letting them surveil BUT giving incorrect information? Intentionally do things (manually or automated) that gives them completely incorrect information about you. Avoiding surveillance is becoming very hard. But giving incorrect information is very easy.
- protonbob 4y agoI would say that it is becoming much harder. You need a real address to ship your items to that they will later correlate all of your activity to for example. In addition, many social media sights are requiring verification with government IDs. Try creating a Facebook account with fake details. They are able to filter these out pretty easily.
- AlexanderTheGr8 4y agoI believe there's some misunderstanding. I meant letting them know who you are, but giving incorrect information about your beliefs and thoughts. I still believe that giving incorrect information can be very effective. Even if Google/NSA knows your name, they can only see the online activity that you choose to do. You can intentionally choose to give them very incorrect online activity. For example, intentionally visit websites (manually or automated) that you don't believe it. This will trip up their algorithm. How are they supposed to know what you actually think or believe in?
- derevaunseraun 4y ago> For example, intentionally visit websites (manually or automated) that you don't believe it. This will trip up their algorithm. How are they supposed to know what you actually think or believe in? Imo the claim "We can suggest what you should do next, what you care about. Imagine: We know where you are, we know what you like." is just a sales pitch to the data industry in disguise. They know what we do, but it isn't possible to know what we think without making a bunch of assumptions
- 4y ago
- woojoo666 4y agoAnother big downside of surveillance that the article doesn't mention is the "social cooling" effect [1]. People are less likely to be honest if anything they say can impact their entire life [1]: https://www.socialcooling.com/ https://www.socialcooling.com/
- photochemsyn 4y agoThe only real way to ensure your data isn't being collected and sold in the course of every single transaction you engage in (cash transactions being somewhat less trackable, however), is to get data privacy laws passed that forbid this activity by retailers, data brokers, and related entities. The EU has the right idea on this. Ordinary individuals who attempt to use technology to 'go dark' will likely, if they're careful, be able to conceal their online identity from your average stalker type, malicious ex, or seedy credit card fraudster, but certainly not from the likes of Google, Apple, Verizon, or any number of government agencies with access to those outfit's data centers. This is called mass domestic warrantless surveillance and it is illegal under any reasonable interpretation of the US constitution, and certainly shouldn't be allowed by private parties either. As far as spies, every history of spies I've ever read has one thing in common: they all hide in plain sight, using cover identities of some sort, acting as much like a normal member of society or their organization as possible, and then running off to do their data transfer/nefarious activity in secret only rarely. Notably, mass domestic surveillance isn't a very useful tool for catching such people - it's more about authoritarian snooping on the population, engendering fear of the state as with STASI, as a means of control. That nonsense shouldn't be allowed, and those who promote it are nothing but authoritarian enemies of democratic rule and free expression.
- jodrellblank 4y ago> "cash transactions being somewhat less trackable, however" "Then he said he was going to buy the book with cash, so nobody could trace the purchase to him and exploit his interests for commercial purposes" - Calvin, talking about his Dad, in Calvin and Hobbes by Bill Watterson, December 1993. https://www.gocomics.com/calvinandhobbes/1993/12/07 https://www.gocomics.com/calvinandhobbes/1993/12/07
- kkfx 4y agoIMVHO people should be more warred by their control on their data, in the sense of the ability to access and process them without depending on third parties services, than the already-lost privacy war...
- derevaunseraun 4y agoAlso want to add that in the coming years they will start pushing biometric logins (https://www.theguardian.com/technology/2022/may/11/techscape-fido-passwords https://www.theguardian.com/technology/2022/may/11/techscape...) in the coming years. This will tie all accounts to the same biometric data and identity, which will make blanket data harvesting and profiling much easier and more economically feasible. > As early as 2010, Facebook’s marketing director argued that “online anonymity has to go away.” These companies have a financial incentive to destroy online anonymity to the detriment of the rest of society, and biometrics are the latest attack
- Twisell 4y agoTLDR; This subject is very important so OP took time to write a really long intro, please subscribe to his blog to get the answer next week. In the meantime feel free to read the discussion in HN because it's probably more interesting until the part 2 eventually comes out.
- nunorbatista 4y agoOP here. It's a fair criticism, thanks. I have a limit of around 800 words per article. This is a newsletter, otherwise would be too long. It's the format I believe works best. The idea is also to discuss the what and the how of online privacy. The list of actions can get pretty long, so I decided to divide the article while I was writing it.
- brewdad 4y agoI hate that we have brought back the serial novel in 38 parts for the sake of "engagement". Write the article or don't but I've seen too many of these things get abandoned before enough useful info gets published. Pass.
- nunorbatista 4y agoBelieve it or not, it's not for the sake of engagement. I also use the internet and find articles with 2 parts to be disappointing but I felt like there was enough value in part 1 alone. 800+ words on an email client on a phone is just too much and there are better options to read long-form. I could make it smaller, but I would risk leaving out an important part I wanted to debate.
- fragmede 4y agoBe dark enough that your impersonators fail due to take/insufficient info on you. Don't let this happen to you! https://taskandpurpose.com/news/army-daniel-blackmon-romance-scams/ https://taskandpurpose.com/news/army-daniel-blackmon-romance...
- snowmizuh-04 4y agoThere's another option, which few are able to implement. Sign off entirely. Stop using the digital Machine. Humans lived this way for all but the most recent wink of an eye. Many humans still do. Think of the monastics on Mt Athos. When I first saw the title, I thought the author was going to discuss truly taking the red pill. I was disappointed to read just another '10 things you can do to increase your privacy' piece. You're not going far enough.
- nunorbatista 4y agoOP here. Fair criticism thanks. As I stated in another comment, I was going to make this a list of things you could do, but the argument to why you should do it was not clear, at least for me. This is the purpose of the article: explain my mother why. The how will come later.
- t_mann 4y agoUsually when a question is asked in a headline one would expect the article to at least attempt to answer it. This piece doesn't guide you on how to make trade-off decisions between privacy and usability, it doesn't even give concrete tips on how to improve privacy (apart from a single mention of password managers, where it doesn't even say whether they should be used or avoided). This is as useless for beginners as it is for experts, how did this make it to the front page of HN?
- fsflover 4y agoSome concrete advises: https://prism-break.org https://prism-break.org
- ryanisnan 4y agoI find sites like this very hard to accept at face value. For example, on iOS, they say to avoid Authy for MFA but recommend a project called Tofu. This may be a sensible recommendation but they give zero supporting information as to why. I have nothing against Tofu (maybe the texture) but if you are going to convince someone that an opensource project made by mostly one person with very little financial backing, over a corporate MFA provider, data or rationale is required!
- cto_of_antifa 4y ago
- fsflover 4y agoThey usually explain and discuss specific apps in the Issue tracker: https://gitlab.com/prism-break/prism-break/-/issues https://gitlab.com/prism-break/prism-break/-/issues.
- nunorbatista 4y agoOP Here. Thanks for the feedback. When I started to write the article, I was set to give a list of things we can follow to improve privacy. In the middle, I noticed the arguments why you should do it were not clear. As I said in another comment, it's not clear for my mother the consequences of oversharing, so it's not easy for me to tell her not do do so. The reality is that it really depends. Maybe you do need to flash your phone and use a VPN or maybe not. It's complex. I work in Cybersecurity and I often get into projects where PMs want magic bullets but there isn't one. Are you processing personal data? Are you going to have legal, financial or reputation implications if you have your data stolen? It's not binary. The idea is to get the basics right so I can defend to my significant other why she doesn't see ads on Google: it's because pi-hole, honey. I will come up with the list of things you can do and share it here soon, sorry if you think it's clickbait.
- echoradio 4y agoThe most valuable course I took at university taught you how to request and analyze public records. This was at least 4-5 years before the government had records available online. So it required you to physically examine this information. While taking the class, I came to realize the paper trail you leave the moment you become an adult is immense and almost impossible — from a government perspective — to eliminate entirely. If you require a license or own property, you have no choice but to be in the system. You literally have to disconnect from society and live as a hermit in the woods (and even then I wouldn’t doubt the ability to be tracked.) The digital realm has only made this paper trail exponentially impossible to control, even if you’re consciously trying. I’ve adopted the practice of limiting my digital footprint as much as possible (within reason). I don’t have accounts or engage with the social media walled gardens. I am very conscious of the media I consume. For instance, I don’t follow my curiosity about topics an on platforms where an algorithm might force feed me — if I wanted to know about a conspiracy theory for giggles, I’d read on Wikipedia, not watch a video on YouTube. And, finally, ad and tracker blockers at every possible level. I figure if someone has me profiled, I can at least block the tailored message they’re sending.
- logifail 4y ago> "Profiling - Your online behavior can be used to serve you specific content or ads. This was particularly important in the 2016 Donald Trump campaign" No references, I'm afraid I stopped reading there. Sorry.