5 ms·

For people who say they have nothing to hide, I ask them why they have locks on their doors, passwords to their email, and clothes on their body.

hammyhavoc 3y ago
Well, clothes are mostly down to weather and laws on public decency, and nudists are the counterpoint that prove some demographics would prefer to be naked if the law allowed it, same with tribes like Koma. Locks are more for security than privacy, and it's important not to conflate the two. People can have nothing to hide, but also not want to be robbed. And as for email, that's again a matter of security because then someone could impersonate you for one, and I can't name a service that allows you to omit having a password for your email account. (I know, looking too deeply into it! Sorry.)
- pksebben 3y ago
  In an information environment, security and privacy are the same thing. The terms may have different connotations culturally, but good security-in-depth is the same set of practices that enable digital privacy, because the objective is the same: prevent leakage of facts.
  - hammyhavoc 3y ago
    You can have E2EE to the service provider, but they can be free to rummage through your data if they choose to or are coerced to by a legal demand from an authority. But it eliminates the average schmoe from going through that data. Is that adequate security? Is that adequate privacy? This is what bills like EARN IT and its ilk are positing with backdoors et al. It depends on your threat model. If a warrant opens a door or account one way or another, it can be argued that privacy-wise, locks and passwords are poor solutions. Are you protecting business data or trying to survive in an oppressive regime? Different solutions for different problems, how appropriate they are varies with demographics too. This is an interesting talking point about privacy and security: https://news.ycombinator.com/item?id=35617773 https://news.ycombinator.com/item?id=35617773
    - ranger_danger 3y ago
      > Are you protecting business data or trying to survive in an oppressive regime? First it's just one, then it becomes the other.
    - smolder 3y ago
      E2EE refers to fully encrypted communication between end-users of a service, hence end-to-end. If one of the ends is the service provider, the term doesn't apply.
      - hammyhavoc 3y ago
        This is the point. It's a buzzword and the reality of a lot of popular services is that the service provider can likely already provide access to your data if requested to by a government. Ergo, if this is a consideration within your threat model, it's an inappropriate solution. However, I am highlighting that EARN IT is no more a threat than existing service providers abiding by a court order, ergo the existing solutions likely aren't fit-for-purpose for some folks, depending on threat model.
  - JohnFen 3y ago
    > In an information environment, security and privacy are the same thing Yes. Privacy is a subset of security.
    - d4mi3n 3y ago
      I'd argue that they're overlapping sets of concerns, not necessarily identical to or subsets of each other. Off the cuff: * Being an anonymous person walking through a city. This is a privacy concern and only becomes a security concern if I'm a public persona or some kind of person of interest. * Moving to a new school/city/job and not having your social reputation follow you. This allows a lot of people a chance to redefine who they are and how they interact with people around them. This can't happen if everybody always knows somebody's pervious public persona. * Breaking a law and being fined/punished/imprisoned for it. Without privacy, such a person has a much poorer chance of having a decent life even after they've done their time or paid their dues. These all strike me as privacy concerns, but not necessarily concerns to security. I think they're all important enough to consider privacy as a good thing in it's own right and that such scenarios signal that it's possible to advocate privacy in the absence of (or opposition to) security concerns.
      - pksebben 3y ago
        How would you define the terms? IMO these are all 'security' related, just personal security (which is what I define privacy as). The most accurate lines I can draw around either are abstract enough that they end up in the same bucket, but perhaps we're defining them differently
        elesiuta 3y ago
        Not GP, but security refers to the protection of the system, while privacy refers to the protection of information. So you need to protect the system to protect the information on it, but there are also sometimes trade offs between security and privacy when you offload some system protection by giving away some information to another party. For example SmartScreen with Microsoft, and Safe Browsing with Google Chrome.
  - ranger_danger 3y ago
    Another problem that I feel has barely even been touched on in recent time is what even are facts. People see things on the Internet and take it for gospel. You know information people ALWAYS blindly believe 100%? "Leaked" data. Imagine how much power one could have with manipulated, leaked, data.
    - hammyhavoc 3y ago
      This is what I said about WikiLeaks even at the time. Sprinkle in some untruths with truths and you've got something convincing.
      - idiotsecant 3y ago
        You don't even need to say anything that isn't true. Just being selective about which true secrets you reveal can be a very powerful tool to control the narrative.
        hammyhavoc 3y ago
        Absolutely.
- lcnPylGDnU4H9OF 3y ago
  > as for email [passwords], that's again a matter of security I guess if we're nitpicking I'll point out that this is still privacy (how one keeps their password) for the sake of security. Information is kept private and passwords are information.
  - hammyhavoc 3y ago
    Perhaps drawing a distinction between outbound and inbound email protocols would be good too. I understand the argument being made, but the sensible assumption is that your email, even with a password, isn't a sensible choice for sensitive communications.
    - lcnPylGDnU4H9OF 3y ago
      > your email, even with a password, isn't a sensible choice for sensitive communications This seems like it's shifting the goalposts. Someone says something about "nothing to hide but they have locks on their doors" and you say "security isn't the same as privacy". It's accurate but it's moot. I keep the location of my hide-a-key private so I can continue to keep my house secure with the lock on the front door. I keep my email password private so I can secure the account against unauthorized access. Some people do use their email for what they would consider sensitive communications, and it's less than helpful to suggest they need better opsec practices in response to someone else saying that they should be able to expect their email to be private. It's saying "just hide it better, lol" when that's literally exactly what many people are trying to do when speaking against this sort of legislation.
- JohnFen 3y ago
  > Well, clothes are mostly down to weather and laws on public decency Where I live, there are no laws against public nudity (as long as the nudity isn't "salacious" in nature). And yet, very nearly 100% of the people are clothed at all times.
  - hammyhavoc 3y ago
    And yet in other areas of the world, people wear no clothes. People also smoke cigarettes, eat junk food, and do things that are unnatural and otherwise detrimental due to what they're bombarded with. I wear clothes, I'm not a nudist. I have zero shame about my body though, it's a body—we've all got one. The point as per my other comments: different solutions for different problems, the appropriateness of each varies with demographics. E.g., if you're surviving in an oppressive regime as a dissenter, email is something to be avoided. If you're running a business, it's likely fine, provided that it's compliant for your industry, e.g., HIPAA.
- elondaits 3y ago
  Email passwords are not for preventing impersonation. For one, POP3 passwords are separate from SMTP. Second, nothing in SMTP prevents impersonation… large mail handlers like GMail don’t allow it anymore, but you can put whatever you want in the “From” field. Things like SPF, DMARC and DKIM are there to prevent impersonation at the domain level for mail servers that want to protect their users.
  - hammyhavoc 3y ago
    When accessing email via a protocol with an email client, sure, but I primarily had the Gmail web app in mind when I wrote the comment. I also touched on protocols in another comment. With what I had in mind, if you logged into my Gmail account, which provides both sending and receiving, you could impersonate me to my own mother, but I would have nothing to hide as I don't receive any sensitive information via email (privacy). However, accounts elsewhere could be recovered via my email, and thus be used to impersonate me elsewhere (security).
stronglikedan 3y ago
Easy: Thieves, scammers, and public decency laws, in that order.
- wholinator2 3y ago
  Unsure if sarcasm but doesn't the exact same reasoning apply to these? If there's things you don't want thieves to steal then obviously you _do_ have something to hide. Or maybe a better word is protect but both apply equally well
  - fooqux 3y ago
    Surely the government would never steal from its citizens. /s
- bonestamp2 3y ago
  > Thieves, scammers Which means they do have things to hide. There are lots of thieves in places of power, and that is a compelling reason not to let them have our data.
NickBusey 3y ago
I like to ask why they have a door on their bathroom.
- rootusrootus 3y ago
  I routinely pose that question to my kids. And yet, they still poop with the door open. And without the ventilation fan. I keep hoping that eventually I will get through to them. Maybe I'll just put a spring-loaded hinge on the bathroom doors and a motion-activated ventilation fan.
  - croes 3y ago
    Take them to a public toilet. There is a difference between pooping in front of family and in front of strangers.
    - wintogreen74 3y ago
      Is it irony that doing this (or even your comment) would likely land you in really big trouble under the purpose of this act?
      - croes 3y ago
        We'll get more cases like that: https://news.ycombinator.com/item?id=32564126 https://news.ycombinator.com/item?id=32564126
    - rootusrootus 3y ago
      For sure, they act totally different in a public toilet. Very carefully locked door in that case. Hell, the first time my son used a public toilet on his own, I had to talk him through how to actually unlock the door when he finished. I tried to tell him not to latch it since I was standing right on the other side of the door, but no, -CLICK- went the lock anyway.
  - rightbyte 3y ago
    I've got a 2.5yo that furiously yells at me to get out when he poops, but he have no remorse trying to physically drag me out of the loo when I am doing my business. Or force me read some book for him. I guess he is a metaphor for the surveillance state. Or the other way around. Dunno.

hammyhavoc 3y ago

Well, clothes are mostly down to weather and laws on public decency, and nudists are the counterpoint that prove some demographics would prefer to be naked if the law allowed it, same with tribes like Koma. Locks are more for security than privacy, and it's important not to conflate the two. People can have nothing to hide, but also not want to be robbed. And as for email, that's again a matter of security because then someone could impersonate you for one, and I can't name a service that allows you to omit having a password for your email account. (I know, looking too deeply into it! Sorry.)

pksebben 3y ago
In an information environment, security and privacy are the same thing. The terms may have different connotations culturally, but good security-in-depth is the same set of practices that enable digital privacy, because the objective is the same: prevent leakage of facts.
- hammyhavoc 3y ago
  You can have E2EE to the service provider, but they can be free to rummage through your data if they choose to or are coerced to by a legal demand from an authority. But it eliminates the average schmoe from going through that data. Is that adequate security? Is that adequate privacy? This is what bills like EARN IT and its ilk are positing with backdoors et al. It depends on your threat model. If a warrant opens a door or account one way or another, it can be argued that privacy-wise, locks and passwords are poor solutions. Are you protecting business data or trying to survive in an oppressive regime? Different solutions for different problems, how appropriate they are varies with demographics too. This is an interesting talking point about privacy and security: https://news.ycombinator.com/item?id=35617773 https://news.ycombinator.com/item?id=35617773
  - ranger_danger 3y ago
    > Are you protecting business data or trying to survive in an oppressive regime? First it's just one, then it becomes the other.
  - smolder 3y ago
    E2EE refers to fully encrypted communication between end-users of a service, hence end-to-end. If one of the ends is the service provider, the term doesn't apply.
    - hammyhavoc 3y ago
      This is the point. It's a buzzword and the reality of a lot of popular services is that the service provider can likely already provide access to your data if requested to by a government. Ergo, if this is a consideration within your threat model, it's an inappropriate solution. However, I am highlighting that EARN IT is no more a threat than existing service providers abiding by a court order, ergo the existing solutions likely aren't fit-for-purpose for some folks, depending on threat model.
- JohnFen 3y ago
  > In an information environment, security and privacy are the same thing Yes. Privacy is a subset of security.
  - d4mi3n 3y ago
    I'd argue that they're overlapping sets of concerns, not necessarily identical to or subsets of each other. Off the cuff: * Being an anonymous person walking through a city. This is a privacy concern and only becomes a security concern if I'm a public persona or some kind of person of interest. * Moving to a new school/city/job and not having your social reputation follow you. This allows a lot of people a chance to redefine who they are and how they interact with people around them. This can't happen if everybody always knows somebody's pervious public persona. * Breaking a law and being fined/punished/imprisoned for it. Without privacy, such a person has a much poorer chance of having a decent life even after they've done their time or paid their dues. These all strike me as privacy concerns, but not necessarily concerns to security. I think they're all important enough to consider privacy as a good thing in it's own right and that such scenarios signal that it's possible to advocate privacy in the absence of (or opposition to) security concerns.
    - pksebben 3y ago
      How would you define the terms? IMO these are all 'security' related, just personal security (which is what I define privacy as). The most accurate lines I can draw around either are abstract enough that they end up in the same bucket, but perhaps we're defining them differently
      - elesiuta 3y ago
        Not GP, but security refers to the protection of the system, while privacy refers to the protection of information. So you need to protect the system to protect the information on it, but there are also sometimes trade offs between security and privacy when you offload some system protection by giving away some information to another party. For example SmartScreen with Microsoft, and Safe Browsing with Google Chrome.
- ranger_danger 3y ago
  Another problem that I feel has barely even been touched on in recent time is what even are facts. People see things on the Internet and take it for gospel. You know information people ALWAYS blindly believe 100%? "Leaked" data. Imagine how much power one could have with manipulated, leaked, data.
  - hammyhavoc 3y ago
    This is what I said about WikiLeaks even at the time. Sprinkle in some untruths with truths and you've got something convincing.
    - idiotsecant 3y ago
      You don't even need to say anything that isn't true. Just being selective about which true secrets you reveal can be a very powerful tool to control the narrative.
      - hammyhavoc 3y ago
        Absolutely.
lcnPylGDnU4H9OF 3y ago
> as for email [passwords], that's again a matter of security I guess if we're nitpicking I'll point out that this is still privacy (how one keeps their password) for the sake of security. Information is kept private and passwords are information.
- hammyhavoc 3y ago
  Perhaps drawing a distinction between outbound and inbound email protocols would be good too. I understand the argument being made, but the sensible assumption is that your email, even with a password, isn't a sensible choice for sensitive communications.
  - lcnPylGDnU4H9OF 3y ago
    > your email, even with a password, isn't a sensible choice for sensitive communications This seems like it's shifting the goalposts. Someone says something about "nothing to hide but they have locks on their doors" and you say "security isn't the same as privacy". It's accurate but it's moot. I keep the location of my hide-a-key private so I can continue to keep my house secure with the lock on the front door. I keep my email password private so I can secure the account against unauthorized access. Some people do use their email for what they would consider sensitive communications, and it's less than helpful to suggest they need better opsec practices in response to someone else saying that they should be able to expect their email to be private. It's saying "just hide it better, lol" when that's literally exactly what many people are trying to do when speaking against this sort of legislation.
JohnFen 3y ago
> Well, clothes are mostly down to weather and laws on public decency Where I live, there are no laws against public nudity (as long as the nudity isn't "salacious" in nature). And yet, very nearly 100% of the people are clothed at all times.
- hammyhavoc 3y ago
  And yet in other areas of the world, people wear no clothes. People also smoke cigarettes, eat junk food, and do things that are unnatural and otherwise detrimental due to what they're bombarded with. I wear clothes, I'm not a nudist. I have zero shame about my body though, it's a body—we've all got one. The point as per my other comments: different solutions for different problems, the appropriateness of each varies with demographics. E.g., if you're surviving in an oppressive regime as a dissenter, email is something to be avoided. If you're running a business, it's likely fine, provided that it's compliant for your industry, e.g., HIPAA.
elondaits 3y ago
Email passwords are not for preventing impersonation. For one, POP3 passwords are separate from SMTP. Second, nothing in SMTP prevents impersonation… large mail handlers like GMail don’t allow it anymore, but you can put whatever you want in the “From” field. Things like SPF, DMARC and DKIM are there to prevent impersonation at the domain level for mail servers that want to protect their users.
- hammyhavoc 3y ago
  When accessing email via a protocol with an email client, sure, but I primarily had the Gmail web app in mind when I wrote the comment. I also touched on protocols in another comment. With what I had in mind, if you logged into my Gmail account, which provides both sending and receiving, you could impersonate me to my own mother, but I would have nothing to hide as I don't receive any sensitive information via email (privacy). However, accounts elsewhere could be recovered via my email, and thus be used to impersonate me elsewhere (security).

stronglikedan 3y ago

Easy: Thieves, scammers, and public decency laws, in that order.

wholinator2 3y ago
Unsure if sarcasm but doesn't the exact same reasoning apply to these? If there's things you don't want thieves to steal then obviously you _do_ have something to hide. Or maybe a better word is protect but both apply equally well
- fooqux 3y ago
  Surely the government would never steal from its citizens. /s
bonestamp2 3y ago
> Thieves, scammers Which means they do have things to hide. There are lots of thieves in places of power, and that is a compelling reason not to let them have our data.

NickBusey 3y ago

I like to ask why they have a door on their bathroom.

rootusrootus 3y ago
I routinely pose that question to my kids. And yet, they still poop with the door open. And without the ventilation fan. I keep hoping that eventually I will get through to them. Maybe I'll just put a spring-loaded hinge on the bathroom doors and a motion-activated ventilation fan.
- croes 3y ago
  Take them to a public toilet. There is a difference between pooping in front of family and in front of strangers.
  - wintogreen74 3y ago
    Is it irony that doing this (or even your comment) would likely land you in really big trouble under the purpose of this act?
    - croes 3y ago
      We'll get more cases like that: https://news.ycombinator.com/item?id=32564126 https://news.ycombinator.com/item?id=32564126
  - rootusrootus 3y ago
    For sure, they act totally different in a public toilet. Very carefully locked door in that case. Hell, the first time my son used a public toilet on his own, I had to talk him through how to actually unlock the door when he finished. I tried to tell him not to latch it since I was standing right on the other side of the door, but no, -CLICK- went the lock anyway.
- rightbyte 3y ago
  I've got a 2.5yo that furiously yells at me to get out when he poops, but he have no remorse trying to physically drag me out of the loo when I am doing my business. Or force me read some book for him. I guess he is a metaphor for the surveillance state. Or the other way around. Dunno.