5 ms·

In an information environment, security and privacy are the same thing. The terms may have different connotations culturally, but good security-in-depth is the

In an information environment, security and privacy are the same thing. The terms may have different connotations culturally, but good security-in-depth is the same set of practices that enable digital privacy, because the objective is the same: prevent leakage of facts.

hammyhavoc 4y ago
You can have E2EE to the service provider, but they can be free to rummage through your data if they choose to or are coerced to by a legal demand from an authority. But it eliminates the average schmoe from going through that data. Is that adequate security? Is that adequate privacy? This is what bills like EARN IT and its ilk are positing with backdoors et al. It depends on your threat model. If a warrant opens a door or account one way or another, it can be argued that privacy-wise, locks and passwords are poor solutions. Are you protecting business data or trying to survive in an oppressive regime? Different solutions for different problems, how appropriate they are varies with demographics too. This is an interesting talking point about privacy and security: https://news.ycombinator.com/item?id=35617773 https://news.ycombinator.com/item?id=35617773
- ranger_danger 4y ago
  > Are you protecting business data or trying to survive in an oppressive regime? First it's just one, then it becomes the other.
- smolder 4y ago
  E2EE refers to fully encrypted communication between end-users of a service, hence end-to-end. If one of the ends is the service provider, the term doesn't apply.
  - hammyhavoc 4y ago
    This is the point. It's a buzzword and the reality of a lot of popular services is that the service provider can likely already provide access to your data if requested to by a government. Ergo, if this is a consideration within your threat model, it's an inappropriate solution. However, I am highlighting that EARN IT is no more a threat than existing service providers abiding by a court order, ergo the existing solutions likely aren't fit-for-purpose for some folks, depending on threat model.
JohnFen 4y ago
> In an information environment, security and privacy are the same thing Yes. Privacy is a subset of security.
- d4mi3n 4y ago
  I'd argue that they're overlapping sets of concerns, not necessarily identical to or subsets of each other. Off the cuff: * Being an anonymous person walking through a city. This is a privacy concern and only becomes a security concern if I'm a public persona or some kind of person of interest. * Moving to a new school/city/job and not having your social reputation follow you. This allows a lot of people a chance to redefine who they are and how they interact with people around them. This can't happen if everybody always knows somebody's pervious public persona. * Breaking a law and being fined/punished/imprisoned for it. Without privacy, such a person has a much poorer chance of having a decent life even after they've done their time or paid their dues. These all strike me as privacy concerns, but not necessarily concerns to security. I think they're all important enough to consider privacy as a good thing in it's own right and that such scenarios signal that it's possible to advocate privacy in the absence of (or opposition to) security concerns.
  - pksebben 4y ago
    How would you define the terms? IMO these are all 'security' related, just personal security (which is what I define privacy as). The most accurate lines I can draw around either are abstract enough that they end up in the same bucket, but perhaps we're defining them differently
    - elesiuta 4y ago
      Not GP, but security refers to the protection of the system, while privacy refers to the protection of information. So you need to protect the system to protect the information on it, but there are also sometimes trade offs between security and privacy when you offload some system protection by giving away some information to another party. For example SmartScreen with Microsoft, and Safe Browsing with Google Chrome.
ranger_danger 4y ago
Another problem that I feel has barely even been touched on in recent time is what even are facts. People see things on the Internet and take it for gospel. You know information people ALWAYS blindly believe 100%? "Leaked" data. Imagine how much power one could have with manipulated, leaked, data.
- hammyhavoc 4y ago
  This is what I said about WikiLeaks even at the time. Sprinkle in some untruths with truths and you've got something convincing.
  - idiotsecant 4y ago
    You don't even need to say anything that isn't true. Just being selective about which true secrets you reveal can be a very powerful tool to control the narrative.
    - hammyhavoc 4y ago
      Absolutely.

hammyhavoc 4y ago

You can have E2EE to the service provider, but they can be free to rummage through your data if they choose to or are coerced to by a legal demand from an authority. But it eliminates the average schmoe from going through that data. Is that adequate security? Is that adequate privacy? This is what bills like EARN IT and its ilk are positing with backdoors et al. It depends on your threat model. If a warrant opens a door or account one way or another, it can be argued that privacy-wise, locks and passwords are poor solutions. Are you protecting business data or trying to survive in an oppressive regime? Different solutions for different problems, how appropriate they are varies with demographics too. This is an interesting talking point about privacy and security: https://news.ycombinator.com/item?id=35617773 https://news.ycombinator.com/item?id=35617773

ranger_danger 4y ago
> Are you protecting business data or trying to survive in an oppressive regime? First it's just one, then it becomes the other.
smolder 4y ago
E2EE refers to fully encrypted communication between end-users of a service, hence end-to-end. If one of the ends is the service provider, the term doesn't apply.
- hammyhavoc 4y ago
  This is the point. It's a buzzword and the reality of a lot of popular services is that the service provider can likely already provide access to your data if requested to by a government. Ergo, if this is a consideration within your threat model, it's an inappropriate solution. However, I am highlighting that EARN IT is no more a threat than existing service providers abiding by a court order, ergo the existing solutions likely aren't fit-for-purpose for some folks, depending on threat model.

JohnFen 4y ago

> In an information environment, security and privacy are the same thing Yes. Privacy is a subset of security.

d4mi3n 4y ago
I'd argue that they're overlapping sets of concerns, not necessarily identical to or subsets of each other. Off the cuff: * Being an anonymous person walking through a city. This is a privacy concern and only becomes a security concern if I'm a public persona or some kind of person of interest. * Moving to a new school/city/job and not having your social reputation follow you. This allows a lot of people a chance to redefine who they are and how they interact with people around them. This can't happen if everybody always knows somebody's pervious public persona. * Breaking a law and being fined/punished/imprisoned for it. Without privacy, such a person has a much poorer chance of having a decent life even after they've done their time or paid their dues. These all strike me as privacy concerns, but not necessarily concerns to security. I think they're all important enough to consider privacy as a good thing in it's own right and that such scenarios signal that it's possible to advocate privacy in the absence of (or opposition to) security concerns.
- pksebben 4y ago
  How would you define the terms? IMO these are all 'security' related, just personal security (which is what I define privacy as). The most accurate lines I can draw around either are abstract enough that they end up in the same bucket, but perhaps we're defining them differently
  - elesiuta 4y ago
    Not GP, but security refers to the protection of the system, while privacy refers to the protection of information. So you need to protect the system to protect the information on it, but there are also sometimes trade offs between security and privacy when you offload some system protection by giving away some information to another party. For example SmartScreen with Microsoft, and Safe Browsing with Google Chrome.

ranger_danger 4y ago

Another problem that I feel has barely even been touched on in recent time is what even are facts. People see things on the Internet and take it for gospel. You know information people ALWAYS blindly believe 100%? "Leaked" data. Imagine how much power one could have with manipulated, leaked, data.

hammyhavoc 4y ago
This is what I said about WikiLeaks even at the time. Sprinkle in some untruths with truths and you've got something convincing.
- idiotsecant 4y ago
  You don't even need to say anything that isn't true. Just being selective about which true secrets you reveal can be a very powerful tool to control the narrative.
  - hammyhavoc 4y ago
    Absolutely.