3 ms·

The primary question to me is whether the risk of data breech outweighs the harm from not keeping the data, and while 20 years ago this tradeoff may have made s

The primary question to me is whether the risk of data breech outweighs the harm from not keeping the data, and while 20 years ago this tradeoff may have made sense, I'm not so sure it makes sense now.

akerl_ 3y ago
If the data is breached, an attacker learns... that sometimes you have a cough?
- kstrauser 3y ago
  ...and your SSN, and your driver's license info, and all the other personally identifying information they collect and store in the DB.
  - phone8675309 3y ago
    Generally not your SSN - I've never had to give it for Sudafed - but at least full legal name, birthday, gender, home address, driver's license number, telephone number, location(s) you've been to buy medication, and possibly email address. Much of which would be covered as PII and PPI, and, in combination with info from other other data breaches can tell someone a lot about you.
- phone8675309 3y ago
  In addition to at least your full legal name, birthday, gender, home address, driver's license number, telephone number, location(s) you've been to buy medication, and possibly email address.
  - tptacek 3y ago
    You do not in fact provide an email address to buy Sudafed. The rest of that information is for most people already a public record. I'm not saying that makes it OK to assemble into a database, and I think the point about amassing PII is well taken, but I think people are probably overestimating the value/hazardousness of this particular data set.
    - lazide 3y ago
      It’s an attractive nuisance which seems to provide zero practical value overall, let alone for it’s stated reason to exist.
      - tptacek 3y ago
        It decreases the number of backyard meth labs, which are a danger to their surroundings. Despite the availability of overseas industrial meth, meth labs would make a comeback if you could simply buy pseudo-meth at the drug store to shake-and-bake in your garage.
        phone8675309 3y ago
        A more robust fix compared to keeping a list of cold medicine buyers would be to decriminalize or legalize hard drugs, ensuring that a clean, inexpensive supply is available for those addicted under medical supervision, providing a safe place for those who choose to use, providing judgement free addiction treatment, increasing invest in addiction prevention, and addressing the systemic issues that drive people toward drugs due to a lack of opportunity, lack of support, or lack of understanding the negative impacts of drug use.
        akerl_ 3y ago
        Oh, so I guess we just draw the rest of the owl. Good to know that if we fundamentally alter society and sidestep the challenges in doing so, we can avoid the burden of occasionally having to show our ID for one more drug than before. We can and should do the things you're suggesting, but I can't get behind the logic that we should wait til we can accomplish those things, when we can take any other more straightforward measures to mitigate "people making meth at home next door to people who don't like meth labs".
        phone8675309 3y ago
        > I can't get behind the logic that we should wait til we can accomplish those things Where in my post did I say we should stop taking IDs and then wait until all of those are 100% fully accomplished before trying something else? Re-read the post - it's not there. I'm arguing a more robust fix would be to do all of those things. That's not incompatible with keeping the current system of checking IDs until we hit some critical mass where the fixes for the more systemic issues reduce the need for checking IDs.

akerl_ 3y ago

If the data is breached, an attacker learns... that sometimes you have a cough?

kstrauser 3y ago
...and your SSN, and your driver's license info, and all the other personally identifying information they collect and store in the DB.
- phone8675309 3y ago
  Generally not your SSN - I've never had to give it for Sudafed - but at least full legal name, birthday, gender, home address, driver's license number, telephone number, location(s) you've been to buy medication, and possibly email address. Much of which would be covered as PII and PPI, and, in combination with info from other other data breaches can tell someone a lot about you.
phone8675309 3y ago
In addition to at least your full legal name, birthday, gender, home address, driver's license number, telephone number, location(s) you've been to buy medication, and possibly email address.
- tptacek 3y ago
  You do not in fact provide an email address to buy Sudafed. The rest of that information is for most people already a public record. I'm not saying that makes it OK to assemble into a database, and I think the point about amassing PII is well taken, but I think people are probably overestimating the value/hazardousness of this particular data set.
  - lazide 3y ago
    It’s an attractive nuisance which seems to provide zero practical value overall, let alone for it’s stated reason to exist.
    - tptacek 3y ago
      It decreases the number of backyard meth labs, which are a danger to their surroundings. Despite the availability of overseas industrial meth, meth labs would make a comeback if you could simply buy pseudo-meth at the drug store to shake-and-bake in your garage.
      - phone8675309 3y ago
        A more robust fix compared to keeping a list of cold medicine buyers would be to decriminalize or legalize hard drugs, ensuring that a clean, inexpensive supply is available for those addicted under medical supervision, providing a safe place for those who choose to use, providing judgement free addiction treatment, increasing invest in addiction prevention, and addressing the systemic issues that drive people toward drugs due to a lack of opportunity, lack of support, or lack of understanding the negative impacts of drug use.
        akerl_ 3y ago
        Oh, so I guess we just draw the rest of the owl. Good to know that if we fundamentally alter society and sidestep the challenges in doing so, we can avoid the burden of occasionally having to show our ID for one more drug than before. We can and should do the things you're suggesting, but I can't get behind the logic that we should wait til we can accomplish those things, when we can take any other more straightforward measures to mitigate "people making meth at home next door to people who don't like meth labs".
        phone8675309 3y ago
        > I can't get behind the logic that we should wait til we can accomplish those things Where in my post did I say we should stop taking IDs and then wait until all of those are 100% fully accomplished before trying something else? Re-read the post - it's not there. I'm arguing a more robust fix would be to do all of those things. That's not incompatible with keeping the current system of checking IDs until we hit some critical mass where the fixes for the more systemic issues reduce the need for checking IDs.