3 ms·

Whenever someone asks about the consumer demand for privacy, I have to ask "what kind of privacy?" Almost everyone says they value privacy, but that means diff

Whenever someone asks about the consumer demand for privacy, I have to ask "what kind of privacy?" Almost everyone says they value privacy, but that means different things for different people. Most teenagers don't care at all about government surveillance but care a lot about what their parents see. Spouses may care about the history log in their browsers. Employees care about what their employers see. In addition, our desire for privacy is also contingent upon the effects of losing that privacy, which may vary based on factors that aren't strictly related to privacy. For example, people may regard their e-mail address or phone number as "private", but what those people (or at least some of them) really care about is spam. In the absence of spam (e.g. thanks to really good filtering), certain individuals might not regard an e-mail address as private. If we analogize privacy to security, we might say that different people have different threat models, and that in turn determines how much convenience they're willing to give up for more security and the corresponding "market" for products or services that enhance that type of security.

hackuser 12y ago
Many in our industry believe that consumers don't understand technology or its implications, don't know what they want, and if you base your product design on consumers' stated desires you are substituting the offhand ideas of ignorant amateurs (I don't mean that pejoratively; they have their own jobs to do) for the hard-won, carefully thought-out ideas of expert visionaries. Then why, regarding security issues, do so many in our field say 'consumers don't want that'? Very few consumers understand security technology (try asking one for their password, perhaps the simplest security tech) and even fewer understand the potential implications of threats to their confidentiality (for a simple example, how many think metadata is not a threat -- of the few who know what metadata is). Few people in IT really understand the implications, because it requires understanding political, historical, and social issues. Many in IT know as much about those implications as typical end-users know about metadata, but we are deciding those issues for the world.
- walterbell 12y ago
  > it requires understanding political, historical, and social issues A good primer on the social context of engineering is L. Sprague de Camp's "The Ancient Engineers", https://news.ycombinator.com/item?id=8158385 https://news.ycombinator.com/item?id=8158385 "The first engineers were irrigators, architects, and military engineers. The same man was usually expected to be an expert at all three kinds of work. This was still the case thousands of years later, in the Renaissance, when Leonardo, Michelangelo, and Durer were not only all-round engineers but outstanding artists as well. Specialization within the engineering profession has developed only in the last two or three centuries."
- andrewfong 12y ago
  > Then why, regarding security issues, do so many in our field say 'consumers don't want that'? You answered your own question. Consumers actually do say they want privacy and security all the time. It's (some) folks in our industry who think they really don't. Or think that "privacy" or "security" in the abstract are pretty meaningless terms. I fall in that latter category. Consumers say they want "privacy," but what they really want is something that addresses a particular threat model at minimum cost. Take Snapchat for instance. For its target demographic of teenagers, the primary threats are parents. Snapchat won't protect you from a technologically savvy opponent, but for most of its users, that's fine. Snapchat COULD build in two-factor auth, end-to-end encryption, and a whole slew of other privacy measures, but if it makes the app slower and harder to use, it's probably not a good value proposition given what Snapchat knows about its users. Now, what I think what you're implying is that Snapchat should do more, regardless of what its users care about. Although Snapchat's users might not care about the security of their pictures outside of their parents, there are larger "political, historical, and social issues" surrounding the fact that a single entity has access to so many of those pictures in the first place. That well be so. You could argue that Snapchat should take greater care of those photos in order to be a good citizen of the world. But that's a different argument than "there's a growing market for privacy".

hackuser 12y ago

Many in our industry believe that consumers don't understand technology or its implications, don't know what they want, and if you base your product design on consumers' stated desires you are substituting the offhand ideas of ignorant amateurs (I don't mean that pejoratively; they have their own jobs to do) for the hard-won, carefully thought-out ideas of expert visionaries. Then why, regarding security issues, do so many in our field say 'consumers don't want that'? Very few consumers understand security technology (try asking one for their password, perhaps the simplest security tech) and even fewer understand the potential implications of threats to their confidentiality (for a simple example, how many think metadata is not a threat -- of the few who know what metadata is). Few people in IT really understand the implications, because it requires understanding political, historical, and social issues. Many in IT know as much about those implications as typical end-users know about metadata, but we are deciding those issues for the world.

walterbell 12y ago
> it requires understanding political, historical, and social issues A good primer on the social context of engineering is L. Sprague de Camp's "The Ancient Engineers", https://news.ycombinator.com/item?id=8158385 https://news.ycombinator.com/item?id=8158385 "The first engineers were irrigators, architects, and military engineers. The same man was usually expected to be an expert at all three kinds of work. This was still the case thousands of years later, in the Renaissance, when Leonardo, Michelangelo, and Durer were not only all-round engineers but outstanding artists as well. Specialization within the engineering profession has developed only in the last two or three centuries."
andrewfong 12y ago
> Then why, regarding security issues, do so many in our field say 'consumers don't want that'? You answered your own question. Consumers actually do say they want privacy and security all the time. It's (some) folks in our industry who think they really don't. Or think that "privacy" or "security" in the abstract are pretty meaningless terms. I fall in that latter category. Consumers say they want "privacy," but what they really want is something that addresses a particular threat model at minimum cost. Take Snapchat for instance. For its target demographic of teenagers, the primary threats are parents. Snapchat won't protect you from a technologically savvy opponent, but for most of its users, that's fine. Snapchat COULD build in two-factor auth, end-to-end encryption, and a whole slew of other privacy measures, but if it makes the app slower and harder to use, it's probably not a good value proposition given what Snapchat knows about its users. Now, what I think what you're implying is that Snapchat should do more, regardless of what its users care about. Although Snapchat's users might not care about the security of their pictures outside of their parents, there are larger "political, historical, and social issues" surrounding the fact that a single entity has access to so many of those pictures in the first place. That well be so. You could argue that Snapchat should take greater care of those photos in order to be a good citizen of the world. But that's a different argument than "there's a growing market for privacy".