4 ms·

No one should have any expectation of privacy for anything they put on the Internet. Privacy is something you have to work for, and unless you have those contro

by debacle 12y ago

No one should have any expectation of privacy for anything they put on the Internet. Privacy is something you have to work for, and unless you have those controls (PGP, encryption at rest) in place, privacy doesn't exist. Even if you have those things in place, your privacy is only as strong as the privacy of the people you are communicating with. We should work towards strong privacy as a default, but the service delivering targeted ads is not incentivized to protect your privacy.

click170 12y ago
What about privacy when applying for a job? When I apply for a job, I'm not putting my content online. But that's all the Sony employees have done, and now they're directly in the crossfire.
- freehunter 12y ago
  And a lot of this wasn't even "online", where online is defined as "internet-facing". Once someone it in your network, it doesn't matter what is internet-facing anymore.
- deleted 12y ago
  [deleted]
state 12y ago
Thank you for saying this. Events like this make it clear how much everyone exercises extreme wishful thinking in these situations. Nothing about these systems is secure, and no one should have that expectation. It's unfortunate, but it's true.
bdamm 12y ago
There has to be a range of options. Strong privacy is simply expensive to do well and not everyone cares to do it well. We should expect strong privacy from institutions that need it (any government, including municipal, and organizations such as AT&T) and give out pseudonyms to others. Your employer should be competent to keep your personal data secured as well, and they likely will have to do that by selecting a reputable provider for HR operations services. Yes, we should "work towards" strong privacy by default, but since we'll never get there we need to accept alternative models.
AnimalMuppet 12y ago
But this wasn't "put on the internet". This was the internal corporate network. The normal "put on the internet" rules aren't supposed to apply.
- debacle 12y ago
  Unless that internal corporate network is airgapped, it was put on the Internet for all intents and purposes.
  - Cushman 12y ago
    If we're talking about the general public here, I think we're going to want to come up with more nuanced guidance than "Don't store private data on any internet-connected computer, ever."
    - debacle 12y ago
      I think the better solution is to just assume insecurity. Don't send dick pics to anyone, etc.
      - Cushman 12y ago
        Maybe we're talking past each other here-- there's a significant qualitative difference between the risks of uploading data to a globally-routable server somewhere, and storing that same data on a firewalled, password-protected system on an internal network which could theoretically be owned from outside. The former is obviously unsolvable, and "don't transmit anything you don't want shared" is good advice. But surely we want to arrive at a world where typical end users can feel secure about the data on their own computer, even if it is plugged into an ethernet jack.
        debacle 12y ago
        You should feel relatively secure, but you should not be amazed if that information gets copied/stolen.
phpnode 12y ago
> No one should have any expectation of privacy for anything they put on the Internet. Right, except Joanna Public does have this expectation and continues to do so because of manifestly poor public education about the risks of the internet. We should literally have lessons about this stuff in schools. And as another commenter stated, these things were not "online", they were "on a computer". If I can have no expectation of privacy for things I put on a computer then that is going to lead to no expectation of privacy under any circumstances. This stuff is going to have profound social consequences and something has to change.
- lelandbatey 12y ago
  I did receive education on the risks of the internet, starting in elementary school (around 4th grade). In grade school we where given school-district emails, which we used to communicate with teachers, get information from the school district, and could use to talk to other students. I still remember when we where first given these, because our teacher gave a very long warning about using the internet. I remember the exact phrase "whatever you put on the internet will be there forever, and you can never take it down. Think about that before doing anything." This was about a decade ago, but I grew up in Redmond, Washington, so my education is probably very different from other peoples (at least regarding computers).
  - A_COMPUTER 12y ago
    Nah, that's the same education we got in 1995 in high school, too. What happened in the interim is that there were a couple of dot-com bubbles where companies encouraged you to share recklessly because they built business models on it. Ignore all that safety stuff. So I see all these services pop up that ask you to do things we were always taught not to do, it created intense feelings of unease in me, but everybody did it anyway. And then nude pics get hacked and shared, people get harassed/fired because of a global Facebook tweet saying something stupid, and everybody acts like it's a big fucking surprise when all they had to do was follow the rules. But the rules conflicted with the merger of narcissism and corporate profits.
krschultz 12y ago
Some of this stuff, sure, it's not necessary at work so you are taking a risk of it becoming public for no reason. But some of it is necessary in a corporate office. I have emailed HR questions about medical insurance or 401ks that I wouldn't want to post on my Twitter. Identifying the beneficiary of my life insurance policy doesn't seem like something I want many people to know, yet HR has to. What else are you supposed to do than use the internal systems? You have to trust IT/Security with that stuff.
pjc50 12y ago
You're basically saying that nothing on a networked computer should be considered private, including all the authentication details, which kind of makes banking (and bitcoin!) meaningless.
sgustard 12y ago
So, don't give your employer your social security number or any other sensitive data? And still expect to have a job and get paid? That doesn't seem like a tenable plan.

by debacle 12y ago

click170 12y ago

What about privacy when applying for a job? When I apply for a job, I'm not putting my content online. But that's all the Sony employees have done, and now they're directly in the crossfire.

freehunter 12y ago
And a lot of this wasn't even "online", where online is defined as "internet-facing". Once someone it in your network, it doesn't matter what is internet-facing anymore.
deleted 12y ago
[deleted]

state 12y ago

Thank you for saying this. Events like this make it clear how much everyone exercises extreme wishful thinking in these situations. Nothing about these systems is secure, and no one should have that expectation. It's unfortunate, but it's true.

bdamm 12y ago

There has to be a range of options. Strong privacy is simply expensive to do well and not everyone cares to do it well. We should expect strong privacy from institutions that need it (any government, including municipal, and organizations such as AT&T) and give out pseudonyms to others. Your employer should be competent to keep your personal data secured as well, and they likely will have to do that by selecting a reputable provider for HR operations services. Yes, we should "work towards" strong privacy by default, but since we'll never get there we need to accept alternative models.

AnimalMuppet 12y ago

But this wasn't "put on the internet". This was the internal corporate network. The normal "put on the internet" rules aren't supposed to apply.

debacle 12y ago
Unless that internal corporate network is airgapped, it was put on the Internet for all intents and purposes.
- Cushman 12y ago
  If we're talking about the general public here, I think we're going to want to come up with more nuanced guidance than "Don't store private data on any internet-connected computer, ever."
  - debacle 12y ago
    I think the better solution is to just assume insecurity. Don't send dick pics to anyone, etc.
    - Cushman 12y ago
      Maybe we're talking past each other here-- there's a significant qualitative difference between the risks of uploading data to a globally-routable server somewhere, and storing that same data on a firewalled, password-protected system on an internal network which could theoretically be owned from outside. The former is obviously unsolvable, and "don't transmit anything you don't want shared" is good advice. But surely we want to arrive at a world where typical end users can feel secure about the data on their own computer, even if it is plugged into an ethernet jack.
      - debacle 12y ago
        You should feel relatively secure, but you should not be amazed if that information gets copied/stolen.

phpnode 12y ago

> No one should have any expectation of privacy for anything they put on the Internet. Right, except Joanna Public does have this expectation and continues to do so because of manifestly poor public education about the risks of the internet. We should literally have lessons about this stuff in schools. And as another commenter stated, these things were not "online", they were "on a computer". If I can have no expectation of privacy for things I put on a computer then that is going to lead to no expectation of privacy under any circumstances. This stuff is going to have profound social consequences and something has to change.

lelandbatey 12y ago
I did receive education on the risks of the internet, starting in elementary school (around 4th grade). In grade school we where given school-district emails, which we used to communicate with teachers, get information from the school district, and could use to talk to other students. I still remember when we where first given these, because our teacher gave a very long warning about using the internet. I remember the exact phrase "whatever you put on the internet will be there forever, and you can never take it down. Think about that before doing anything." This was about a decade ago, but I grew up in Redmond, Washington, so my education is probably very different from other peoples (at least regarding computers).
- A_COMPUTER 12y ago
  Nah, that's the same education we got in 1995 in high school, too. What happened in the interim is that there were a couple of dot-com bubbles where companies encouraged you to share recklessly because they built business models on it. Ignore all that safety stuff. So I see all these services pop up that ask you to do things we were always taught not to do, it created intense feelings of unease in me, but everybody did it anyway. And then nude pics get hacked and shared, people get harassed/fired because of a global Facebook tweet saying something stupid, and everybody acts like it's a big fucking surprise when all they had to do was follow the rules. But the rules conflicted with the merger of narcissism and corporate profits.

krschultz 12y ago

Some of this stuff, sure, it's not necessary at work so you are taking a risk of it becoming public for no reason. But some of it is necessary in a corporate office. I have emailed HR questions about medical insurance or 401ks that I wouldn't want to post on my Twitter. Identifying the beneficiary of my life insurance policy doesn't seem like something I want many people to know, yet HR has to. What else are you supposed to do than use the internal systems? You have to trust IT/Security with that stuff.

pjc50 12y ago

You're basically saying that nothing on a networked computer should be considered private, including all the authentication details, which kind of makes banking (and bitcoin!) meaningless.

sgustard 12y ago

So, don't give your employer your social security number or any other sensitive data? And still expect to have a job and get paid? That doesn't seem like a tenable plan.