6 ms·

Privacy Behaviors After Snowden

83 points by ivotron 11y ago

quchen 11y ago
PDF version: http://delivery.acm.org/10.1145/2670000/2663341/p48-preibusch.pdf?ip=178.27.248.251&id=2663341&acc=OA&key=4D4702B0C3E38B35.4D4702B0C3E38B35.4D4702B0C3E38B35.643A5797A8FAE0F7&CFID=514364689&CFTOKEN=34970414&__acm__=1432545192_01a335e6c187d69b80964980924e0ed1 http://delivery.acm.org/10.1145/2670000/2663341/p48-preibusc...
- deleted 11y ago
  [deleted]
- tobik 11y ago
  The link doesn't work. Use http://m.cacm.acm.org/magazines/2015/5/186025-privacy-behaviors-after-snowden/pdf http://m.cacm.acm.org/magazines/2015/5/186025-privacy-behavi...
deleted 11y ago
[deleted]
chrisacree 11y ago
I'm not surprised by this. Getting the public at large's attention concentrated in the first place is hard enough; keeping it there is impossible. However, that's not to say that all this has been in vain. The snooping revelations sent huge ripples through the tech community, and that is the community both most affected and most poised to make a change. A small group of dedicated people is all it takes to enact change, and it's clear to me there has been significant increase in the scrutiny of both government surveillance and existing businesses privacy policies and software. Maybe the public at large has moved on, but some people have adopted the cause, and a small focused group can be far more potent than a vague, if large, mass of people. Just ask Occupy Wall Street. The main take-away here is that yes, the public will move on. As it always does. Nothing is going to hold the country's attention more than a couple weeks, and even that is pushing it. So use that momentum if appears, but don't depend on it staying. More important is whether a subgroup is galvanized to action and will commit to the long fight. Parallels to consider: - the political influence of relatively small interest groups via lobbyists - the oft-repeated wisdom that for a startup it's better to have a core group that loves you than a million that think you're just pretty good
- themartorana 11y ago
  I'm also interested in the effect companies pushing for and enacting better privacy and encryption had. For instance, Google made sweeping and immediate changes, and Apple tightened encryption in iMessage and iOS, to the vocal chagrin of govnt agencies. Did visible actions like these help speed the public decline in interest because the public at large felt that major influencers had become their champions (naive though it may be)?
belorn 11y ago
The research methodology seem to have looked at the amount of people looking for privacy tools, privacy statements, and usage of privacy tools. This seem to correlate with news article, and then die down a time afterward. I am not very surprised by this. If one would look at global health news and news about diseases, and correlate that with purchases of health products, you would likely find similar pattern where you get initial peaks that is followed with a decreased interest which slowly returns to original levels. Once you have tried a product out, its hard to notice any difference and its thus easy to return to previous behavior after a initial scare. What is hard to predict is if peoples risk analyses changes from reading such news. After Snowden, has help lines, priests, lawyers, and therapist seen a impact? If so, how much and for how long? The decision to try out tor for a week and then switching back feels inherently different from deciding to not call a help line in case someone might be listening in.
fnordfnordfnord 11y ago
"Privacy" probably isn't a keyword that I would search for if I had new concerns about my online privacy. I think "secure" or "encrypted" as in secure browser, text, communication, etc. After reading a few Snowden related articles, I think a lot of people would also bypass simple keywords for more targeted searches such as "TOR", "OTR", etc. Also, as the author makes note of, I'd want to look at search data that wasn't from Bing, mainly because that is the default installed search engine for MS Windows. While anyone may choose to use Bing, its users will also include a large pool of unsophisticated users.
- deleted 11y ago
  [deleted]
junto 11y ago
I have also sadly noted that there is little interest from my peers in such matters. It is also hard to change. I work with technology everyday. I planned to: - move away from Gmail to Fastmail - move away from Dropbox to Spideroak or Owncloud - move away from G+ Photos to ? - move away from SMS and WhatsApp to TextSecure The results? I'm still on Gmail. I still have a Dropbox account and I'm slowly moving stuff to Spideroak. I'm the only one who uses TextSecure and I end up sending SMS in the clear to my friends. I've tried a multitude of photo apps and none of them do what I want. All a very sad state of affairs.
- feld 11y ago
  It's ok to admit you don't care enough to make the switch. I've been on Fastmail for quite a while, don't use a Dropbox alternative, Smugmug for photos, and whatsapp mostly because my friends switched once long before Textsecure and don't see the benefit of switching again It's really not that big of a hassle
- nota_bene 11y ago
  There is also the "network effect" that is keeping users locked in these services. In other words: "I leave only if my friends leave". That's the problem https://www.iWouldDo.it https://www.iWouldDo.it can solve for you.
- tedunangst 11y ago
  What does one gain by moving from gmail to fastmail? Do you think the AU government has no leverage? Or that the NSA is incapable of infiltrating their servers?
  - kazazes 11y ago
    FastMail isn't scanning your emails to generate a profile of you in order to serve you highly targeted advertising all over the web. https://support.google.com/mail/answer/6603?hl=en https://support.google.com/mail/answer/6603?hl=en
    - 11y ago
higherpurpose 11y ago
I think the methodology to show "how much people care about privacy post-Snowden" is flawed in that regard. I'll just give the most powerful example for this. So this study shows that there's basically little difference between people searching for privacy tools now and before Snowden, right? Okay, except pre-Snowden there's no way something like the Patriot Act wouldn't have been renewed again. Why has it failed to be renewed now then? Because many people do care about privacy and have called their Congressmen to act accordingly. I'm also seeing much more interest in end-to-end encrypted apps. Pre-Snowden few knew about "end-to-end encryption" and what that means. I'm seeing many more comments online with people asking about it. I think the biggest issue is that people feel "overpowered", so the solution usually becomes inaction. In other words it's not "I don't care about privacy" - it's "I don't care about privacy enough to learn to use complicated new tools or radically change my behavior online...but if you give me easy to use strong encryption, especially in the apps I'm already using, I'm happy to use it." Let's assume sending (snail) mail wasn't secure, but pigeon messaging was. People wouldn't refuse to use pigeon messaging because "they don't care about privacy". They wouldn't do it because it's too complicated and too much of a hassle. This is why convincing platforms and service providers to use strong encryption by default is so important.
Zigurd 11y ago
It's not the user's fault. Unless mainstream services make privacy strong, simple, and pervasive all they are doing is marking the people who seek privacy for greater surveillance. Google, Yahoo, and Microsoft need to step up and make it so my mom can have secure email. They have all the tools, especially the ability to use social graphs as the basis for web-of-trust.
- schoen 11y ago
  Yahoo and Google are both working on end-to-end e-mail options. https://github.com/google/end-to-end https://github.com/google/end-to-end https://github.com/yahoo/end-to-end https://github.com/yahoo/end-to-end An even harder problem, maybe: how could we make it so communications intermediaries don't know your social graph? The most exciting idea in this direction I know of is AGL's Pond: https://pond.imperialviolet.org/ https://pond.imperialviolet.org/ But it comes with some more severe tradeoffs than just end-to-end encrypting your e-mail, like deliberately introducing delays in sending and receiving messages in order to create ambiguity about when communication took place.
  - Zigurd 11y ago
    There are many ways to find one's social graph, and that train may have left the station in the 1970's or early 80's with Project Daytona, which was rumored to be built for analyzing all the call detail records that could be gathered and entered in to a database. The social graph is also an opportunity for securing key exchange through key signing and combining key exchange with real time communication that's hard to falsify and hence hard to MITM.
  - throwawayaway 11y ago
    well imagine a decentralized facebook with absolute privacy. you don't need delays. traffic to and from "the server" is maintained at a flat rate of encrypted white noise type signal. whoever talks to whoever else through this black box is a mystery.
    - schoen 11y ago
yakamok 11y ago
i refused to read it on the basis the font sucks and its light color!!
- btbuildem 11y ago
  http://www.readability.com http://www.readability.com
throwawayaway 11y ago
> When the Web search engine DuckDuckGo, which advertises its superior privacy practices, attributed a rise in its daily queries to the PRISM revelation, it did not include user counts. contrary to this article, duckduckgo showing a huge increase in the number of queries: implies an increase in number of users. it doesn't store user id's as a matter of policy, surprised the author doesn't mention that is why user count is not reported. the fact that it can't do so is the whole point. would be interested in growth numbers for textsecure, redphone, firefox hello vs. skype, visits to glen greenwalds site and so on. some background on the author: Author Sören Preibusch (http://preibusch.de/ http://preibusch.de/) is a user experience researcher at Google, Mountain View, CA, and was at Microsoft Research, Cambridge, U.K., when this article was written.
Canada 11y ago
The general public can't do anything to improve privacy. They have no viable options. It's up to us, the hackers and entrepreneurs, to create new viable options.
resonation 11y ago
God, that was the least informative research project I've ever encountered. The premise of the research is something akin to: Based on recent news reports, where a whistleblower revealed that tobacco farmers routinely fertilize their crops with human brains, which then inadvertantly leads to contamination of tobacco products, leaving all smokers at risk of developing human prion related diseases, we've conducted a study to see if this increased the frequency of hits on the Phillip Morris website's ingredients page. Our findings show that numbers only increased by 0.00001%. Gee, thanks. Nevermind questioning why anyone would look at the list of public ingredients, when the problem is contamination, which, by definition, means that unintended ingredients ruined the desired product. Why would a company list an accidental poison as part of its normal product? Why would Microsoft's privacy policy reveal any useful information about secret government programs? At no point in time have I ever met anyone who would have imagined that Microsoft's privacy policy would protect them from the NSA. It's almost like someone decided to study the things people DON'T do, after learning of some significant revelation. Like, hey let's conduct a study of how many people prefer to watch Family Feud over Price Is Right after being in a car accident! Oh, interesting! The difference is barely measurable!

83 points by ivotron 11y ago

PDF version: http://delivery.acm.org/10.1145/2670000/2663341/p48-preibusch.pdf?ip=178.27.248.251&id=2663341&acc=OA&key=4D4702B0C3E38B35.4D4702B0C3E38B35.4D4702B0C3E38B35.643A5797A8FAE0F7&CFID=514364689&CFTOKEN=34970414&__acm__=1432545192_01a335e6c187d69b80964980924e0ed1 http://delivery.acm.org/10.1145/2670000/2663341/p48-preibusc...

deleted 11y ago
[deleted]
tobik 11y ago
The link doesn't work. Use http://m.cacm.acm.org/magazines/2015/5/186025-privacy-behaviors-after-snowden/pdf http://m.cacm.acm.org/magazines/2015/5/186025-privacy-behavi...

deleted 11y ago

[deleted]

chrisacree 11y ago

I'm not surprised by this. Getting the public at large's attention concentrated in the first place is hard enough; keeping it there is impossible. However, that's not to say that all this has been in vain. The snooping revelations sent huge ripples through the tech community, and that is the community both most affected and most poised to make a change. A small group of dedicated people is all it takes to enact change, and it's clear to me there has been significant increase in the scrutiny of both government surveillance and existing businesses privacy policies and software. Maybe the public at large has moved on, but some people have adopted the cause, and a small focused group can be far more potent than a vague, if large, mass of people. Just ask Occupy Wall Street. The main take-away here is that yes, the public will move on. As it always does. Nothing is going to hold the country's attention more than a couple weeks, and even that is pushing it. So use that momentum if appears, but don't depend on it staying. More important is whether a subgroup is galvanized to action and will commit to the long fight. Parallels to consider: - the political influence of relatively small interest groups via lobbyists - the oft-repeated wisdom that for a startup it's better to have a core group that loves you than a million that think you're just pretty good

themartorana 11y ago
I'm also interested in the effect companies pushing for and enacting better privacy and encryption had. For instance, Google made sweeping and immediate changes, and Apple tightened encryption in iMessage and iOS, to the vocal chagrin of govnt agencies. Did visible actions like these help speed the public decline in interest because the public at large felt that major influencers had become their champions (naive though it may be)?

belorn 11y ago

The research methodology seem to have looked at the amount of people looking for privacy tools, privacy statements, and usage of privacy tools. This seem to correlate with news article, and then die down a time afterward. I am not very surprised by this. If one would look at global health news and news about diseases, and correlate that with purchases of health products, you would likely find similar pattern where you get initial peaks that is followed with a decreased interest which slowly returns to original levels. Once you have tried a product out, its hard to notice any difference and its thus easy to return to previous behavior after a initial scare. What is hard to predict is if peoples risk analyses changes from reading such news. After Snowden, has help lines, priests, lawyers, and therapist seen a impact? If so, how much and for how long? The decision to try out tor for a week and then switching back feels inherently different from deciding to not call a help line in case someone might be listening in.

fnordfnordfnord 11y ago

"Privacy" probably isn't a keyword that I would search for if I had new concerns about my online privacy. I think "secure" or "encrypted" as in secure browser, text, communication, etc. After reading a few Snowden related articles, I think a lot of people would also bypass simple keywords for more targeted searches such as "TOR", "OTR", etc. Also, as the author makes note of, I'd want to look at search data that wasn't from Bing, mainly because that is the default installed search engine for MS Windows. While anyone may choose to use Bing, its users will also include a large pool of unsophisticated users.

deleted 11y ago
[deleted]

junto 11y ago

I have also sadly noted that there is little interest from my peers in such matters. It is also hard to change. I work with technology everyday. I planned to: - move away from Gmail to Fastmail - move away from Dropbox to Spideroak or Owncloud - move away from G+ Photos to ? - move away from SMS and WhatsApp to TextSecure The results? I'm still on Gmail. I still have a Dropbox account and I'm slowly moving stuff to Spideroak. I'm the only one who uses TextSecure and I end up sending SMS in the clear to my friends. I've tried a multitude of photo apps and none of them do what I want. All a very sad state of affairs.

feld 11y ago
It's ok to admit you don't care enough to make the switch. I've been on Fastmail for quite a while, don't use a Dropbox alternative, Smugmug for photos, and whatsapp mostly because my friends switched once long before Textsecure and don't see the benefit of switching again It's really not that big of a hassle
nota_bene 11y ago
There is also the "network effect" that is keeping users locked in these services. In other words: "I leave only if my friends leave". That's the problem https://www.iWouldDo.it https://www.iWouldDo.it can solve for you.
tedunangst 11y ago
What does one gain by moving from gmail to fastmail? Do you think the AU government has no leverage? Or that the NSA is incapable of infiltrating their servers?
- kazazes 11y ago
  FastMail isn't scanning your emails to generate a profile of you in order to serve you highly targeted advertising all over the web. https://support.google.com/mail/answer/6603?hl=en https://support.google.com/mail/answer/6603?hl=en
  - 11y ago

higherpurpose 11y ago

I think the methodology to show "how much people care about privacy post-Snowden" is flawed in that regard. I'll just give the most powerful example for this. So this study shows that there's basically little difference between people searching for privacy tools now and before Snowden, right? Okay, except pre-Snowden there's no way something like the Patriot Act wouldn't have been renewed again. Why has it failed to be renewed now then? Because many people do care about privacy and have called their Congressmen to act accordingly. I'm also seeing much more interest in end-to-end encrypted apps. Pre-Snowden few knew about "end-to-end encryption" and what that means. I'm seeing many more comments online with people asking about it. I think the biggest issue is that people feel "overpowered", so the solution usually becomes inaction. In other words it's not "I don't care about privacy" - it's "I don't care about privacy enough to learn to use complicated new tools or radically change my behavior online...but if you give me easy to use strong encryption, especially in the apps I'm already using, I'm happy to use it." Let's assume sending (snail) mail wasn't secure, but pigeon messaging was. People wouldn't refuse to use pigeon messaging because "they don't care about privacy". They wouldn't do it because it's too complicated and too much of a hassle. This is why convincing platforms and service providers to use strong encryption by default is so important.

Zigurd 11y ago

It's not the user's fault. Unless mainstream services make privacy strong, simple, and pervasive all they are doing is marking the people who seek privacy for greater surveillance. Google, Yahoo, and Microsoft need to step up and make it so my mom can have secure email. They have all the tools, especially the ability to use social graphs as the basis for web-of-trust.

schoen 11y ago
Yahoo and Google are both working on end-to-end e-mail options. https://github.com/google/end-to-end https://github.com/google/end-to-end https://github.com/yahoo/end-to-end https://github.com/yahoo/end-to-end An even harder problem, maybe: how could we make it so communications intermediaries don't know your social graph? The most exciting idea in this direction I know of is AGL's Pond: https://pond.imperialviolet.org/ https://pond.imperialviolet.org/ But it comes with some more severe tradeoffs than just end-to-end encrypting your e-mail, like deliberately introducing delays in sending and receiving messages in order to create ambiguity about when communication took place.
- Zigurd 11y ago
  There are many ways to find one's social graph, and that train may have left the station in the 1970's or early 80's with Project Daytona, which was rumored to be built for analyzing all the call detail records that could be gathered and entered in to a database. The social graph is also an opportunity for securing key exchange through key signing and combining key exchange with real time communication that's hard to falsify and hence hard to MITM.
- throwawayaway 11y ago
  well imagine a decentralized facebook with absolute privacy. you don't need delays. traffic to and from "the server" is maintained at a flat rate of encrypted white noise type signal. whoever talks to whoever else through this black box is a mystery.
  - schoen 11y ago

yakamok 11y ago

i refused to read it on the basis the font sucks and its light color!!

btbuildem 11y ago
http://www.readability.com http://www.readability.com

throwawayaway 11y ago

> When the Web search engine DuckDuckGo, which advertises its superior privacy practices, attributed a rise in its daily queries to the PRISM revelation, it did not include user counts. contrary to this article, duckduckgo showing a huge increase in the number of queries: implies an increase in number of users. it doesn't store user id's as a matter of policy, surprised the author doesn't mention that is why user count is not reported. the fact that it can't do so is the whole point. would be interested in growth numbers for textsecure, redphone, firefox hello vs. skype, visits to glen greenwalds site and so on. some background on the author: Author Sören Preibusch (http://preibusch.de/ http://preibusch.de/) is a user experience researcher at Google, Mountain View, CA, and was at Microsoft Research, Cambridge, U.K., when this article was written.

Canada 11y ago

The general public can't do anything to improve privacy. They have no viable options. It's up to us, the hackers and entrepreneurs, to create new viable options.

resonation 11y ago

God, that was the least informative research project I've ever encountered. The premise of the research is something akin to: Based on recent news reports, where a whistleblower revealed that tobacco farmers routinely fertilize their crops with human brains, which then inadvertantly leads to contamination of tobacco products, leaving all smokers at risk of developing human prion related diseases, we've conducted a study to see if this increased the frequency of hits on the Phillip Morris website's ingredients page. Our findings show that numbers only increased by 0.00001%. Gee, thanks. Nevermind questioning why anyone would look at the list of public ingredients, when the problem is contamination, which, by definition, means that unintended ingredients ruined the desired product. Why would a company list an accidental poison as part of its normal product? Why would Microsoft's privacy policy reveal any useful information about secret government programs? At no point in time have I ever met anyone who would have imagined that Microsoft's privacy policy would protect them from the NSA. It's almost like someone decided to study the things people DON'T do, after learning of some significant revelation. Like, hey let's conduct a study of how many people prefer to watch Family Feud over Price Is Right after being in a car accident! Oh, interesting! The difference is barely measurable!