Hacker News Reader

Comment by staunch | Hacker News Reader

The U.S. needs consumer protection laws. Companies won't stop unethically collecting and retaining data on their own.

https://en.wikipedia.org/wiki/Right_to_be_forgotten

But don't companies need to collect and retain data to operate their businesses? Like they need your info to bill you, they need info to login to your account, your emails stored if you use their included email, etc.

Data can be deleted when it's no longer needed. Sale of data can be forbidden. Old data can be encrypted by the customer's public key so only the customer can initiate access. There are many ways to roll back the madness.

>customer’s public key

The general public has no concept of what a ‘public key’ is.

So... give up? Solve that problem through better products or education. The general public needs counterprogramming against the government's idea of encryption.

a "public key" can also just be a secret. "Apple toothpaste monkey piano" is something someone can write down for recovery. they don't need to know; they just need to remember where they put it (which might be a stretch, yes, but it's better than storing things in plain text)

Actually... that'd be a private key.

+1. The data collection greed of corporations and the accompanying utter loss of control for the hapless consumer who is forced to provide said data is very saddening to see. Unfortunately, consumers in this country seem to not give a whit about the immense loss of control they are willingly undergoing. Witness the EFF/T-Mobile Twitter thread as an example where (seemingly few so far) people are agreeing with the TMob CEO and abusing EFF.

Not nearly as much if you use a payment method like Bitcoin or cash.

Yes, but they don't need to leave it on the porch for anyone to pick up.

We hold the details of over 100M consumers, many of them children. This comprises stuff like their login, order history, etc. We take this shit seriously, keep what's needed only, pentest daily, ids, wargames, strict infosec policy - and when clowns like TW manage shit like this we all get tarred with the same brush.

Since the talk-talk hack we have had clients panicking at least twice a week over shit they read in the Newspapers.

Black Friday when all the ecommerce sites melt is similar - mass panic, at us - even though we've had 100% uptime since may last, and five nines over the year - and have never had any breach of any variety.

There should be steep criminal penalties in place for the officers of a company who allow this to happen. Jail. Business-ending fines.

US isn't even threatening VW officers of jail time (They've recently announced that it will be a civil lawsuit, not penal). US isn't even threatening HSBC officers of jail time, after 30 years of so-called "war on drugs"...

Worst case these companies pay some laughable, trivial fine. That's all that will ever happen in the US. Money talks. EVERYTHING else walks.

Yes, consider using a company that

1. technologically competent (PCI compliant and more) 2. That company can keep that information along with other financial data.

3. That vendor's code and hardware infrastructure is being periodically audited by a third (independent ) party and expert. Or open sourced! Both hardware and software.

3 is crucial to maintain the operating integrity of the company.

Reply on news.ycombinator.com