The privacy wars are about to get a whole lot worse

Perhaps that's why Experia's little breach never made the headlines. They couldn't be framed as a victim as the guy bought all the data legally. It's less than reassuring to ponder, depending on the "how" the data is used, anyone with a shell company, a little diligence and, most importantly, cash could buy this info, too.

http://krebsonsecurity.com/2014/03/experian-lapse-allowed-id...

While I agree that things like sql injection are negligent, there were also credit card hacks/leaks(and an nsa leak) that were the result of malicious contractors. Saying "dont hire bad people" is easy, but how do you do that?

And the standard for best practices is constantly moving in our industry, how do we decide when it is negligence, and when there was nothing that could be done.

Not saying people are being harmed by this, Im just saying its not so black and white. In some cases the companies that were hacked couldnt have reasonably stopped it. I mean, how do you prevent contractors from setting up something that steals credit card numbers? You hired the contractors because you dont have those skills in house.

It's funny how personal data is so clearly valuable - if it weren't companies wouldn't spend resources to hang on to it - and yet that value is so hard to define.

I wonder if it would be helpful if personal information were treated like some kind of intellectual property which could be licensed out, and there were some kind of market for doing so. If a company leaked my data I could sue them like a record company suing individuals who share music files.

Of course, any one individual might not be able to make much money by selling access to their data. It's just a thought.

I'm in a similar position to you. I value my privacy and think it's an important right the needs to be protected. Unfortunately you miss out on a hell of a lot of things if you are strict about maintaining it (thanks mostly to ad supported web services). I also agree that it's through laws that this can be fixed. I think generally laws just can't keep up with the pace of technological change or are made by people with almost no technical knowledge. I'm actually just about to start studying for a law degree (I'm in my late 20's) so that I can apply my technical knowledge (I've been a full-time dev for the last 7 years) to privacy law. Hence I've been researching it a lot recently. The best group I've come across raising awareness and fighting for privacy is Privacy International. It's definitely worth checking out. They produce reports on privacy rights in countries throughout the world and they fight government legislation trying to erode our privacy rights. As for legislative efforts to strengthen privacy the EU's recent changes to data protection and data use of EU citizens by companies based outside the EU springs to mind (Privacy Shield). It's not great but there is effort to improve.

As to the awareness group - I guess this will be controversial - but there are the Pirate Parties with privacy in the core of their ideology.

Personally I think that we'll have to give up strict privacy - it is inevitable that more and more online devices will know more and more about us - but we need some time to adjust, to find out how to make a world without this strict privacy reasonable.

I'm similar to you in many ways on privacy. If the price can come down for the Blackphone and Celluar data, I'd be all for it. It make take time though.

[1] - https://www.silentcircle.com/products-and-solutions/devices/

1) Be offline as much as possible. I have banished the webbrowser from my phone and tablets. The main computer is completely airgapped; I keep an old laptop around to go online. But I installed an app called Self-Control and use it in whitelist mode. I keep a separate To Do list for things that require internet access and when the time I set in Self-Control has passed, I do all my "internet errands" in one go. Usually does not take more than 1-2 hours/ week all in all.

2) Since you care about privacy, you already do all this but for completeness sake: ublock, ghostery, etc. are your friend. I also use an app called Little Snitch. Very useful! Obviously, I don't approve of Facebook, Google etc. but I actually went one step further and block all their properties in Little Snitch. No beacons, "like buttons" or supercookies for me, thank you.

3) Even with (2), I avoid the web as much as possible. In fact, with the exception of HN, I'm usually not on the web anymore. For news or some light magazine reading, I download the PDF editions (or have them sent to my email). For documentation and manuals, I use an offline reader called Dash. When I want to watch a video, I use youtube-dl (on my "internet groceries day"). For ebooks, I have a dedicated reader that is completely offline (needless to say, I do not sync with "the cloud"; Marvin is an excellent alternative to iBooks for reading epubs). In general, all my media library is local: Music, movies, TV shows, magazines/newspapers,…. I don't do streaming, I don't do "cloud". Storage is cheap, why give up your privacy for nothing? Unlike fking webpages, PDFs don't track your reading/thinking behind your back, you can annotate them if you want, and overall I think they offer a better reading experience compared to a webbrowser, esp. on a bigger tablet like the iPad Pro or (haven't tried but should be the same) Surface. Since I really, really dislike ads (= being told what to think, how to feel, etc) I even paste over all the ads before I read a magazine or newspaper! After a bit of practice, I can do it now in about 1-2 minutes per PDF. It's a small price to pay to keep these mercenary memes from infiltrating your mind.

4) For email, I switched to Protonmail. I understand that the NSA can hack them if they really want, but that's okay, they are not my threat model. My goal is to keep what I write in confidence from being read by Google/Gmail, Microsoft/Hotmail etc. So I usually send "pseudo-encrypted" versions to such addresses (where the reader has to enter a simple password, just to keep it from being machine-read as per default). Alternatively, I might send an encrypted PDF if it's more formal or important.

5) For more fluid, extemporaneous communications with friends and family, I mainly use iMessages. In general, Apple is your sole remaining friend among the mainstream vendors (and like I said, I'm talking pragmatic here, not ideal). If someone is on Android, there's still the cross-platform Signal app. Facebook-owned Whatsapp is an obvious no-go. I found that people usually can understand if I explain it to them why. It's like second-hand smoking, only worse. If they insist on exposing me to their "smoke" (or, negative externalities), then I cut the contact.

One last comment: If you feel like you are getting "de-synchronized" from your environment, consider that that might actually be a sign that you are detaching from the hivemind and starting to think on your own again. It's not a guarantee that you will be more (or more often) right than the crowd but at least you have a chance of thinking an interesting thought or developing your own good taste, of not being trite. So take courage! :-) I found that with a bit of effort, it's possible to keep some measure of privacy and make it a bit harder for these people to psychologically profile and manipulate you.

One thing to try, would be to lie more. We don't owe giant corporations the truth, but we especially don't owe them the whole truth. Never use your real name. Use fake addresses when you can. Use different email accounts for each site that needs one. Never use "social media logins". When you have to make payments, do so through Paypal or some other obfuscating service. Zealously delete cookies, and use whatever tech is available to help with that.

There are probably theoretical ways around this, "fingerprinting" etc. It might be like outrunning the lion, however: one might only have to be faster than some other prey, who happily stays logged into FB all the time even when ordering sex toys and vaporizers.

I don' think this is right. When you were being a "luddite" you probably had less data collected about you, but you couldn't see that. All you can see is the cool tech stuff you are missing out on, so you feel that keenly.

I think the reason a lot of people give up their privacy is that they feel like they have lost it already, so they might as well "Get what they can" from it. I don't think this is the right way to think about things. Not every company is sharing data with every other company (yet), so each new toy/app/gadget you used by a different company creates a new entry in some database about you.

As we've seen with the NSA over the last few years, mere laws will not stop the government from spying on you (if you can convince them to implement token restrictions on government surveillance in the first place, which is not often the case).

You can't. If you want to have the security of a democracy, you have to accept the inefficiencies of a democracy (as far as the power structures are concerned, it's pretty analogous to the difference between a dictatorship and a democracy).

https://www.youtube.com/watch?v=hxLJExWk9GE

He mentions that we are past the point of being a luddite much mattering. Much of your activity can be inferred through activity of your friends, family, and those around you.

What do you mean by that? That phrase always struck me as an argument-ending non-argument. What if I disagree that you have a "right" to privacy in any meaningful way? What if I think that I have a basic human right to control the data you choose to upload to my server?

It's not all or nothing. Like any security (and confidentiality is one of the three pillars of security), there's no perfect solution but you can make it more costly for attackers. A few things that help for little cost:

* Use a pre-paid phone plan; don't give your identity to the telco. (Maybe not possible in all countries.)

* Use a VPN and/or Tor. Protect your browsing habits from your ISP.

* Use an ad-blocker or something like uMatrix to stop most tracking

* Pay for things with cash when possible. If it was invented today, we'd all be impressed with the technology: Complete trust between strangers, anonymous financial transactions - all implemented in paper; no encryption needed.

* Use one of the many anonymous, confidential communication services for chat, text and voice.

But I agree that the answer in the law, not technical means.

Moreover you don't need new laws to have privacy. Or looked at from another angle, even if you had laws protecting your privacy you should not rely on laws to keep your private information secure.

If all real time communication were secured with endpoint-generated ephemeral keys, and all storage and store-and-forward payloads were secured with keys distributed with a web-of-trust ket distribution infrastructure, the surveillance state and other commerce-oriented snoops would have to work much much harder to glean far less information.

This helps somewhat and is no real effort.

I find Google to useful when travelling so I use gmail for making travel reservations so Google Now knows what I am doing. So, a few times a year I let myself be tracked for convenience. Otherwise I like private email, Private calendar, etc.

I don't think privacy has to all or nothing deal. Just make choices you are comfortable with.

I half agree with you: technological solutions alone will not suffice, though they may be part of the solution.

But additionally, legal reforms, economic reforms, and social reforms need to be part of this.

Legal reforms to limit the ability of organisations to access, appropriate, store, exchange, and act based on exfiltrated data.

Economic reforms, as noted, to change the business model of publishing from ads-supported media.

Social reforms such that people push back on this. That's less a burden than necessary, IMO, as awareness of the scope of invasion seems highly developed, though responses to that are presently limited.

In concert with the above, provided and mandated technical means for people to protect their information, and to keep corporations and other organisations from grabbing and using it in the first place.

I think the social structure of the 'proletariat' is fine, though the institutions like the news that support it are being eroded due to changing technology and the corporate clout.

But technological solutions are probably necessary to some extent even if not sufficient, particularly when we're talking about communications channels where you're sharing something deliberately with one party but other parties are involved along the way.

And corporate officers.

While that can be a big ask for many services, we're also doing a great job of replicating the functionality of many closed services in an open way. As long as the FOSS/hobby tech world still cares, we'll keep biting away at the new markets closed services create.

And when will it be useful? The scariest thing is when all this data will be used by smart algorithms designed to construct plausible stories in a court of law about you, making anyone a target for legal threats and jailtime and intimidation. It's already the case in more totalitarian countries, but this is about free countries where juries of peers and other systems will be subverted with clever algorithms and a mountain of data to use.

All your blockchain and anonymous transactions are stored until such time as you slip up and get deanonymized.

All you are currently relying on -- all that our legal systems are relying on -- is inefficiency of the attacker. You think they can't cross reference enough materials, analyze them deep enough, at a large enough scale, fast enough, and can't put two and two together. But the growing repository of data is there to be (quantum-cracked and) mined for information.

Ask yourself this: what would it take for a determined attacker to ruin your reputation or credit today using only the techniques in the NSA field manual? https://theintercept.com/2014/02/24/jtrig-manipulation/

While I would love to browse the web with all security and privacy features enabled and things like JavaScript disabled, it breaks too much. The middle ground between security/privacy and user experience/convenience is different for everyone.

Mozilla seems to not want to interfere with online advertising practices.

The Facebook "Like" button for starters.

Is that user-hostile? Is that important?

It's in the eye of the beholder, but if Firefox "doesn't work" for a large tranche of non-technical users, that's a big problem.

It's also not clear how much it would achieve. It's not that difficult to turn a 3rd party cookie into a 1st party one.

The future: where a remotely accessible camera/microphone now follows you into bathrooms.

Don't get me wrong... I think it is horrid and the trend is worrisome, but I haven't seen conclusive proof this is happening yet.

In the country I live it's also very popular for every store to have their own plastic card you gather points on at every purchase (e.g. for discounts or freebies). This is an easy way of matching your purchases with all the other personal information they gather.

This problem was solved in an earlier age of commerce through a Uniform Commercial Code (throughout most of the US), or equivalent statutory or case law in other domains. Essentially, contracts were reduced to a common set of standard components. Exceptions might be allowed for specific cases, including unilateral "contracts of adhesion", but these too were generally limited.

In particular, ordinary transactional terms are limited by:

1. The scope and extent of the transaction. The term is for a single purchase or transaction, not an ongoing "relationship", with few exceptions (utilities, rental agreements, subscriptions).

2. There's a limit to the data exchanged. In general, the minimum amount of data required for a transaction is what's provided. Even where personal information was taken down, it was recorded on and remained on paper forms, rarely being converted to electronic form. This is no longer the case, where, say, a license number (or a license held as surity) for, say, an hourly boat or bicycle hire might be scanned electronically, OCRd, entered into a database, and matched with other records.

3. As noted above, information one organisation gathered on you was only rarely shared with others. This is no longer the case. As my awareness of such practices has spread, I've become vastlty less interested in transactions in which I'm aware my information is being exchanged: magazine subscriptions, credit or debit card purchases, anything with an email or postal code, etc. For a good decade or more, I refused to sign electronic signature pads. I still generally balk at this.

But until terms of service are both standardised and codified with users' interests in mind, the present situation will only get worse.

In reality, the power these companies have means there is no negotiation. They are gatekeepers to nearly necessary tools to exist in society (especially for the non-tech-savvy) and they can put whatever rules they want on those gates. Your choices are to do whatever they want or walk away.

In fact, I'd posit it's a waste of time for someone who isn't a privacy attorney to read these take-it-or-leave-it-style "contracts" since you HAVE to accept them, and the only things you can argue about or discuss are provisions in the contract which are illegal or unenforceable, and that discussion happens much later in front of a judge.

The ONLY way we can protect ourselves from these abusive contracts (particularly the pervasive and rights-destroying mandatory binding arbitration clauses) is to use legislation to delete them from existence.

Nearly all tech companies try to use noncompetes to keep their employees in a brutal stranglehold and stop them from shopping around to try to earn the market value of their labor. California is where tech goes to flourish and startups abound, because noncompetes are banned there.

We need to ban mandatory binding arbitration altogether (there is no reason it should have ever been legal), and have very strict guidelines about what kinds of privacy/tech contracts are allowed -- with punishments for companies who violate, strict ones.