Hacker News Reader

Comment by ThePhysicist | Hacker News Reader

The problem is not that software developers are sleeping, it's that most users do not care much and are not willing to pay for privacy despite saying it's important for them. This might change when people actually realize what companies can and will do with their personal data and how easy it is to categorize, predict and manipulate people with only a little of their behavior data. Until then, people will just enjoy their free search engines, social networks, phone operating systems and will be content paying with their private data.

Some things are changing for the better though: Many people finally become a bit more informed about privacy, also thanks to the effort of journalists uncovering some of the biggest data scandals.

In addition, at least for EU citizens the situation should massively improve on May 25, 2018, as then the new EU data protection directive will come into force, which will significantly increase the rights of people to control how, when and by whom their data can be used. And with a maximum fine corresponding to 4 % of the worldwide revenue, companies will finally have some good incentives to be more careful with the data of their users.

View on HN

I'm a dev on a marketing team and we build all our own AdTech instead of buy products, for the most part.

The (mostly young) online paid ad guys are way more paranoid than the old conspiracy theorist hacker types I grew up around. All we do is talk about how advanced the tech around attribution is, all the data DSPs are collecting about you, etc. All of these guys seem to have an attitude where they're making a deal with the devil and they want to make as much cash as they can before retiring to some island off the grid. It's really bizarre.

Do they use any specific tools or practices to protect themselves?

There's dozens of tools around for this, but I recommend this fairly simple combination:

- uBlock Origin - just straight up blocking ads solves the problem, some lists also block other kinds of trackers, it also has an excellent advanced mode feature that can be used to whitelist

- EFF's Privacy Badger - blocks or trashes tracking cookies automatically, includes social blocking too

- HTTPS Everywhere - force SSL on with as many sites as possible

- Consider referrer control extensions too, though they may break some sites

Other tools in this field include Ghostery and Disconnect, but Ghostery has some sketchy ownership and Disconnect seemed to break random sites - plus most if not all of the stuff they catch will already be blocked between uBlock Origin with privacy lists and Privacy Badger.

I second uBlock origin and Privacy Badger, as they have (to my knowledge) no commercial interests. As OP said, many other extensions/tools actually belong -through intermediaries- to data collection companies, so they might protect you from some threats but actually spy on you as well. Ghostery allows you to opt out of their data collection though, so it seems that the tool is at least partially trustworthy.

Interesting list of tools, in that it implies browsers are the only things to be protected.

I was primarily talking about browsers because web ads were the concern - and also probably the most common way to be spyed on.

But for desktop and mobile I can't endorse enough running a software firewall with outgoing blocking and active prompting - many of these will also let your block things from injecting into other applications, adding themselves to startup, etc. XPrivacy on mobile works wonders. Outpost used to be my recommendation on Windows, but it's unfortunately dead now, so I've been running ZoneAlarm lately, which does a decent job. If someone knows something better, please let me know.

I'd like to add Self-Destructing Cookies to your list.

I believe that's similar to what Privacy Badger achieves, is it not?

Privacy Badger strips cookies from some third-party requests. SDC clears cookies (and LocalStorage) from all non-whitelisted domains after some time passes. Effectively overrides cookie expiration time globally.

Privacy Badger is made specifically to just block tracking cookies without impacting the user experience so it tends to be my recommendation. I believe it will indeed do local storage too as of 2.0 though I could be mistaken about that.

In the past I've had my browser dump everything on exit, every time I exit, but that can be a major inconvenience. SDC sounds like an interesting middle ground though.

>In the past I've had my browser dump everything on exit, every time I exit

Me too, until I realized I often leave my browser open for days and weeks, especially at work.

Ghostery has recently been aquired by Cliqz¹, which is a German company and presumably will have to abide by German law in regards to data protection.

① https://www.ghostery.com/blog/ghostery-news/ghostery-acquire...

None of them will protect you from apps on your phone listening for tracking codes in videos/sound playing elsewhere.

Yes, but XPrivacy will do that.

Those 'after me the deluge (French saying)' people are the worst. Same as rich people fucking up the globe but massively buying 'escape hatches' in New Zealand. If you're that kind of person, you should be burned at the stake.

I disagree. We are sleeping.

It's not that ordinary people don't care; it's a cost benefit problem --- the time/bullshit-costs of moving data from entrenched cloud providers is large.

The joy of hacking is that everywhere we go, we beat a path. We build good clients for bad APIs, we figure out the weird munge and consistency problems involved in data transfer, and we automate the process of managing servers. These levels of responsibility and abstraction are modern software, and the more we go there (personally and professionally), the easier it becomes for viable consumer-grade alternatives to appear.

We also set-trends more than we realize. Almost every major newspaper has a tech section, and much of that is fascination with our culture, and reflection on privacy issues.

This is on us.

The privacy problem at its core is a political one, and it needs a political solution. I think the belief that software will fix the world, which is quite common among developers, is quite problematic because it often fuels behaviour that is not always very helpful. The truth is, the overwhelming number of societal problems get solved politically, and technology is often just the means to turn political decisions into reality. This might change in the future, but so far it is true.

The data protection directive is a good example: With the political engagement of Jan Philipp Albrecht (and many others), he did more to protect peoples privacy than any hacker or software developer I could name.

So if you really wanna do something about this, don't think about how you can solve the problem using technology, but for a change think about how you can help us achieve a political solution first.

So, what laws should we propose from the IT community?

+ Ownership about your own data.

+ The right to be forgotten.

+ The right to use your own data in your way.

+ The transparency of being able to monitor who is when looking into your data.

Yes those are very good points, and they are actually contained in the EU data protection directive:

* You have the right to know exactly what a company knows about you, for which purposes it uses that information, and how it processes it.

* You have the right to revoke a company's permission to process/store your personal data, and a right to have your data erased (there are some exceptions though)

* You have the right to obtain a digital copy of all your personal data (including data that was generated through your behavior, e.g. by clicking on "Like" on Facebook) in a common machine-readable format, and also to have that data transferred to another company if you wish so (this should make it easier to change providers)

* You have the right to know (actually you even need to be told beforehand) for which purposes your data will be used and by whom it will be used. If you should be subjected to a fully-automated decision making process (e.g. your credit score gets calculated algorithmically) you have the right to know which kind of algorithms are used in the process and how their internal logic is structured.

> The privacy problem at its core is a political one, and it needs a political solution.

I'm with you --- my views are pretty much in agreement this, and with Schneier in Data and Goliath.

However, while legislation and regulation are the only things that will prevent us from full-blown monopolistic dystopia, there are meaningful ways in which technologists can make privacy preserving behaviors easier to adopt on a wide scale.

The most obvious example of this is Signal. It wasn't brought about because the government said it had to be built (though they did end up funding it), and not only has it significantly advanced the privacy of instant messaging for millions of people, and moved the Overton window on expectations of encryption, it provided a new open standard (and FOSS reference implementation) for other messaging services to adopt.

To add to that, I have found that a lot of my friends in the software developer community, who used to have the "nothing to hide, nothing to fear" mentality, are finally paying more attention to privacy related issues in light of the new administration in the States. Reminds me of what Snowden said a few years back, "Even if you trust the government today, what happens when it changes?”. I have noticed a similar phenomenon happening among my non-technical family members as well. So yes, I am totally with you that things are changing, I am excited to see how the dynamic changes in Silicon Valley for companies that used to rely on that mentality. However, I am still worried that this might just be an initial reaction to the regime change in the States and it might die down soon as people, at the very least the non-technical people, might become tired of how hard it is to use products that are privacy and "freedom" respecting and might fall back to the convenience of the products and services offered "free" but for the price of their privacy.

I can't help wonder if it is a generational memory thing.

The people doing tech now didn't grow up or live through a massive war and police states. Because those that did had insulated them from that.

It seems like we humans are incapable of learning from past events because we primarily learn by experiencing. End result is that we take the status quo for granted until it changes, boiling frog like.

It is definitely a generational and cultural thing.

For example : I feel the same way about American positivity on self driving cars, because I live in a country where people can drive on the wrong side of the road, or footpaths. Where beggars can swamp your car during a light, or where gangs distract you by tapping the back of your car.

These are cultural memory and experience.

In India, people are very pro surveillance, many believe that we have nothing to hide and those who do are likely criminals. We are only building civil liberties groups today.

Side note: apparently the boiling frog thing isn't true. If it gets hot it jumps out.

> boiling frog like

Just want to mention that the anecdote about a frog slowly being boiled alive has no foundation in reality: https://en.wikipedia.org/wiki/Boiling_frog.

To be fair, your viewpoint is quite narrow.

There are plenty people doing tech and living in police states even today.

I agree that a big share of responsibility lies with consumers not choosing privacy-minded alternatives.

I wouldn't write off software developers completely though. There likely are some who simply do what they're told without speaking up or questioning the decision, even though they know better / think differently. They stick Google Analytics on a site instead of raising the idea of using Piwik instead. Or they add Facebook and Twitter share buttons without asking whether they can be optionally loaded. Maybe they'll be shot down by a superior, or maybe the superior doesn't even care and allows the software developer to decide. Depending on the size of the software's audience, that small decision could make a substantial difference in privacy.

In my brief experience with adtech integrations it's more about costs in time and servers. Piwik takes more

When they deny you auto insurance or double your rates, because your brother living 1000 miles away looks like an alcoholic on Facebook. THEN, you'll start thinking about your privacy.

You do realize, companies are already lobbying for and soliciting access to Facebook data.

Tick tock...

P.S. I became friends with and helped out a convicted felon, this past year. Three DUI's. Their life is now back on track.

Per corporate-sought data maximalism, our Facebook friendship could cost me in terms of insurance premiums or even simple insurability, employability, perhaps my ability to get or maintain a mortgage. God knows. And that's a further part of the problem, that this is all feeding into corporate "black box" algorithms and decisions.

Maybe I start getting "enhanced screening" at every pass through an airport, because the government -- or a private/privatized screener -- is using Facebook to acquire this third party data that, so far, it's (supposedly) prevented from acquiring directly. You see, it's not just alcohol, but this person used to be into drugs.

So, do I need to rethink my whole decision to help this person? Will data domination dissuade simple kindness and decency? And that proverbial "second chance"?

Privacy. Ultimately, it strikes at the core of our society and our humanity.

A far greater threat than the ostensible threats ostensibly (um, data, please) being prevented.

Or, in the case of private business, a far greater loss than the profit supposedly being maximized.

Yes, this is not the users fault as is kind of implied by the first statement. Most users (lamen users not tech savvy) don't have/don't know know they have much choice when it comes to privacy.

That's why this has to be controlled by regulation rather than driven by market demands (which you allude to in the closing paragraph).

Does it though?

If people don't care about privacy, then government is wasting their time creating regulation that doesn't matter to people. That's not useful.

If people don't know about the privacy implications of technology, is adding regulation the best way to inform them? There are lots of organizations like EFF that are much more effective with their resources to inform people compared to government. And wouldn't it be speculative to create regulation without first determining how people feel about it?

Don't get me wrong – I think privacy is extremely important – I just don't think government can address it nearly as well as the free market, which is much more in tune with how important it is to people.

A market solution to privacy issues involves consumers making informed choices about how much information they share, which is currently relatively difficult. Companies are able to track a wide variety of information with only minimal effort to inform people or acquire consent.

Regulation could make their use of data far more visible, or even require explicit consent for different instances of tracking. This isn't holding the market back, it's enabling individuals to make more efficient decisions about which transactions they think are actually beneficial to them.

I'd actually say it's relative easy to find privacy information about a product or company. Independent researchers and organizations (like EFF) are exposing privacy violations all the time. It's oftentimes just a search away.

Case in point: Pokémon Go. It didn't take long at all before they were exposed (http://adamreeve.tumblr.com/post/147120922009/pokemon-go-is-...) for requesting full access to your Google account. The subsequent outrage caused them to take a more privacy-minded stance.

My point being, this information is and can be made available to consumers without requiring government or regulation. A whole new non-profit organization could be established that does just that: researches and publishes privacy-related data on products/companies. It could even have a program that rates and awards gold stars to those that pass their requirements, like EFF's Secure Messaging Scorecard (https://www.eff.org/node/82654).

> This isn't holding the market back...

Regulation always makes it harder for new entrants to the market, while simultaneously keeping incumbents in power (because they're often large enough to handle the time and money required to comply). And with less competition comes less choice, poorer service, and higher prices.

It sounds backwards, but not regulating privacy actually makes it easier for privacy-minded companies to enter the market and find success.

>I'd actually say it's relative easy to find privacy information about a product or company. ... It's oftentimes just a search away.

And I think that's still far too much effort to expect from people for every single company they interact with. People should not be able to give up their privacy without actively choosing to do so.

>Regulation always makes it harder for new entrants to the market, while simultaneously keeping incumbents in power ... not regulating privacy actually makes it easier for privacy-minded companies to enter the market and find success.

In order to have a competitive market for privacy, it needs to be a visible choice.

If companies can hide data gathering in the small print, it makes it hard to convince people that your product is meaningfully different. Whereas if the other company has a big notice saying "We sell your data to advertisers" and yours doesn't, it's a lot easier to sell.

Yes, the cost of compliance will marginally reduce competition overall, but competition in terms of privacy will be greatly increased because people will actually factor it into their decisions.

I must admit, this is an interesting spin on it.

Most people are not aware of the scale of this thing. And it's just getting going. I don't think people's ignorance is a good reason to not protect them. If all the companies are at it (which they are due to lack of regulation and need to compete), then what good is it informing the user. What choice do they have? It's all very well saying they can choose to not use said service/product etc, but that is tant-amount to bribery - and an unrealistic prospect. So what actually happens is people click through the T&C's grudgingly (well, the ones who understand what going on), and downwards we go.

We should not be forced into such a choice and the only way that will happen is regulation.

EDIT: then again, this will never happen, because where do you think the gov gets their information from!

If politicians think it will help them win elections, it will totally happen.

I think people are much more aware of it since Snowden. And, as with all knowledge, people have chosen to respond in different ways. Some have become much more privacy-minded and actively seek out like-minded products and companies. Others haven't because it's not that important to them, which is their prerogative.

> I don't think people's ignorance is a good reason to not protect them.

Even if there are some who are completely in the dark about privacy, this mindset would lead to regulation protecting people from literally everything, as there will always be people ignorant of something. I don't think it's the right default stance to take.

> We should not be forced into such a choice and the only way that will happen is regulation.

We have a right to privacy in the sense that we can choose not to use a product or service that invades our privacy. But we can't force our right to privacy on others.

The good news is, if there's a market for privacy-minded products, entrepreneurs will provide for that market. And I believe there is a market, because there's an increasing amount of privacy-minded alternatives.

> EDIT: then again, this will never happen, because where do you think the gov gets their information from!

Hah, this we can agree on! And I think it highlights an important point: How can we trust government to protect our privacy when they've been the biggest aggressor against our privacy?

Whilst I don't agree with all you said, indeed the problem we have as a society is that (as snowden et al have revealed), is that I cannot even trust my firmware. And if I cannot trust my firmware, what is the point of securing anything above it.

>it's that most users do not care much and are not willing to pay for privacy despite saying it's important for them.... Until then, people will just enjoy their free search engines, social networks, phone operating systems and will be content paying with their private data.

What's worse is that there are privacy-respecting alternatives available out there, all for free or close to it.

For search engines, you can use startpage.com and duckduckgo.com.

For social networks, you can use Diaspora. You might have to pay for a cheap hosting account though.

For phone operating systems, you can use LineageOS (formerly CyanogenMod).

For PC/laptop OSes, you can use Linux.

But no one wants to bother with any of these things. They'd rather use whatever's mainstream, and they're perfectly happy to post all their private information on Facebook for the whole world to see.

Mostly accurate, until you say ' "they'd rather use whatever's mainstream"

Ignoring that the options people do choose are vastly more capable, usable, convenient, reliable, supported, etc, than any of the options that would protect their privacy.

People are making tradeoff, but it has nothing to do with what is 'mainstream'. The mainstream choices are mainstream because they offer tremendous value in comparison to the privacy preserving alternatives.

Excepting the dimension of privacy, none of those alternatives are as useful or capable as their mainstream competition.

After switching to DuckDuckGo from Google completely more than a year ago, I have to say it's quite good. Bangs (https://duckduckgo.com/bang) are particularly useful.

Are the results as good? Probably not. But there's always a trade-off we make when choosing our tools. It's not always about choosing the one with the most features or the one that's most popular. Sometimes ideology matters, and I'd say that's the case for many who choose a search engine like DuckDuckGo over Google. I'm more than happy to trade not-quite-as-good search results for privacy – and I know that the more people who do, the better those search results will become.

Naturally. Respecting user privacy hinders your ability to enhance and monetize your products efficiently.

> For PC/Laptop OSes, you can use Linux

How many people who had no relationship with a university have you gotten set up on Linux? There is a solid chunk of people that just cannot afford the cost of running Linux once you take into account the risk of having to spend a bunch of time mucking about with your package manager or something else with a high cognitive cost.

Granted, I switched from OSX to Ubuntu back in 2013.

This is total BS. I've set up two friends with Linux Mint machines; one is elderly and the other middle-aged and not a techie at all. Both of them are quite happy with them because they never have any problems, and I almost never have to even answer any questions. I did give them each a 15-minute orientation course beforehand, but considering that KDE works a lot like Windows (before the whole Win8/Metro debacle), it wasn't hard for them to adapt. WhyTF would they need to "muck around with a package manager"? And how is that harder then messing around with Windows' total mess of "installers" which don't do proper package management at all? In fact, Linux package management is superbly easy: just open up the software center, search for whatever you want, select something, read the description, and click "install" and type in your password. How is that hard? It's sure a lot easier than looking for random software on random webpages and worrying about it having malware baked-in like most Windows software on places like download.com.

Mucking with software installation without a package manager may be even harder sometimes.

A curated app store, akin to a Linux distro repository, is what's missing from Windows experience of many people.

But if you want AAA games, Windows is usually the easiest, or the only, platform. :(

I think these are really not viable options for most people.

Social networks? How to persuade people to join the better alternatives when all their relatives and friends use the popular ones?

Devices? Most people do not want or need a desktop or a laptop these days. Smartphones are much more convenient and easier to use.

Alternative phone operating systems work well on very few of these devices and the installation procedure is rather harrowing. Might completely brick your phone if you don't know what you're doing, who wants to take that risk?

Those that do need a proper computer probably prefer compatibility with everyone else, and that means they will not run Linux.

Search engines? People would rather trust and use Google or whatever because DuckDuckGo looks and sounds like it's made for five-year-old kids. Startpage.com is spewing stuff about goverment spying and hacking on the front page.

Reply on news.ycombinator.com