Hacker News Reader

I see many people argue that fighting for privacy is a lost cause. That it'd take too much effort to reverse current trends.

I think that you and others are too cynical, although I agree that it might become worse before it gets any better. If we look at history we can see that other societies had the will, if not the means, to engage in data mining on the scale that ours does through the internet and massive analysis through machine learning/statistics. The Stasi is an example of an organization that certainly displayed the will to violate privacy as much as possible.

But it also becomes apparent that the privacy violating priorities of those organizations and societies can change, in an almost Hegelian dialectic manner, to protecting privacy. These days counter culture is still going strong in Germany, relative to other parts of Europe. People that belong to a counter culture will resist tools that exert control over them, such as extensive surveillance, by definition. This is in addition to the fact that Germany is more privacy friendly than most of its European neighbours.

Things can and do change over time. Through history a pendulum swings from one extreme to another. We just need to wait until something goes horrendously wrong with the way our privacy is currently being violated before it starts to swing in the other direction.

I think privacy feelings are often misplaced. Using the internet may feel private, but it's like setting up a giant antenna on your roof and using radio to chat with someone else.

IMO, the fight should focus on things like secretly turning on the microphone on your internet connected device (cellphone etc) and listing in. That's the kind of situation where we could get useful long term precedent and most people would agree with the intent.

Because, if we are not careful that can quietly change and AI will make listing to every conversation anyone has in the county a real possibility.

I always found it crazy that they didn't carry over the hardware "recording" LED to cellphone cameras. I'd really like to see that become a thing, and maybe another LED for the microphone, wired into the circuit so that the camera and/or microphone cannot be in use without the LED lighting up. I'd basically like a row of status LEDs like an old Thinkpad for monitoring all systems on my devices.

Conversely surreptious cellphone camera use is also a big defense against police abuse of power.

Not sure I'd want to be unable to mask the camera and mic being active either.

i assume the LEDs suggested by the parent are for the protection of the device's owner.

for your use case, you might consider tape that's the same color as the material surrounding the light. though, that'd be a huge inconvenience to apply in the heat of the moment, and it'd somewhat defeat the purpose of an easy indicator if you had to peel it back every time you wanted to check the light. though... you might also worry about recording when it's in your pocket, in which case you'd still have to pull it out to look at it.

i know that police will often try to interfere with recording despite the legal precedents, but it seems pretty well accepted at this point that recording police activity is completely lawful as long as you're not interfering with said activity. again, i know police have blatantly disregarded that in practice, but it's something.

oh, another low tech option for surreptitious recording: finger over the light. still gotta remember to do it, but again, it's something.

Presumably the status lights would face the user, so unless you're filming the cops with the front-facing camera, they won't be able to see them.

Discreet hardware switch?

Yeah, this is what I want for my money if I'm expected to drop $999 on a cell phone.

I'll note that those are soft switches at least as far back as the T510, because installing Windows 10 disabled the microphone mute button.

> Because, if we are not careful that can quietly change and AI will make listing to every conversation anyone has in the county a real possibility.

Are we sure mass recording isn't already happening? It wasn't that long ago that the idea of bulk metadata collection was thought of as tinfoil hat material by many.

That's pretty trivial to detect by inspecting network traffic. Although perhaps we should make those kind of monitors easier to use and much better UX.

how many people can inspect network traffic on any given device? I don't think that's even a common skill among software developers unless you have a devops/IT focus, much less the entire populace

It is pretty common amongst System/Network engineers though. Modify a few switch configurations and setup a sniffer.

There are quite a few ways to do it.

I expect my android phone exchanges encrypted information with google for updates and other purposes. How would I know if it slipped some other information into one of the encrypted transmissions?

You could try something like TaintDroid. Marks data on your phone with a tag that is detected if said data is transmitted off the device without first being encrypted. Disclaimer: haven't personally tried it yet, but that's the general concept.

This doesn't address the concern that my phone, which Google has a large degree of control over, can leak my data to Google without me being able to detect it. As far as I can tell there is no way for me to use Google Play Services and have any assurance of privacy from Google.

One datapoint from a decade ago is Room 641A:

https://en.wikipedia.org/wiki/Room_641A

The biggest problem is when you combine intrusive massive surveillance with a ultra-powerful entity that can be capricious, malicious, and often abuses and punishes its underlings.

I am not so worried about that as I am about the cost. Consider: You could always get the dirt on someone if you were willing to drop a few grand on a private dick. That created a bit of friction - you had to really want to get at that person. But what if you can get all the dirt you could ever use for just $1, or some trivial cost? Someone so inclined could go on a fishing expedition on a whim. Your HR department could routinely do everyone in the company, and every supplier and customer, because why not? That's the way this will be weaponized.

Enabling the average worker to take risks like searching for a better job or maybe even starting a company of their own (if they can argue the business model to a funding entity or have sufficient savings or grant incentives) is the proper way of defusing that power.

Everyone should have access to quality healthcare (as a birth/emigration right); tax everyone, single payer (the government) negotiates with doctors in an area for the best price; everyone that needs a service done picks from among the open local doctors and just gets treated. No secondary bills, no annoying billing department, just treatment.

Second would be to actually have a national ID, and among other things, to have (an abstracted) public shipping address for registered mail to reach that person. First Class (normal post) would be able to lookup the address as part of the service. Anyone could thus mail to #NATIONALID# and not need to worry about where someone has moved or re-located.

Third is enforcing market competition for basic supplies (of all kinds, but I'll focus on housing since that's a major concern on HN). This would mean that if there isn't enough housing in an area people want to be, more would be encouraged, and if that isn't enough to match demand special arrangements would be called for to do things like buy out whole neighborhoods (at once) at something like 2-5 times current market value per unit and re-develop an area to a correctly targeted density.

It doesn't need to even be a #nationalid#. It could be like an email address you register with USPS.

Even better would be unlimited aliases to your national id where only you and USPS know who the alias points to (unless, of course, you tell someone else yourself).

Corporate surveillance is, in my life, a bigger deal than government surveillance.

I think Zeynep Tufekci described the situation really well with the title of her recent Ted Talk: "We're building a dystopia just to make people click on ads".

I don't think it makes sense to separate those two... if that data is collected by a third party and made available for sale, the government can buy it too.

Most people, myself included, wouldn't survive if directly targeted by the government - so I exclude them from my threat model. But I do hope that being wary of commercial surveillance will at least reduce the footprint I leave behind.

    > I think we have already lost the
    > battle over data mining

Who is we? GDPR comes into force in 6 months' time: https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

Really? In a lot of cases, we give our consent for our data to be processed, and the terms of which - do you really think, even with a more up front disclosure statement and post-process record keeping, that for most people it'll have a large impact on data from opted-in networks? And the subsequent (consented) use of it in all manner of ways?

It's not a combative question - I'm genuinely interested as to whether I've misinterpreted GDPR requirements or not? From what I've seen, as a lot of personal data is willingly traded by people, and the greyness around "legitimate interests" of the controller, the landscape wont look massively different (just perhaps a more invasive privacy notice on first visit?)

I think I have a slightly different perspective, from various business dealings I have.

Firstly, I am elbow deep in the recruitment sector, and GDPR is a Major Fucking Deal for everyone. Software companies in the recruitment space are spending a huge amount of time and treasure making sure they are on top of the game for GDPR. Recruitment consultancies are too. The industry is taking it super seriously. Recruitment is (amazingly, and contrary to what people tend to believe) generally pretty good about this sort of stuff (with almost all shady shit coming from individual recruiters with too little oversight), so maybe the industry is over-reacting, but I don't think so.

Secondly, I am pretty aware of a lot of shady internet marketing and retargetting type shit. I don't know how that industry is reacting because I'm not close enough, but I'm pretty sure they should be in a panic if they're not.

The law as I understand it will make it difficult for companies to use catch-all privacy policies without being specific, and companies will have to make an explicit case for -- for example -- reselling your data to advertising companies if that's not explicitly what you signed up for.

Funnily enough, I work in recruitment marketing and do quite a lot with programmatic targeting and retargeting so am close to it too.

One of the benefits of recruitment is we tend to have a lot of touchpoints to gather informed consent, whether through the points in an ATS, expressions of interest, candidate contact and follow ups.

It's serious, don't get me wrong, but I think given the grey areas in definitions that there are (and the rationales developed for collecting information in the first place), if you're a responsible data controller in the first place, the impact will only be felt in a few ways.

For the purposes of advertising, it's always been sketchy to "sell" data to an ad company. Most of the time it's owned data passed along and processed by them on behalf of the original acquirer (something comparatively easy to get consent for, because it also ties into personalisation) for retargeting. Initial targeting is going to be the hard part, as the right to be forgotten is going to be hard to manage across multiple DSPs.

Analytics is going to be a *, as we'll need to delay any analytics firing until someone's opted in, but this will become blind after a while once someone's opted in or out. Persisting this option will, perversely, mean having to store more personal data around choices, but hey ho.

An approach we can take on an individual level is to be mindful of the data we are giving up. If you are employed and in the process of job hunting, then stop "liking" the article headlined "10 Reasons why you deserve better from your company".

This is giving in to surveillance: allowing it to define what you are allowed to say and do.

It is also not feasible. Sure, you can stop doing that, but there are millions of other 'tells' that you will give up through your actions online that can predict this information. Machine learning will pick up features you cannot control or even imagine that will accurately predict whether or not you are on the job hunt, no matter what you do to hide it short of just disconnecting from the Internet. Which is likely a tell itself.

That's just acquiescing to surveillance. That's not a solution.

Surveillance capitalism and government spying on the populace (enabled by the former) has gone far enough, to acquiesce to a degree like that is to give them an inch, and if you give them an inch, they will take a mile and we'll be back to where we started.

I call BS on the comments that say doing what you suggest is giving up... To me, "Liking" something implies expressing your opinion publicly, probably via Facebook. When I receive a job application, the first thing I do is check to see what the person has publicly posted. That's not surveillance. Before the general population starts to worry about surveillance, they need to think about the public image they are portraying online. I can't hire someone who posts stupid shit publicly. It could damage my business if my clients look them up.

That's not surveillance

Yes it is. No less than if you got their postal address from their CV, parked outside their house and watched who came and went. After all they volunteered their details and the street outside their house is public... right?

I mean, it is clearly "less" isn't it?

This continuum fallacy stuff really just makes privacy advocates look like kooks.

You have to use the language other people use if you want to convince them, and normal people do not draw an equivalence between someone googling their name, and someone staking out their house, because there is an ocean between them.

This continuum fallacy stuff really just makes privacy advocates look like kooks

You've clearly not read the article, in which a judge says that planting a tracking device on a car is materially different than tailing it.

As a non-USAian, I would suggest that USAians take the approach of referring to the FBI and its ilk as the Gestapo, KGB or the Stasi (or any other well known like group). Keep the references up and you might just see some changes.

It's possible it won't make changes but, hey, ya neva no wot can appen.

As a fellow non-USAian, I don't think it's helpful to equate US law enforcement agencies with Nazis and Communists.

The FBI is nowhere near as evil an organisation as the Gestapo, the NKVD, and so on. Using Nazi allegories all the time limits your ability to escalate rhetoric when they actually do something Nazi-like.

I think referring to the FBI as "the KGB" or "the Gestapo" would be counterproductive, making it harder for open-minded friends and family to hear valid concerns, and more likely that they just roll their eyes and tune us out -- similar to the effect of the euphemism "non-USAian" on this non-nonUSAian.

I stopped reading when I reached "USAian". What a stupid term.

> I think we have already lost the battle over data mining. It is happening, and will continue to happen and it seems to me there is really nothing we can do short of drastically restructuring the entire Internet.

Let's say we've lost so far, but certainly we can change. Europe, for example, has much stronger protections than the U.S. Laws cleaned up the environment in cities, brought a revolution in civil rights to billions .... certainly we can provide privacy to end users if we put our minds to it. (I'm not saying it will be easy.)

What do you mean lost? I deleted my linked in over a year ago when I learned about them selling my data to recruiters and it being used to assess my likelihood of leaving a job.

a boss only has power over you so far as you're being paid to act on behalf of the company, and that's the proper power you should have when you need to run a company, clearly having employees be able to harness some law and create a kind of capture on the employer wouldn't be ideal

you could end up with job seekers that are just seeding for predatory lawsuits, or people end up squatting on a company to get whatever they can regardless of what cost/value impact they are having on the company, terrible for both businesses and competitive job seekers alike

even if they made a law that says "you can't fire people for things discovered using data mining" you now run into the situation of having to provide some reason for firing someone, which is a messy situation, because you shouldn't need to provide proof or reasoning for no longer wanting to work with someone, it would make it dangerous to work with anyone that showed any potential risk for making things difficult, and we don't want to make it more risky and expensive for people to get jobs

>a boss only has power over you so far as you're being paid to act on behalf of the company

This is obviously untrue. You can be fired for any reason, anytime. Whether what you're doing is at work or not. Your boss can see you at a protest and fire you. Your boss can call you at 2am on your personal line and fire you if you don't pick up the phone. Your boss can fire you for not liking the right music or restaurants, or for refusing to go to certain parties (it's just not a good culture fit).

> clearly having employees be able to harness some law and create a kind of capture on the employer wouldn't be ideal

No, it wouldn't be ideal, but it would be very, very good. Asking for something ideal is a little Utopian, so I'll take the massive improvement you are suggesting.

>people end up squatting on a company to get whatever they can regardless of what cost/value impact they are having on the company

You have just described most bosses and corporate owners.

>you now run into the situation of having to provide some reason for firing someone, which is a messy situation, because you shouldn't need to provide proof or reasoning for no longer wanting to work with someone

This is how it works in nearly every developed country in the world, and how it used to work in the US. It works just fine. There is no need to give bosses ultimate complete power over all aspects of their employee's lives. There is no reasonable justification for it I have ever seen except ideological devotion to the unquestioned authority and power of the wealthy.

I don't know how many times I say it, but I'm glad I don't live in a country where somebody would think it acceptable to fire somebody for the type of music they like. I know you are joking, but even the fact that you think this is in any way acceptable implies that you are happy with the situation.

I so no joke there.

I believe the paragraph you are referring to was a statement of fact, not an approbation. I've read it as: "here's what US employers can do, and why it sucks big time".

At the same time, I feel that a boss should not be able to deprive someone of their livelihood on a whim. I feel there should be an actual reason why the person is being fired.

Absolutely. Privacy is basically security through obscurity. It's never going to stop a malicious government or even employer. We need better mechanisms to prevent such entities from becoming malicious in the first place.

Privacy is more than just security. It's about being able to act freely without being judged and controlling one's personhood.