Hacker News Reader

Comment by kypro | Hacker News Reader

> I'm more concerned about Google using AI to mine every conversation I've ever had or my browsing history to classify me as a dissiden before I apply for a visa to travel to China or the United States, or as a deadbeat before I apply for a bank loan, or sick before I apply for insurance, or as unrehabilitatable before I apply for parole.

I'm quite paranoid about this, yet whenever I speak to people about it either people don't care, or already accept it's happening and inevitable.

I think part of the problem is many of us already feel we've lost the battle for privacy. Although, I'm not sure we ever seriously attempted to fight for it. Every street in cities in the UK is full CCTV cameras. The underground and buses track where you travel. Our internet is monitored and logged. This isn't a future problem that will manifest from greed and advances in AI, it's something we all accept and deal with today.

In fact, a lot of people will say to this, "if you don't do anything wrong you've got nothing to hide". They welcome it.

View on HN

already accept it's happening and inevitable

I've almost given up. I'm pretty much despondent at this point.

There is a booth on my way to work where they give out free Lays chips in exchange for your photo. The gimmick is that it's like a photo booth. I asked the attendant to read the privacy policy, and it's frightening, to say the least. I have no doubt that they are contracting with some AI consultant to be able to identify your face in the crowd and link it to your email address, which of course can be used to identify you freely on the Internet.

People are freely giving away their identities and their rights for a free bag of potato chips.

I always try to make sure my face is covered when I walk by it, but I can't help but despair a little when I realize that I am still surrounded by security cameras. At least one would hope that the MTA police are too busy or understaffed to do anything malicious with my face.

Have you ever stood in line for passport/ID control at an airport or anywhere else any time in the past decade? If yes, that government's security and intelligence services (and anyone they share data with) have enough video frames of your your face to build a high fidelity facial recognition model. And it's linked to your name, nationality and passport number.

Yes, unfortunately. No need to dig myself any deeper.

That doesn't make it ok!

Two wrongs don't make a right. Just because one party is doing it, doesn't mean we want everyone doing it, or even that we wanted it to ever happen at all.

That’s bad, but it’s not to exploit influence over you for profit.

I recently noticed when coming back through UK passport/ID control that there are now boxes hanging from the ceiling in the waiting area, I assume to scoop up IMSI's/Wifi/Bluetooth/NFC MAC addresses from phones and tablets. All tied to passport/facial biometrics presumably.

Is simply turning off your device while there a solution? Asking as someone who may travel to the UK and EU this year.

I'm speculating, you could try asking GCHQ. With SDRs so compact and cheap these days the chances are high that they are installed in such places as airports and train stations. It is fairly safe to assume that turning things off should prevent most data leakage, but for the truly paranoid you would have to remove all the sewn RFID tags from your clothes and not carry contactless enabled cards.

No, there are stealth SMS messages and your baseband processor is receiving/answering them even when phone is off but battery is inside.

https://github.com/CellularPrivacy/Android-IMSI-Catcher-Dete...

They probably also have enough to generate a DeepFake if they want. Can't wait for the next big incident to involve that...

Haven't they had your passport photo on file, like, forever? Probably since before digital archives even existed. The USA is a bit different in this regard, but every country with a national ID (i.e. most of the world) has your face linked to your name, nationality and document number, that's how ID works, it gives an ability to identify people.

It's the same as the Microsoft "How old are you?" and Google "What painting do you look like?" apps. People don't think about what's going on behind something that seems trivial.

In Microsoft's case, my guess is that it was just a research experiment. It worked pretty well on a few family photos I threw at it.

I think that the site is not even working anymore. Anyways, they said they were not keeping the images, and I have no reason to doubt it.

It's a pity that Microsoft is going only after the corporate market, Oracle style, and not trying to make money from consumers any more. That leaves Apple as about the only big independent player in that field. We could have benefited from the competition.

Anecdotally, Google Opinion Rewards first question was whether or not I supported the UN. I immediately deleted the app.

Somebody, probably a political organization, ran an opinion poll on the UN and got anonymized aggregated results. What part of that made you delete the app? If you get a political phone survey, will you unplug your phone?

You say MTA, so is this booth in NYC? Where exactly is this Lay's spying machine so I can steer clear.

Those of us with the munchies also want to know the location of this snack dispensing machine.

Tunnel between the Fulton St transit center and the Oculus.

The "best" part is how good an AI would be at privilege escalation. Go ahead, build out that security camera network, automate your cars, store your money using cryptography. I'm a geek and I love the way technology increases our collective prosperity, but most of our security relies on the attackers being approximately as smart as any other human. To a sufficiently capable intelligence, encrypted machine code is just as understandable as the most elegant source code. Once you fully understand something, anticipated edge cases are easy to find and exploit... every day we expand the capabilities of a future strong AI.

this comment is incoherent

My takeaway/TL;DR: OpSec is harder vs. AI (ever-vigilant pattern matching) than humans.

But it did drift into discussing a more offensive AI than passive monitoring done today.

How many sentences is TL these days? But yes, this is an offensive AI, and no, we aren’t passive-only today - look at the IoT botnets.

Why? It's pretty simple, if we computerize everything a future AI is going to have more leverage over the world. If you believe Cory Doctorow when he says that everything is a computer, then everything is vulnerable to future AI.

To a sufficiently capable intelligence, encrypted machine code is just as understandable as the most elegant source code.

Depends on what you mean by "sufficiently" and "encrypted"!

I'm not an expert, but my guess is these are still truly difficult, deep unsolved questions... We don't even know yet if one-way functions exist; and existing modes of analysis increasingly seem insufficient to fully account for the apparent recent successes of this last wave of 'AI' on ostensibly non-convex optimization problems! (Not to mention the debates about the possibility of fundamental physical/computational complexity limits to intelligence explosion, and so forth...)

So who knows at this point; but I think it is still an open question whether a future AI could reasonably 'break' even today's commodity encryption.

The problem is that we don’t know whether our encryption is vulnerable to advanced attacks. Cryptographic hash functions actually have a useful lifespan based on the math and the cost of computing. The more time we spend analyzing the math, the more likely we are to find unexpected weaknesses.

http://valerieaurora.org/hash.html

"Kuang Grade Mark Eleven did the Times ICE like a hot titanium wire through a cube of chilled petroleum jelly," smirked the Finn.

It depends on the rate of improvement of AI and what the intrinsic strength of defence is against attack. Arguably, security will start incorporating AI techniques, and by the time AI attackers surpass human capability, AI defenders would likely be too strong for humans, and quite possibly strong enough to hold against a higher intelligence.

>I'm quite paranoid about this, yet whenever I speak to people about it either people don't care, or already accept it's happening and inevitable.

Most people have no mental capacity to imagine the consequences of someone misusing their private information until either it happens to them or they see it happening in some specific scenario.

What bothers me is that everyone is being carefully conditioned to misplace the blame. Person A meticulously constructs a system designed to screw you over. They willfully neglect its security for years. Then person B comes along, pushes a button and triggers the system. These days 99% of the blame somehow goes towards person B. (Evil Hackers, or that one employee who forgot to install some update, or whatever.) Mass media is totally on-board with this kind of crap.

By the way, the same applies to AI "threat". Should we worry about AI overtaking all the world's smart toasters and simultaneously overloading the to cause mass fires? Or should we worry about the fact that those toasters somehow have processors, are Internet-enabled and run shit software?

* * *

Also, "the battle for privacy" is a bad mental model. There is no single battle you win or loose. It's a gradient. The more information you leak, the worse off you are in the long run.

> In fact, a lot of people will say to this, "if you don't do anything wrong you've got nothing to hide". They welcome it.

Weird that those people want their poops and bedtime routines live on TV globally. Having something private is not bad and anyone who thinks so hasn't taken a second to think about it.

I think the extra dangerous thing here is propaganda along with the AI to convince everyone it is okay, and I'd say that is already happening, as your comment describes.

Aside from electing responsible people to government in order to pass regulations, what can a regular person do to change the profit incentives at scale of the companies who are building the mass surveillance systems? It seems a dire and impossible situation.

> Aside from electing responsible people to government in order to pass regulations, what can a regular person do to change the profit incentives at scale of the companies who are building the mass surveillance systems? It seems a dire and impossible situation.

There's no need to be so fatalistic. The EU is about to enact GDPR; a huge privacy preserving peice of legislation. It seems like the large technology companies are going to give the same protections globally (verification is too much fuss). This is a huge win, and US citizens get it for 'free'.

Here are some ideas for more productive things than despairing on Hacker News:

- Vote with your neurons. Stop using services that you find objectionable, even if you enjoy them.

- Stay abreast of issues via organizations like the EFF, EPIC and the FSF in the US; ORG, Privacy International and FSFE in the UK, etc. Send them your cold hard cash.

- Speak to your representatives, and give them your angle. If they're being paid by the organizations you're worried about, tell them politely what you think of this.

- Socially, as charmingly as possible, let people know what you think about surveillance if it comes up. It's a fun one if framed correctly, as it doesn't divide down left/right lines, and no-one likes to sound authoritarian. Offer help and expertise to people who are wishing to make privacy preserving changes (e.g. move off gmail, set up a pseudonym, configure a VPN, etc.)

> ... feel we've lost the battle for privacy.

I agree with pretty much all of the concerns you and many others have cited, and I worry about that stuff too. On the other hand, I think about the past. How much privacy did most humans have in history?

To be clear: I'm nothing like an expert on these topics.

I'm specifically not considering the wandering nomad types. I think that the vast majority of all humans who have existed lived in fairly insular communities.

So you're a member of a small town where most adults and kids work in agriculture in order to survive. The building you live in is crowded, and not just with immediate family. You sleep in the same room as a number of other people.

What privacy do you have? Cross talk/gossip moves very quickly and is pervasive. I believe if any member of this community does anything out of the norm, every member will very quickly find out about it.

I also think that most any deviance from the norm was met with, at best, suspicion.

Are you free to leave and do your own thing? Sure, but isn't that quite risky? Maybe you could join another community...maybe. But the privacy situation remains the same.

Excluding the romantic but minority cases of hearty frontier settler, and the like, I don't think humans have enjoyed much privacy at all, ever.

I'll say it again: I'm an amateur at best in these topics.

Isn't it basic human nature to, on average, form gossipy, minimally private communities?

I'm not forgetting the enormous differences between what I just described, whether it be accurate or not, and what's happening today with technology.

I'm just thinking that, perhaps, only a small percentage of all humans in history have enjoyed anything like real privacy.

PS: I'd love to receive clarifications/corrections on this from more knowledgeable folk.

But the consolidation of energy (capital) and influence that allows corporate organisms to drive the "norm" has not been practiced on the scale of billions of users. "privacy" seems to be somewhat synonymous with, "finding a viable existence in parallel with the existing system." With massive-scale ability to automate who is within a norm or outside of it, avoiding an arbitrarily defined norm becomes un-viable.

One huge difference is that information to a large degree would stay within these communities. Gossip was inherently limited by the bandwidth of the jungle telegraph. What's scary now, however, is anyone can publish any information about you, tag it to your face, and now everyone walking past you could theoretically face-search you to see any gossip about you. Before you could travel someplace else, should you do something that required it. Now you can't go anywhere.

In earlier times you could travel somewhere else and try the same thing again, one side-effect of which was the proliferation of serial scammers.

For a good person, in a sense that covers most people, having your past reputation follow you around is a benefit, the ability to wipe out reputation only benefits those with negative reputation. Furthermore, if there's a general assumption that it will follow you around, it acts as a deterrent to avoid doing immoral things, since you won't be able to easily walk away from that.

The obvious limitation to "anyone can publish any information about you, tag it to your face" is the well-established concept of libel. Publishing false harmful information is already forbidden, but they should be able to "warn the world" if the information is truthful.

I think asymmetry plays a role here. In communities as you describe the amount of information I have is roughly equivalent to the amount of information you have.

The amount of data Google has and the amount of data a government will have gives an order of magnitude advantage to whoever gets to harness it.

Beyond that, it's a power asymmetry as well.

If you have to collect info on someone "the old fashioned way" (like being siblings with them or marrying them) the power differential in the relationship is bounded by definition. To me, privacy is almost like a vector with two components—the level of privacy, plus the degree of intimacy of the relationship.

Lots of people care about this. I think the solution is to produce policy papers about this risk complete with proposals for how to go about curtailing those kinds of abuses. The EU still cares a lot about privacy, and other government bodies are happy to help if you can suggest how.

> ...and other government bodies are happy to help if you can suggest how.

Ah, you mean like the US punishing the company that leaked one out of every two social security numbers of its citizens? Or China, a country worldly-known for the Great Firewall? Or Russia, in which you either hand out data about your customers to the government, or your business fails?

I mean, the EU's actually giving a shit about their citizens' privacy, but they are pretty lonely in that fight. My country (bordering EU) doesn't give a shit, and neither does Serbia, a country that's supposed to join the EU in the next decade (yeah, I know, wishful thinking).

Even if you live in a so-called democracy, chances are that you can make exactly 0 effect. And there are all sorts of other problems which have much higher priority. FFS, I can't run to be a president of my own country. It's in our constitution that you have to declare yourself as a member of one out of three ethnicities just to be eligible to run. The country lost three cases in the European Court of Human Rights because of this and similar fuckups in our constitution, oldest of which will be a decade old next year, and our constitution is still unchanged.

I truly do care about my own privacy and about my citizen's privacy. Yet, if I decided to advocate for certain things inside my own country to make it better, I would have at least three problems much higher in my agenda than online privacy.

You have to be strategic if your country doesn't care, but the first step is to create the intellectual edifice activists in the future will lean against. Also even as someone not in your country, I would still enjoy reading any writing on this.

>In fact, a lot of people will say to this, "if you don't do anything wrong you've got nothing to hide". They welcome it.

The usual rebuttal I see to this mindset is "well, there's so many laws out there you're bound to accidentally incriminate yourself for something minor".

Is that the real concern here? Are people more concerned with autonomous monitoring itself, or the potential outcomes/implications that come with it? I'd love to understand this mindset. (As an aside, I've always advocated for modernizing/reforming laws so that doesn't happen, instead of blaming news tools that help law enforcement do its job.)

I think we can agree there is some amount of potential benefit of this kind of pervasive monitoring (right?). I also think we can all agree there are potential downsides as well. In an ideal world, I would think we'd take an approach that minimizes the downsides while maximizing the upsides, but if people are actually taking concern with the loss of privacy to autonomous programming (i.e. non-humans), I have no idea how to measure how "good" such a system is.

(As an additional aside, there's obviously potential for misuse by human actors, but that seems like a separate issue to tackle as well: everything has potential for misuse, and needs the proper precautions and safeguards put in place to ensure it isn't misused.)

I will have lost my battle for privacy when I am six feet underground or in a straitjacket, and not a moment before. We can NOT accept defeat.

>a lot of people will say to this, "if you don't do anything wrong you've got nothing to hide"

That kind of assumes legally OK is everywhere and always the same as ethical, morally OK. Which is I guess easy to do, until life teaches you personally that there's a wide gulf between the two.

"You measure democracy by the freedom it gives its dissidents, not the freedom it gives its assimilated conformists." - Abbie Hoffman

> I'm quite paranoid about this, yet whenever I speak to people about it either people don't care, or already accept it's happening and inevitable.

I have yet to see much in the way of concrete harms from the supposed privacy issues plaguing online advertising. Everyone has a favorite hypothetical situation where Google dobs you in to the Chinese government, but no evidence that anything of the sort is actually happening.

Here's a simple one that you can try at home. This isn't one of those 'the facebook app listens to me' privacy breaches, it's more concrete and provable. Take a friend you haven't talked to in a couple of years, and start chatting with them over WhatsApp. After some days of this, go to your Facebook feed and watch how their posts now appear prominently, even though they didn't before you started chatting.

This is simple and harmless, but this same information has other uses that are not so harmless. They may not be being used right now, but they may start to be used in the future

My point is specifically that these things are harmless, and everything else is purely in people's imaginations.

The problem manifests in different ways though. I'm not so concerned about obvious violations of privacy like the one you mentioned, because it's so obvious that they are wrong.

Let's say you tweet some anti-American stuff from time to time and the US government decides they want you to stop. They probably won't put a bullet in your head, but they might dig up information on you and arrest you for something totally unrelated.

This happens already. It doesn't really matter what you think of them, but people like Martin Shkreli in the US and Tommy Robinson in the UK were obviously targeted by the state because they didn't like what they were doing. They dug up information and they got them on something unrelated.

AI and tech gives governments the ability to do this to new levels. They might crash your self-driving car, or they might cause your smart-TV to catch fire while your in bed, and no one would know. We'd all carry on believing surveillance is in the interest of our safety.

Martin Shkreli wasn't targeted by the government for prosecution. Shkreli got the max sentence for a crime he committed because he was out spoken about how he was not remorseful his crimes, nor did he show any capacity to even understand the seriousness of his actions. He also encouraged others to commit crimes for him during his sentencing. Judicial discretion isn't always perfect, but enforcing the max on an obvious danger to society was the correct course of action in his case.

I'm not arguing this. My point is simply that they wouldn't have gone after him if he didn't surrounded himself in controversy. What he did happens all the time, but unlike many others his outspokenness exposed the corruption and greed which occurs daily in our economic system.

I think that really only becomes an issue in countries where there are laws passed that contradict each other and to get anything meaningful done you have to break laws and/or give bribes. At any time someone can come after you because you had to break some laws in the course of everyday business whether you wanted to or not.

Joe Nacchio [0] is a better example than Shkreli. Convicted of insider trading, allegedly in retaliation for his refusal to give customer data to the NSA.

[0] https://en.wikipedia.org/wiki/Joseph_Nacchio

> I have yet to see much in the way of concrete harms from the supposed privacy issues plaguing online advertising.

I haven't heard of nation-state level repercussions but the persistent profiling has already bitten a few people in the ass, such as the case where Target's profiling of a teenaged girl and their subsequent marketing betrayed her pregnancy status to her parents.

Nothing bad so far... For example there's a lot of homophobic people out in the world, right? Now let's assume this article, https://osf.io/zn79k/, is correct in it's conclusions and boom, you've got machines that could potentially discriminate based on the CCTV footage of the building you entered for a job interview. This is just the start, scientists are heavily looking for those genes that make people smart, more prone to diseases, creating an AI that based on your genes determines if you're fit for high school even is seriously dystopic.

So far every single reply to my comment was about how things could go bad, without anything currently bad.

In the presence of all the tracking that people rail against, there are so few actual harms that everyone invents an issue.

I think this is telling.

I think this is telling that you don't understand what "risk" is. Do you allow random people into your home? They most likely have not done anything bad, until they do.

let me just call up the director of CIA and ask how frequently they use facial recognition technology to identify drone-strike targets in crowds.

Institutions have a long life. All the data collected today, too, will have an extremely long life. I am sure German Jews thought the census records, tax returns, synagogue membership lists, parish records that identified them as Jewish were harmless as well - until they weren't.

Suggesting that, amongst numerous possible scenarios of abuse, if there is nothing happening now then it has absolutely no potential for harm is an overwhelmingly ignorant position. Not to mention, the public would have absolutely no idea of such abuses even if they were happening.

But to actually answer your question, here is mobile malware [1] found by the lookout team that used 3 different vulnerabilities to complete compromise an iPhone all through a link opened in Safari. This allowed for applications that encrypt messages in transit, but not at rest on the device, to be compromised. Foreign governments used this malware to target investigative journalist and activists.

[1] https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegas...

Well, the good news is that fossil fuels will run out soon and then we'll all be too busy dying of looting and starvation while old datacenters are used by local warlords as death mazes for entertainment.

Reply on news.ycombinator.com