Hacker News Reader

Comment by Hnrobert42 | Hacker News Reader

How is it a secret?

i've been trying to explain this to my wife for a while and struggle with it lol. I get all grumpy and oldman like during tech commercials nowadays saying "pssh that isnt AI!". The other idea that is hard to comprehend is just how much data people have. They most likely dont really know what a 'data center' is and the scale of it. They dont see all of the apps/programs we use like we do, it is magic to them and the consumers are constantly getting 'swindled' by a bunch of hype-drivin buzzword mumbo jumbo.

I do the same thing.

My SO's response is generally along the lines of 'I'm fine with it, because it isn't in the hands of anyone I know. If you go out and buy that information, that's creepy and scary because you know me.'

I've started coming to terms with the fact that I won't be able to convince her of anything with privacy; because she isn't a technical person, and just like users; they won't care how/why/what cost so long as they can do what they want.

You could always offer to take off all the window curtains/shutters in the house, take down all fences around the property, and leave all windows/doors unlocked. Your SO should be fine with that since it's likely that most of the people that pass by are not people they know.

This does nothing to help convince people that data privacy is important. Physical privacy and data privacy are two very distinct ideas that have very different implications in people's lives. Please don't conflate the two as if they're equally important and you can't value one without having to value the other.

sadly, you really need to have your data privacy abused to understand the potential. Accounts emptied. Stalked. Secrets posted on line. But then only the victim gets it and everyone else goes happily on their way.

Care to elaborate on how they are ultimately different? Sure there's the superficial differences (they could see you poop vs. you emailing someone), but how is knowing exactly where someone has been, knowing the vast majority of their digital correspondence (content and recipients),knowing their purchasing history, knowing their social preferences, etc (and putting it all together), ultimately, any different than being able to watch someone in their home 24/7?

Most users of these products are non-technical, among other things. They have no idea that they should even consider that something like that is happening.

> i've been trying to explain this to my wife for a while and struggle with it lol.

A losing battle, it seems. I find people can't make the pattern connections about good and bad hygiene. So explaining one example doesn't prevent similar behavior in another, even for really "obvious" stuff. Kinda drives me a little crazy.

Users don't read. There are Consent screen which clearly explain what kind of access the application will have to your Google Account.

Edit: Formatting & Spelling

That said, there's a difference between understanding what privilege you are granting and understanding the implications of that grant.

For instance, Google help pages [0] just talk about "Full account access" and "View your basic profile information." What about apps that can view your calendar? That's in between. What information do those apps actually see? What can somebody do with the information that I might not like? These are hard questions to answer with the information Google gives you.

[0] https://support.google.com/accounts/answer/3466521?hl=en

> understanding the implications of that grant

Grant an application permission because it asked to in order to fulfill a request to handle one particular thing about one particular email. Instead, grant access to your entire email account, not get notified of which emails the application accessed, and get upset because the application exceeded what you desired to grant.

I don't think Google is a villain here, except for the lack of fine grained access control common to all cloud apps.

For example, I had enabled IFFT to record something to a Google Sheet periodically. I didn't realize that in doing that, I gave the company unfettered access to my entire corpus of data.

Technical users or not, the implications need to be MORE CLEARLY spelled out.

Putting it on the user to figure out the implications of some obscured click-through garbage text isn't fair.

There is a big difference between, say, a 3rd party application using a google API to work with anonymized keyword data from a gmail accounts VERSUS an actual person being able to browse someone else's gmail inbox.

If Google makes it possible for some 3rd party asshole to peruse the gmail inboxes of whoever uses the service, that should be UPFRONT and VERY CLEARLY STATED.

> If Google makes it possible for some 3rd party asshole to peruse the gmail inboxes of whoever uses the service, that should be UPFRONT and VERY CLEARLY STATED.

Within the last year Google changed their OAuth policies so that you need approval from Google before you can publish an app that uses OAuth. One of the requirements for this is linking to your privacy policy, where you need to say how the data is going to be used.

Reply on news.ycombinator.com