Hacker News Reader

Comment by madrox | Hacker News Reader

Having worked at a large company that cares a great deal about COPPA, I've seen how regulation really can work for consumer benefit. I'm not sure if people appreciate how much COPPA cleaned up in child privacy. However, it's definitely hurt the bottom lines of small businesses that liked playing fast and loose with data.

The sudden commodification of facial recognition means most of the companies racing to fill business needs are startups. Large corporations like Microsoft are much better positioned to deal with industry regulation. This may be a self-interested, anti-competitive move on Microsoft's part, but I don't care as long as I benefit as a consumer, too.

View on HN

Being a teenager when COPPA went into effect and having a number of netfriends under 13 (at the time) - I'm not sure that employees at big companies really understand all the unintended consequences of it.

By far the most common consequence amongst my friends was to teach us to lie. (The second most common consequence was to shut us out of smaller websites that didn't want to deal with regulation - at least until we learned to lie.) "Are you under 13?" - duh, no. "Are you under 18?" - better answer no on that one too, to be safe. "How old are you?" - 20 is a good number. "What's your birthdate?" - how about Jan 1, 1970?

I had one friend who forgot her password to her Yahoo Mail account. "Why can't you just use the password reset functionality?" "I forgot which birthday I entered." "Why don't you call them up and have them reset it?" "I registered under a fake name too, and forgot what I put."

And she was one of the savvier ones. I saw a number of people post their street addresses, pictures of their house, vacations they were taking on the public Internet, but when it came to their ages, "I'm, uh, 24" (adding a decade and change).

People wonder why Millenials aren't more up-in-arms about data breaches and identity theft, and why they prefer pseudononymous currencies like Bitcoin or Ethereum over the real banking system with its KYC requirements. Maybe it's because we've been trained to see identity as temporary, reputation as something that can only be used against you, and information as something you give out to get what you want at the moment.

> I'm not sure that employees at big companies really understand all the unintended consequences of it.

They knew - just like they know people don't read EULAs. They didn't care because it was CYA action that took the bullseye off their collective backs. Those that pretended to care requested "credit card age verification" to improve their funnel conversion.

That's what I'd always assumed, but taking madrox's comment at face value, it seems like the employees in question thought they were actually cleaning up the Internet. COPPA did no such thing; it just gave the appearance of cleaning up the Internet by making all children magically appear to be over 18 to those asking the question.

Reminds me of a story where PayPal froze some person’s account because they were not eighteen when they created the account. I read it here on hon. Maybe someone can find a link to the comment...

"If you opened your PayPal account before you were 18, close it"

https://news.ycombinator.com/item?id=14226775

This thread conflates two problems: how identity is managed on the internet, and corporate responsibilities in the face of that.

True age verification on the internet is a funny business. Unless we get some kind of government-backed ID, you have to trust what the user is telling you. It's a company's responsibility to take reported age seriously. Lying on age breaks the user agreement no one reads.

But if you tell the truth, and you're using an app designed for kids, your data will be protected according to the law, which is very pro-consumer.

In the end, if you choose to lie about your identity on the internet, that's your business.

> People wonder why [Millennials] aren't more up-in-arms about data breaches and identity theft, and why they prefer [pseudo-anonymous] currencies like Bitcoin or Ethereum over the real banking system with its KYC requirements.

As a millennial, I've always wondered about this. I'll hear coverage on NPR fairly regularly about the latest data breach, and I always feel like NPR is either a) pushing the outrage on me or b) assuming that I must be outraged, because I'm never outraged. I see pretty much everything I put online as public, even if there is a veil of privacy (like FB for example).

The ones that outrage me aren't the passwords being leaked, it's the SSN that I never put online in the first place but was shared by companies I trusted with companies I don't trust but had no choice or notification of.

My guess is that the useful intended consequence was that companies specifically targeting young people for exploitation would think twice. Everyone knows the young will sneak onto porn sites. But an enterprise that constructs an app to exploit kids in particular is going to feel a big target on it's back and rightfully so.

Edit: My guess you'd have to be millennial to think other generations didn't learn to lie to adults in a multitude of ways.

Millennial here too.

I absolutely agree with this. The issues mentioned are too real (forgetting your birthday, etc).

I bet most Millenials barely know what the bitcoin is and are hoping Ethereum is some cool new drug.

> I've seen how regulation really can work for consumer benefit. I'm not sure if people appreciate how much COPPA cleaned up in child privacy

Yes absolutely! Similarly, HIPAA has been incredibly useful in forcing hospitals and other for-profit companies to at least kind of care about medical data security. It's not perfect, but without HIPAA that data privacy/security would be in a far worse state.

Addendum to this: HIPAA told us (engineers who work in the health space) what to do, and HITECH told us how to do it.

Both are useful.

To play devil's advocate: Without HIPAA, health care costs in the US might also not be multiple times higher than in other developed countries. I have worked multiple jobs in the health sector, and it seemed as if the vast majority of the overhead and time spent was for the sake of complying with HIPAA.

The reason health care costs in the US are ballooning is not HIPPA. It's the Byzantine system of who pays for what, how much, and why, where nobody has an incentive to make care cheaper.

See:

* Why nobody can itemize a medical bill.

* Why a bag of saline may cost the patient $100.

* Why an in-network hospital will bring in an out-of-network independent contractor nurse to assist an in-network surgeon, leaving you with a $200 bill for the surgery + a $5,000 bill for the out-of-network assistant.

* Why nobody will tell you how much a procedure will cost, with, or without complications.

* Why nobody knows how much your insurance will pay for, until the bill is due. Often months after the procedure.

Compared to all of these problems and abuses, HIPAA seems the least of America's problems.

I'd like to contribute to reducing the cost of care, by shopping around for more efficient/more affordable/better dollar for value doctors/hospitals, but I haven't the foggiest idea of where to start. It's like going to a car dealer, saying that you want a Prius, and not knowing what the age of the car, its condition, or how much you will be billed for until after the title is irrevocably transferred to you. Oh, and the dealer across the street will happily sell you one for half what you paid for. Or double. You really have no idea.

> nobody has an incentive to make care cheaper.

Companies who act as the insurance company and the care provider have an interest in cheaper care. E.g. Kaiser Permanente

Well, they are essentially a single-payer system for their customers. That's not really surprising.

They also have an incentive to err on the side of providing less care. Since you still can't meaningfully comparison shop between them and their competitors, I suppose it is exactly like a national single-payer system.

> They also have an incentive to err on the side of providing less care.

This is only true at the end of a person's life. Before then, ignoring problems does not make them go away, it in fact makes it more expensive for them.

Not quite; there's also the chance you might switch providers before discovering a condition.

And sometimes less care produces better outcomes. You can run too many diagnostics leading to more false positives.

> I'd like to contribute to reducing the cost of care, by shopping around for more efficient/more affordable/better dollar for value doctors/hospitals, but I haven't the foggiest idea of where to start.

Not to mention that this is almost completely out of your hands if you're unconscious or otherwise not able-bodied. If you get in a car accident and are unconscious, you're likely to go to whichever hospital the ambulance takes you to, and you're on the hook for that ambulance ride now, too. Before you even get to the hospital, your bill can already be over $1000.

That's an outlier, and it's outside of my control, that I don't care much to optimize for it. Ambulance rides in most other countries cost similar amounts, too.

AIUI HIPAA really isn't that much different from European regulations regarding medical data, so no, that argument does not seem to hold any water.

> I have worked multiple jobs in the health sector, and it seemed as if the vast majority of the overhead and time spent was for the sake of complying with HIPAA.

It is pretty easy to comply with HIPAA, and other countries also have privacy laws governing medical records. I suspect you've worked for incompetent organizations - some organizations intentionally drag out compliance and make things more difficult in order to complain or justify increased costs. This is the lamest excuse I've heard in a long time. All user/customer data should always be protected and compartmentalized to the greatest extent possible in any industry.

Why US spends 2-3x in dollars per capita, and almost as much more in percent of GDP, on healthcare than Germany and France and similar countries is an interesting question...but is at actually an important question?

The thing that is causing most of the problems for people when it comes to affording healthcare is that the costs keep going up. We think we've finally got something we can afford...and then in a few short years we can no longer afford it. It has outstripped our pay and our investments.

This is not just a US problem, either. Costs are going up at roughly the same rate in those other countries. E.g., US to Germany dollars per capita ratio in 2017 for healthcare was 1.8.

In 2010, it was 1.8.

In 2000, it was 1.7.

In 1990, it was 1.5.

I'd happily for the US continuing to pay the high amount we are now paying if we could just curb the growth so that whenever I manage to get coverage I can afford I can keep it for a long time.

Here's a site with all the data available for download, and explorable interactively on the site [1]. Uncheck "latest data available" and use the year range slider to select a range, and it will show you the growth in several countries over that range. You can use the filters to narrow it to specific countries or groups like G7, G20, OECD, etc.

[1] https://data.oecd.org/healthres/health-spending.htm

It's not really HIPPA. I think it's more things like a lack of price transparency, the 'customers' of health care being disconnected from the users of health care and so on. Kind of like how B2B software is often horrible because the customers are disconnected execs and the users (employees) pay the price. This goes into more detail:

http://abovethecrowd.com/2017/12/18/customer-first-healthcar...

Here in Brazil, where something like HIPAA doesn't exist, doctors routinely send patient records over WhatsApp, 'because it's more convenient'.

I feel like despite making some some things more cumbersome, strict rules for sensitive data are usually a good idea.

Conversely, in the US a lot of medical data still needs to be sent by Fax... so it's still not perfect by any means

> Conversely, in the US a lot of medical data still needs to be sent by Fax...

That's actually largely because fax is exempt from security requirement applicable to electronic communication under HIPAAit's a loophole organizations exploit to avoid the cost of secure comms.

I get my records via an app. I honestly have no faith that it is secure, but if someone really wants to know what my creatinine value is, im sadly not concerned.

One day, your health insurance will be more expensive. One day, your might be denied a bank loan.

That's fine I wouldn't want to do business with that type of bank.

Clearly you haven't observed the trend of corporate consolidation in this country, especially in the financial sector.

What happens when there's only two, and they both deny you? Seems shortsighted to not care about your privacy.

Which specific HIPAA IT security requirements would you not have met otherwise?

As I recall, it’s super basic controls like disk encryption, backups, system updates, and screensaver locks. Not, like, certified crypto hardware and static analysis.

I appreciate that we can punish people for failing to meet table stakes, but if you weren’t going to do that stuff anyway, something is deeply wrong.

If the number of breaches happening every week is an indication, something is deeply wrong not with individual companies, but most of the industry.

HIPAA doesn't really begin to address APTs with 0-days. The controls it specifies are necessary, not sufficient.

Agree. And anyone who sees a business opportunity in a shady area where basically “regulation hasn’t kept up with tech” just deserves to have the rug pulled from underneath by regulators. The message to the next company should be “if it seems shady, it’s probably not worth trying”.

> The sudden commodification of facial recognition means most of the companies racing to fill business needs are startups.

I know it's a common phrase, but to be rhetorical, when is facial recognition actually a "business need"?

Facial recognition is not a business need in and of itself, but it can be used to fulfill business needs

Agreed. Rare instance of corporate and personal interests aligning and what not.

Reply on news.ycombinator.com