Hacker News Reader

Comment by code4tee | Hacker News Reader

For me the key is transparency of collection and use (which some will quickly point out is very GDPR-like).

I’m OK to anonymously share my car’s position and speed of in return I get live traffic data from others doing the same. I’m less cool about people collecting my data without me knowing (or burying it deep in unreadable T&Cs) and then selling that for uses that I’m not aware of or didn’t approve.

When you visit a free website or use a free service I get the “your the product” mantra, but for products I buy and put in my home... no.

View on HN

Sharing such data contains the information where your car is parked (because that's where it starts moving). It contains more metadata than you may think. It contains information such as your home location (and therefore can be correlated to you), your neighbourhood, your work address, how long and often you work, where you do your groceries, how long you spend with aunt Tillie on Saturday morning. Such data is not anonymous, just like an IP address is PII (in the EU, at least, YMMV).

Not necessarily - it could just change your anonymous ID frequently enough that it would be impossible to know which vehicle did what. If you can't track a single car then you don't know if a car started and another parked where it used to be or if a car just drove past a parked car (assuming the data is not unreasonably precise).

How frequently do you propose? If it would change your 'anonymous' ID e.g. daily then all it has to do is look at the other data where cars seemingly move to and from the very same home address to the very same work address with a strange pause at work for ~8 hours and a strange pause between ~10 PM and ~7 AM due to sleep.

The device discussed in the article also knows our own SSID and surrounding SSIDs (supposedly it has WLAN to communicate) and can therefore also figure out where you live using e.g. Wigle [1].

A way to actually anonymise the data would be to use hashes and only use those instead.

[1] https://wigle.net/

An interesting anonymization - useless for instant traffic updates, though - would be to fuzz the location based on vehicle speed. When you're moving quickly, very precise data would be shared, but when you're stopped, uncertainty would be increased - that way, where you're parked every night would be much less precise than the highway you take to work.

This wouldn't do much good in more rural areas, of course - you could probably zero in on exactly where my parents park their car with a month's worth of data even if you add a mile-wide fuzz to every parked check-in.

Need some sort of deterministic bias based on user ID? Each user offset 1*Math.rand(hashseed) miles from location at randVector(hashseed)

Why does it have to be deterministic per-user? Why not completely randomized across every user?

I guess depends on the application. Consistent offset would allow measurement of distances, but that does leak some information, so perhaps all-random is better for many uses.

It could be done in a such a way that no device identifier or any other identifier is ever sent. Just (time, current lat/lng, previous lat/lng)

This is what pisses me off about paying for my internet connection, cellular plan, or television plan: everyone says "if you're not paying, then you are the product, not the customer"

But in all of these, one is paying, and then the argument switches to "your paying for access to the service, which is a cesspool of ads, PII exploitation and sentiment manipulation and if you don't like that, the go fuck yourself - you chose to be online"

So, here is a personal RFS: an ISP that gives me a prefiltered pipe which I pay for.

Ads consume data, if I am paying for N gigs of data per month, then I shouldn't be required to pay the data back haul for shit I would want to block at the client anyway.

That's like paying by the pound for ten pounds of steak at the butcher because my 8 ounce steak is sold to me in a 9.5 pound box if trash.

I challenge common networks to be the first to offer a prefiltered connection, where I manage the filter as far upstream to me as possible, so the data consumption on the last mile is purely desired content. And that all inbound ads and outbound trackers are nixed at the ISP. And offer this ideally as a default package option nearly the same price...

Sure, if they can have you pay _and_ sell or monetize your data and habits on the side, so much the better.

People paid for their Vizio TVs, and that didn't (and largely still doesn't) stop them from "being the product" when Vizio decided to collect and sell viewing data.

In the ISP space it similarly goes well beyond them just being a pipe for all the ad-supported tracking garbage you're downloading, they of course want to get directly in on the action as well.

>People paid for their Vizio TVs, and that didn't (and largely still doesn't) stop them from "being the product" when Vizio decided to collect and sell viewing data.

Ironically, I was on the team that helped make that possible at Vizio.... Another reason why I am very opposed to this.

Makes me wonder if we need the government to:

- Require companies to register before collecting personally identifying information (what, why, from whom, etc).

- Specify how & when privacy policies are distributed.

- Audit companies to ensure they adhere to their own privacy policies.

I have long wanted to see a standardized data privacy table like food nutrition information on the side of most packaged food in the US.

I'd like to see America regulate chemicals too as they are in Scandinavia, such as requiring evidence proving their safety, but legislation such as TSCA grandfathered in thousands of compounds with zero safety data. If you think you're going to get a crumb from the klepto-plutocrats' table, I think you're gonna need a straight-jacket and a padded room.

People are still dumb enough that they willingly hand over their contact details for a "prize" car or something that no one ever wins in order for some company to sell their details to be nonstop marketed to. And post-Equifax, it's easier than ever to steal a person's identity by opening accounts in their name without them figuring out until collections come calling.

When/if political winds shift far enough, then it might be possible for Americans to gain identity protections as stringent as Germany's. Until then, Americans will continue being screwed and lied to, and it's their fault for being too compliant and not demanding better leadership.

Not with Ajit Pai and the rest of the cronies dynamiting government. This is just wishful thinking so long as billionaires run the politics in America. Changing that, which means tempering the timeless interests of the rich aristocracy to control everything for their exclusive benefit, is a precondition to any meaningful, major overhaul that doesn't benefit them. Otherwise, suggesting such would be waiting for Godot.

> (which some will quickly point out is very GDPR-like)

I hope not. Knowing what data is collected and when is rarely argued against by anyone. Requiring the ability to provide it, provide services without it, large penalty maximums, explicit opt-in requirement, vagueness, non-enforceability, etc (etc, etc, etc) are often what people complain about wrt overreach.

> Large Penalty Maximums

This is needed, otherwise there is no real reason to actually protect personal data. Equifax losing the personal data for 50% of Americans should have resulted in major penalties due to the nature of their security.

The other requirements raise the cost of storing this data closer to the damage that can be done by the loss/theft of that data (from the perspective of the data subject).

> When you visit a free website or use a free service I get the “your the product” mantra, but for products I buy and put in my home... no.

Are you old enough to have bought or subscribed to physical newspapers or magazines? We were the product back then too.

Reply on news.ycombinator.com