Hacker News Reader

Comment by vorpalhex | Hacker News Reader

Oh great, a private company promising to store my home address and other sensitive personal details in a database. That surely won't get breached at all, ever, in any way, due to terrible malfeasance of even the most basic security principles.

Oh, and combined with lobbying cities to force adoption?

Realistically, how do we prevent every blockhead with an unsecured database from hoovering up personal information? Can we start instituting major fines and the requirement to carry liability insurance or something?

View on HN

I do think liability insurance is a good idea in theory; in practice, it will shut down "little people" projects and will likely only effect the worst of the worst. (Which is not nothing, but not enough.)

Mroe generally, the answer is "everything you can think of". People are trying to pull the world in a direction you don't like, so pull it in a different direction. Poison their data. Explain why they're awful to everyone you can. Talk to your local ABC authority before these jerks get there and explain why this is terrible. Try to solve the whatever actualy "problem" there is here in a less intrusive way. Whatever else you can think of that is legal.

You don't have to ask for permission to fight back.

For my part, I will not go to establishments that scan my ID. I'll show it to you for legal compliance reasons, but you don't get to record it. If your house rules say otherwise, that's fine, I'll spend my money in some other house.

I do the latter implicitly. Any place that’s crowded enough to have ID scanners sounds like my own personal hell.

Agree wholeheartedly.

Even if you are a social butterfly, use your head. That place has decided that they need ID scanners. Just imagine the things that have happened that made that necessary.

Just imagine the things that have happened that made that necessary.

I'm imagining visits from pushy ID-scanner salesmen, stopping by the bar to drum up some business while on their way to meet with legislators.

We can't, which is why stopping people from collecting information is the wrong place to prevent bad actors.

Your address is not a secret. If you own a home, it is necessarily a matter of public record. If you ever want to have anything delivered to you, you necessarily have to share it. If having your address in a database is a problem for you, you're going to have to learn subsistence farming and move completely off the grid, because you're not really going to be able to function in modern society.

How would you feel about having your name, address, and photograph in a database of people who frequently visit bars catering to the gay community? Would you change your answer if you lived in Alabama, or on a military base?

For me the bigger issue here is how one night at a bar might follow me around for the rest of my life. I get into an altercation at a bar and kicked out.. now I have a "record" that everyone can see? There is no due process here. No investigation. Nothing.. just a record that a future employer might be interested in taking a look at.

It's the Chinese social credit system but worse because it's privatized.

I agree, I just think that trying to prevent people from collecting publicly available information is the wrong way to stop it. The bar has a legitimate reason to look at your ID.

Instead how about we just make a law that bars can only ban people for incidents that occurred in that bar. That seems reasonable to me and would hold them to a similar standard as the justice system (no hearsay).

Looking at your id is not the same thing as scanning and storing it. They clearly don't have a legitimate use for that data just a pretext. Having spent time in bars I definitely don't want bartenders and bar owners to know where I live.

No, it's really not any worse. Under both systems, the social credit system is run by some organization that has no real accountability to the people it's keeping track of. China's government is, in a way, "privatized", since it only works for an elite group of people who control it, which if you think about it sounds very much like a corporation.

And I got asked to leave one pub because another family member had complained about the noise from the establishment.

If you don't like lots and lots of noise, then you have no business patronizing a bar or restaurant in America. The same is becoming more and more true of workplaces too. Americans love noisy places, and they love to talk really, really loudly.

Here's a great article in The Atlantic about how American restaurants got so noisy: https://www.theatlantic.com/technology/archive/2018/11/how-r...

The house was next door to the Pub - it wasn't about noise inside the pub.

> How would you feel about having your name, address, and photograph in a database of people who frequently visit bars catering to the gay community? Would you change your answer if you lived in Alabama

Isn't this already the case if you visit a gay bathhouse anywhere in the south?

I wouldn't care. Straight people go to gay bars. I've gone to several on a few different occasions, despite being straight.

I doubt I would want to associate with anyone who would care. I'm confident that I could find people who wouldn't even think to check such a database even in gasp Alabama or on a military base. Just because someone doesn't live in one of the five approved liberal cities doesn't mean they're automatically a bigoted jerk.

That's fine for you, but not for everyone. Would you really feel comfortable if this database leaked, a la Ashley Madison, and you knew people could search your name on some PasteBin and see all the bars you've been to?

Gay bars, biker bars, strip clubs, bars hosting political rallies, bars hosting events mocking religion. Bars where convicted felons are present, bars where alleged gang members are present, bars where prostitutes are present, bars known for drug use, bars known for cheap liquor and heavy drinking. Going to see a concert you're not that familiar with and it turns out to be racist/sexist/atheist/pro-abortion/anti-abortion...

Accidentally ending up in the same bar as your coworkers during a union organizing drive, intentionally going to the bar with your coworkers during a union drive... Five bars in one night, one bar after 3am...

I can honestly say that I would not want anything to do with anybody who would search my name on pastebin to find out if I was at a bar that did something that offended them so they can hold that against me. That person sounds absolutely insufferable. If they are going to go to that much trouble to find something to dislike about me, we were never going to get along in the first place.

Are you at least vaguely aware that people get assaulted or killed or blackmailed or discriminated against because of who they are and who they associate with?

It's not much consolation that you "find them insufferable" when they tie you to a fence or drag you behind a truck because of who you are.

This isn't that complicated. Many of us consider it a right to keep parts our our life private including who we choose to socialize with. You have every right to not agree with that point of view, but you should quit the charade of pretending not to understand it.

Do you honestly believe that the people tying people to fence posts or dragging people behind a truck are going to go search for names on pastebin to find their victims? That doesn't make a lot of sense. If that's really what they want to do, they'll just wait outside the bar and grab whoever comes out.

I agree it's a problem that people do things like that. I don't think that worrying about a name in a database has anything to do with preventing it.

I'm really struggling to find any credibility in this scenario:

Mr. Bigot thinks Jeff is gay. Mr. Bigot then goes to search on pastebin to see if there's any evidence of Jeff going to gay bars before beating him up.

In my experience people like Mr. Bigot are not real big on fact checking.

Of course this could happen.

How about this. Mr. Bigot employs Jeff, or is his client.

Ukrainian Bob hacks a database and finds out Jeff goes to gay bars. Bob contacts Jeff and says pay me or I tell Mr. Bigot.

Or maybe Jeff is a schoolteacher, and the bar is a BDSM themed bar. And Bob the hacker is a student.

Or maybe Jeff still goes to a bar in his old neighborhood, which is an ethic neighborhood. And maybe a black box unaccountable AI algorithm used by an insurance company flags him as higher risk because of that data point in his larger profile they've queried from a data broker.

Or whatever scenario you can think of. As long as certain things in society are legal and OK but taboo in some contexts, people are going to want privacy around them. Once you keep records like this that privacy is threatened, given that the probability of lists such as this leaking is basically 100% in the current environment.

Many of us want that privacy safeguarded. You are clearly not arguing in good faith by pretending not to understand why someone might have this opinion.

You are either deliberately misrepresenting my argument or I haven't made myself clear. Yes. Those things are problems. I don't disagree they could happen. I disagree on what the appropriate solutions to those problems are.

If there is anything the digital age has demonstrated beyond a doubt, it is that attempting to control information is futile. Go ask the music and movie industries how successful they have been in controlling the flow of the digital information representing their IP.

Jeff's employer wants to fire him because of his sexuality? Jeff's employer is wrong and we should not allow that. Jeff should have cause to sue his employer and win.

A schoolteacher is into BDSM and someone thinks this is a problem for some reason? They are wrong and we should prevent them from taking any action against the schoolteacher.

An AI increases someone's insurance premium because of occasional visits to one bar? This AI sucks and its data model is probably severely broken. A better insurance company with a smarter data model should offer a better deal to that customer.

For anything that is legal but "taboo" without clear evidence that it actually results in a real problem, we need to aggressively prevent people from interfering with other people's lives because of ill-defined feelings they might have about things that in reality don't matter at all. THAT is what is going to solve this problem. Trying to unpour the jug of water that is digital information is destined to fail and a waste of time.

Telling people with unusual but harmless lifestyles that they need to hide and hope that nobody finds out instead taking steps to protect them is wrong.

> For anything that is legal but "taboo" without clear evidence that it actually results in a real problem, we need to aggressively prevent people from interfering with other people's lives because of ill-defined feelings they might have about things that in reality don't matter at all.

Indeed. I do in fact fully support your impassioned argument that we should eradicate the legacy of centuries of bigotry and ignorance and bias that underpin nearly all human interactions.

In the meantime, while you're working on that, I'd like some fucking data privacy laws.

Mr. Jones gets in a dispute with Mr. Smith. Mr. Jones, in a huff, searches the leaked bar database to see what he finds.

He goes around the neighborhood telling everyone Mr. Smith used to hang out at gay bars, or that Mr. Smith habitually bar hops on weekends, or that Mrs. Smith emasculates her husband by going to the bar with her friends while he stays home with Smith Jr. Mr. Smith loses some business opportunities, or gets in hot water with his religious relatives, or just notices people laughing at him behind his back at the block party. If Mr. Violent Bigot is his next door neighbor, maybe this is how he learns Mr. Smith is gay, or hangs out at bars frequented by other races, or whatever.

Also, stalkers could easily use this to track their victims and people who they associate with.

> "Just because someone doesn't live in one of the five approved liberal cities doesn't mean they're automatically a bigoted jerk."

And just because somebody does live in a liberal city doesn't mean they don't have legitimate reasons to desire privacy.

Knowledge of your address is not a violation of privacy. I assume you never order take out food or receive mail?

There is much more here than a mapping of name-to-address, and you know that.

Yes, there are also bar owners reporting incidents that happened in their bar. Are you going to propose that bar owners are not allowed to write down things that happened to them? Are you going to propose that they are not allowed to tell other people about things they witnessed? How do you reconcile that with free speech?

For me the point at which this becomes a problem is where other bars that were not a party to the incident ban people based on unverified information. That is the actual problem and what I would propose restricting

The company will be logging every single card that gets scanned. You will be in their database even if you are never written up for any infraction, and that running history of every bar you ever scanned in at will be information that could become public through incompetence or greed.

You know this. I know that you know what data brokers are, that companies obsessively log everything by default, and that cyber-security is frequently abysmal. You're not dumb, you're just pretending to be. That's a nasty habit.

Ok, they will have a partial [1] list of bars I visited. This will allow them to do what specific nefarious acts, exactly? I'm not pretending anything. Maybe I really am dumb or just unimaginative. I don't see what harm is going to come to me from someone having this information or even why anyone would care to look at it.

[1] partial because not every bar is going to implement this

Pretending to lack an imagination isn't really a good use of your time, nor is this conversation a good use of mine. Have a nice day.

> How do you reconcile that with free speech?

I don't have to. Commercial speech isn't by definition free.

The bar owner is certainly permitted to tell their friends about something that happened, or write a book about what an asshole customer you are. That doesn't mean every for-profit database of information, no matter how personal or how obtained, is legal.

As, of course, you most certainly already know. There aren't any consumer credit reporting agencies, for example, making legal claims that the FCRA is a first amendment violation.

If you truly believe that, please reply to this comment with your full home address.

The possibility of fines, even large ones, is ultimately just considered a cost of doing business. If you really want to stop this sort of behavior we'll need a streamlined process for piercing the veil and criminally prosecuting both executives and engineers, with very serious (but fully deserved) setencing guidelines.

We’re all one GDPR violation from bankruptcy.

Time to put some EU risk takers and ambulance chasing lawyers in Sacramento together for freedom. Would make a great startup.

> Realistically, how do we prevent every blockhead with an unsecured database from hoovering up personal information?

GDPR. You need to take GDPR, translate it to your local language without removing any clauses, maybe add some liability for processors too, and get that implemented as a law.

I can't read TFA because it's paywalled, so I don't know if it talks about the information saved, but they don't need your home address, ID number and issuer is all they need to store as far as PII goes and you don't even have to store those directly - you can encrypt them like a password.

The article states that they store in their database your "name, gender, date of birth, zip code, and photo", but currently they don't store your address or id number.

The information stored though is certainly sufficient to find your street address and a great deal of other information in almost all cases since a full legal name + DoB + zip code match is nearly always a unique identifier.

Storing the id photo is fun and no doubt useful for further tracking of the patron using things such as the cameras on the table kiosks. Also the photo has value for sale to other interested parties.

I think OP was asking: even though there are best practices to follow when storing PII, how can we trust every private entity that stores our PII to be using those best practices?

You can brute force an ID number a lot easier than a good password.

This is one of the kinds of behaviour that the GDPR is designed to protect against.

Reply on news.ycombinator.com