Don’t worry, Facebook will soon put out a press release including the phrase “we need to do better.”
the security handbook[^1] has a chapter on that actually, and they basically say that role playing is the only way of not getting burned. Humans are excellent at role playing, and it can help you prevent a lot of catastrophe without having experienced them before.
To me, a good parallel is home insurance. If you get robbed, a good insurance will cover your losses. However, if said insurance determines that you were negligent -- say you never lock your front door -- you are on your own.
Do you have precious art at home that you want insured? No problem. Just make sure you add an alarm and sprinklers.
That is how I want discussions around security to be held. Are you a start-up with 10 users? It's okay to do minimal security. Are you a bank whose wires carry $1B? Make sure you throw sufficient "bodies" at the problem, from the top of the hierarchy to bottom.
Mark Zuckerberg probably spends more on personal and family security and privacy than Facebook spends on their users' security.
"You keep using that word. I do not think it means what you think it means."
I "deleted my account" in the run-up to the 2016 election, because I could see how social media was being manipulated, and what it is doing to society. And I mean I _deleted_ it. I took the extra steps of researching how to REALLY delete it; not just suspend it.
A couple years later, I needed to get a new account to help admin a page. You can guess where this is going. I tried my usual email -- since it should be free, and it was deleted, right? And... what do you know? Everything was still there. All my posts. All my connections. Everything.
Facebook never deletes anything.
At this point I’m not really sure what it will take for companies, like Facebook, to understand that you need to not fuck around with peoples private data.
Ex, pay x amount per month in perpetuity for each piece of information about a user your keep. And have to pay the "net present value" of those payments if you lose the data.
Having to pay for hoarding user personal data changes the incentives from gobble up as much as possible, to instead only pay for a users data that is worth the cost to your business.
And as an extra incentive to not hold unneeded user data, know the costs you'd pay if it was breached.
Respectfully, I'm not sure either of these lead to outcomes we want