Protecting privacy is a losing game today (2018) | Hacker News Reader

Protecting privacy is a losing game today (2018)

brookings.edu

84 pointsdredmorbius42 comments

A defeatist piece. If you're determined and have initiative you can achieve a lot. If you depend on the legislators in society, like this author, you may indeed be doomed. But you don't need to be.

The good thing is that with defensive measures you can stop much of it. With retroveillance you may even be able to strike back from time to time.

We need privacy at the societal level though. Even if I have perfect privacy for myself, bad actors who invade everyone else’s privacy are still able to influence society in a way that has never been possible before. Think of the election interference made possible solely by the huge amounts of data these companies have.

Even if I have perfect privacy, I’m still screwed if I live in a society where 99% of people don’t.

So construct a government where individuals are not secured or compromised their liberty depending on the outcome of an election. You speak of the popular will being corrupted by an external power, but the tyranny of the majority is enough of a threat to the safety of the individual and the tenants of natural law anyway.

Your perfect society is everybody's perfect society, one where collective force is used to secure individual liberty, and not choke it.

If that's the case, elections are meaningless and you're living in a state where current leadership cannot excercise their power

100% privacy can be hard, for some people also next to impossible to achieve, but making spying more difficult and expensive is still worth. Surveillance is pervasive because it is relatively cheap; what if suddenly it became more costly after people change their habits and adopt safer technologies? Companies do that for profits, and governments use taxpayers money; forcing them to spend more by putting obstacles will hit where it hurts the most.

Depending on the legislators is what most people have to do since not everyone has the time to focus on their privacy - The price of giving up privacy isn't so much that they should focus on it instead of leisure in the few daily hours of free time afforded by the other parts of their life (and sometimes they're directly compensated, eg. ad-supported hulu costing less than ad-free).

Yes, you can fight for your privacy, but good luck fighting for other people's privacy (what they mean by 'protecting privacy').

> Depending on the legislators is what most people have to do since not everyone has the time to focus on their privacy…

Not to mention the knowledge. The "everyone for themselves" approach doesn't address the actual problem, which is why it's important to think about this issue beyond our own personal networks and defensive capabilities.

While I mostly agree with you, it's a very hard endeavor that only a few extremely motivated individuals can do.

I have a Linux desktop and a GrapheneOS smartphone. However my ISP still knows a lot of things about me (and I'm not sure that a VPN provider would be better) including my geoloc, the websites I go to and how much time I spend on them.

I clean my cookies regularly, I use different browsers for different activities, but with browser fingerprinting it's probably in vain.

So basically I'm 80% there. But it's pretty tiring not to have the same apps / capabilities as others (I lost half my contacts by not having whatsapp), to be conscious that I clicked a Google link by mistake etc

The last 20% are way too much overhead for me (TOR etc).

And frankly I don't know anybody else doing it (IRL).

> retroveillance

This is the first time I have seen this term, could you explain exactly what you mean by it?

He may have meant sousveillance.

sousvideance?

yeah, the slowly boiling frog one

What would be great is a legal precedent to own the metadata you generate. If companies didn't own this data it would solve many privacy problems for individuals. I would like the legal ability to opt out of harvesting under scrutiny of punishment from the Government or the ability to opt in and sell it back to the companies who harvest it.

Even if the market wasn’t there, and I think it is, we shouldn’t ever give up on privacy. It acts as a balancing force to what companies want to do.

Yes.

So DESTROY their market by finding and using substitutes or even substituting with being mostly off-grid in a social media sense. We lived just fine before and without the internet. It was far less exhausting, frustrating and crazy.

This reminds me of an observation whose name escapes my feeble attempts to Google, that roughly states government bureaucracies tend to find more things to grow into over time, rather than diminish.

Wish I could find what it was… I remember reading about it in the context that if you wanted to grow your underdeveloped country, you should do as western countries did 50-100 years ago, rather than copying current institutions, as doing the latter would likely keep you from being competitive.

The bureaucracy is expanding to meet the needs of the expanding bureaucracy

— Oscar Wilde

There’s an “official” name to it, somebody’s law I think, in the social sciences.

Parkinson’s Law comes to mind.

Jerry Pournelle’s Iron Law of Bureaucracy

https://www.jerrypournelle.com/reports/jerryp/iron.html

It's also a form of Jevon's Paradox... efficiencies are always consumed and grown beyond.

https://en.wikipedia.org/wiki/Jevons_paradox

Why isn’t the wealth and power of the targets mentioned in debates for privacy ?

I mean, no one cares to know the private details of the powerless, and who has the power to know the private details of the powerful ?

There must be some analogue to eat or be eaten for privacy. Some people like reading tabloids.

> no one cares to know the private details of the powerless

I think you may want to reevaluate your thoughts on that.

Both times democracy was birthed, it happened so because the elite (cultural, political and economic) of society agreed that a majority rule that protected its minorities was the best way to secure long term stability and welfare. Because giving everyone (this hasn’t actually included everyone in most of of the history of democracy) a voice was the most efficient way of nobody getting their head cut off by angry mobs (to variating success).

Sure you could have a dictatorships but from the Roman Empire up until modern day China, that wasn’t exactly a great idea if you wanted your society to prosper. Not because dictatorships don’t work, but because they take immense and unopposed structure of governance that isn’t too bogged down by corruption to pull of successfully.

The Romans did it by making each providence rely on the others. One producing weapons, another tools and trade and a third food. Along with a massive standing army this made rebellion hard, and having very few external enemies meant the oligarchy was “free” to fuck around during their long periods of competent leadership. This is very simplified and not completely accurate, but it’s a good enough picture of what made the last prominent dictatorship work.

Until modern day China rose to power, but how did it move from Maos cultural revolution to what modern day China is today? I’d argue that control and information are the key answers.

Because how do you control all those powerless people, who are actually the real power of your society if they ever join together? Where “western” communism and socialism from Marx to Lenin always focused on the time after the revolution where the proletariat would have taken control and redistributed the wealth of society, Maos take was always that the revolution never ended. His doctrine was one of information control, and while that obviously didn’t work so well 50 years ago, it works really well in a works where the elite knows everything about you at all times.

You can’t assemble in secret. You can’t spread dissent. You can’t have the wrong religion. You can’t even jaywalk without society knowing and being able of intervening before they have to resort to the more drastic measures of their North Korean neighbours.

This is what total surveillance gets you. A society for people who fit in to have prosperous lives, and, the capability to weed out anyone who doesn’t early enough that you don’t need to “sanitise” the whole field in which they grow.

Threats are usually worse from powerful outsiders as well as powerful insiders. And the tools are more selective, cowardly spying and not iron fisted surveillance.

> ...a majority rule that protected its minorities was the best way to secure long term stability and welfare.

Huh. I hadn't connected the dots between minoritarian rule and surveillance (capitalism) until now. Thanks.

They really are codependent, aren't they?

So advocating majoritarian rule -- more democracy, consent of the governed, etc -- will weaken the pressure for surveillance.

Missing from title: " - and how to change the game".

A lot of recovery you privacy is realizing the value proposition of social media simply isn't all that.

I don't do any "FAANG" at all, and frankly I don't feel like I'm missing out on anything of value. I guess I'm weird because I have a life beyond all of that.

Privacy isn't dead if you don't want it to be.

Sadly your online identity with Apple or Google is essentially mapped to a mobile phone one way or the other. Then the same is indeed linked to your financial accounts, so there is no proper way to disconnect the same.

Use different phone numbers with all of them and don't use a mobile phone number, get a bunch of cheap virtual numbers.

Most people in the world won't live their lives this way.

One idea would be a "Privacy Bastion" business that proxies transactions for people.

Maybe I'm authenticated with several, and distribute transactions across them.

When they get hacked, I'm jacked, but still.

I was thinking of starting this kind of service, but I got scared by the potential liabilities and legal issues of giving a person basically a second identity.

How would this work for hotels and stuff? Do you basically make a fake company, open a bank account in its name, and use that account to buy stuff discreetly?

What if the person you a proxying for bought something illegal with the account? Who’s liable?

To that point, a phalanx of sharp lawyers would be must.

Also, incorporation in a suitable country, e.g. Switzerland.

I'm not sure how one could end up trusting such organizations besides "just taking their word for it".. also this system sounds more flawed than what you could do with cryptocurrencies?

> I'm not sure how one could end up trusting such organizations besides "just taking their word for it"

A legally binding contract with sufficiently punitive clauses. It's a solved problem for people who care about privacy/secrecy. Have you ever worked with highly proprietary or secret data/code in a professional context?

> also this system sounds more flawed than what you could do with cryptocurrencies?

I have no idea how cryptocurrencies are supposed to help with things like location privacy. Maybe it's suposed to help with the privacy of financial transactions? But I can already buy shit with a combo of cash and visa gift cards purchased in cash; not anonymously, due to cameras everywhere, but again, not sure how crypto is supposed to help.

> It's a solved problem for people who care about privacy/secrecy. Have you ever worked with highly proprietary or secret data/code in a professional context?

You mean like Edward Snowden and stuff?

This thread is not discussing criminal invasion of privacy, but rather the more mundane "legally selling your info" invasions of privacy. Fortunately, that means we're working with a threat model don't include US citizens fleeing to other jurisdictions.

Illustrative example: Suppose I could get Visa to sign a contract that says they won't sell my personal info. The original parent asked why I would just "take their word" that they won't sell my info.

The answer to that query is that contracts or consumer protection laws with sufficiently punitive clauses are a perfectly fine mechanism.

You counter with Snowden. But... I'm not particularly worried about the CEO of Visa defecting to Russia so that he can tell the highest bidder how often I visit the liquor store. A sufficiently punitive contract with Visa prohibiting the sharing or sale of my information would likely be sufficient deterrent.

Now, figuring out how to get Visa to sign such a contract is difficult, of course. But the actual enforcement mechanism for mandating privacy is straight-forward and doesn't involve crypto foo nonsense.

But even if we were discussing criminal invasions of privacy, I'm not sure how digital tulips are supposed to prevent data exfiltration by an trusted insider. Or, for that matter, preventing the liquor store from selling exactly the same info as Visa by leveraging the facial recognition in their POS system.

Neither am I.

Perhaps multiple, layered arrangements.

Trust doesn't scale, though.

Would it be similar to Blur (www. abine.com)?

"We're going to have a more private internet. It's either going to be through tech or regulation, or through users making choices with what they download or the extensions they use or how they interact with publishers through subscriptions or other mechanisms."

https://www.wired.com/story/can-killing-cookies-save-journal...

A different, more optimistic view: https://news.ycombinator.com/item?id=27859463.

Reply on news.ycombinator.com