Hacker News Reader

Comment by zacwest | Hacker News Reader

The part that stands out to me, as someone who writes software for a living:

> Tech companies: Do you want to help put your users behind bars by handing over the data you hold about them in response to legal demands by law enforcement? Do you not really care if they go to prison, but do care about the bad PR you’ll get if the public finds out about it? Then start planning now for what you’re going to do when – not if – those demands start coming in. Data minimization and end-to-end-encryption are more important than ever. And start worrying about internal access controls and insider threats, too: don’t assume that none of your employees would ever dream of quietly digging through users’ data looking for people they could dox to the police in anti-abortion jurisdictions. Protecting your users is already so hard, and it’s going to get a lot harder. Update your threat models.

View on HN

I agree it might turn out to be worthwhile, but don't underestimate the difficulty. Building a system where all user data is encrypted with keys only the users have is an order of magnitude harder than the regular way. You can't debug anything from server logs. You can't change database schemas server-side. Otherwise simple things like migrating accounts to a new device become an ordeal.

It's only in the last few years that some messenger services have probably (?) got secure group chat right. That's how hard it is for a well-studied application. Expecting developers to do this for lifestyle trackers is asking a lot.

It would be much more efficient for society if the government didn't criminalize common behaviors, requiring regular citizens to have nation-state-proof opsec.

Or we could go back to on prem and customer owned machines I guess.

Why is this getting down-voted? It seems worthy of a little discussion.

Paycheck induced blindness to the premise of not writing spyware.

Can you elaborate?

"It is difficult to get a man to understand something, when his salary depends on his not understanding it." - Upton Sinclair

It is also difficult to get a man to understand something when you refuse to explain the thing to him.

You can lead a horse to water, but you can't make him drink.

People whose livelihood currently comes from businesses whose primary source of income is in selling people's data don't want to even think about the idea that doing something else might be a better idea.

There are a lot of people in tech (and, quite likely, on HN) who work for companies with such a profile. (Just for instance, everyone working for Google, Facebook, etc.) I doubt it's a majority, which is why the comment appears to have returned to a positive score, but there's certainly a strong contingent that could very well feel threatened by the idea that we might, as a society, have to abandon profiting off other people's data as a business model.

Because it’s a lazy insubstantial dismissal and doesn’t stimulate interesting discussion

Ironically, "on prem" means you're one "strangely clean burglary" away from law enforcement getting all your data :D

Better yet, though, why "on prem" when virtually everyone has a supercomputer in their pocket all the time ?

No one says you wouldn’t encrypt on prem too. It just adds the extra layer of difficulty slurping everyone’s info all in one go. Someone would need to actually walk to the customers site and all to take their servers, potentially.

Remote access is a good point, but most commercial sensitive data (medical, manufacturing, etc) is location use restricted anyway.

Maybe, just maybe, we should stop building lifestyle trackers outright?

The point is that this is only the beginning of a deluge that will build over time.

For example, defense-in-depth was once an academic notion that nobody seriously considered due to the difficulty of implementing it. Far better if the operators would only be more vigilent or the perimeter were just made stronger. Then the threat model began to morph and the legal liability framework changed and suddenly nobody was laughing anymore.

Talking in terms of "people should" and "people shouldn't" and "if only this group would" is avoiding reality. And reality doesn't care if you're ready for it.

Personal data is a liability. We can profit from it now because we're still in the heyday, but that's going to end.

I’m super attracted to the idea of going back to client-only software with nothing (or minimal amounts of stuff) on the server. If you can make money with a model like that, it’s ideal. You host nothing, so you have nothing to lose sleep over. Except having airtight updates, but I’d rather worry about my code than users' data.

Existing national security legislation in many countries already allows governments to compel individual to push updates with comprisimised updates and to implement backdoors.

doesn't that only work with distribution systems that can target individual accounts? since that legislation does not allow pushing a backdoor to all users instead of the one being targeted?

hence f-droid would not be able to comply with such an order since it doesn't even have a concept of user acounts. same goes for most linux distributions

The Australian legislation makes no such distinction. If the government wants to spy on someone or requires you to make a backdoor, you must do it, no matter the consequences (or even compatibility if they are providing the backdoor software). This legislation applies to all citizens, even if they have migrated to another country, btw.

I'm sure other developed nations have similar power to compel their citizens.

the EU is debating similar laws right now, which means they don't have that yet, and neither does the US as far as i know.

this is quite different from laws that allow to push a specifically crafted app to a particular individual.

and even the australian law apparently states that companies cannot be compelled to introduce a "systemic weakness" or a "systemic vulnerability"

https://arstechnica.com/tech-policy/2018/12/australia-passes...

https://www.schneier.com/blog/archives/2018/12/new_australia...

> Technical Capability Notices (TCNs), which are compulsory notices for a designated communication provider to build a new capability, so that it can fulfil subsequent Technical Assistance Notices and Requests

>The current law prohibits the creation of a “systemic weakness” or “systemic vulnerability” in encryption and other systems of “electronic protection,” terms that have proved difficult to define.

They can be compelled to introduce decryption and interception capability. It's just sophistry for them to say that this can't introduce weakness or vulnerability in the underlying system.

[1] https://carnegieendowment.org/2021/03/31/encryption-debate-i...

What happens if you can't comply due to sheer difficulty? Like if your design simply does not allow you to target a specific user at a technical level. Are you forced to shut down your company or something?

>tech firms and businesses may be penalized up to $7.2 million USD if they don’t respond to the government's requests [1]

>The legislation ... creates a new framework for law enforcement agencies to request or compel technical assistance from tech companies, even to create new capabilities such as backdoors to get around the encryption in some of their products. [2]

They request a backdoor in the encryption and if the cooperator does not cooperate, then fine the company / Australian citizen and if they enter the country again, they can go to jail.

[1] https://fee.org/articles/australia-s-unprecedented-encryptio...

[2] https://www.theguardian.com/australia-news/2020/jul/09/austr...

Since googling a bit more, this is the best overview of the legislation: https://carnegieendowment.org/2021/03/31/encryption-debate-i...

I've worked with a system that went from pre-GDPR compliance to post-GRPR compliance. What are your reasons that it's "an order of magnitude harder"?

You don't need to have personal data in your server logs.

You don't need to see the production data of your users in your database tables to make migrations that work. (You do have a staging environment, right?)

When you have a bug in your migration that only production data tickles (which is not uncommon), it gets a whole lot harder.

When you’re trying to debug a data corruption issue in user data, not being able to log data related to it makes it harder.

Also, keeping track of all the GDPR type sensitive data everywhere is harder than just YOLO’ing it, of course.

Sure. But does any of that increase development by a magnitude? I don’t think so.

Extraordinary claims require extraordinary evidence. Parent provides 0, just hyperbole.

Open source tools are already built this way. If it weren't for the pathological attack on users that are mobile OSes this would hardly even be a discussion.

Not to be dismissive but you can write software for a living and not deal with personal data. It's possible. Entire fields out there.

Since even IP addresses are considered personal information, that seems a bit unlikely - anything that talks over a network is potentially an issue.

Highly sensitive personal information like medical records are of course easier to ignore.

You can simply not store any IP addresses whatsoever, or anonymise them. Current privacy laws have provisions for it.

It's not only about which data goes trough your system. It's about what you do with it.

When I go to my friend's house they also see my face and hear my voice, but they don't record it. That's an important distinction when it comes to privacy.

Which is impossible without even more work (up front) in any system which needs to maintain any sort of plausible audit records, prevent abuse or DOS attacks, be able to correlate traffic to resource usage, etc.

Which is pretty much any non-toy system, and a bunch of toy systems.

And you’d be surprised how many friends are recording, especially if they have kids - nanny cams, home security cameras, ring/doorbell cameras, etc.

It’s probably 50% or more of households now.

It doesn’t require that they’ve got a mic taped to their chest to be doing so.

> Do you want to help put your users behind bars by handing over the data you hold about them in response to legal demands by law enforcement?

It depends on the law being enforced, doesn't it? For example is someone is accuse of peddling CSAM then tech companies would be tripping over themselves to hand over data. In fact tech companies (e.g. Apple) will try to set up dragnets that even catch innocents under the premise that it's better to hassle a few thousand innocents than let even one offender escape.

As for abortion, are all tech companies pro choice? I don't ink because it never was a relevant question before since choice was legal for decades.

Those are all great practices that i wish more companies would implement.

Having said that, unless you work for an insurance company or something directly involved in healthcare i can't imagine how your product would know somebody had an abortion?

Big tech companies like Facebook are notoriously good at sniffing your browsing history and inferring private medical details about you for the purposes of showing you ads. Facebook most definitely knows who's pregnant from their browsing patterns. It almost certainly knows if you're looking at having or have had an abortion too.

I guess that makes sense, I hadn't thought about all the creepy surveillance capitalism stuff.

(although tbh anybody who gathers that sort of data is pretty despicable and I can't imagine them suddenly changing it now).

Reply on news.ycombinator.com