Hacker News Reader

Comment by kebman | Hacker News Reader

Looks like some kind of ad that tries to discredit regular encryption by claiming that it's already compromised (it isn't), or that it will be very soon. But lo! Here is the knight in shining armour coming to the rescue (FHE)! Soon. Maybe.

View on HN

No, the point of FHE isn't that regular encryption is already compromised. It's that you can do processing on encrypted data while it's encrypted, without decrypting it. This opens up many more possibilities. For example, a cloud provider might store your data only in encrypted form and you can still do queries to pick out particular data or do some basic analysis, with the algorithm running on cloud computers, the result delivered to you in encrypted form, which you then decrypt with your private key.

The only problem is that there's a large performance penalty still, though there has been major progress in making it more efficient.

The article does put quite a lot of emphasis on "soon broken" encryption algorithms, so can't blame kebman for that comment. It only mentions what you pointed out almost in passing.

Also not an expert here, but if "Valuable insights through AI (artificial intelligence), big data, and analytics can be extracted from data", then you'd be a fool to believe this will protect your privacy, right? Or am I missing something? I want encryption that protects me from corporations, not encryption that protects the data corporations have from us and ups their surveillance game. I guess it's no coincidence a lot of research seems to be done by M$.

If FHE could be made to work (and we are a long way off), the cloud provider would not be able to see your data even though you're doing processing on the data that remains on the cloud provider's CPUs, so in that sense it would protect you from Amazon/Google/Microsoft/plug in your cloud provider here.

Then how can they extract "insights" from the data if they can't see the data? At what point do the "insights" defeat the purpose of protecting your data from the cloud provider? Or are the claims in the article bogus?

fhe solves a ton of issues in sass products that don’t look great under audit. things where we sign off on audit today with fancy contracts called “data privacy agreements.” i think it will take some time (20 years?) but i expect zero knowledge for most of your data to be table stakes for saas offerings

Saas is all about collecting, controlling, and exploiting your data though. If they can still mine your data and leverage or sell the information they get out of it that's not really "zero knowledge". I don't expect companies will stop being interested in making money at all costs in 20 years, especially where the costs are mostly to you and your privacy.

Actually saas is about providing services for money.

Money and control is what it's about. That usually means making someone dependent on you in order to access/use their own stuff, making it hard to migrate their data away from your service, and taking every advantage of the data being collecting.

I've never seen a saas product that isn't using and/or "sharing" their customer's data for their own benefit somehow. If they exist at all, they're the exception and not the rule.

This is completely wrong way to view SaaS. It's just about making money, the control part is just so they can try and squeeze more money out of you. Control is not the goal. Money is.

I guess that's fair... ultimately money is everything, but I do think there are absolutely companies who highly value the control aspect as well. It can give them the ability to censor, act as a gatekeeper, and nickel and dime.

Saas seems a lot more predatory and risky than most products/services. You hand over money, you hand over control, you hand over your data and all of it leaves you varying degrees of vulnerable.

I guess I shouldn't expect a pragmatic view of saas to be popular around here (some of you are likely working on your own saas projects after all), but the reasons saas is attractive for companies to offer are the same reasons that make me hesitate to use them.

Money is the goal of the individual Cogs in the machine. Control is the goal of the machine itself, which uses money to incentivize (power) its Cogs. If you're a Big Tech company you essentially have endless free money to leverage compared to your Cogs. The machine itself doesn't care about money. That free money train is coming to an end though over the next decade. Or at least that's the reality I'm planning for. :)

Typically that "service" involves doing something with the data server side (such as displaying it in a slick website).

FHE does have potential applicability here, but i think the potential is a bit overblown because there are a lot of devil in the details issues.

Reply on news.ycombinator.com