Hacker News Reader

Comment by neilv | Hacker News Reader

I wonder what will be the watershed lawsuit event that makes tech companies consider capturing and holding PII to be liabilities.

View on HN

Agreed, but this was search and watch history. I can see an argument for not keeping search history, but if I'm paying for Spotify, YouTube, or Netflix, I'd like to go back to that song or video I enjoyed last week but can't recall the name of

In other words, this is data we as consumers want to be able to access, and therefore want kept.

It doesn’t have to be synced to the cloud though. Even if you want it on multiple devices, if the tech industry decided to try just a little bit you’d have a cross device, local store sync solution. But there’s money to be made from tracking so it gets stored on hackable cloud servers.

I was thinking the other day that people have forgotten that end-user data confidentiality is relatively simple, generally speaking, but we have built the wrong infrastructure (so far).

> but if I'm paying for Spotify, YouTube, or Netflix, I'd like to go back to that song or video I enjoyed last week but can't recall the name of

Surely this is up to the client, or perhaps explicit bookmarking capabilities. Not implicit records of what you looked for in the past

You CAN turn off watch history in Youtube (not sure about Spotify). However, for better or worse revealed preferences seem to show that people prefer automatic content recommendations over doing the search & bookmark work themselves.

Is it a revealed preference or is it an inevitable result of making the UX to turn it off hidden, frustrating to use, and come with unwanted side effects?

If companies actually think "users really, really want X" then they should have no fear making X opt-in.

Some things need to be opt in but most things don't. What makes sense to have which way is not as simple as saying "if people wanted it, they'd configure it that way". Imagine how many problems having to opt in to keeping recent files or whatever on each program you use on all of your devices would be. Apart from the annoyance of setting it up, the annoyance of forgetting to set that (among a dozen other opt-ins) on one of your dozens of programs and finding out only when you can't remember the name of the document you had open yesterday. Most people would "opt in" to use a provider which has what most consider "sane" defaults instead.

But there are obviously MANY things we prefer to keep opt-in. E.g. sharing my recents data with 3rd party advertises. No need to throw the baby out with the bath water and make every service awful by default just to have a universal rule to quote though.

All for privacy, but if you have Watchtube that has worse, less relevant personalization by default and Viewtube with better, more personalization by default, my guess is Viewtube will win the day with users

I believe Bruce Schneier suggested more than twenty years ago now that we think of personal data as like a form of toxic waste or pollution, but this metaphor doesn't seem to have caught on widely.

I thought you were thinking of this: https://youtu.be/GAXLHM-1Psk?si=hVjBZNsmmdh-P9n8

Brilliant talk.

A leak of politicians' dirty habits should hopefully do it.

Like previously happened with video store rental records?

https://en.wikipedia.org/wiki/Bork_tapes

> The subsequent leakage and coverage of the tapes resulted in Congress passing the Video Privacy Protection Act (VPPA), which forbids the sharing of video tape rental information, amidst a bipartisan consensus on intellectual privacy.[8][9][10] Proponents of the VPPA, including Senator Patrick Leahy, contended that the leakage of Bork's tapes was an outrage.[11][12] The bill was passed in just over a year after the incident.[13][14]

Yeah and that was for innocuous tapes. Imagine what they would have done if the rentals had been salacious?

That said, if I were to imagine myself working at a place like that when they existed, I can't see myself turning over customer data like that willy-nilly to someone fishing for information. Like are you the police, what gives?

We already had some of that with the Target credit card fuck up that birthed PCI rules, which in turn birthed lots of payment card processors just so companies could wash their hands of all card holder PII rather than meet with their insane auditors.

Interestingly enough there's a legislative push to make companies verify your real ID, I believe many porn companies already do this.

Yeah, thought the same, should they even be allowed to save data like that?

It sounds super personal, just like religion or blood type

Reply on news.ycombinator.com