Comment by ISL | Hacker News Reader

Comment by ISL | Hacker News Reader

Parent Full thread

Are you willing to insure, in real money terms, the privacy of your customers from leaks/warrants at your end?

If so, how much? Can that money be held in escrow by a third party?

Are you willing to go to jail for your customers? For how long?

If a customer orders 134 phones ($10k), will you comply with any relevant federal financial disclosure guidelines?

If served a national security letter that includes a gag order, how will you react?

Will you accept cash transactions through the USPS, with only $75 and an address enclosed?

Can you prove that records are not kept? How?

These questions are partially rhetorical, but for people who want/need anonymity, they're important.

edit, to keep questions in one spot:

How do you anonymize shipping? It's straightforward to find ways to accept anonymous payment, but how do you keep the Man from following all outbound packages from burnerphone?

What are advantages over buying a gift card with cash and purchasing a phone online or through an intermediary?

Hi ISL,

We're totally aware that we need to be a lot more explicit and include more information on our site about the product / processes / security stuff. We've been working on this for a while now, but kind of rushed the launch due to the recent press over the NSA stuff -- we figured it was better to launch early than delay.

We're actively working on answering all those questions, and will be including a page which covers all the security aspects fully in the next week-ish.

We're 100% dedicated to making this work for our users (and ourselves), and providing real security for people.

Cool - Good luck :)!

How are you planning on proving that no records are kept? I'm currently engaged in a project that takes privacy very seriously and that also makes that very promise (amongst others). I would be very interested in hearing about your approach.

delete from orders, customers where...

There will never be a way to prove the records are gone. It's all based on trust.

A huge pile of escrowed cash, held against any release of records (inadvertent or otherwise), does seem to be a way of moving some of that trust around.

The only way I could think to do it would be to have it process the transaction in memory and never store the data at all. Make the running code open source, and make it hashable in some way so that when you visit the site, you could tell if the current running version is the same as the one in the code repository.

Hashing the code wouldn't help. In fact, nothing besides simply not processing any transactions would.

How about simple audits to make sure you're not keeping records? Your customers could even nominate a representative to be present during the audits.

While it's probably good to answer these questions eventually for your clientèle, don't worry about an early or rushed launch. As Reid Hoffman said, "If you're not embarrassed by the first version of your product, you've launched too late."

If yu haven't already, consider a "warrant canary" - something like this:

http://www.rsync.net/resources/notices/canary.txt

That $10,000 limit you're thinking of only applies to money service businesses. Specifically, it's from the Bank Secrecy Act and is invoked in reference to negotiable instruments.

Reply on news.ycombinator.com