Comment by beloch | Hacker News Reader

Comment by beloch | Hacker News Reader

Porn has long been at the forefront of internet technology, driving next-gen solutions that eventually trickle down to many other sectors. However, when faced with declining sales due to privacy fears, Kink (and many other sites) are shrugging off privacy concerns in order to make a buck off of invasive advertising ("Honey, why am I seeing so many ads for condoms and nipple clamps today?"). Talk about self-destructive business practices!

North American society is far too prudish about sex; especially sex that isn't deemed "mainstream". BDSM themes in particular have long been used by Hollywood to characterize particularly vile antagonists. Mainstream sexual mores are becoming less parochial, but not nearly fast enough to alleviate privacy concerns for most people. Acworth really ought to take this a lot more seriously. His attitude ranks up there with the Sony exec's who figured rootkits were a good idea! It really is a recipe for disaster when pirated goods carry fewer risks than legitimately purchased goods!

> Porn has long been at the forefront of internet technology, driving next-gen solutions that eventually trickle down to many other sectors.

Can you give any examples? I worked with developers at one of the biggest networks, and while I found exactly one to be competent, I think I facepalmed myself bleeding. E.g:

"Can you give me the login credentials to the admin backend to view the stats of our affiliates?"

"Sure, you can use this link: http://genericbacked.com?login=john&password=john123"

While they would isolate their backends on different servers, it just a couple hours of being bored and some kiddy scanning on their netblocks and some manual SQLi to expose glaring holes and start dumping databases. Some CSV export sources were completely open.

I also found some nifty holes in their billing forms, when a user would do an authorization of future payments. (i.e. entering their creditcard, but not getting charged"). I could reuse the params that we could store, and change the template id of the presented form, to have the form present my the users CC data.

>When faced with declining sales due to privacy fears, Kink (and many other sites) are shrugging off privacy concerns in order to make a buck off of invasive advertising

Those privacy concerns were never addressed in the first place. Really common software to manage doorway sites, billing forms and affiliates is "NATS, The Next-Generation Affiliate Tracking Software" It stores all passwords in plain-text in the database, while a year ago it had some updates on its styling.. like actually use CSS and tableless layouts... nothing changed in regards to security. Log files also contained huge amount of privacy sensitive data.

Another common practice was to never destroy user data, just make it not visible anymore when they opt out of their account. It will still hold resell value on the e-mail address alone. My manager told me these could be worth $0.50 a piece for a validated e-mail address.

A lot of the things in the article are true. The saturation of the market means that we had to take any effort to gain an edge. In the end this meant we were starting to run our own ads, and crunch the data to display better / different ads. When we got good at that, we started accepting other people to use our ad-network. Coincidentally the big money is in all the ad-networks. Most of the big show online porn guys, next to having a gabillion of the same sites, is running their own ad-networks.

> Can you give any examples?

They certainly don't lead in terms of security (and definitely not in terms of privacy, much as they'll claim otherwise to their potentially easily embarrassed customers) as your examples suggest.

Where they have been pioneers in the past though are in the area of monetising content, online payments and related matters, particularly (but not exclusively) video content. Also in the early days some bandwidth management techniques where tested in the real world on porn content before anything else, and many other services lacked the constant high demand that needed them.

BitCoin will have properly "made it" when it starts being common for porn suppliers to accept it!

>when faced with declining sales due to privacy fears

thats where bitcoin comes in

yep. Microtransactions built into the browser would herald a paradigm shift. I wouldnt pay 20 dollars per month for a recurring porn subscription but I would pay 70 cents to watch a single video every once in a while.

or cryptocurrency in general as soon as porn industries will start to accept doge/lite/max/whatever coin

To verify, you mean by ruining any idea of privacy by making all transactions public? (It isn't clear if you are actually saying that bitcoin would increase the privacy experienced in this situation.)

You wouldn't have to make a payment from "JOHN DOES ACCOUNT" to "PERVERTED PORN ACCOUNT". You could easily set up several wallets in the middle, obfuscation the transaction and gaining deniability.

However, beware! If your wife is an paranoid data scientist, she could still find circumstantial evidence for your porn subscription.

So, if you aren't going through a remixer (which is the point at which my paranoid data scientist friends point out "that doesn't even really help, at least in the long run, if not even in the short run"; and it isn't like any normal user is going to be doing this) the obfuscated wallet approach isn't really helping you much, if nothing else due to timing correlations. Even then, most normal people (the kind of people who are likely going to run into this problem most often) aren't going to understand how to do anything other than use the default features encoded into their wallet software (which are remarkably deterministic in function, almost never obfuscates the change making the middle steps trivially transparent, and generally don't provide any control over which transactions will accidentally cluster). Bitcoin is simply not trying to solve this problem: there are things bitcoin claims to solve, and things bitcoin succeeds in solving (whether on purpose or as a side effect), but "I want my transactions private" was never one of them. While it would be awesome if it were true, not all things related to payments are made better by bitcoin :/.

It also must be pointed out that you aren't just dealing with your spouse at this point: you are dealing with everyone who might possibly care; maybe your pastor is a "paranoid data scientist", or maybe the noisy person across the street has taken up statistical correlation and inference as a new hobby. Maybe someone makes a new service that helps companies screen employees, and one of the things it does is scan the blockchain using some really epic algorithm coming up with some kind of bogus (and questionably-legal) "morality score" (I bring this up as there already have been companies constructed to do this for data on Facebook). The transaction record of bitcoin is out there for everyone to datamine, and if you make a mistake the record will still be there and still be public years from now. There might even be new techniques (whether bitcoin-specific, or generally in the fields of statistics or machine learning) that will make this data more transparent in the future. The defense model for "I don't want people I deal with to know about my porn addiction" of bitcoin vs. even a normal credit card does not come out very strong.

Those are good objections. I guess the only safe way of dealing with bitcoins is to get money into a wallet without in any way associating it with your real life persona, which could be very tricky. And after that never ever use your wallet to pay a service that is assigned to your real name.

Are there any good resources to read up on how the remixers work, and why they cant be relied upon?

I do not have any resources related to that; the summary (as I vaguely remember the arguments) came down to evidence being accumulated due to reasonable caps on fees and delays (if giving your money to the remixer occasionally ate 99% of the money and occasionally made it hold onto the money for a year, you are no longer in a position to effectively utilize it) combined with correlations on repeated transactions.

To be clear, though, my argument was simply to move the "data scientist" line from "wallet obfuscation" (for which I then provided more concrete issues) to "remixers", and then to point out that normal people (the kind of person who didn't solve the underlying problem long ago using prepaid credit cards ;P) aren't using remixers and are unlikely to begin using remixers (as they probably aren't even using the more useful forms of wallet obfuscation: they are probably relying on what their wallet software is doing by default).

Reply on news.ycombinator.com