Hacker News Reader

Comment by gnosis | Hacker News Reader

"If anyone mentions Dropbox to me one more time, I will scream. I'm sure it's a wonderful solution, but I have deep misgivings about handing my data over to someone I don't trust."

It's really disturbing how eagerly most people are willing to hand over personal information to corporations; whether it's data to the likes of Dropbox, movie viewing preferences to Netflix, book reading preferences to Amazon, all of one's email conversations to Google, and a list of who one's friends are to Facebook.

I could go on and on listing information that the vast majority of people give away about themselves without a second thought to get some "free" service.

And the saddest thing is that few people care, or even think about what they're doing.

Hopefully, as the general public becomes more computer literate, and groups like the EFF and ACLU educate them on the privacy implications of these technologies, their attitudes might change for the better.

View on HN

In some cases, there's a bit of self-interest. I tell Netflix about the movies I like because the recommendation system works better for me that way and improves the quality of the system in general. So, it's not a total something-for-nothing, but there is a lot of trust involved nonetheless.

"I tell Netflix about the movies I like because the recommendation system works better for me that way and improves the quality of the system in general."

Well, if you use Netflix you don't really have a choice, do you?

Say you didn't care one whit about their recommendations (as I don't), but want to use their movie renting service. You still have to give them your name, address and credit card number. And they'll promptly stick you in their database and track every movie you rent. You might not be telling them what you thought of the movies you watch, but there's still a lot of information given them just by the choice of movies you rented. And the way the system is designed, there's nothing you can do about it short of not using Netflix in the first place.

Amazon is pretty much the same way. In fact, virtually all of the commercial internet infrastructure based on credit card transactions suffers the same fault. From your ISP being able to track every internet connection you make to vendors tracking what you buy from them.

And even when you're not directly tracked by a service (because you haven't given them your name, address, phone number, or credit card number), they could still potentially track you through your IP address (not to mention stuff like OS fingerprinting, browser fingerprinting, history and cache exploits, cookies, etc..).

Of course, there are ways of at least attempting to get around these tracking mechanisms. But relatively few people know of them, few care, and even fewer people bother to use them.

This is, of course, why many countries have data protection legislation. They recognise that companies will get hold of your data, and so legislate to protect you from its misuse.

I'm not sure that legislation alone is really enough.

Companies break laws all the time, if they feel they can get away with it. I'm sure I don't need to list any of the major corporate fraud cases that have plagued the news recently (from the major financial meltdown to Enron, etc), not to mention corporate fraud that's occurred in earlier days of even less regulation and oversight.

Clearly, if data protection legislation is actually going to work there needs to be some way of verifying that companies are really following the law. That may mean there has to be some independent agency that actually investigates what corporations do with the data they collect.

In the US, in the present political climate, such an agency is bound to be seen as overly intrusive in to private sector businesses, so there's bound to be much opposition to it (if the idea ever even sees the light of day). Even the prospects of serious data protection legislation in the US is only dimly glimpsed on the horizon at the moment.

But even strong data protection legislation with strong oversight would not really address the core issue, which is that the corporations have data on you in the first place.

In my opinion, the only way to address this issue is with a robust system of anonymity that connects consumers to providers and vendors. Fully anonymous money transfers, fully anonymous internet connections, and some way of keeping the provider and vendors from subverting these mechanisms via cookies, OS/browser fingerprinting, etc, would need to be part of this solution.

Unfortunately, the political, legal, social, and technical challenges involved in such a scheme put it far in to the realm of science fiction for the foreseeable future.

A fully anonymous system as you describe would have the side effect of removing responsibility from the consumer. How do you request payment from an overdue customer when you can't even tell who he/she is? In real life, when you shop with your credit/debit/atm(clave) card you're willingly giving out some of your information. In the net, it works the same way, if you want to buy X item from X online retailer or you want to sign up for X web based service, you need to give them some identifying information.

If you really want to stay anonymous, your only option in real life is to use cash only and go dressed in a hoodie and sunglasses to every place you shop. In the net if you want to stay completely anonymous, you have the option to not use the services or purchase the items.

It's not Netflix's job to make sure you stay anonymous. Their job is to collect your information to be able to charge you X amount of money for a service they provide (even when their service includes something you don't want - recommendations). It's your job not to use said service if you don't want your data in their systems.

"It's not Netflix's job to make sure you stay anonymous."

Never said it was. The tracking of consumers is rarely seen as a problem by most businesses. Most businesses want to know as much as possible about their customers. But this is very much a problem for consumers who care about their privacy.

"How do you request payment from an overdue customer when you can't even tell who he/she is?"

Just insist that they pay up front for any service you provide. A month's payment upfront isn't too unreasonable, is it? In fact, it's a rather tried and true business model. And it's not at all incompatible with anonymous payments from anonymous customers.

So that's not really a problem at all for such an anonymous system.

But there are some HUGE problems with it, which seem (at this point) completely insurmountable.

One problem is that anonymous money transfers aren't really looked at kindly by the IRS, the DEA, and various other organizations who have a vested interest in keeping track of who's paying whom and for what.

Then there are concerns that anonymous communication (nevermind payments) would facilitate terrorism, organized crime, and the like.

Then there are problems with getting the general public to care enough to use and even demand such systems. And even if that somehow miraculously came about, they need to properly use such systems without inadvertently leaking information about themselves all over the place.

The system and software involved would also have to be made to be brain-dead easy to use, and relatively foolproof (which, if you are familiar with the pain and security subtleties of digital key management and proper encryption use is no short order).

I could probably list half a dozen more major problems with a attempting to create a fully anonymous system.. but I think you probably get the idea by now.

It's just not going to happen any time soon.

I consider myself pretty computer literate, but I have absolutely no issues with this. I support the EFF, but I think campaigning against this is both backwards and never going to succeed.

Never is a long time.

Sure, it's probably not going to substantially change in the near future. But I think making people aware of the issues and why they matter is a good thing. Hopefully, with education and time people will start to care and maybe things will change.

In fact, things are already changing. Not so long ago almost all Americans were completely computer illiterate, and you had to be pretty exceptional to even have an email address or own a computer, much less care about electronic privacy.

Now most Americans own or at least have a computer, have email addresses, and are reasonably computer literate compared to how they were before the internet boom. And there are exposes on various privacy and security issues in the printed news and even on television.

So slowly people are becoming more aware. I expect this trend will only continue to increase now that more and more of the population are born in to the internet age and with a computer virtually in their crib almost from the day they were born.

Some of the most idealistic and privacy conscious people are the ones that are closest to technology and who are most adept at manipulating it and shaping its future. And their numbers are also growing as the general population becomes more computer literate as a whole, and as there are more and more abuses of privacy by corporations and the government.

So I would not count the chickens of a privacyless age quite yet. Remember that not long ago most people thought the collapse of the Soviet Union was as incredibly far off in the future (if it would ever happen at all). And there are still people living who at one time thought that Segregation would never end. And yet both Segregation and the Soviet Union did end. Things did change. They changed drastically in ways that many did not foresee even a decade before.

I had misgivings about Dropbox too, which is why I only sync one file, namely a 1GB TrueCrypt archive with all my data inside it. I hear Dropbox added TrueCrypt support in some fashion in their latest release, but I haven't investigated that yet.

If you are sharing with other people, something like encfs would be better:

http://www.arg0.net/encfsintro

Encfs encrypts file by file, so you do not have to worry about multiple people editing (and possibly corrupting) one giant file.

Sounds good, but no Windows version.

One thing to keep in mind if you give others encrypted data is that the encryption might be practically unbreakable for now. But there's no guarantee it will stay unbreakable in the future.

Given foreseeable advances in technology, along with unforeseeable breakthroughs in both technology and cryptoanalysis no one can really say how long it will be until your data is compromised.

But what we can probably predict with some certainty is that at least some of these data storage companies will keep the encrypted data you send them for as long as they possibly can. And they may even share it with others.

Reply on news.ycombinator.com