Comment by alxlaz | Hacker News Reader

Comment by alxlaz | Hacker News Reader

Parent Full thread

It's not even "just" about privacy. I find the idea that "preferences, password, and files are stored in the cloud and carry over to new devices" a bit unsettling in terms of security and trust.

I am reasonably convinced that Microsoft isn't snooping on me, not at a level of detail that would bother me anyway. I'm sure they have the tools to do so if they want, but I'm not an US citizen, not doing anything illegal, not involved in anything shady or uncomfortable for the US government or its allies (which includes my country, for that matter) -- I think it's unlikely enough that I'll ever be a target.

But.

Microsoft, and its cloud servers, are a really big target. It's the holy grail of ID theft. Do I trust Microsoft to safeguard my passwords, preferences and files against attacks, not just today, but over the next ten or twenty years, at a time when Windows isn't really the focus of their business anymore? I'm gonna say a pretty big no to that.

Even if I were convinced they had only good intentions (let's say they do) about this stuff, so did Yahoo, and LinkedIn, and Adobe and countless other vendors who eventually ended up with huge data breaches.

Do I have any guarantees that, twenty years from now, Microsoft's personal data storage systems won't give way, between budget cuts, incompetent management (twenty years is a long time, maybe Satya Nadella's successor is going to be worse than Steve Ballmer...), technical debt and increasing capabilities from malicious actors? Can I be sure that Microsoft is never going to lower their security standards? That they won't make any compromises that they aren't willing to do today, even, say, if they were on the verge of bankruptcy?

Granted, I have neither the budget, nor the security know-how that Microsoft does, but I'm not that big a target, either, nor do I store my data on systems that are accessible 24/7 from anywhere in the world. My passwords aren't too valuable -- for all the reasons that make me unimportant to Microsoft + a bunch of other ones (I'm not that rich, I'm not friends with any celebrity etc. etc.). The costs involved in getting access to my data remotely far outweigh any benefits -- which can't be said for Microsoft's treasure trove of personal data.

The hubris from these companies is insane.

"Just trust us, we're the Cloud™ -- what could possibly go wrong?!"

It's unfortunate the vast majority of people don't know any better and easily fall for tech companies' UX dark patterns.

Also, using local account on Windows protects you from about 19 out of 20 critical vulnerabilities:

https://www.computerworld.com/article/3173246/94-of-microsof...

I appreciate your point, I really do, but I think that ship has sailed a long time ago. Your password to that website? If the website is popular and has some financial value, its on the shortlist too. They're not only going after microsoft cloud servers. Yes, a central location makes it easier to get a large dataset, but then again, penetrating some random e-commerse website is way easier than hacking microsofts cloud servers. Your personal data and billing info is already in tons of places, and all those places - are not using the best security engineers to secure it. Your documents? Well unless you're not sending those documents out, they're already on the cloud in some form, everytime you email them to someone, or hand them on a usb drive. The network effects of this are so strong that its simply impossible to escape any of this. Without regulation, there is little chance of reversing these worldwide trends.

>Do I trust Microsoft to safeguard my passwords, preferences and files against attacks, not just today, but over the next ten or twenty years, at a time when Windows isn't really the focus of their business anymore? I'm gonna say a pretty big no to that.

>Do I have any guarantees that, twenty years from now, Microsoft's personal data storage systems won't give way, between budget cuts, incompetent management (twenty years is a long time, maybe Satya Nadella's successor is going to be worse than Steve Ballmer...), technical debt and increasing capabilities from malicious actors? Can I be sure that Microsoft is never going to lower their security standards? That they won't make any compromises that they aren't willing to do today, even, say, if they were on the verge of bankruptcy?

Do any businesses exist that you can apply this guarantee to?

The fact that the state of security or privacy is already bad is no reason to make it worse. Sure, "that ship" might have sailed a long time ago but that's no reason to send the rest of the fleet after it.

At one point, "the ship" of every tide that humanity has turned "had sailed". For example, there was a time when virtually every potent means of human transportation ran on heavily-polluting fuel -- and while we're by no means back to stone-age levels of environmental friendliness, we're still better off than in the 1960s.

> Do any businesses exist that you can apply this guarantee to?

No, but that's also why there is no company that I trust with a significant portion of my data over an indefinite period of time, nor with any data that I'm not comfortable sharing. (In fact, I don't trust any company that doesn't have a good retention policy -- thankfully, the GDPR makes it a little easier to filter those out now).

The value of data increases exponentially with its amount. For example, mounting a convincing ID theft based on passwords to my LinkedIn account and the local computer shop is difficult, but doable, with the right skills and the right motivation, and for reasonably simple things (e.g. impersonating me to get interesting, but not particularly sensitive data from a former colleague who still works at a former workplace). Mounting an ID theft based on all the data that Google or Microsoft store about a person is a whole different story.

Well, I'm saying that you're already trapped in the thing you're trying to avoid. I am too, everyone is. I'm not saying things will always stay the same or that we shouldn't do anything - I mentioned that we need more regulation. I'm just acknowledging that we have only a notional amount of control over our data. The data is distributed over such a large surface area and each node on that graph has a weakness to it. A large node like Google or MS will be a tough nut to crack, but a few small nodes (e.g. 150 million SSNs and other personal info from Transunion) will be far easier.

>The value of data increases exponentially with its amount. For example, mounting a convincing ID theft based on passwords to my LinkedIn account and the local computer shop is difficult, but doable, with the right skills and the right motivation, and for reasonably simple things (e.g. impersonating me to get interesting, but not particularly sensitive data from a former colleague who still works at a former workplace). Mounting an ID theft based on all the data that Google or Microsoft store about a person is a whole different story.

Right, so they would just hack Transunion and directly get SSNs and other personal info on 150 million people. Of course practically speaking, there are no 150 million "new" people who are just waiting to assume the identity of someone else.

Also as an aside if you were given the documents folders of 150 million people, you'd need a massive amount of storage space and compute power to run indexing, de-duplication and other automated tasks on all the various document formats before you can even begin mining any data from it. Though I'm sure the cost of that will come down over the next decade...

"It's too late not to want your life to be spied on, so you need to accept it whenever you see it happening to you. Otherwise you are being naive."

Is that a fair summary of your point?

Well, thats a fair criticism. But I'm saying its like trying to avoid being kidnapped when you're already in the trunk of someones car. Sometimes the trunk is nice and large and roomy... :)

Reply on news.ycombinator.com