Comment by schappim | Hacker News Reader

Comment by schappim | Hacker News Reader

Parent Full thread

For those who haven't read the post, the summary of Tim's Post is:

  Reid Blackman's article in the NYTimes argues that Signal App is dangerous because bad people could use it to plan nefarious activities and the legal authorities wouldn't be able to eavesdrop on them. However, it is impossible to address the downside of the app without completely shattering the upside of protected privacy. Blackman's claims about Signal's ideology are irrelevant because the math doesn't care - people are justified in wanting privacy, and there have been no credible proposals for taking away just the bad people's privacy. Signal is not the only end-to-end encrypted way to communicate, but it is a great piece of software and privacy is good.

I'm really torn on this issue, as I understand both sides of the privacy debate. I am both a strong proponent of privacy, but I'm also an ecommerce business owner.

Unfortunately, the same tools I use personally (VPNs, disposable email addresses, parcel lockers, etc.) are also utilized by fraudsters to make fraudulent orders. At this time, crypto payments appear to be the only viable way I can guarantee my customers' privacy and protect my business; however, the real-world market penetration for crypto is too low, and there are numerous other issues.

This puts me in the sad position where "[complete] Privacy is NOT OK" for my business. I am currently exploring 3D Secure 2, what other options do I have?

How would having a backdoor to Signal help with your fraud issue? Are you sure you're a strong proponent of privacy?

I am attempting (poorly) to emphasize that this conversation requires more nuance. It is possible to be pro-privacy while simultaneously understanding why it is sometimes necessary to reveal private information.

Not sure why your post was downvoted. There is a difference between asking customers voluntarily on your ecommerce site to say pass an AVS check or have an IP address in the same country that their card is from (in my view reasonable) and requiring all communications to go through mediums that the government can read (in my view unfeasible and invasive).

I understand what you're saying, and I also would love a middle-ground.

However, as the article explains better than I could, there's no way to get the upsides of privacy while mitigating the downsides.

We have system for that. Court tells you to do it or else you're punished.

Or a "secret" court does the same...

Something that struck me reading through a collection of Greek myths[1] a couple of years ago is that Hermes (Mercury in Roman mythology) is not only the god of messengers and communication, but of financial gain, commerce, eloquence, communication (including divination), travelers, boundaries, luck, trickery, and thieves.[2]

It's ... as if the ancients over two millennia ago recognised that communications cut multiple ways, and can serve benefit or harm.

From a more recent example, the term "confidence man" comes from Herman Melville's novel of the same title, which takes place on the first great motorised superhighway of the United States: steamboats plying the Mississippi River. Again, travel, and the opportunities afforded by intimacies amongst strangers gives rise to both positive and negative aspects.

The co-evolution of communications, trust indicia and mechanisms, and frauds and trickeries, is constant. James R. Beniger's The Control Revolution addresses this somewhat in its study of business and commercial communications technologies and practices. Trust at a distance, over time, and at scale is particularly challenging.

________________________________

Notes:

1. H.A. Guerber's 1906 anthology The Myths of Ancient Greece and Rome. It's well written and readable, though quite expurgated, with "great care being taken, however, to avoid the more repulsive features of heathen mythology".

2. List taken from Wikipedia's article on Mercury. Guerber's anthology combines the Greek and Roman myths and pantheons.

> I'm really torn on this issue, as I understand both sides of the privacy debate.

There are no two sides. You are one of the customers of security theater. Simple. Nobody who knows what they're talking about in infosec acknowledges email authentication or IP blocking.

> my customers' privacy and protect my business

You aren't protecting anything, just filling checkboxes.

> At this time, crypto payments appear to be the only viable way I can guarantee my customers' privacy and protect my business

How does crypto protect your business?

Like ls15 said, there is no chargeback. This makes it useful for merchants who don't want chargebacks, and customers who want privacy.

There is no chargeback

Well, that's a key feature for many customers; and I'd bet that most people for most purchases would not want to gain privacy at the cost of losing the ability to charge back wrongful payments.

> and I'd bet that most people for most purchases would not want to gain privacy at the cost of losing the ability to charge back wrongful payments.

I'll bet that many customers would appreciate if they could decide if they want one or the other, instead of the shop owner just deciding against their privacy.

For most yes but there is a big use case outside of most. Digital goods/software especially is rampant with friendly fraud, virtual cards with fake balances for trial abuse, etc. Example: https://news.ycombinator.com/item?id=27659172

Reply on news.ycombinator.com