Hacker News Reader

Comment by debacle | Hacker News Reader

No one should have any expectation of privacy for anything they put on the Internet. Privacy is something you have to work for, and unless you have those controls (PGP, encryption at rest) in place, privacy doesn't exist. Even if you have those things in place, your privacy is only as strong as the privacy of the people you are communicating with.

We should work towards strong privacy as a default, but the service delivering targeted ads is not incentivized to protect your privacy.

View on HN

Some of this stuff, sure, it's not necessary at work so you are taking a risk of it becoming public for no reason. But some of it is necessary in a corporate office. I have emailed HR questions about medical insurance or 401ks that I wouldn't want to post on my Twitter. Identifying the beneficiary of my life insurance policy doesn't seem like something I want many people to know, yet HR has to. What else are you supposed to do than use the internal systems? You have to trust IT/Security with that stuff.

> No one should have any expectation of privacy for anything they put on the Internet.

Right, except Joanna Public does have this expectation and continues to do so because of manifestly poor public education about the risks of the internet. We should literally have lessons about this stuff in schools.

And as another commenter stated, these things were not "online", they were "on a computer". If I can have no expectation of privacy for things I put on a computer then that is going to lead to no expectation of privacy under any circumstances. This stuff is going to have profound social consequences and something has to change.

I did receive education on the risks of the internet, starting in elementary school (around 4th grade). In grade school we where given school-district emails, which we used to communicate with teachers, get information from the school district, and could use to talk to other students.

I still remember when we where first given these, because our teacher gave a very long warning about using the internet. I remember the exact phrase "whatever you put on the internet will be there forever, and you can never take it down. Think about that before doing anything."

This was about a decade ago, but I grew up in Redmond, Washington, so my education is probably very different from other peoples (at least regarding computers).

Nah, that's the same education we got in 1995 in high school, too. What happened in the interim is that there were a couple of dot-com bubbles where companies encouraged you to share recklessly because they built business models on it. Ignore all that safety stuff. So I see all these services pop up that ask you to do things we were always taught not to do, it created intense feelings of unease in me, but everybody did it anyway. And then nude pics get hacked and shared, people get harassed/fired because of a global Facebook tweet saying something stupid, and everybody acts like it's a big fucking surprise when all they had to do was follow the rules. But the rules conflicted with the merger of narcissism and corporate profits.

What about privacy when applying for a job?

When I apply for a job, I'm not putting my content online. But that's all the Sony employees have done, and now they're directly in the crossfire.

And a lot of this wasn't even "online", where online is defined as "internet-facing". Once someone it in your network, it doesn't matter what is internet-facing anymore.

But this wasn't "put on the internet". This was the internal corporate network. The normal "put on the internet" rules aren't supposed to apply.

Unless that internal corporate network is airgapped, it was put on the Internet for all intents and purposes.

If we're talking about the general public here, I think we're going to want to come up with more nuanced guidance than "Don't store private data on any internet-connected computer, ever."

I think the better solution is to just assume insecurity. Don't send dick pics to anyone, etc.

Maybe we're talking past each other here-- there's a significant qualitative difference between the risks of uploading data to a globally-routable server somewhere, and storing that same data on a firewalled, password-protected system on an internal network which could theoretically be owned from outside.

The former is obviously unsolvable, and "don't transmit anything you don't want shared" is good advice. But surely we want to arrive at a world where typical end users can feel secure about the data on their own computer, even if it is plugged into an ethernet jack.

You should feel relatively secure, but you should not be amazed if that information gets copied/stolen.

Aren't those things logically inconsistent? If I feel secure about my data, it means I have a strong expectation that it won't be stolen.

But again, we're talking about different stuff. Obviously the people reading this, who know what "zero-day" means, won't be shocked by any individual attack. That doesn't make it a good idea to encourage end users to believe that all computers are inherently untrustworthy. Normatively speaking, we should set an expectation of high security in general, s.t. normal people can have faith that if they use recommended software, and follow the rules, they're safe at least from non-state attacks.

After all-- if computers are inherently untrustworthy, why should users bother to follow the rules? (From the sounds of it, that might be exactly what happened to Sony.)

No.

Put on a networked machine, maybe. But despite the buzzword-lathered Cisco releases, there is such a thing as "internal networks" and heightened security zones. Your bank account being on a server in a datacenter doesn't make it "on the Internet", and there is absolutely a higher expectation of privacy when sending messages on a protected email exchange vs. IRC on Freenode.

Yes, and this incident proves that that expectation is wrong.

The incident proves that Sony is incompetent and didn't prioritize cybersecurity the way an information-based company should.

The network is a lot more porous these days, but if your bold assertion were as serious as you think, then every bank in the world would be popped. Sony was the slowest deer.

So, don't give your employer your social security number or any other sensitive data? And still expect to have a job and get paid? That doesn't seem like a tenable plan.

Thank you for saying this. Events like this make it clear how much everyone exercises extreme wishful thinking in these situations. Nothing about these systems is secure, and no one should have that expectation.

It's unfortunate, but it's true.

There has to be a range of options. Strong privacy is simply expensive to do well and not everyone cares to do it well. We should expect strong privacy from institutions that need it (any government, including municipal, and organizations such as AT&T) and give out pseudonyms to others.

Your employer should be competent to keep your personal data secured as well, and they likely will have to do that by selecting a reputable provider for HR operations services.

Yes, we should "work towards" strong privacy by default, but since we'll never get there we need to accept alternative models.

You're basically saying that nothing on a networked computer should be considered private, including all the authentication details, which kind of makes banking (and bitcoin!) meaningless.

Reply on news.ycombinator.com