Comment by aiiotnoodle
14 hours ago
I'm seriously at a point where I'm opposed to talking to my doctor because the information may be digitally recorded and leaked, going on a flight because my passport may be used to aqquire a loan by cybercriminals, comparing car insurance because my phone will be called by robocallers selling me things or verifying my ID with websites because it might be used to associate my information with whatever else I do online.
I don't think, for a vast majority of cases, these companies I'm forced to interact with can be trusted with my data and it's having a real world negative impact. Even with the best intentions the information is somehow valuable to steal and I'm baffled how it's not secure.
There should be some consequences for companies asking for things like SSN/National Insurance numbers on job adverts or retaining drivers licence photos after test driving a car, they just don't need the data anymore.
I am at a point where I simply stopped worrying and began to love the bomb. I did my best, I really did - degoogled before it was trendy, dropped all social media, built a homelab for complete data ownership, set up matrix messaging with family, and so on - but it feels like a wasted effort at this point.
All my data is out there, one way or another, and a dedicated cybercriminal - or worse, a government entity - can obtain or exfiltrate it without issues. I know it, they know it, everyone knows it.
The only thing I can change now is my reaction to this fact, and although the idea of off grid autarky is tempting, I am not there yet. I just don't want to stop living - flying abroad, going to doctors - I just accept that privacy in the current state of human condition is impossible, and move on with my life.
>I simply stopped worrying and began to love the bomb
This may apply to the consequences of ones data being subject to so many breaches and leaks and thefts, but it should not be the attitude one adopts towards the idea of ones data being taken and used by so many parties. At some level, my data is my personhood - it is my evidence of myself, and my record of myself, and my proof of myself. It encodes who I talk to, what I'm interested in, where I go, and what I do. My health, my finances, my habits, vices, schedule, family, friends, coworkers, beliefs. People more clever than myself use this data to advertise to me; people more powerful use this data to surveil me. When will people more malevolent use this data to persecute me?
I should not have to love the bomb because the bomb will kill me.
Yes, that's the direct subtext of that phrase.
well isn’t the point of the movie that if you have a doomsday-(dead man switch)-device you should let everyone know?
I don’t get that comparison with data being available everywhere
Loss of privacy has no upsides. The bomb, on the other hand, saved many millions of lives over the last 80 years, so it works as a metaphor everyone shares, but the metaphor itself was always much more arguable with nukes. It's possible to actually rationally love the bomb, but what are the upsides for everything about me being exfiltrated at will?
3 replies →
Some of us are more practical than ideological, but we tend not to put as much energy into communicating our views as the ideological types. The result online is an often distorted sense of the universality and importance of ideology. You feel That your data is part of your personhood? I feel that it’s more like tracks in the woods and scat.
To be zen about one's privacy is easier for some people than others.
There are situations in many a person's life that if revealed to the public would have life-altering consequences.
Rather than the world give up, we should have better tools and laws to flood the internet with spurious personal data.
It’s not the current use of the data that’s concerning, it’s its future use. Who’s to say that some facet of your life that is ordinary now will not one day paint you as the target of some future regime? It happened in Europe a few decades ago, and in many other countries around the world.
Yeah, like the way US citizens now are not targeted at all by ICE because their data is out there? Future evil government will not care about your data, they can just invent shit. The idea is to instill fear and uncertainty not "finding the correct people".
On the other hand, said data can be today use because various entities use extremely shitty authentication methods, like just insert your birthday and first name and voila you have a credit with our bank (not an actual example, just for illustration purposes).
Similarly. My browser was carefully containerized, with a ton of anti fingerprinting measures, VPN, Linux, Librewolf, everything. Even on my phone, I restricted whatever possible. Then one day I went to the YouTube main page, and I saw that Google somehow got to know that I played Minecraft again after a decade. I gave up right there. I suffered to avoid this, and it was pointless. I knew at that point already that probably all my PI is public information anyway, but I wanted to restrict whatever possible, and no, everybody sells my data anyway, and it seems that avoiding fingerprinting is impossible without turning off the internet completely, and ditching smart phones.
> Google somehow got to know that I played Minecraft again after a decade. [...] I knew at that point already that probably all my PI is public information anyway
How are you jumping from Minecraft (probably one of the most watchtime-generating content types out there) being displayed on your main page to… your personal information being known to everyone?
9 replies →
>My browser was carefully containerized, with a ton of anti fingerprinting measures, VPN, Linux, Librewolf, everything
Doesn't that just make your browser very unique?
3 replies →
>Then one day I went to the YouTube main page, and I saw that Google somehow got to know that I played Minecraft again after a decade
Did you play minecraft on the same network? If so, I'm not sure why the results are surprising or why it would negate all your efforts. If someone else played minecraft on your network you would also see a minecraft video on your main page I would imagine.
3 replies →
These swings can be avoided by not doing stuff so hard but instead more effectively.
For example, matrix sucks ass. It's terrible. Everything about it is a bad experience. Of course you'd want to eventually stop using it and go back to the previous life.
But that is not the correct take-away.
The correct take away is to include UX (and honesty to yourself about it) in the calculation and to not go all in on an unsustainable compromise, just to then snap back to doing the opposite ca 3 months later.
Same as with loosing weight, really. If you replace 100% of the pleasure of eating with the "right" but unpleasant solutions, you will not be able to keep that diet going indefinitely.
We use xmpp in the family and the experience is good enough. I wish WhatsApp would support official federation and it would be perfect.
This makes me think: how would someone like Mark Zuckerberg handle this for his own internet presence? Or does he sidestep this issue completely by having assistants for nearly everything? I can imagine he doesn't do much more than look at .ppts and fire off emails. Do data brokers have any information at all on this guy?
There's concierge services for this kind of data removal. At a certain level of wealth I assume there are teams working on this with lawyers 24/7.
1 reply →
I bet you could find his SSN if you looked.
1 reply →
The next frontier is to maintain 'limited privacy'.
That's denying most culprits the opportunity to use the collected data against you.
Like always on VPN, turning off personalization, ad guards and using open source products where possible.
> The next frontier is to maintain 'limited privacy'.
The real next frontier is to maintain one or more carefully curated personas with various companies to optimize how they treat you. Wear shabby clothes and fake beards when grocery shopping so that the cameras think you're poor. Security will be all over you, but the digital price tags will give you lower prices as long as you don't have your cell phone on you and they can't get a good face ID because then they won't be able to pull up your actual income level.
Create and maintain specially crafted social media accounts filled with fake hobbies and AI generated photos but never express an actual opinion on anything at all so that future employers can see you have a "presence" but they won't see anything that might disqualify you a job, like your political views.
Buy multiple high/low end devices and rent a closet or PO box in both rich and poor neighborhoods so that you can selectively hand out a mailing address that will make you appear either poor or well off.
Pay someone to take your cell phone out them on friday night so that you can appear more socially active otherwise you'll be flagged as anti-social which can impact employment, raise your health insurance rates, etc.
It's a bit like physical security of your house - could someone break into my house, not easily but it's a house not a bank vault. Keeping our gate closed and having a large dog (who is actually very friendly) about the place probably keeps the vast majority of possible thieves away.
That's still a bit on the obsessive side. The reasonable position is the same as it always has been in the real world too:
- Don't volunteer your intimate details left and right;
- Feel entitled to deny requests for unnecessary data (and advocate for such rights if you're in position to)
- Otherwise don't sweat it, because you can't actually control what others know about you, you never could
2 replies →
I agree.
And most people on the behavioral side do too, but not at the cognitive level. EU is the best example with EU AI Act, strict data regulation as well as privacy rights, on the other hand demanding that Apple does serve the EU with AI.
I have mainly one distinction: the state is the worst protector of your data and the most ruthless gatherer of all your details.
Opposite to the open sourcing of your data in the end by the state are private companies who live by your data but do this for 20+ years - battle tested protection and hardening against malicious hackers.
Security is their business while security for the state is a cost factor.
Being at the mercy of some ignorant politician is not the best way to talk about data security.
Berlin, Denmark - those are the known one. And there are many more to come.
And regarding cognitive dissonance: politicians demanding high standards and punishing data loss ruthlessly on the one hand, giving oneself a pass on a hack is nothing to increase trust into the system.
X got fined for a missing blue mark. Berlin? Denmark? Others?
A second aspect is that the average guy doesn’t get that part of the whole spectrum must be the degooglers, the home server guys.
So it is relatively easy to get data on them as well just by filtering out the other data.
In other words: 95% not doing degoogling makes for a great small sample of 5%. Negating and interpolating other demographic and psychographic factors and you get a great way of gaining insights.
And remember: being the one who is not using google when being around other guys who do - magic.
So my idea is simple: what’s in it for me, and the state offers way lower value than Google and co.
Pick your fate.
> I have mainly one distinction: the state is the worst protector of your data and the most ruthless gatherer of all your details.
How many state data breaches vs corporate data breaches? There are hundreds of state entities with my data (probably thousands), and yet private companies with my data have been hacked more times.
1 reply →
I think both are possible. To have a goal and to accept reality. I would not draw the conclusion that all privacy measures are meaningless. It is hard, but I think it is still worth working towards a goal of better privacy for citizens.
> wasted effort
That depends. One thing is following precautions, another the Principles. Precautions may have a limit ("due diligence done, I'll stop there"), Principles do not.
Remember also that many phenomena occur because the individuals in the masses have not said "no". Acceptance enabled them. So the acceptance of some ill conceived systems is criminal - it is what lets them exist.
Two problems with that:
1. I don't want to love it. I hate it. You can learn to live with things you hate though, and not have it impact your day to day life or mental health though.
2. Its still a bomb. Until we find out how we can de-value the data, it will have an incentive to be stolen.
One thought here that I don't personally agree with, but might be important regardless:
Imagine a society without secrets or privacy at all for example.
I don't personally like the sounds of it, but it is sort of where we're headed at the moment, and if the fundamental reality is that obtaining data is much more easy than defending it, then perhaps we need to come to terms with a world without privacy, and how to create the best version of that unconstrained world.
Again, I don't like the sounds of this, but I'm curious to read more about it. Can someone give a philosophical pitch of why GDPR style regs on personal and company data are so important?
LoL. We are all dancing naked on the table and hoping our clothes and wallet or purse and some of our pride will be where we left them.
Evidence is pretty clear after decades of this: big data breaches are inconsequential for an average person.
They happen all the time, nobody cares, criminals who want to target you will target you anyway, criminals who don't target don't care about you specifically, legitimate entities cannot use this data anyway, and legitimate scammers (marketing) will find different ways to get you to give them the data you need.
At this point I thing privacy obsession is modern copium, a way for people to deal with the fact that we're all individually a speck of dust on the face of human civilization. It's about asserting, "I am not an NPC, I have this richness of experience", and then trying to hide it all in case the world wants to check.
> big data breaches are inconsequential for an average person
A relative killed herself after her therapist was hacked[1] and the data was leaked. If that is inconsequential, I do not know what isn't.
[1] https://en.wikipedia.org/wiki/Vastaamo_data_breach
1 reply →
[dead]
All of the popular surveillance apps correlate your email address and phone numbers mostly, but if you used 1@gmail.com to sign up for 2@gmail.com google knows and marks it as your altnerate account, it could give them all your 30 rando gmails, you're then linked by phone activations through those emails to everything else, whatsapp, telegram, credit card purchase, etc. the biggest link in the chain is always the phone number though. They also have a big "Alternate Emails" button. Everything fans out from those.
I don't know how deep palantir can build profiles on someone, like digging into comment histories and extrapolating you are x y or z sort of stuff. I'm sure they've learned a lot about people via public irc logs and discord servers. But the only screenshots I've seen have been way more simple than that, basically a facebook UI that gives them buttons for all the apps with the phone # that has been identified as you the user, so it would be your list of social media apps accounts and they just click in and read messages. These screenshots have popped up in court cases recently.
We need to stop using the same phone numbers and rotate them constantly. Ideally back to something like fi that masks your "real" isp account phone number. They need to stop being a 2fa and especially stop being able to identify a person. Carry a dumb 2fa. I've always been on the "dont ask for my phone number to use your service" bandwagon but absolutely now.
And now some banks are doing instant voice recognition. I don't pick up my phone for any number I don't know anymore.
>I just don't want to stop living - flying abroad, going to doctor
Good, you're not throwing out the baby with the bathwater. I don't get why you think throwing out the bathwater itself was wasted effort though.
The point is to get rid of things you can live without. If you're going to get rid of something but then spend every day thinking of its absence, then yes, that may be bridge too far. Otherwise, getting rid of it has some value.
I don't see the harm of asking, "Do I need this entity's services enough to justify forking over this data" for every entity that you interact with. Everyone draws their line in the sand at a different place. Data hygiene is a good phrase for that reason, everybody's acceptable level of hygiene (or lack thereof) is different.
I gave up when i realised Firefox had google analytics and noone even knew or cared. That was about 10 years ago now.
Because it did not. Extensions page used them but nothing else.
7 replies →
> I'm seriously at a point where I'm opposed to talking to my doctor because the information may be digitally recorded and leaked
And then add on that fact that my doctor recently started using some kind of AI voice transcription app that listened to our entire conversation. Except that it hallucinated details I absolutely did not say, which are now in that doctor's records and I'm sure will be taken at face value in the future.
It's maddening.
It is definitely worth asking for a copy of those notes, verbatim, as-is from the automatic transcription, to check for errors while the session is fresh in your mind.
If your doctor is worth seeing at all, they will be glad for the corrections.
I recently needed a lawyer on something that involved lots of highly sensitive PI.
Sending my file over to lawyers in a semi-safe way has proved impossible.
And in any case, i received an answer with lots of PI over a plain email…
Absolutely maddening
Was Signal an option you have considered? It's designed to be secure even if the user is non-technical.
Why? I would assume encrypting and sending the key via a different channel would be sufficient. Or are lawyers still not technically apt to do so?
Then lawyer replies in plain email discussing those very things...
2 replies →
“We can’t open this”
It was .7z with strong pwd. The normal zip is supposedly too weak according to llms
If normal people aren't, I wouldn't expect lawyers to be either. If there's no happy path to encrypted communication, then it will not happen.
1 reply →
I have another solution. I look normal online when filling out information. I use Facebook, whatever.
But whenever possible, I lie. Different name, birthdate, every question about "favorite pet"? A lie. "They" have tons of data on me, but more and more is wrong. Let it leak.
I use my password manager to maintain unique answers to all of the useless verification questions about pets, movies, teachers, etc. Only way to scale it.
I just use the noun in the question. The name of my pet is pet, my favorite movie is movie, and I attended High School. Add your own standard prefix if you want it impossible to guess. Nobody will know you attended “BLARG High School.”
Then this is something for you https://shop.digitalcourage.de/themen/ak-vorrat/lichtbildaus.... Either get it online, or buy at events like Chaos Computer Congress.
> There should be some consequences for companies […] retaining drivers licence photos after test driving a car, they just don't need the data anymore.
I know it’s modern American tech tradition to make fun of the GDPR, but this is genuinely one of the things it stipulates: You’ll get at least a slap on the wrist, or potentially much worse, if you needlessly keep data around longer than necessary to do the task you had collected it for in the first place.
What punishment does the country of Denmark get here, if you had to guess?
Pretty ironic to be extolling the virtues of the EU's privacy approach on this story in particular...
I was at that point in 2015, at which point my social was already leaked in a major breach, and after which it was leaked two more times in other breaches.
We need HIPAA for businesses. We tried letting them regulate themselves and it didn't work. Businesses need to be forced to compete on the quality of their products/services and not rewarded for reselling customer data to spammers and criminals
I mean why does every hotel need to make a copy of my passport?
It is a basic police requirements on most countries. Hotels must collect visitor id's and keep it for several weeks.
Yeah, it's old-school people control. This said, these days it could be done electronically, without the hotel storing physical information: at check-in, you put your passport in goverment-issued, (hopefully) tamper-proof machines, the hotel confirms length of stay, police server gets the info and that's it; early checkouts, the hotel must notify via some web portal. It would be relatively easy to implement.
But nobody really cares enough to spend money modernising this sort of system.
15 replies →
Not in my, admittedly limited, experience. I've stayed in hotels in at least a dozen countries and under half of them wanted my passport. In the UK it's usually enough to just say my name to the receptionist, they confirm how long I'm staying, ask me to sign a form and tell them my car registration number and then they hand me the key. Quite often there isn't even a form to sign, just a terminal to enter my car registration number to avoid parking fees.
I was asked for my passport in a Premier Inn this summer because they thought I was a foreigner but when I pointed out that I was a UK citizen they dropped the requirement.
In Europe it was mostly Italy and Poland that wanted to see my passport.
The requirement is that they provide some of the information contained in the visitor's id to a police web application. At least, that's how it works here in Spain. But it doesn't mean the hotel needs to take a picture of your id, nor scan it. They just need to transcribe the required information. Yet some would not let you check-in if you refuse to let them scan your id or take pictures of it, that you never know how and for how long will be kept. Of course, you usually don't want to argue after you arrive at some place to make the check-in when the alternative is to sleep on the street.
I politely refused the data collection a couple times just to confirm my understanding, expecting to trigger some discussion in case I was wrong. But hotel staff was perfectly aware of the applicable local rules and just skipped ahead to explaining the most convenient route to my room. Apparently the general assumption among visitors is that they would not ask if they were not required to collect it.
I just tell them they can look at it but not copy it and that's satisfied them, for now. Sometimes had to get a manager in, but never had them deny me fully. I'm sure sooner or later I'll run into a stubborn one and have to scramble for a day-of replacement hotel, and that just adds to my list of reasons to avoid travel.
Travel to Spain and they will not give you a room key until they can take your passport and make a scan of it, often times on an old flatbed print/scanner combo, that they print out a copy on paper to staple to their copy of the invoice and put god knows where. It's been like that for about 6-8 years. No more showing up and paying cash for a hotel room.
You can try to say no, but I don't think you can anymore. I go through this a dozen times a year on my travels there.
This is Spain.
And why are politicians immune to all of this shit??
Why can’t WE spy on them 24/7?
If democracy really worked, and your desire to spy on politicians is shared by enough people, supposedly, you should be able to create your own party which has that explicit goal. Maybe find a few other goals, or you will end up like the pirates :-)
I am writing this because I don't think democracy works as advertised.
Because you are a slave, Neo.
I said it before as well, but it’s because nothing “publicly really bad” happened despite the leaks and stolen information over the past decades. After Equifax breach, everyone got tired, because company survived, and whatever identity theft happens from time to time gets swept under the rug. It didn’t impact most people’s lives, despite leaking half of the US’s SSNs and etc. Then fatigue kicked in, and with subsequent leaks everything just mellowed down, so nobody cares.
I’ve switched to operate with the idea that my information has already been leaked at some point. I should be generally ready to fix the problems if/when identity theft happens, rather than inconveniencing myself and figuring out the third party trust situation.
In France the french IRS leaked infos about the wealth of its citizens and evil thieves cross-checked it with leaks of people who ordered hardware wallet for cryptocurrencies and families are getting kidnapped and tortured. In a recent case three family members have been beaten over two days so that... 40 000 EUR could be stolen.
That's the world we live in.
"Police and thieves", collaborating one way or another (leaking data collected by big brother and then having big brother being very soft on crime is one way to collaborate with evil people), "to scare the nation with their guns and ammunition" (as in the reggae song).
As much as I don't like the cryptocurrency ecosystem, I don't think facilitating and encouraging kidnapping and torture is the way to go.
Shame on the french government.
Two sides of the same coin.
> As much as I don't like the cryptocurrency ecosystem, I don't think facilitating and encouraging kidnapping and torture is the way to go.
The cryptocurrency ecosystem is used to not only avoid taxation but to enable criminal activity. How many people are being held hostage and the ransom will be payed thanks to cryptocurrencies?
I do not like the cryptocurrency ecosystem either. And I totally agree that it should be abolished. It is just a way to finance crime and terrorism.
> or retaining drivers licence photos after test driving a car,
mind that there was a breach recently where all the data was being leaked *the moment it was collected*
so simply controlling retention is not enough. The very fact of data being taken is already a vulnerable part
Last month I had to lodge a complaint with Lycamobile because they arbitrary cancelled my plan, essentially, pocketing some 50 Euro. Trying to follow their very elaborate support extensions maze, I ended up in some Indian customer support center that proved to be completely useless when it comes to solving issues caused by the service provider itself.
However, next week, I started getting calls from other Lycamobile numbers, where it sounded like the same Indian guy, but now he presented himself as a police officer who wanted to arrest my bank account :)
The moral of the story: if you have a phone number, it's been already sold to some shady call center in South-East Asia and it's just a matter of time before they will try to scam you or use your phone for some nefarious purpose. I don't think Lycamobile is unique in how bad their system is and how much they want to extract every last penny from you buy outsourcing every service to foreign companies with zero responsibility and questionable work ethics.
> where I'm opposed to talking to my doctor because the information may be digitally recorded and leaked
Let me say "Hi mate, +1". State doctors? There are territories in which a pharmacological prescription is shared DB only now (where previously they could be on paper - a secret between you, the pen, the paper, the pharmacist and the gods). Private entities? Good luck finding one that does not require a privacy waiver as a condition for the visit. Searching for a medical dock (a dock for a doc), calling them to ask? "This is a recorded message. If you proceed with the call then you agree..." (Hang-up click).
>previously they could be on paper - a secret between you, the pen, the paper, the pharmacist and the gods
Excuse me?
If you weren't paying with cash whoever paid for the prescription (govt, insurance) has a record of it. The pharmacy that filled the prescription has a record of it as well as the doctor who wrote it.
> cash
How can you presume we do not pay with cash?! How can you remotely suppose one sane mind would not use cash for all sensitive private transactions - books, medicines, preferential (profiling) products etc.?
We use cash in general because nobody in Dignity would accept their own daily matters to be recorded and given to multiple untrusted parties¹, not to mention potentially retrievable by even more untrusted parties - of course the matter is much more evident for all transactions over confidential items!
(¹EU here: 12 public-hybrid-private DBs as per the PSD2 legislation.)
5 replies →
> I'm baffled how it's not secure.
Our civilisation needs to face up to the fact the reason is simply: its stored on a connected computer.
Too much is stored in computers. In the EU, you own the data about yourself. In the US, whoever owns the computer owns all the data on that computer - you own nothing and you will love it. We need to make PII radioactive and fine everyone who had that data stored on their computer when it leaked.
No, in the EU, you don't "own" the data about yourself in any meaningful sense. For example, under the GDPR, consent is just one of several potentially available legal bases for processing personal data — in fact, it's the one basis you usually want to avoid as a business if at all possible — which also means that for most uses of your data, you do not have any unqualified right to demand a controller cease processing or remove your personal data.
> they just don't need the data anymore.
Thats the wording of GDPR.. that you should delete data after you dont need it anymore for the original purpose..
Unfortunately, it seems noone is enforcing it enough.
> my passport may be used to aqquire a loan by cybercriminals
In the US, you can freeze your credit, making this impossible (even for yourself).
I’m never going to a therapist after one company leaked all of the patient data / therapy notes for 33k patients.
It looks like you punish yourself unnecessarily, for things that are out of your control.
Whether or not that data exists to be leaked is entirely within my control though.
Thanks, I got a good laugh out of this comment, but therapy is just a tool to mostly learn how to deal with things that are outside of your control.
A therapist reads like the-rapist, in his case, and in many others. It's bandaid on a failing system, a failing society, and instead of fixing the system the victim has to pay the-rapist. Misaligned incentives all over again. To correct this therapy should be free, because the need for it shouldn't exist. Let the tech billionaires pay for it: if they cause the damage, they have to pay the bill. That'll teach them how to prioritize user satisfaction.
> things that are out of your control
That's because of corruption. A system that doesn't want to change because some tits can't be let go of. A well working system would render control back to you.
1 reply →
This is just a general American complaint that has merit on its own, but has nothing to do with the article and is just derailing any discussion about the article itself and driving the conversation to your own personal concerns about something completely separate.
In this case, the EU does have consequences for data breaches where proper protocols are not followed.
Additionally, this is not private information .. most anyone can look this information up. ID numbers are not confidential information like SSNs are treated in the US.. they are just a number to tell person A from person B. You give this number to everyone without thinking about it because it's how every company you interact with identifies you.
In this case a rogue company, or compromised company, used their access to contact the central database to download everyone's information.
In my country we essentially use the same system, except for we still allow companies to download the whole database if they want to instead of making individual queries.
In this case the access to their system was unauthorized, and under GDPR data breaches have to be reported within 72 hours. Companies can't make the decision on their own that it's not a big deal.
[dead]
> I don't think [...] these companies [...] can be trusted with my data
Abusing privacy is the lucrative norm. The laws won't help you and the government is busy with its corporate agenda.
There’s nothing lucrative in abusing privacy, and yes the government is busy but it has nothing to do with a "corporate agenda", any government or any country with more than a few millions of people is busy, agenda or not.