Ask HN: What's a good response to “It's fine, I've got nothing to hide online”?

Whenever I try to explain my concerns about online data privacy to other people (family and friends, mostly), the most common response I get is:

"Oh it's fine, can collect whatever they want, I don't have anything to hide."

I try to explain that the kind of data collection (and use/sale) we see from these businesses can be a much bigger concern than just "Facebook knows where I work", but I can never really articulate my thoughts well.

What are some good ways to explain to (primarily non-technical) people why it might be worthwhile being more aware of what data is being collected on them?

I've often found that people don't fully understand the staged process. The fact that, most of the time, it's not what you directly supply to a 3rd party (as that's often innocuous) But the fact that this can be used as a stepping stone to gaining other, more private details.

The example I often use (as it's actually happened to people) is the different usage of the last 4 digits of a bank card.

Some companies will freely throw this info around, as a convenience to the user. In emailed order confirmations, etc.

Other companies, however, use the last 4 digits of a card as a security measure To confirm you are the account holder, please supply the last 4 digits of the card used, or whatever.

Using social engineering, you can play these 2 companies off of each other, and possible gain some extra information A name, a billing address, or whatever.

I try to emphasis that you, the user, are not involved in this at all This is a person going back and forth between various company's call-centres using the info to gain more It's a to-and-fro, initially with only the innocuous information, but by the end you possibly have the authority to order something using the legit card and billing address but delivery to a PO box (sorry, UK terminology here, unsure what the US equiv. of a PO box would be, but delivery to a post office for collection)

I try to steer away from the more outlandish stuff (while true, and in use, people seem to dismiss them - like the recent psychological manipulation used on Facebook) I try to keep it simple, someone ordering some jewellery on your card and collecting it from a PO box, all completely without your knowledge

I also try to emphasis the importance of securing your email account. As someone with access to your email can run through the "I forgot my password" things on various popular sites.

I like the "last 4 digits of a card" thing, as most people have come across this difference User convenience vs. security measure But it's never registered as a potential problem

One might have nothing to hide from one's neighbor either, but one might wonder why he is keeping a detailed log of one's comings and goings, visitors, the times the bathroom light is turned on etc, as well as attaching tracking devices to one's car, bike, skis, and even clothing. One might get really uneasy if one finds out he has been collecting detailed information about one from the grocery store, gas station, movie theater, and restaurants etc.

Even if one is not doing anything wrong, one might feel uneasy about having a "permanent record" of all one's movements tied to one's full biometric information.

>I like the "last 4 digits of a card" thing, as most people have come across this difference User convenience vs. security measure But it's never registered as a potential problem

As someone who is against the facebook data slurp, this is something I'd never really noticed till just now either.

I remember seeing a documentary featuring Edward Snowden, where he said something along the lines:

"Saying "I do not care about my privacy, because I have nothing to hide", is like saying "I do not care about freedom of speech, because I have nothing to say""

This explanation stuck with me, because I find it extremely useful in situations when explaining the importance of privacy online to non-technical people.