The privacy wars are about to get a whole lot worse

It's such an uphill battle, though. There are many clever ways you can be tied across websites.

Unless you are using some sort of VPN or proxy that's constantly changing your IP as you're browsing, and a browser that consistently changes or masks fingerprintable information and wipes all persistent tracking beacons, then what you're doing is not even remotely sufficient to evade tracking by any entity. What you're doing is definitely not enough to avoid Google or Facebook.

At this time I believe nothing can do this with 100% effectiveness. The closest would be to use Tor Browser and never disable NoScript and only use sites that don't rely on JS... but even then there are many theoretical workarounds, many more to come in the future, and probably various unknown techniques currently being tested or deployed.

I know enough about the technology to realize it saves me a lot of time, effort, and stress to just accept my fate. I no longer include ad networks or big tech companies in my personal threat model, even though I dislike what they're doing.

I guess the details are still not known? I was confused by the target hack in my earlier comment(sorry). That was where hvac contractors had their credentials stolen, and malware was installed on their pos system. The home depot hack was malware suspected to have been installed on their self checkout machines[1].

" it shouldn't be the customers who suffer when this happens. The people that made it so easy for my personal information to leak, the ones who necessitated that my personal information even be required as part of the transaction, should be the ones feeling the pain"

I get what you mean about some services collecting everything they can, and not taking the best possible care of it. I agree with you there. I was trying to point out an exception where there isnt anything that can be done. For example, try and stop finfisher :)[2] Companies will get hacked, and it is not always negligence. I was trying to point out that you wouldn't blame a shopkeeper if an armed robber stole credit card info, but if he left it in an unlocked room then we should. And I dont think either home depot or target were collecting more than they needed to.

PS, if anyone has a link as to how we can be more proactive about working with law enforcement to catch the fraudsters, I would love to see it. Either from the point of view of a consumer, or service provider.

1. http://krebsonsecurity.com/2014/09/home-depot-56m-cards-impa...

2. http://news.softpedia.com/news/finfisher-s-account-of-how-he...

> there were also credit card hacks/leaks(and an nsa leak) that were the result of malicious contractors.

Wouldn't the negligence just be that they had access to the unencrypted credit card numbers?

Ok, so I was confusing the home depot hack mentioned in the article with the target hack, but I dont want to edit my comment after so much discussion. I also want to point out that i was trying to show an exception, not to say that noone should ever be held accountable for a breach.

In the target hack, hvac contractors had their credentials stolen, and malware was installed on their pos system. The home depot hack was malware suspected to have been installed on their self checkout machines[1].

So no, they never allowed anyone access to the unencrypted credit card numbers. Negligence is failure to exercise reasonable care.[2] Bad things happen, and even more so when sophisticated criminals are attacking you. It is impossible to create a fully hack proof system. I would say allowing a sql injection is negligence, but when people are using sohpisticated attacks, there is nothing you can do.

1. http://krebsonsecurity.com/2014/09/home-depot-56m-cards-impa...

2. https://en.wikipedia.org/wiki/Negligence

There was an attempt to come up with a UCC for services, within the US, though it failed to garner sufficient support: UCITA.

It's not clear to me how some breadth of interests couldn't be addressed. The usual T&C generally address limits on liability of the site's owners, occasionally try to impose binding arbitration or limits on class action suits (among my complaints against the so-called "Kinder, gentler Reddit", Imzy), jurisdiction, reverse-engineering clauses, etc.

Allowing users to specify licenses for submitted works would address much of your concerns. A standard set of merchandise clauses, including, say, escrow, liability, and chargeback terms, might be among the boilerplate additions to a standard contract which might be made.

But the point is to make the contracts themselves standard and modular. There might be a base services contract, a base merchant contract, and a base rights-for-sale contract, but not infinite variations on each. Also limits on what sites or users might carve out as grantable or transferable rights.

My point in noting that ordinary commerce is limited to a single sale transaction is just that: that these are simple transactions and hence the associated legal binding is also simple. Ongoing relationships are inherently more complex.

There are alternatives to advertising and subscriptions, including non-market constructs.

In the example I posed, the value of the drivers license as a hire surity is that the hirer is quitely likely to return for it. The disadvantage, today, is that the license has not only the attributes of "valuable to the owner", but "hive of data which can be used to draw additional relations".

Some years ago I discovered that the purchase of certain over-the-counter medications required, by store policy though not by local law, presentation of a drivers license. I held up my license for the clerk to visually examine. He tried to take it from my hand, which I refused. He wouldn't close the sale without scanning the card. I walked off without paying and without product.

I've been insisting on respecting my privacy rights for some time, and am not above forgoing business, taking my business elsewhere, or making others pointedly uncomfortable for asking questions I won't answer. Sadly, I am an exception.