Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Silicon Valley is terrified of California’s privacy law

techcrunch.com

Post reply on HN
Print view View original

531–540 of 553 posts

Re: Silicon Valley is terrified of California’s privacy law

#531

Post by scarejunba »

afiori wrote: post #519
scarejunba wrote: post #401

Earlier quoted context omitted.

No one's performed a proper survey AFAIK, but the GDPR opt-out rate is very very low, which provides weak evidence. This is not evidence of numbers, but I have an existence proof in that I also personally know a lot of people who know and insist on not opting out.

At best this proves that this law is harmless.

I don't think the law is harmful. I'm considering the absence of opt-outs and the general prevalence of opt-ins evidence of people not being eager to opt-out.

Re: Silicon Valley is terrified of California’s privacy law

#532

Post by 1000units »

emiliobumachar wrote: post #508
1000units wrote: post #454

Earlier quoted context omitted.

People are looking.

Not that I'm doubting you, but could you please provide sources?

I will not. This is both common knowledge and common sense.

You can easily find articles about sufficiently low-level drones getting fired from Facebook for snooping if this is an authentic query.

If you have trusted friends in tech, you can ask them even better.

Re: Silicon Valley is terrified of California’s privacy law

#533

Post by loup-vaillant »

aetherson wrote: post #334
loup-vaillant wrote: post #301

Earlier quoted context omitted.

> The entire premise of free exchange is that I give you my services in exchange for something of value of yours. Not if the thing I value is my personal data. Because I, as a typical short sighted consumer, will consistently underestimate the value of my data, as well as how my data affects those around me (extreme case: my data is my social graph, which you can use to reconstruct the social graph of my acquaintance…

You used the first person pronoun a lot there. Do you yourself actually feel that you are short-sighted and that you consistently underestimate the value of your data? Or are you putting yourself in the place of a hypothetical other person?

Hypothetical. The post I replied to used "I" and "you", so I used "you" and "I". That said, I genuinely don't know how much my data is worth…

Re: Silicon Valley is terrified of California’s privacy law

#534

Post by jkp56 »

mirimir wrote: post #149
yuliyp wrote: post #105

Earlier quoted context omitted.

Do you have an error log on your web server? Does that only collect data that is essential or do you do something like log a referer or IP address or user id in hopes that it might be useful un debugging. Is there an access log? What happens if a user asks to delete their data. Do you go back and scrub all such logs? What about if you have a backend service that logs errors about what data it had problems accessing.…

I'm no expert. But typically, when installing web servers, I don't enable logging. I'm more familiar with the issue of logging by VPN services. And I've been assured, by someone who runs one, that logging isn't necessary. Everything can be done in real time, with any "logs" retained briefly in RAM.

I'm an expert. The correct answer is to not log any PII data. Logging obvious PII because it might be useful in some hypothetical future sounds like plain incompetence. If you really need to log PII, log it separately and set clear policies about how this data is stored, how it's replicated, who can access it. If you need to log some PII IDs in common logs, use some fuzzy hashing: good enough for logs, not good enough to restore the original PII.

Re: Silicon Valley is terrified of California’s privacy law

#535

Post by JohnFen »

chroma wrote: post #419
JohnFen wrote: post #368

Earlier quoted context omitted.

> I hope that's an accurate summary of your view. It's not, really. I object to data about me or my use of my machines being collected without my permission at all. Past that, I object to it being shared with others. What it's used for is beside the point. Marketing companies come into it simply because they are the most egregious bad actors when it comes to those two points.

I'm sorry I misunderstood you. > I object to data about me or my use of my machines being collected without my permission at all. Past that, I object to it being shared with others. What it's used for is beside the point. What can I engage with here? I'm trying to figure out what bad consequences you're worried about, but you seem to have a terminal value that companies shouldn't be allowed to keep information you se…

Yes, in the interests of brevity, I've omitted a lot of nuance. Let me try to add some of that back in.

I do not object to data collection that is technically necessary to provide services. For instance, I don't object to web server logs.

I also don't generally object to sites using data I have willingly provided for their own purposes, as long as they aren't doing things like sharing it with other entities or combining it with data about me that they have obtained with other entities (unless I have given consent, of course). So I have no problem with your wifi hotspot or paywall examples.

Anything beyond that -- which would include your casino example -- requires my express consent. I do think that casinos violate this principle, because they do not inform me of their surveillance before I set foot on their properties. If they did, though, then I would not object.

The essential principle that I operate under is that of informed consent. It's really that simple. Having a relationship with a specific entity carries with it a certain amount of implied consent (web server logs are an example of this) -- but even that data should remain private between me and that entity. Any sharing of it with others requires my express permission. "Sharing with others" includes indirect mechanisms such as using that data to match me with advertisers, even if the raw data itself is not transmitted to others.

Re: Silicon Valley is terrified of California’s privacy law

#536

Post by jkp56 »

This law is a step in the right direction, although in its current form it's toothless and uses disgustingly submissive language (e.g. the user may not out or the user needs to be informed about how theur data is going to be abused). The final goal of such laws should be to poison user data: so that collecting it and storing would open all sorts of legal and criminal troubles and that no company would want to touch user data with even 10 foot pole. This will open more ethical business opportunities that currently can't compete with data mining model. An analogy in real world. If theft and robberry was legal, no other business model could exist: if you sell gas for 3 bucks a gallon and your neighbor sells it for a negative price, but sells user address to theft agencies, you'd be out of business long before everybody realises the true cost of that "free" gas.

Re: Silicon Valley is terrified of California’s privacy law

#537

Post by JohnFen »

vsl wrote: post #450
JohnFen wrote: post #378

Earlier quoted context omitted.

> The privacy agreements of gmail, facebook and what not, serve like a poll for this I don't think they do, given that most people don't read them, and a large percentage of them are written so it's very hard to tell what they are really saying unless you're a lawyer.

That nobody gives a damn and doesn’t even read it kinda proves the point, no?

No. Not reading it is not equivalent to "not giving a damn".

First, having to read a long block of legalese on every visit to a website (which would be necessary because those privacy polices can change without notice at any time) is unsupportable. If people actually did that, it would render the web completely unusable. The average normal person can't be blamed for saying "screw that", nor can their attitude about privacy really be inferred from it.

Second, even for those of us who are more concerned than the average person about these issues, reading privacy policies is a pointless waste of time. Once you have a lawyer interpret them for you, it turns out that the vast majority of them say the same thing -- they are reserving the right to do anything they want with my data. That means that I can safely predict what privacy policies say, so there's no need to read them.

Re: Silicon Valley is terrified of California’s privacy law

#538

Post by laughinghan »

danans wrote: post #436
laughinghan wrote: post #431

Earlier quoted context omitted.

I am 100% okay with HN doing whatsoever they'd like with posts I've made that I haven't deleted. I know they have them. I personally wrote them here with my own two hands. I am 100% not okay with HN doing anything at all with my location information. Why would they have that information in the first place? Why would they keep it? The discussions I frequent are more of a gray area; I favor Maciej Ceglowski's Six Fixes…

> Why would they have that information in the first place? IP based geolocalization? > But all of this is irrelevant to the thread you're replying to, because my user id is anonymous. Just because your hacker news user id is anonymous doesn't mean your account can't have an ad targeting profile built based on it if HN decided. They are sort of independent, and most sites don't care so much about who you actually are,…

To clarify, I happen to be technically sophisticated enough to know that yes, unless I use a VPN, websites can guess what city I'm in based on my IP. But I'm saying rhetorically, as someone surfing the Web, it doesn't feel like part of my contract with HN that they know my location.

Everyone knows no one reads terms of service, but even if people did, they don't generally specify location, just that they collect "information about your visit". Or they might mention that they collect your IP, but most people don't know what an IP address it is, much less have an intuition for how specific of location information it reveals (some probably think you can backtrace the IP and send the cyberpolice after them).

That's why ad targeting profiles shouldn't be built on that kind of incidentally-provided behavioral data. As per the Six Fixes, ads should only be targeted to the content of the page I'm looking at, just like a dead-tree newspaper.

Note that this can be achieved either technically, i.e. anonymous browsing, or legally, e.g. requiring my permission to track me to build an ad targeting profile. That's not a conflict, that's anonymity and control over data about me as two sides of the same coin.

Btw I highly recommended Maciej Ceglowski's other works, e.g. https://idlewords.com/talks/haunted_by_data.htm

Re: Silicon Valley is terrified of California’s privacy law

#539

Post by alxlaz »

drusepth wrote: post #516
alxlaz wrote: post #487

Earlier quoted context omitted.

Not sure about the legal framework in the US but over here across the pond, it's enough if you remove the data when restoring the backups (reasonably easy to do; took me about a day to implement that on an old codebase that I wrote more than ten years ago, and I haven't touched either PHP or that codebase since then...). IANAL but the guy who told us how it's done was, and in addition to all the legal stuff, of which…

>Not sure about the legal framework in the US but over here across the pond, it's enough if you remove the data when restoring the backups Implementation-wise, is the best approach to do this to store some token for "user XX requested YY data be deleted" and check those tokens whenever you restore a backup? I feel like that'd run befoul of a true solution because, in the event of a leak, it could be used to tie the i…

That's pretty close to what I did, except I didn't reference the user who requested removal -- it's just a token that says "data will be removed due to GDPR request". I think there's a requirement to log removal requests, so there are still dots that can be connected, though.

Also, I don't know if it's the best technical approach -- I did just because it's code that I wrote a very long time ago, for a friend who was just starting their business. I took care of it because we're still friends and he asked me if I could take a look at it, but it's the first time I've done backend/web development in more than 12 years now.

I think this is sufficient, even considering things like the potential for data breaches. It complies with both the explicit requirements and the general spirit of the GDPR. IANAL and all but I think that, since data leaks aren't a form of data processing by the company who collected the information, they are outside the scope of Art. 17. There are already requirements in place about the secure storage and administration of personal data.

Plus, if you think of it, the framework of this whole construction provides sufficient assurance. If you have live, online backups which can be restored immediately, with a single click, then it's clearly not a problem to erase data from them immediately. If you have offline backups, you're required to have a retention policy for them anyway, and you can't process data from them anyway -- not until they're restored and you've had a chance to purge them. It's certainly possible that someone might break into your storage unit and run away with your archive tapes or hard drives or whatever, but at that point there's a lot of legislation that you have to worry about having broken before you even get to the damn GDPR :).

Re: Silicon Valley is terrified of California’s privacy law

#540

Post by laughinghan »

danShumway wrote: post #429
laughinghan wrote: post #344

Earlier quoted context omitted.

My shared secret with HN, my password, is an identity? I don't think you'll find a lot of people who agree with that definition of the word. As for the use of photos of me that are owned by other people, I'm pretty certain that neither CCPA nor GDPR cover those. The EU might have some relevant privacy laws, but they're not relevant to the "dichotomy" you brought up, because no one expects to be unidentifiable in a ph…

Your identity on HN is your profile and posts, and your shared secret is how you prove you own that identity. Is that actually uncommon? I would call `laughinghan` an identity. > As for the use of photos of me that are owned by other people, I'm pretty certain that neither CCPA nor GDPR cover those. You're talking about specific laws, and I'm talking about general principles. The dichotomy I'm supposing is between co…

You're making no sense.

If someone publishes a link between my address and my name, or my address and an online handle of mine or something, in order to remove that link I would have to prove that I am the person with that name at that address, or that I am the person with that online handle or whatever, but there's no fundamental reason I would have to further identify myself in any way. There's no conflict between anonymity and control here. Their having that information about me has hurt my anonymity, but controlling that information in no way further hurts my anonymity.

The possibility of corporations being anonymous is not an example of a tradeoff between anonymity and control either. If the operator of a company had the option of being anonymous, that would be giving them more control over information about them. More control = the option of more anonymity, because there's no tradeoff or conflict, they're two aspects of the same thing.

Post reply on HN