Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can't leak users' data if you don't hold it

seancoates.com

Post reply on HN
Print view View original

71–80 of 170 posts

Re: You can't leak users' data if you don't hold it

#71

Post by jmward01 »

eddd-ddde wrote: post #59
mooreds wrote: post #55

Earlier quoted context omitted.

> avoid saving info so you can't ever leak it I think that this is a good idea. It's similar to the principle of least privilege: keep only what you need to offer the service you are providing. Less risk for the provider, less risk for the consumer. However, at least in the USA, I've noticed an increasing number of companies who have determined that personal data is worth good money. This is why most stores have rewa…

Even without reward programs, couldn't they just associate purchases with a given credit card or similar?

This has been my thinking too. When I make any purchase I am giving everything about myself away now. A long time ago I had the idea to create an 'accountability' e-mail server/credential generator that generated emails/credentials with unique ids along with a note about what it was used for so that you could see exactly who sold your info when you saw junk mail come in. There are now ways to do this but it is still a bit manual. It would be great to have this tied in with auto opt-out and auto reporting of abusers. Of course creating a personal e-mail server now is almost impossible.

Re: You can't leak users' data if you don't hold it

#72

Post by mhuffman »

Terretta wrote: post #21

This is why B2B SaaS should stop charging enterprise price for SSO, and just REQUIRE an IdP or the Oauth/OIDC/whatever flow: https://vaultvision.com/blog/what-is-oidc The user experience is these "continue with" buttons: - https://id.atlassian.com/login - https://www.xsplit.com/user/auth Then you don't have their account creds to lose. Personal data, PII, etc. is risk debt.

But then how can I make billions with targeted advertising using their metadata?

Re: You can't leak users' data if you don't hold it

#73

Post by andrewnicolalde »

wolverine876 wrote: post #70

From their privacy policy: https://matter.xyz/privacy > If we make changes to this privacy policy, we will update it here and update the effective date at the top. (We can’t email you about changes because we don’t collect everyone’s email addresses.) Changes to this policy will not apply retroactively. Effectively they can change it any time and you probably won't know. If they violate it, what power do you have to…

Perhaps it means that a change to the policy can’t be used to justify actions taken that would have broken a prior version of the policy but which don’t violate the new one. Granted, I don’t have a complete understanding of the legal enforceability of a company’s privacy policy.

Re: You can't leak users' data if you don't hold it

#74

Post by jazdw »

xu_ituairo wrote: post #52
jazdw wrote: post #47

Except you can leak data even if you don't hold it. You are focusing on data at rest. Not storing the data obviously helps massively, but a bug or maliciously inserted code could lead to user data becoming compromised.

We shouldn’t let perfect be the enemy of good

We shouldn't make blanket statements

Re: You can't leak users' data if you don't hold it

#75

Post by refulgentis »

wolverine876 wrote: post #70

From their privacy policy: https://matter.xyz/privacy > If we make changes to this privacy policy, we will update it here and update the effective date at the top. (We can’t email you about changes because we don’t collect everyone’s email addresses.) Changes to this policy will not apply retroactively. Effectively they can change it any time and you probably won't know. If they violate it, what power do you have to…

This is exactly as good as it gets as a privacy extremist - if they don't have your email, they won't send it, if they change it, the changes won't apply to you.

They explicitly ruled out using your data according the new policy - retroactively means, if they update it, the updated version doesn't apply to you.

Re: You can't leak users' data if you don't hold it

#76

Post by YeBanKo »

alistairw wrote: post #54
YeBanKo wrote: post #37

Earlier quoted context omitted.

Their website is an epitome of idiocy of modern web product design. They want my email, because we are all "stardust". There is no clear explanation of what their product is or how it's different from a photo app and a notebook. Instead of a proper description of their business, they send to the Business Insider article about the founder who wants to prevent unhappiness.

I was reading your comments as a classic overly negative hn comment but then went straight to that website and wow, yep that's bad. I can't tell if they're trying to sell me groundbreaking new brain scan technology or very dodgy supplements. Possibly one of the most vague product sites I've seen and there are a lot that come up on here. I'm surprised this happens in tech so much. I feel I'm always very aware of peopl…

This is definitely a thing.

Few years ago I was at a cloud conference and met who worked for a failure large and known security company in a tech position. They have all kinds of offerings. While he was talking to someone, I decided to speak to one of their sales guys. I shared a bit about what my company did and what kind of infra we were using and then asked him what they offered and specifically what they could offer to us. This was one of dumbest conversation I had ever had. The guys had no f*cking clue what his company was selling beyond "we sell turn key enterprise security solution", it was so painful. I even tried to steer him into trying to sell us some vulnerability scans or traffic analysis for threat detection.

Yeah, I get it, it maybe niche, he is in a non technical, they have many offerings, he hadn't been there too long (iirc about a year, which is long enough for sales), but it was still unacceptable. To me it's the same phenomenon – lack of clarity in communication – not exactly sure what the root cause.

Re: You can't leak users' data if you don't hold it

#77

Post by 1vuio0pswjnm7 »

jmward01 wrote: post #10

I agree with the core idea, avoid saving info so you can't ever leak it. I personally think our legal framework should be based on consequences to encourage this mentality more. If you are hacked I don't care even a little that you did everything right, I just care that my information got taken. You should be held liable even if you did what the industry thought was right.

Data centers could be closed, removing their negative environmental impacts.

Re: You can't leak users' data if you don't hold it

#78

Post by bamnet »

forgotmyinfo wrote: post #4

What happens when Matter gets acquired? I'm sorry, but all this self back-patting is a bit too little too late for this jaded guy, especially because a thousand other companies have made the same promises in cheery blog posts, before something happens and my social security number winds up on a sticky note on some hacker's monitor in Belarus. Hell, I've worked for companies where I was forced to break users' trust be…

This isn't just a theoretical point. Chrome extensions are the canonical example of products which start off with the best intentions, get acquired, and then ...

Re: You can't leak users' data if you don't hold it

#79

Post by RajT88 »

_yb2s wrote: post #69
mooreds wrote: post #55

Earlier quoted context omitted.

> avoid saving info so you can't ever leak it I think that this is a good idea. It's similar to the principle of least privilege: keep only what you need to offer the service you are providing. Less risk for the provider, less risk for the consumer. However, at least in the USA, I've noticed an increasing number of companies who have determined that personal data is worth good money. This is why most stores have rewa…

Yep... I think already companies have a profit incentive to not keep data they don't think will provide them value. They are keeping the data not because they are not thinking about security, but because the data is valuable to them, either to sell to a 3rd party or to better target/market to specific customers.

A lot of companies seem to pay to keep data they are not using.

Some because they forgot, some because they have not figured out how to monetize it yet.

Re: You can't leak users' data if you don't hold it

#80

Post by wolverine876 »

refulgentis wrote: post #75
wolverine876 wrote: post #70

From their privacy policy: https://matter.xyz/privacy > If we make changes to this privacy policy, we will update it here and update the effective date at the top. (We can’t email you about changes because we don’t collect everyone’s email addresses.) Changes to this policy will not apply retroactively. Effectively they can change it any time and you probably won't know. If they violate it, what power do you have to…

This is exactly as good as it gets as a privacy extremist - if they don't have your email, they won't send it, if they change it, the changes won't apply to you. They explicitly ruled out using your data according the new policy - retroactively means, if they update it, the updated version doesn't apply to you.

> if they don't have your email, they won't send it

They could post a notice in their app, for example.

> They explicitly ruled out using your data according the new policy - retroactively means, if they update it, the updated version doesn't apply to you.

I think it's much more vague than that. Maybe it's not retroactive to prior actions of theirs or to prior data they had. You're assuming it's not to prior users.

Post reply on HN