Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can't leak users' data if you don't hold it

seancoates.com

Post reply on HN
Print view View original

161–170 of 170 posts

Re: You can't leak users' data if you don't hold it

#161

Post by _heimdall »

vharuck wrote: post #154
_heimdall wrote: post #98

Earlier quoted context omitted.

I agree with the sentiment here, but I'm not sure how that could ever really be implemented. Our laws shouldn't punish people for honestly doing the best they know how to, especially with a caveat that it doesn't matter if it was industry standard. Not only is that confusing and at serious risk of punishing all the wrong people, it creates incentives to help hack your competition and throw them to the legal wolves.

The government should assign punishing penalties for leaks that scale with the quantity and invasiveness of the data, and help grow an insurance industry for paying those penalties. That way, the law dictates how "bad" leaks are with fines, and the insurers encourage/require best practices. Externalities become internalities.

Wouldn't assigning leaks a specific value and creating an industry to insure against it make it easier to weigh the relative risk of cutting corners and ignoring risk?

If anything, an insurance policy for it allows the companies to externalize and distribute the fines.

Re: You can't leak users' data if you don't hold it

#162

Post by defen »

travisjungroth wrote: post #125
defen wrote: post #66

Earlier quoted context omitted.

Isn't this an argument against putting any personal information into any app? Signal could turn malevolent tomorrow and start sending all your chats to their servers, which could have life-threatening implications for people vs just potentially being embarrassing.

I put data into Google Docs knowing it lives on their servers. So there’s no problem there. Signal has an open source client. Big difference for these claims.

Do you compile your own open source client for your phone? Or do you install it from an app store? Most people are going to install it from the app store, so I believe my point still stands. What correlation is there between what's in the app store vs what is published in the open source repo? e.g. how do you validate that the app store client was compiled from a specific commit in the open source repo?

Re: You can't leak users' data if you don't hold it

#163

Post by ahaseeb »

Affric wrote: post #57
mooreds wrote: post #55

Earlier quoted context omitted.

> avoid saving info so you can't ever leak it I think that this is a good idea. It's similar to the principle of least privilege: keep only what you need to offer the service you are providing. Less risk for the provider, less risk for the consumer. However, at least in the USA, I've noticed an increasing number of companies who have determined that personal data is worth good money. This is why most stores have rewa…

I am still waiting for digital identity. Not sure why I can’t authenticate myself with these companies based on a private key and any details they want be disclosed to them for whatever reason don’t just come ephemerally from my server. Obviously, you could also have a third party acting in this space for the non-tech savvy. Right now all my data is held by corporate types who don’t give a shit.

some of it has to be with regulations where data retention is required by the law ( Fintech/Telco). Other than that it's to learn more about client and use the data to reach more clients.

In a perfect world, we should have the right to revoke our data access anytime we want, specially when there is a material change in management ( Exit/Acquired/CoFounder left) etc.

Re: You can't leak users' data if you don't hold it

#164

Post by travisjungroth »

defen wrote: post #162
travisjungroth wrote: post #125

Earlier quoted context omitted.

I put data into Google Docs knowing it lives on their servers. So there’s no problem there. Signal has an open source client. Big difference for these claims.

Do you compile your own open source client for your phone? Or do you install it from an app store? Most people are going to install it from the app store, so I believe my point still stands. What correlation is there between what's in the app store vs what is published in the open source repo? e.g. how do you validate that the app store client was compiled from a specific commit in the open source repo?

The Signal Android app has (had?) reproducible builds. You can see what is on the site and in the App Store is the same as when built from source. One person doing this provides some confidence for everyone else.

Still, I’m less confident in saying any other company fulfill’s Matter’s promise than saying they aren’t.

Re: You can't leak users' data if you don't hold it

#165

Post by sunshinerag »

ComplexSystems wrote: post #159

> When users add memories to the app, they'll usually add content such as images. We don't want to (and we don't) hold these, either—at least not in a way we can see them. We primarily store these images on your device, but because the size of this storage is limited, we do have a system for storing assets such as images that have been encrypted on-device, and the actual photo contents or the decryption keys are neve…

I read it as the encrypted data is on the user's devices and not servers?

Re: You can't leak users' data if you don't hold it

#166

Post by sunshinerag »

andai wrote: post #139

> Matter is an iPhone app, so we store data on your phone with Core Data, and in a private database that syncs within your iCloud account, but is set up in a way that even we can't access it. But Apple can? From the title, "We outsourced storing user data to an evil megacorporation" isn't exactly what I was hoping for...

or Google can on Android by the same argument.

Re: You can't leak users' data if you don't hold it

#167

Post by textinterface »

loughnane wrote: post #143
textinterface wrote: post #140

I've had ideas for side-projects before, but most times I never actually went to building them because I got too scared of holding private data (sometimes sensitive information such as financial data). I thought of just building offline apps for the browser and letting the user sync data using Dropbox or some competitor, but never found an open source project to facilitate that kind of thing (an actual db that syncs…

I struggle with this too. I've got a side project now that's a django app w/ a typical database setup. I'd _love_ to set up some sort of E2EE along with it, but the support for a novice like me to do that isn't really there. Maybe once it matures a bit I'll deploy E2EE, but i gather it's a bunch of work.

Hey, after I posted that, I went and gave a second look online to see if I could find something that would allow me to develop a local-first app with offline persistence and syncing capabilities.

I ended up finding some possibilities out there that could potentially help me build stuff. One of them is RxDB [1], which offers WebRTC syncing - you'd still need a signaling server, I suppose, but all sensitive information could be synced E2E-encrypted via WebRTC.

Then there's CRDT's [2], which is a universe that turned out to have multiple possibilities that match (at least partially) my needs. In particular, the next thing I want to take a look at is cr-sqlite [3], which might be just thing I needed to kick-off some side-projects.

I'm posting here cause I just found some hope of not needing to build a traditional client-server app and having to deal with all the hassle involved in securing a server (and with fear that my efforts could be not good enough), and I thought someone else could benefit from getting to know these things.

[1] https://rxdb.info/ [2] https://crdt.tech/ [3] https://github.com/vlcn-io/cr-sqlite

Re: You can't leak users' data if you don't hold it

#168

Post by aeternum »

dj_mc_merlin wrote: post #102
aeternum wrote: post #82

Earlier quoted context omitted.

The problem is the core idea is flawed. The same concept (don't store the data) was applied to creditcard account data 10 years ago in many point-of-sale systems. Malware simply evolved to logs the data itself. Not collecting user data in the first place might be a solve, but don't let simply not storing it create a false sense of security. Your user's data is still very much at risk.

That's an improvement. It changes the risk profile from "company whose security practices you have no clue about getting hacked" to "one of my personal devices getting infected with malware", which you can at least do something about.

It doesn't because many companies believe they are safe simply because they don't "hold" your personal data. If it transits their systems it is still at risk, and those companies are much more likely to have security issues because why invest when they're not "holding" user data.

Re: You can't leak users' data if you don't hold it

#169

Post by loughnane »

textinterface wrote: post #167
loughnane wrote: post #143

Earlier quoted context omitted.

I struggle with this too. I've got a side project now that's a django app w/ a typical database setup. I'd _love_ to set up some sort of E2EE along with it, but the support for a novice like me to do that isn't really there. Maybe once it matures a bit I'll deploy E2EE, but i gather it's a bunch of work.

Hey, after I posted that, I went and gave a second look online to see if I could find something that would allow me to develop a local-first app with offline persistence and syncing capabilities. I ended up finding some possibilities out there that could potentially help me build stuff. One of them is RxDB [1], which offers WebRTC syncing - you'd still need a signaling server, I suppose, but all sensitive information…

Rxdb looks neat. I’ll def take a look. Thanks for sharing

Re: You can't leak users' data if you don't hold it

#170

Post by ingigauti »

Little over a week ago I published a programming language called plang (as in pseudo language).

It does exactly what you are describing in this post, all data is local, has identity (so no passwords), data is encrypted on local device but with ability to sync between devices securely.

Another benefit it has is that the code is verifiable, the app you create is just series of JSON files that anybody can read, do verifiable.

Yet another benefit is that the code is written in natural language, making it easy to understand what is suppose to happen. I call it intent programming. You can see more about it at plang.is

Post reply on HN