Schluss – A secure vault for personal data
schluss.org
Schluss – A secure vault for personal data
1–10 of 43 posts
Re: Schluss – A secure vault for personal data
#2Idea-wise, this seems similar to Tim Berners-Lee's Solid (https://solidproject.org/).
The problem with these approaches is that no significant company is going to do this voluntarily. And this is not going to make a dent until Meta, Apple and friends do it. They are not going to do it because it doesn't give them an advantage, it only makes their lifes harder. It makes it harder even if they don't use the data for anything, because of increased technical complexity etc.
So, this is not a technology problem, but a legal/political problem. Just as the EU is forcing big messaging apps to ensure interoperability now, the only thing that will make a difference here is a law that disallows companies from saving customer data in their own databases. A GDPR 2.0. If you want to make a difference in this space, you need to spend your time pushing new legislation.
I'm sure that in time the EU will get there. And then we will need good tech like Schluss or Solid. But before then, it's not going to do anything.
Re: Schluss – A secure vault for personal data
#3Idea-wise, this seems similar to Tim Berners-Lee's Solid ( https://solidproject.org/ ). The problem with these approaches is that no significant company is going to do this voluntarily. And this is not going to make a dent until Meta, Apple and friends do it. They are not going to do it because it doesn't give them an advantage, it only makes their lifes harder. It makes it harder even if they don't use the data for…
Tim Berners-Lee's startup Inrupt [0] is essentially trying to partner with companies to sell an enterprise version of the Solid Project software. Their website suggests they've partnered with some large-ish companies already[1]. I could see a webpage prompting you for a release of your certain parts of your 'pod' rather than use cookies perhaps.
[0] https://inrupt.com/ [1] https://inrupt.com/solid-enterprise-natwest-bbc
Re: Schluss – A secure vault for personal data
#4Idea-wise, this seems similar to Tim Berners-Lee's Solid ( https://solidproject.org/ ). The problem with these approaches is that no significant company is going to do this voluntarily. And this is not going to make a dent until Meta, Apple and friends do it. They are not going to do it because it doesn't give them an advantage, it only makes their lifes harder. It makes it harder even if they don't use the data for…
Does Solid have a concrete working example? I've tried getting into it, but it seems very academic and with the nitty-gritty details conveniently left out, it gets frustrating trying to work out what exactly Solid _is_.
I don't think Tim Berners-Lee is trying to sell us some vaporware, so has anyone got any pointer?
Re: Schluss – A secure vault for personal data
#5I still don't understand how one can retract access once given. If I share my purchase history with some financial web app and later decide to retract access the web app will no longer get new data, but how can I be sure they don't keep a copy of my old data around? Same with GDPR. I often ask companies to remove my data, and legally they should, but I highly doubt many of them do indeed scrap all my data. I still need to trust the other party to honor my wishes (and follow the law) which makes me wonder if Solid or Schluss can help removing my data.
Re: Schluss – A secure vault for personal data
#6I still don't understand how one can retract access once given. If I share my purchase history with some financial web app and later decide to retract access the web app will no longer get new data, but how can I be sure they don't keep a copy of my old data around? Same with GDPR. I often ask companies to remove my data, and legally they should, but I highly doubt many of them do indeed scrap all my data. I still ne…
> Same with GDPR. I often ask companies to remove my data, and legally they should, but I highly doubt many of them do
I was talking once with a friend who deals with GDPR issues at their company. They said that they’re required to keep a record of deletion requests so it can be spelunked through vendors for a full deletion. This often creates more data than was originally deleted.
Re: Schluss – A secure vault for personal data
#7"Information wants to be free (freely copied)", even when it's information about you. Freely copied means stored in many places. GDPR is in essence reverse-DRM. Normal DRM prevents you from copying and storing some company's information. GDPR prevents companies from copying and storing information about you. And we all know how good DRM works.
Re: Schluss – A secure vault for personal data
#8I still don't understand how one can retract access once given. If I share my purchase history with some financial web app and later decide to retract access the web app will no longer get new data, but how can I be sure they don't keep a copy of my old data around? Same with GDPR. I often ask companies to remove my data, and legally they should, but I highly doubt many of them do indeed scrap all my data. I still ne…
Of course there is still trust involved. Every time you cooperate with somebody else booth of you have some assumption what the other will do. You trust that a webshop will send you your product after you have bought it, etc. To give a foundation for this trust we have laws. It would be illegal to sell you a product and just keep the money without giving you the product.
This is the same with data protection and GDPR. They could just say that they deleted it and keep a copy on their own. BUT using such systems or asking them (in a documented way) to delete your data is a really strong signal from your side what your assumptions are. This will make the fines much higher if a data protection authority would find out that a company kept the data when you have already shown your strong request to delete it. So in a way these mechanism should make it easier for you to trust the other side to do their part because the fines will just get bigger.
Re: Schluss – A secure vault for personal data
#9I still don't understand how one can retract access once given. If I share my purchase history with some financial web app and later decide to retract access the web app will no longer get new data, but how can I be sure they don't keep a copy of my old data around? Same with GDPR. I often ask companies to remove my data, and legally they should, but I highly doubt many of them do indeed scrap all my data. I still ne…
The solution is social, not technical. The relevant authorities have the right to audit the process and do so in certain cases.
Keeping your data after this request has a tiny benefit to the company - not that many people retract access, and one individual's data is not that valuable. On the other hand, intentionally keeping and using that carries significant financial risk of fines if found out; so a prudent organization simply won't do that - otherwise, it'll just be a huge expense for no good reason after e.g. some disgruntled ex-employee blows the whistle on this practice.
Re: Schluss – A secure vault for personal data
#10Idea-wise, this seems similar to Tim Berners-Lee's Solid ( https://solidproject.org/ ). The problem with these approaches is that no significant company is going to do this voluntarily. And this is not going to make a dent until Meta, Apple and friends do it. They are not going to do it because it doesn't give them an advantage, it only makes their lifes harder. It makes it harder even if they don't use the data for…
I agree that this won’t change anything significant until the law makes it mandatory, however a huge step towards getting the lawmakers to do so is tho have the tech already out there and working well with hundreds of smaller players. That will save us years of lobbyists claiming it’s unworkable, to expensive, technically impossible, etc.