Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can't leak users' data if you don't hold it

seancoates.com

Post reply on HN
Print view View original

101–110 of 170 posts

Re: You can't leak users' data if you don't hold it

#101

Post by jethro_tell »

eddd-ddde wrote: post #59
mooreds wrote: post #55

Earlier quoted context omitted.

> avoid saving info so you can't ever leak it I think that this is a good idea. It's similar to the principle of least privilege: keep only what you need to offer the service you are providing. Less risk for the provider, less risk for the consumer. However, at least in the USA, I've noticed an increasing number of companies who have determined that personal data is worth good money. This is why most stores have rewa…

Even without reward programs, couldn't they just associate purchases with a given credit card or similar?

I that no you usually give convent as part of the sign up for the rewards program.

They can track your cards and if they want to track those back to an address and match them all up, not a big deal, but they can sell it if you agree to their turns.

Re: You can't leak users' data if you don't hold it

#102

Post by dj_mc_merlin »

aeternum wrote: post #82
jmward01 wrote: post #10

I agree with the core idea, avoid saving info so you can't ever leak it. I personally think our legal framework should be based on consequences to encourage this mentality more. If you are hacked I don't care even a little that you did everything right, I just care that my information got taken. You should be held liable even if you did what the industry thought was right.

The problem is the core idea is flawed. The same concept (don't store the data) was applied to creditcard account data 10 years ago in many point-of-sale systems. Malware simply evolved to logs the data itself. Not collecting user data in the first place might be a solve, but don't let simply not storing it create a false sense of security. Your user's data is still very much at risk.

That's an improvement. It changes the risk profile from "company whose security practices you have no clue about getting hacked" to "one of my personal devices getting infected with malware", which you can at least do something about.

Re: You can't leak users' data if you don't hold it

#103

Post by tppiotrowski »

I try to follow this mantra on my website. I don't want user accounts so if you pay for something I email you a unique link to access it. No login and password and you can use a burner email address if you'd like. I don't care. I don't worry what happens with my user data if I get acquired because no one will ever want to buy a business with 0 registered users. :)

Re: You can't leak users' data if you don't hold it

#104

Post by SecurityLagoon »

Exactly.

I work in cyber security and I am more convinced by the day that the answer is not having the data to steal rather than attempting to mitigate every possible threat.

This combined with zero trust and 2fa/passkeys will go much further than many other snake oil solutions the industry loves.

Re: You can't leak users' data if you don't hold it

#105

Post by dylan604 »

Retric wrote: post #94
albumen wrote: post #42

Earlier quoted context omitted.

That doesn't mean it's not harming them. Have addicts made the right choice by indulging their weakness?

New and fun isn't the same as addictive. We don't consider people watching TV, listing to the radio, or reading books as addicts yet people decried each of them as they became ever more popular for ruining the youth etc. People like stimulation and seem to indulge when it's new, but most people also get used to it relatively quickly.

I think you're trying to move the goal posts. The apps on the new are absolutely without a shadow of doubt trying to make their users addicted. To even suggest they are not addictive is beyond pale, and makes you look like a not serious attempt at the discussion, or worse.

Your second sentence is null after your first.

Re: You can't leak users' data if you don't hold it

#106

Post by lebean »

filleduchaos wrote: post #91
travisjungroth wrote: post #53

Earlier quoted context omitted.

Because their current solution doesn’t meet their own stated goals. > even if we are competent enough to prevent a leak from ever happening, and even if our users trust us to do what we say, we must be resilient to being strong-armed by a future controlling power (e.g. if someone we don't trust buys us) They could be strong armed into collecting data and then handing it over.

And you as a customer can simply stop using their services if you no longer trust their intentions and (and this is a very clear and straightforward point) the company and the new controlling power would have nothing on you. Because it did not exist in the first place. Why are so many of you so keen for them to be "wrong"? Like what even is the alternative approach here supposed to be? Don't build a product in the fi…

No you see, at any moment this company can get acquired and can start pushing malware as updates. It's quite an elementary mistake to not account for this possibility, and the author of this post should hang their head in shame for even pretending to have a solution. /s

Re: You can't leak users' data if you don't hold it

#108

Post by hirsin »

__MatrixMan__ wrote: post #85
mooreds wrote: post #62

Earlier quoted context omitted.

Passkeys are a start. They have their issues (I wrote about some here: https://ciamweekly.substack.com/p/on-webauthn-and-passkeys ) but at least it is widespread, well supported, standardized, (possibly) anonymous public private key cryptography.

It seems likely that you know passkeys better than I do (you wrote a blog about them after all), so I've got a question. My impression is that there's a server side component. It's not just a key in your device, it's a key in your device that's blessed by someone who maintains a server. My further impression is that the people who manage the servers (either the authenticating-you server or the supporting-auth-for-you…

It's not a server-side component but something integral to the passkey itself. Everything is on the key and there's no third party - just the key, and the site you're authing to. So when you auth with a passkey, it includes some details around "this came from a Feitian model x or yubico model y or bitwarden or...". That's blank, IIRC, if it's Apple.

And then if a corporate type has said "well we only gave our employees Yubikey 3s", they can instruct their idp to only accept passkeys for Yubikey 3s.

This is a tradeoff - their employees can't register legitimate, useful personal passkeys like their phone, but an arbitrary (not dedicated nationstate) attacker is a bit less likely to somehow takeover the account and add a Feitian key. That mismatch is a nice signal to block the user.

But in general, outside of corporate identities, no one has any interest in caring what kind of passkey you use. GitHub doesn't, certainly, outside of resident key requirements, a different bundle of fish.

(and yes, Dan is definitely great at this stuff, read his blog on this stuff).

Re: You can't leak users' data if you don't hold it

#109

Post by cheema33 »

> If one of our users' data became valuable to an evil nation state and they kidnapped my family, I'll be honest, I'd probably have to hand over the data.

How is this prevented, when the evil nation asks you to modify the code to your app to do what you said you wouldn't do? i.e. Steal the data.

Re: You can't leak users' data if you don't hold it

#110

Post by gnicholas »

cheema33 wrote: post #109

> If one of our users' data became valuable to an evil nation state and they kidnapped my family, I'll be honest, I'd probably have to hand over the data. How is this prevented, when the evil nation asks you to modify the code to your app to do what you said you wouldn't do? i.e. Steal the data.

Easy: have a livestream of his family and if they’re ever unexpectedly absent then assume that a backdoor was just installed.
Post reply on HN