Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The GDPR blog post

medium.com

Post reply on HN
Print view View original

111–120 of 144 posts

Re: The GDPR blog post

#111

Post by richardwhiuk »

comex wrote: post #81
TeMPOraL wrote: post #65

Earlier quoted context omitted.

Hashing should be done with salt for precisely that reason.

If you mean a static salt, that could help mitigate against hacks (if the attacker has access to the database but not the code), but where adtech is concerned it's probably more realistic to assume that the datasets they're using were disclosed willingly. If you mean using a different salt for each address, that could work for some use cases, but it wouldn't work for the use case described in the blog post, since Tou…

Why is it reasonable to assume they were disclosed willingly? That sounds like a startling assumption and the reverse of the one I'd make.

Without good evidence, you must assume they were disclosed unwillingly.

Re: The GDPR blog post

#112

Post by csomar »

TeMPOraL wrote: post #14
baq wrote: post #6

I got a few dozen gdpr emails today, some from companies I didn't know existed. This law is a fantastic development for end users/consumers.

Yup. Today I opened my fridge wondering if I'll see a note about an updated privacy policy inside. It's ironic seeing that the law was in power for the last 2 years, but companies woke up only last week. A lot of those mails are only information, with no (clearly marked) link to a consent panel, so I assume that me ignoring them means they won't be allowed to spam me anymore.

> so I assume that me ignoring them means they won't be allowed to spam me anymore.

In my case, many of them assumed silence as accepting the new terms.

> We encourage you to take the time to review our revised Privacy Policy and Terms of Use. By continuing to use Microverse on or after May 25th, 2018, you acknowledge our updated Privacy Policy and agree to our updated Terms of Use.

> What do I have to do? You don't need to do anything as these changes will automatically apply to you. If you don't want to accept the changes, you can unsubscribe below and we will remove you from our database.

> Opt out: If you have not already opted out of receiving marketing communications from Bugsnag and would like to, you can do so at any time.

> We are clarifying that all of our users, no matter where they are located, may contact us at any time to review the personal data that we have of theirs, request that we delete that data, or withdraw their consent to receive promotional announcements from us.

> The updated Privacy Policy automatically comes into effect for all Envato users on 25 May 2018. So your continued use of the Envato sites from that date will be subject to it.

Re: The GDPR blog post

#113

Post by netsharc »

merinowool wrote: post #49

So far I have received over 300 GDPR emails. When I am supposed to read all this? How do I track it? How can I track what each company stores about me? Do I feel this in any way improved safety of my data? I don't think so.

300?! You must subscribe to a lot of things...

Then again, I've used my throwaway account to subscribe to a lot of things, I feel like I've gotten around 20 GDPR mails so far, why don't I have more? It's interesting (and scary) how many sites I've not dealt with for years still have my data.

I guess we're all free to ignore those emails, if you don't really care that they have your data (as has been the case until today).

Re: The GDPR blog post

#114

Post by aychedee »

comex wrote: post #81
TeMPOraL wrote: post #65

Earlier quoted context omitted.

Hashing should be done with salt for precisely that reason.

If you mean a static salt, that could help mitigate against hacks (if the attacker has access to the database but not the code), but where adtech is concerned it's probably more realistic to assume that the datasets they're using were disclosed willingly. If you mean using a different salt for each address, that could work for some use cases, but it wouldn't work for the use case described in the blog post, since Tou…

It's really no problem to do this. We're using a variation on this: https://unix.stackexchange.com/questions/158400/etc-shadow-h.... The output of crypt (where the input is an email address) is pretty useless if we did suffer a data breach. They'd have to hash every known email address with that salt in order to figure out who had declined an invite from us.

Re: The GDPR blog post

#115

Post by varjag »

jacquesm wrote: post #102
varjag wrote: post #21

Earlier quoted context omitted.

You're joking, but my fridge did hand me a GDPR notice in the morning: https://twitter.com/varjag/status/998496423019778048

That's fairly incredible. A friend bought a Samsung smart TV, but after reading the EULA (which of course they spring on you after powering it on rather than to inform you at the point-of-sale) decided to forego the smarts in the TV. Those things track just about everything, your fridge apparently is still relatively mellow. Did it open without you clicking 'ok'?

Yeah, I think it was pertaining the Samsung network account only. For secondary features like calendar sync, app control etc.

Re: The GDPR blog post

#116

Post by drusepth »

baq wrote: post #62
merinowool wrote: post #49

So far I have received over 300 GDPR emails. When I am supposed to read all this? How do I track it? How can I track what each company stores about me? Do I feel this in any way improved safety of my data? I don't think so.

In theory, if you don't reply, all these companies should stop using your data and quite likely delete it. Sounds like improving safety for me.

It sounds pretty tedious to sift through 300+ emails to find everyone you want to keep using your data and go through whatever process they have for replying.

Re: The GDPR blog post

#118

Post by jacquesm »

varjag wrote: post #115
jacquesm wrote: post #102

Earlier quoted context omitted.

That's fairly incredible. A friend bought a Samsung smart TV, but after reading the EULA (which of course they spring on you after powering it on rather than to inform you at the point-of-sale) decided to forego the smarts in the TV. Those things track just about everything, your fridge apparently is still relatively mellow. Did it open without you clicking 'ok'?

Yeah, I think it was pertaining the Samsung network account only. For secondary features like calendar sync, app control etc.

I meant the fridge ;)

Re: The GDPR blog post

#119

Post by varjag »

jacquesm wrote: post #118
varjag wrote: post #115

Earlier quoted context omitted.

Yeah, I think it was pertaining the Samsung network account only. For secondary features like calendar sync, app control etc.

I meant the fridge ;)

Sure enough! But we don't discuss important things in the kitchen from now on.
Post reply on HN