Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can't leak users' data if you don't hold it

seancoates.com

Post reply on HN
Print view View original

141–150 of 170 posts

Re: You can't leak users' data if you don't hold it

#141

Post by caddy »

jmward01 wrote: post #71
eddd-ddde wrote: post #59

Earlier quoted context omitted.

Even without reward programs, couldn't they just associate purchases with a given credit card or similar?

This has been my thinking too. When I make any purchase I am giving everything about myself away now. A long time ago I had the idea to create an 'accountability' e-mail server/credential generator that generated emails/credentials with unique ids along with a note about what it was used for so that you could see exactly who sold your info when you saw junk mail come in. There are now ways to do this but it is still…

Not really, I rented a box from hetzner and have ran mail-in-a-box for over a year now. The IP I was assigned was on the microsoft shitlist for a little bit, but I sent them an email explaining why I was using the server and they took me off the list. Also took a few emails to GMail to get off their spam filter, but a few emails to family and asking them to report not spam (around 3 emails) was all it took. The only server I've ever been rejected by is a corporate email server with very strict settings, but every other corporate email has been fine.

Re: You can't leak users' data if you don't hold it

#142

Post by _heimdall »

cuu508 wrote: post #131
_heimdall wrote: post #98

Earlier quoted context omitted.

I agree with the sentiment here, but I'm not sure how that could ever really be implemented. Our laws shouldn't punish people for honestly doing the best they know how to, especially with a caveat that it doesn't matter if it was industry standard. Not only is that confusing and at serious risk of punishing all the wrong people, it creates incentives to help hack your competition and throw them to the legal wolves.

> Our laws shouldn't punish people for honestly doing the best they know how to Sure, but holding on to data you do not strictly need is not doing the best

Who gets to decide what data is needed?

I'd argue that my bank doesn't need to retain details of my transactions, only the amount paid/owed. For sure they don't need that data indefinitely. Do I legally go after them because I don't think they need that data? And does the defendant in such a case just need to provide any potential use case for a specific piece of data they store?

Re: You can't leak users' data if you don't hold it

#143

Post by loughnane »

textinterface wrote: post #140

I've had ideas for side-projects before, but most times I never actually went to building them because I got too scared of holding private data (sometimes sensitive information such as financial data). I thought of just building offline apps for the browser and letting the user sync data using Dropbox or some competitor, but never found an open source project to facilitate that kind of thing (an actual db that syncs…

I struggle with this too. I've got a side project now that's a django app w/ a typical database setup. I'd _love_ to set up some sort of E2EE along with it, but the support for a novice like me to do that isn't really there.

Maybe once it matures a bit I'll deploy E2EE, but i gather it's a bunch of work.

Re: You can't leak users' data if you don't hold it

#144

Post by pembrook »

mhuffman wrote: post #72
Terretta wrote: post #21

This is why B2B SaaS should stop charging enterprise price for SSO, and just REQUIRE an IdP or the Oauth/OIDC/whatever flow: https://vaultvision.com/blog/what-is-oidc The user experience is these "continue with" buttons: - https://id.atlassian.com/login - https://www.xsplit.com/user/auth Then you don't have their account creds to lose. Personal data, PII, etc. is risk debt.

But then how can I make billions with targeted advertising using their metadata?

While I’m sure there is some, I can’t think of a single B2B Saas product that sells their user’s data for targeted advertising.

That’s more of a consumer problem.

Re: You can't leak users' data if you don't hold it

#145

Post by GoblinSlayer »

jmward01 wrote: post #10

I agree with the core idea, avoid saving info so you can't ever leak it. I personally think our legal framework should be based on consequences to encourage this mentality more. If you are hacked I don't care even a little that you did everything right, I just care that my information got taken. You should be held liable even if you did what the industry thought was right.

What industry thinks is right? We don't have a sound solution for breaches, 20% of attack surface can be covered with formally verified software, that's a lot of effort for a smallish gain, so risk should be mitigated somehow and minimization of data hoarding is an available mitigation.

Re: You can't leak users' data if you don't hold it

#146

Post by pc86 »

mooreds wrote: post #55
jmward01 wrote: post #10

I agree with the core idea, avoid saving info so you can't ever leak it. I personally think our legal framework should be based on consequences to encourage this mentality more. If you are hacked I don't care even a little that you did everything right, I just care that my information got taken. You should be held liable even if you did what the industry thought was right.

> avoid saving info so you can't ever leak it I think that this is a good idea. It's similar to the principle of least privilege: keep only what you need to offer the service you are providing. Less risk for the provider, less risk for the consumer. However, at least in the USA, I've noticed an increasing number of companies who have determined that personal data is worth good money. This is why most stores have rewa…

Do you mean 3-4 decades ago? I've been grocery shopping for myself since the 00s and have never seen a physical punch card being used in a grocery store.

Re: You can't leak users' data if you don't hold it

#147

Post by berniedurfee »

pc86 wrote: post #146
mooreds wrote: post #55

Earlier quoted context omitted.

> avoid saving info so you can't ever leak it I think that this is a good idea. It's similar to the principle of least privilege: keep only what you need to offer the service you are providing. Less risk for the provider, less risk for the consumer. However, at least in the USA, I've noticed an increasing number of companies who have determined that personal data is worth good money. This is why most stores have rewa…

Do you mean 3-4 decades ago? I've been grocery shopping for myself since the 00s and have never seen a physical punch card being used in a grocery store.

Our local convenience stores still use them for various items. Milk card and ice cream scoops!

But no, supermarket chains are all heavily data driven now.

Re: You can't leak users' data if you don't hold it

#148

Post by pc86 »

berniedurfee wrote: post #147
pc86 wrote: post #146

Earlier quoted context omitted.

Do you mean 3-4 decades ago? I've been grocery shopping for myself since the 00s and have never seen a physical punch card being used in a grocery store.

Our local convenience stores still use them for various items. Milk card and ice cream scoops! But no, supermarket chains are all heavily data driven now.

Oh man I would love to go somewhere where they just gave you a physical card.

Re: You can't leak users' data if you don't hold it

#149

Post by mooreds »

ryan_lane wrote: post #97
mooreds wrote: post #55

Earlier quoted context omitted.

> avoid saving info so you can't ever leak it I think that this is a good idea. It's similar to the principle of least privilege: keep only what you need to offer the service you are providing. Less risk for the provider, less risk for the consumer. However, at least in the USA, I've noticed an increasing number of companies who have determined that personal data is worth good money. This is why most stores have rewa…

> I don't have any insight into how they use the data, but why would they offer free things (restaurants offer appetizers, grocery stores offer discounts, etc) unless the value they received was more than the cost of the incentive? Ignoring selling the data to brokers, it's not hard to think of some ways to use the data that's beneficial to both you and them: - Inventory management: You buy something low demand, but…

Thanks. Are these benefits based on your experience/direct knowledge or supposition?

They definitely seem reasonable to me, though I'm not sure they need individually identifiable info for most of them.

> The discount they offer isn't really a discount. It's a price hike for folks without the loyalty program.

Sure, that's just messaging. But as a consumer it feels like a discount when I get 0.50/lb off chicken I buy when I use my card.

Post reply on HN