All my data is out there, one way or another, and a dedicated cybercriminal - or worse, a government entity - can obtain or exfiltrate it without issues. I know it, they know it, everyone knows it.
The only thing I can change now is my reaction to this fact, and although the idea of off grid autarky is tempting, I am not there yet. I just don't want to stop living - flying abroad, going to doctors - I just accept that privacy in the current state of human condition is impossible, and move on with my life.
This may apply to the consequences of ones data being subject to so many breaches and leaks and thefts, but it should not be the attitude one adopts towards the idea of ones data being taken and used by so many parties. At some level, my data is my personhood - it is my evidence of myself, and my record of myself, and my proof of myself. It encodes who I talk to, what I'm interested in, where I go, and what I do. My health, my finances, my habits, vices, schedule, family, friends, coworkers, beliefs. People more clever than myself use this data to advertise to me; people more powerful use this data to surveil me. When will people more malevolent use this data to persecute me?
I should not have to love the bomb because the bomb will kill me.
I don’t get that comparison with data being available everywhere
Also,it can help you uncover and put behind bars your dangerous political enemies. That the tables may turn and the shoe may be on the other foot soon, that's too abstract of a thought to occur to most of them.
On the other hand, said data can be today use because various entities use extremely shitty authentication methods, like just insert your birthday and first name and voila you have a credit with our bank (not an actual example, just for illustration purposes).
There are situations in many a person's life that if revealed to the public would have life-altering consequences.
Rather than the world give up, we should have better tools and laws to flood the internet with spurious personal data.
How are you jumping from Minecraft (probably one of the most watchtime-generating content types out there) being displayed on your main page to… your personal information being known to everyone?
intermediaries that will be compromised
Except that YouTube doesn't need any of that to recommend Minecraft videos to you. One mundane explanation that seems more likely is that it's the type of content that on average works best on people they don't yet have information on.
Reminds me a little of these "phones listen to everything we say, otherwise I wouldn't have been shown this ad" anecdotes that don't hold up against empiric evidence.
Microsoft would definitely sell data on which IPs have Minecraft users, as would your DNS provider, cloudflare, or your ISP.
It could also be coincidence, though my experience is YouTube's suggestion algo is very tightly tracked to use data. (What I was fed on a guest account recently was a mix of fascist propaganda and AI nonsense masquerading as reportage.
If phones weren't listening technology like audio beacons couldn't have been invented or useful (https://medium.com/@williamwais01/ultrasonic-beacons-the-sil...).
Surveillance capitalism has been so successful because it's so opaque. It would take a whistleblower for you to know when and how the data companies have is used against you, or how they got that data in the first place. Their tactics can be used in ways that are highly targeted and transient, especially for data collection companies like Google.
Even for something as basic as search results what I see when I search may not be what you see, and what I today might not be what I see when I take the same actions tomorrow.
This can make identifying what our phones are doing almost impossible. A possible explanation for the "phones listen to everything we say, otherwise I wouldn't have been shown this ad" phenomenon might be that a phone picked up an audio beacon being broadcast while something played on a TV, which sparked a related conversation in the person carrying the phone. The conversation wasn't recorded, but topic being discussed was successfully logged anyway. There are countless other data points available that could be used in the same way. In cases like that it would clearly not be coincidence that Google showed an ad when it did, but the spying involved was even more involved and invasive than just listening to what was being said.
There's nothing to stop Google from having small clusters of phones listening to everything for certain periods of time under certain circumstances. They wouldn't have to send all that audio data back to their servers to be effective, just monitor for a sample of specific words/phrases (processed on device) and send back a flag when something is overheard. That kind of behavior would be extremely hard for researchers to catch.
The truth is that we're not allowed to know how and when we're being surveilled, but we are being watched all the time, and that data is collected to be sold or used against us at every opportunity. It doesn't do any good to tell the person imprisoned in the panopticon that he's being paranoid and that it's all coincidental. Even when it happens to be, feeling watched is the natural response.
Honestly I wish I would get more targeted ads for the stuff I look for, when I look. Instead, for some, it happens that after I buy them, I get repeated ads after couple of weeks or even months (like, invoice is on gmail, photos of the object on my phone, but nooo they want to trick me, so they still send me more ads of the same shit that I will not buy again in years).
Seriously, I think the tracking is as crappy as most software is. Sure, it might identify one/two keywords and throw ads at you, but it does it a dumb volume way that corporations work, not in a smart "we know everything about you way", that a true geek might implement.
Right now the amount of data about you companies have is just massive. Everywhere you are at every moment of the day, who you were with, what you talk about, everything you buy, and every website you visit, what your mood is, what your level of education is, how you react to stress, it's all too much information for companies to extract useful data out of right now. AI is going to help with that. Unfortunately, like everything else AI does, it will do it pretty badly and with lots of errors and hallucinations. The companies using AI won't care though as long it works enough times on enough people that they make money.
To make matters worse, ads are only a small part of what all that data is used for. It's the thing that's most visible to you though, so you can imagine that if your ads show that companies think the wrong things about you that HR departments and other companies you interact with offline probably do too.
Doesn't that just make your browser very unique?
Did you play minecraft on the same network? If so, I'm not sure why the results are surprising or why it would negate all your efforts. If someone else played minecraft on your network you would also see a minecraft video on your main page I would imagine.
For example, matrix sucks ass. It's terrible. Everything about it is a bad experience. Of course you'd want to eventually stop using it and go back to the previous life.
But that is not the correct take-away.
The correct take away is to include UX (and honesty to yourself about it) in the calculation and to not go all in on an unsustainable compromise, just to then snap back to doing the opposite ca 3 months later.
Same as with loosing weight, really. If you replace 100% of the pleasure of eating with the "right" but unpleasant solutions, you will not be able to keep that diet going indefinitely.
You as a normal individual simply cannot replicate the kinds of services that an Executive Protection services provide [0][1].
[0] - https://www.pinkerton.com/services/high-net-worth-individual...
Probably wouldn't last long though, as they would be furious, that us lowly human beings are able to glean anything about them. The double standard of this is not obvious to them.
That's denying most culprits the opportunity to use the collected data against you.
Like always on VPN, turning off personalization, ad guards and using open source products where possible.
The real next frontier is to maintain one or more carefully curated personas with various companies to optimize how they treat you. Wear shabby clothes and fake beards when grocery shopping so that the cameras think you're poor. Security will be all over you, but the digital price tags will give you lower prices as long as you don't have your cell phone on you and they can't get a good face ID because then they won't be able to pull up your actual income level.
Create and maintain specially crafted social media accounts filled with fake hobbies and AI generated photos but never express an actual opinion on anything at all so that future employers can see you have a "presence" but they won't see anything that might disqualify you a job, like your political views.
Buy multiple high/low end devices and rent a closet or PO box in both rich and poor neighborhoods so that you can selectively hand out a mailing address that will make you appear either poor or well off.
Pay someone to take your cell phone out them on friday night so that you can appear more socially active otherwise you'll be flagged as anti-social which can impact employment, raise your health insurance rates, etc.
- Don't volunteer your intimate details left and right;
- Feel entitled to deny requests for unnecessary data (and advocate for such rights if you're in position to)
- Otherwise don't sweat it, because you can't actually control what others know about you, you never could
The reasonable position will be slow marched into hell same as the rest of them, just a few steps behind.
And most people on the behavioral side do too, but not at the cognitive level. EU is the best example with EU AI Act, strict data regulation as well as privacy rights, on the other hand demanding that Apple does serve the EU with AI.
I have mainly one distinction: the state is the worst protector of your data and the most ruthless gatherer of all your details.
Opposite to the open sourcing of your data in the end by the state are private companies who live by your data but do this for 20+ years - battle tested protection and hardening against malicious hackers.
Security is their business while security for the state is a cost factor.
Being at the mercy of some ignorant politician is not the best way to talk about data security.
Berlin, Denmark - those are the known one. And there are many more to come.
And regarding cognitive dissonance: politicians demanding high standards and punishing data loss ruthlessly on the one hand, giving oneself a pass on a hack is nothing to increase trust into the system.
X got fined for a missing blue mark. Berlin? Denmark? Others?
A second aspect is that the average guy doesn’t get that part of the whole spectrum must be the degooglers, the home server guys.
So it is relatively easy to get data on them as well just by filtering out the other data.
In other words: 95% not doing degoogling makes for a great small sample of 5%. Negating and interpolating other demographic and psychographic factors and you get a great way of gaining insights.
And remember: being the one who is not using google when being around other guys who do - magic.
So my idea is simple: what’s in it for me, and the state offers way lower value than Google and co.
Pick your fate.
How many state data breaches vs corporate data breaches? There are hundreds of state entities with my data (probably thousands), and yet private companies with my data have been hacked more times.
...and yet private companies with my data have been hacked more times, so far.
Also they might have not been targeted....
That depends. One thing is following precautions, another the Principles. Precautions may have a limit ("due diligence done, I'll stop there"), Principles do not.
Remember also that many phenomena occur because the individuals in the masses have not said "no". Acceptance enabled them. So the acceptance of some ill conceived systems is criminal - it is what lets them exist.
1. I don't want to love it. I hate it. You can learn to live with things you hate though, and not have it impact your day to day life or mental health though.
2. Its still a bomb. Until we find out how we can de-value the data, it will have an incentive to be stolen.
One thought here that I don't personally agree with, but might be important regardless:
Imagine a society without secrets or privacy at all for example.
I don't personally like the sounds of it, but it is sort of where we're headed at the moment, and if the fundamental reality is that obtaining data is much more easy than defending it, then perhaps we need to come to terms with a world without privacy, and how to create the best version of that unconstrained world.
Again, I don't like the sounds of this, but I'm curious to read more about it. Can someone give a philosophical pitch of why GDPR style regs on personal and company data are so important?
They happen all the time, nobody cares, criminals who want to target you will target you anyway, criminals who don't target don't care about you specifically, legitimate entities cannot use this data anyway, and legitimate scammers (marketing) will find different ways to get you to give them the data you need.
At this point I thing privacy obsession is modern copium, a way for people to deal with the fact that we're all individually a speck of dust on the face of human civilization. It's about asserting, "I am not an NPC, I have this richness of experience", and then trying to hide it all in case the world wants to check.
A relative killed herself after her therapist was hacked[1] and the data was leaked. If that is inconsequential, I do not know what isn't.
I don't know how deep palantir can build profiles on someone, like digging into comment histories and extrapolating you are x y or z sort of stuff. I'm sure they've learned a lot about people via public irc logs and discord servers. But the only screenshots I've seen have been way more simple than that, basically a facebook UI that gives them buttons for all the apps with the phone # that has been identified as you the user, so it would be your list of social media apps accounts and they just click in and read messages. These screenshots have popped up in court cases recently.
We need to stop using the same phone numbers and rotate them constantly. Ideally back to something like fi that masks your "real" isp account phone number. They need to stop being a 2fa and especially stop being able to identify a person. Carry a dumb 2fa. I've always been on the "dont ask for my phone number to use your service" bandwagon but absolutely now.
And now some banks are doing instant voice recognition. I don't pick up my phone for any number I don't know anymore.
Good, you're not throwing out the baby with the bathwater. I don't get why you think throwing out the bathwater itself was wasted effort though.
The point is to get rid of things you can live without. If you're going to get rid of something but then spend every day thinking of its absence, then yes, that may be bridge too far. Otherwise, getting rid of it has some value.
I don't see the harm of asking, "Do I need this entity's services enough to justify forking over this data" for every entity that you interact with. Everyone draws their line in the sand at a different place. Data hygiene is a good phrase for that reason, everybody's acceptable level of hygiene (or lack thereof) is different.
You dont get it bro, its not a good vibe.
And if I had bean in management I would have fired anyone involved with that decision.
Why is it so often HN that I point something obvious out , like Rockstar having clearly failed management and a complete loss of control, but instead of agreement or silence I always get flak from some random user who just doesnt get it, and then a year later the company starts falling apart.
Im just a guy who recognises patterns and im not even smart.
So you knew that fierfox never came with google analytics but you decided to claim it anyway...
You download firefox. In firefox, you go to settings->Extensions to download extensions and get exposed to google analytics, is that correct? If that's true, how is it not insidious that in order to download the thing that blocks google analytics, you have to get exposed to google analytics?
Because many "obvious" things are just plausibly sounding bullshit. For example:
> Rockstar having clearly failed management and a complete loss of control
That's both very broad and generic, and completely unfalsifiable, and comes with nothing backing it up. It's just an unsubstantiated opinion. These things are fine when drinking in friends, or otherwise socializing by bonding over ramblings.
If you want to convince someone of something, the standards of evidence (not to mention, clarity of thinking) are a bit higher.
This site will start falling apart if we don't keep things civil.
Oh, I love the bit where a programmer always proudly chimes in with this statement as if it means anything.
I get wanting to be conspiratorial, but its not cool to go after others that challenge your conspiracy, even if its "obvious"
And then add on that fact that my doctor recently started using some kind of AI voice transcription app that listened to our entire conversation. Except that it hallucinated details I absolutely did not say, which are now in that doctor's records and I'm sure will be taken at face value in the future.
It's maddening.
If your doctor is worth seeing at all, they will be glad for the corrections.
But whenever possible, I lie. Different name, birthdate, every question about "favorite pet"? A lie. "They" have tons of data on me, but more and more is wrong. Let it leak.
Sending my file over to lawyers in a semi-safe way has proved impossible.
And in any case, i received an answer with lots of PI over a plain email…
Absolutely maddening
If it's one older guy, good luck. You're probably better off doing everything by FAX honestly.
It was .7z with strong pwd. The normal zip is supposedly too weak according to llms
I know it’s modern American tech tradition to make fun of the GDPR, but this is genuinely one of the things it stipulates: You’ll get at least a slap on the wrist, or potentially much worse, if you needlessly keep data around longer than necessary to do the task you had collected it for in the first place.
But nobody really cares enough to spend money modernising this sort of system.
I'm only half joking: I used to work in payments, hotels didn't care about PCI. Full card numbers stored everywhere.
Are you 'avin a laugh mate?
A photocopy of my passport is going nowhere and is shreadded afterwards. An electronic copy..... God lord.
The GDPR also requires data deletion once you no longer need it; physical as well as electronic. This is common sense, and why some organisations don't do this is simply mind boglling.
If you think photocopies kept in some folder accessible to anyone working in the hotel, with a promise to delete it at some point, is "secure" in any way, I don't know what to tell you.
When I toured apartments they would often take a photocopy of my ID. Okay, overkill. But realistically I have no idea where that photocopy is stored.
Probably in a OneDrive somewhere to this day.
Rather a paper data breach exposed to a few hotel employees than eletronic data exposed to the entire planet!
This said, the police already has a database with these info, and it likely is somehow already on the network, so adding an api (if done properly) would not dramatically alter the exposure profile.
I was asked for my passport in a Premier Inn this summer because they thought I was a foreigner but when I pointed out that I was a UK citizen they dropped the requirement.
In Europe it was mostly Italy and Poland that wanted to see my passport.
You can try to say no, but I don't think you can anymore. I go through this a dozen times a year on my travels there.
This is Spain.
Why can’t WE spy on them 24/7?
I am writing this because I don't think democracy works as advertised.
mind that there was a breach recently where all the data was being leaked *the moment it was collected*
so simply controlling retention is not enough. The very fact of data being taken is already a vulnerable part
I’ve switched to operate with the idea that my information has already been leaked at some point. I should be generally ready to fix the problems if/when identity theft happens, rather than inconveniencing myself and figuring out the third party trust situation.
That's the world we live in.
"Police and thieves", collaborating one way or another (leaking data collected by big brother and then having big brother being very soft on crime is one way to collaborate with evil people), "to scare the nation with their guns and ammunition" (as in the reggae song).
As much as I don't like the cryptocurrency ecosystem, I don't think facilitating and encouraging kidnapping and torture is the way to go.
Shame on the french government.
Two sides of the same coin.
The cryptocurrency ecosystem is used to not only avoid taxation but to enable criminal activity. How many people are being held hostage and the ransom will be payed thanks to cryptocurrencies?
I do not like the cryptocurrency ecosystem either. And I totally agree that it should be abolished. It is just a way to finance crime and terrorism.
However, next week, I started getting calls from other Lycamobile numbers, where it sounded like the same Indian guy, but now he presented himself as a police officer who wanted to arrest my bank account :)
The moral of the story: if you have a phone number, it's been already sold to some shady call center in South-East Asia and it's just a matter of time before they will try to scam you or use your phone for some nefarious purpose. I don't think Lycamobile is unique in how bad their system is and how much they want to extract every last penny from you buy outsourcing every service to foreign companies with zero responsibility and questionable work ethics.
Let me say "Hi mate, +1". State doctors? There are territories in which a pharmacological prescription is shared DB only now (where previously they could be on paper - a secret between you, the pen, the paper, the pharmacist and the gods). Private entities? Good luck finding one that does not require a privacy waiver as a condition for the visit. Searching for a medical dock (a dock for a doc), calling them to ask? "This is a recorded message. If you proceed with the call then you agree..." (Hang-up click).
Excuse me?
If you weren't paying with cash whoever paid for the prescription (govt, insurance) has a record of it. The pharmacy that filled the prescription has a record of it as well as the doctor who wrote it.
How can you presume we do not pay with cash?! How can you remotely suppose one sane mind would not use cash for all sensitive private transactions - books, medicines, preferential (profiling) products etc.?
We use cash in general because nobody in Dignity would accept their own daily matters to be recorded and given to multiple untrusted parties¹, not to mention potentially retrievable by even more untrusted parties - of course the matter is much more evident for all transactions over confidential items!
(¹EU here: 12 public-hybrid-private DBs as per the PSD2 legislation.)
Are the elements in your set aware of what they are doing?
And why did you post that replying to mine, what is the message? We knew that you in the cashless are many.
Is it a cry for help - as you know what you are doing but cannot care? Ok: reread the "Book of Joe", which obviously you have heard of, and take your side. Both of them, really: one for morals, one at least for the mentions of the beast requiring its mark for transactions.
Our civilisation needs to face up to the fact the reason is simply: its stored on a connected computer.
Thats the wording of GDPR.. that you should delete data after you dont need it anymore for the original purpose..
Unfortunately, it seems noone is enforcing it enough.
In the US, you can freeze your credit, making this impossible (even for yourself).
> things that are out of your control
That's because of corruption. A system that doesn't want to change because some tits can't be let go of. A well working system would render control back to you.
In this case, the EU does have consequences for data breaches where proper protocols are not followed.
Additionally, this is not private information .. most anyone can look this information up. ID numbers are not confidential information like SSNs are treated in the US.. they are just a number to tell person A from person B. You give this number to everyone without thinking about it because it's how every company you interact with identifies you.
In this case a rogue company, or compromised company, used their access to contact the central database to download everyone's information.
In my country we essentially use the same system, except for we still allow companies to download the whole database if they want to instead of making individual queries.
In this case the access to their system was unauthorized, and under GDPR data breaches have to be reported within 72 hours. Companies can't make the decision on their own that it's not a big deal.
Abusing privacy is the lucrative norm. The laws won't help you and the government is busy with its corporate agenda.