Slashdot Mirror


Why Online Privacy Is Broken

Trailrunner7 writes "One of the more trite and oft-repeated maxims in the software industry goes something like this: We're not focusing on security because our customers aren't asking for it. They want features and functionality. When they ask for security, then we'll worry about it. Not only is this philosophy doomed to failure, it's now being repeated in the realm of privacy, with potentially disastrous effects. A quick search of recent news on the privacy front reveals that just about all of it is bad. Facebook is exposing users' live chat sessions and other data to third parties. Google is caught recording not only MAC address and SSID information from public Wi-Fi hotspots, but storing data from the networks as well. But the prevailing attitude among corporate executives in these cases seems to be summed up by Google CEO Eric Schmidt, who famously said this not too long ago: 'If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place.' If you look beyond the patent absurdity of Schmidt's statement for a minute, you'll find another old maxim hiding underneath: Blame the user. You want privacy? Don't use our search engine/photo software/email application/maps. That's our data now, thank you very much. Oh, you don't want your private chats exposed to the world? Sorry, you never told us that."

220 comments

  1. User generated content belongs to the user... by alexandre · · Score: 5, Insightful

    If we had continued improving on P2P instead of giving in to centralized servers we wouldn't be there...

    1. Re:User generated content belongs to the user... by BuR4N · · Score: 4, Funny

      No, we would be in IT support hell, maintaining our dads and moms P2P servers......

      --
      http://www.intellipool.se/ - Intellipool Network Monitor
    2. Re:User generated content belongs to the user... by xednieht · · Score: 1

      What is Google, or Facebook, or pick-your-poison is one of the peers of the P2P?

      --

      Hope is the currency of fools
    3. Re:User generated content belongs to the user... by betterunixthanunix · · Score: 2, Funny

      Just like right now, we have IT support hell, maintaining our parents' web browsers and operating systems.

      Seriously, you think that there is something special about P2P that makes it particularly harder to maintain?

      --
      Palm trees and 8
    4. Re:User generated content belongs to the user... by TerranFury · · Score: 5, Insightful

      A big problem is simply NAT. Non-technical people are not going to set up port forwarding. This basically broke the Internet, and pushed its development in undemocratic directions.

      UPnP partially fixes this, but opens up a whole bunch of other problems, which are even worse.

      IPv6 is supposed to fix this for real, but I don't count on it because IPv4 is "good enough," and I bet that it'll be easier for people to keep throwing NAT and subdomains at the problem. E.g., companies don't need to bother maintaining their own webservers and having their own public IPs; the way things are going they'll just point people to "facebook.com/companyName" (I heard an ad do this on the radio yesterday, in fact).

    5. Re:User generated content belongs to the user... by sourcerror · · Score: 1

      Port forward? (extra NAT config)

    6. Re:User generated content belongs to the user... by betterunixthanunix · · Score: 1

      Then you do not add them to your "friends" list. I see P2P social networking being driven by cryptography, so that your data is replicated across the network but only the people you approve as friends are able to decrypt it. Thus, for Facebook or Google to undermine your privacy, you would have to explicitly allow them to do so -- it would be forced out into the open. Further, there would be few incentives for users to allow a company like Facebook to access their data, since the social networking aspect is provided to them regardless.

      Of course, Facebook could try to insert itself in the network by allowing people using a P2P social network to add Facebook users to their friends list, and thus undermine privacy in that manner. That would have an interesting effect, though, as it would force Facebook to be interoperable with another system, something which they have still refused to do. This would be a baby step forward, and would not do much to solve the privacy issues associated with Facebook, but at least it would not be a backward step.

      --
      Palm trees and 8
    7. Re:User generated content belongs to the user... by betterunixthanunix · · Score: 2, Informative

      It is fairly trivial to connect to Gnutella through a NAT without any port forwarding -- so I do not see this being a significant problem.

      --
      Palm trees and 8
    8. Re:User generated content belongs to the user... by betterunixthanunix · · Score: 1

      Really though, it is possible to connect to existing P2P networks through NAT without any extra configuration. Why should a P2P social network suddenly make the exist solutions to the problem infeasible or more difficult to support?

      --
      Palm trees and 8
    9. Re:User generated content belongs to the user... by VTI9600 · · Score: 1

      the way things are going they'll just point people to "facebook.com/companyName"

      At least that's more professional than the ad I recently heard advertising a company's @gmail.com email address. I mean, they let you use your own domain with Google Apps and it's completely free (basic edition anyway). How do people who use Gmail in their businesses not realize this?

    10. Re:User generated content belongs to the user... by Ephemeriis · · Score: 2, Informative

      No, we would be in IT support hell, maintaining our dads and moms P2P servers......

      I do maintain computers/routers for my family members. I've done it for years. The lack(?) of P2P hasn't changed that at all.

      But, supposing that P2P was some kind of nightmare to deal with... Why couldn't we make it work better? Build protocols that played nicer with NAT tables... Or build UPnP that works better... Or just throw out the whole IPv4 thing and go to v6?

      --
      "Work is the curse of the drinking classes." -Oscar Wilde
    11. Re:User generated content belongs to the user... by TerranFury · · Score: 2, Interesting

      This wasn't a user page though; it was literally "facebook.com/companyName," and the company was actually a big one -- something like "Verizon" or the like. I sensed it was less a "we're too poor to have a website" move and more a "all the cool kids are on facebook so we should be there" move.

    12. Re:User generated content belongs to the user... by TerranFury · · Score: 1

      Really though, it is possible to connect to existing P2P networks through NAT without any extra configuration. Why should a P2P social network suddenly make the exist solutions to the problem infeasible or more difficult to support?

      Don't these protocols actually rely on central servers (or lists of servers, or "SuperNodes," or trackers in the case of BitTorrent) known to everyone behind NAT? AFAIK every NAT hole-punching scheme relies on an intermediary, and I can't imagine how it could be otherwise.

      Maybe this isn't as big a problem as I'm making it out to be, but in the end NAT does mean at the very least that the scheme can't be totally decentralized.

    13. Re:User generated content belongs to the user... by Yvanhoe · · Score: 1

      ...until they worked flawlessly

      --
      The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
    14. Re:User generated content belongs to the user... by paxcoder · · Score: 2, Interesting

      Yeah, you just have to know where to connect. Similarly with searching: You have to know whom to ask, so you ask the one who'll know whom to ask and that's the server.

      However, I don't think the original poster isn't talking about random file sharing - such as BitTorrent. He is perhaps talking about decentralized (social) networks with peers/users/friends having their own servers (see SheevaPlug), and controlling both data and software on it (see http://ur1.ca/lch5 and http://groups.fsf.org/wiki/Group:GNU_Social/Project_Comparison - the right part of this page).

    15. Re:User generated content belongs to the user... by skids · · Score: 1

      It's not a huge problem -- the networks are pretty functional just relying on volunteer servers, which could be "peers" that just have a real IP or a port redirect.

      It's a problem that will go away gradually as IPv4 does.

      The real problem with P2P is the inefficiency of the protocol. Even without the RIAA legal issues, P2P protocols tend to set up huge numbers of connections (and from the stateful firewall administrator's perspective, even UDP chatting is a "connection") which totally kills the equipment. So they staunch it so other services work.

      It doesn't help that most of the P2P is used for transferring large files, either, and does next to no layer 4+ congestion control, or does it badly -- another technical reason P2P gets the whack.

      Though social networking on a P2P basis will have less of the second problem, given the brevity of most of the content.

      Anyone thinking of designing a new P2P protocol should make it use HTTPS (on port 443 by default unless blocked), and build a network of intermediary "hops" such that a client's activity looks like a normal browsing session -- both in terms of the number of connections and behaving itself congestion-wise, (which probably means making it difficult for users to tweak the flow control and pleading with them not to.)

    16. Re:User generated content belongs to the user... by xclay · · Score: 1

      ditto. I've initiated my own two cents of effort... starting with OpenID, but then it almost feels like reinventing wheels when Google APIs offer so much through the cloud.. (slap myself on the face: SLAP! SLAP! SLAP!) wake up! This is a war. Yes, independent P2P independent, but social websites across the web. The new generation of social web will once again be decentralized, but then you still need a control server, and once again you have a cloud... no, no, no... yes, yes, yes... sorry, folks for a tidbit of stream of consciousness on this comment... it's indeed an arduous task to yourself rational while trying to stay up nights to create an independent/social website that can be easily packaged for average users...

    17. Re:User generated content belongs to the user... by VTI9600 · · Score: 1

      Umm, I don't think you understood what I meant, which is understandable considering that what I'm talking about is so ridiculous. I've seen more than one company issue email addresses using the template:

      companyName_employeeName@gmail.com to its employees in complete disregard of the fact that you can get a Google Apps account for employeeName@companyName.com at no charge. You don't need an IT guy for that. One such company that I'm referring to was a small software development company that was probably the 2nd best in it's niche market.

    18. Re:User generated content belongs to the user... by slaad · · Score: 1

      I've noticed the facebook thing lately as well. More and commercials on TV have a facebook logo plastered on them and, like you said, some even go so far as to say "Visit our page on facebook" rather than "Visit www.ourcompany.com".

      --


      ~Warning!~ The above is encrypted using rot676!
    19. Re:User generated content belongs to the user... by Anonymous Coward · · Score: 0

      As an IT specialist I agree. End users are difficult enough to support when all they have is one computer and an internet connection. If it all moved to the P2P swarm, now all of a sudden you go from supporting just one end users ignorance to supporting a million of them all at once.

  2. Ignorance, not indifference. by Striek · · Score: 5, Insightful

    I would think (and hope) that customers aren't asking for it because they're not aware of the risks, not because they don't care. Like when people stop using debit cards everywhere only after their card gets duplicated.

    --
    "Government is like fire; a handy servant, but a dangerous master." -- George Washington
    1. Re:Ignorance, not indifference. by Kernull · · Score: 1

      Are you saying that debit cards are more of a risk than credit cards? (I actually don't know, serious question). Enlighten me.

    2. Re:Ignorance, not indifference. by Skarecrow77 · · Score: 1

      my check card (debit card that allows you to run it as a credit card anyplace that accepts mastercard, but takes the money from your account with 0% interest owed instead of racking up money you owe to faceless megacorp with 18% interest) has the exact same protections as a credit card.

      I'm not sure where all these debit card stories come from. assuming that they are not urban legends, then perhaps people need to find a better bank.

    3. Re:Ignorance, not indifference. by AvitarX · · Score: 1

      I believe if your PIN is stolen you have less protections (e.g. from a hard hacked atm).

      Additionally even having your account at zero for a period is a pretty big inconvenience.

      --
      Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
    4. Re:Ignorance, not indifference. by rabiddeity · · Score: 1

      I would think (and hope) that customers aren't asking for it because they're not aware of the risks, not because they don't care. Like when people stop using debit cards everywhere only after their card gets duplicated.

      This.

      Two things are necessary for privacy to really become important to the number crunchers. The first is a direct, measurable impact on individual privacy, which is arguably already happening. Whereas there was an implicit agreement of trust before, you now have essentially no privacy on social networking sites. The second is transparency, the wide exposure and dissemination that sleazy advertising companies have full access to YOUR stuff, and have no compunctions about sharing it.

      You can tell who is on your side in this matter not by the first, but by the second metric. Everyone is swapping personal data like mad because there are no economic disincentives to do so-- in fact, there is a LOT of money in selling who your friends are and what things they like. The companies that want privacy to be taken seriously, like Google, are exposing the breaches themselves and letting loose the shitstorm, with the expectation that users will demand a reasonable privacy standard. The companies that don't give a flying monkey's butt, like Facebook, do their best to obscure what data is being shared and with whom. If you want to know which companies are really evil, look at who is trying to keep information from you.

    5. Re:Ignorance, not indifference. by Endo13 · · Score: 4, Insightful

      With a credit card, they're spending the creditor's money. With a debit card, they're spending your money. Even if all the protections are identical, which do you think will inconvenience you more?

      --
      There is no -1 Disagree mod. Slashdot.org/faq defines mod options. USE IT.
    6. Re:Ignorance, not indifference. by Striek · · Score: 1

      Not at all, I have no idea if one is any more or less secure than the other. It was merely an example of the ignorance of risk.

      --
      "Government is like fire; a handy servant, but a dangerous master." -- George Washington
    7. Re:Ignorance, not indifference. by mcgrew · · Score: 4, Insightful

      Apathy is blamed for a lot of things that people really aren't apathetic about at all. One example is voter turnout: they say 50% of voters stay home because they don't care, when the real reason they stay home is they don't see much if any difference between candidate A and candidate B. It isn't apathy, it's a conscious decision to boycott the system.

      As TFA notes, security is another one. People complain about their virus-infested computers so they aren't apathetic, they're simply ignorant; they don't know HOW to not get viruses, and they bitch loudly because they bought NcAffee and Norton and turned Windows firewall on and STILL get viruses because they DLed Metallica-FreeSpeechForTheDumb.MP3.exe and played it by clicking the file. They have no clue that the file is an executable, because Microsoft hides the file extension by default.

      The same goes for privacy. As TFA (again) mentions, most users want both privacy AND social networking. As the article summarises: "Blame the user? Here's a better idea: Listen to the user."

      Fat chance of that happening though. The user isn't the customer.

    8. Re:Ignorance, not indifference. by squallbsr · · Score: 1, Informative

      With a traditional Visa/Mastercard 'debit' card that pulls money from your checking, there are two ways to use that card and pay for your purchase:

      • Use it like a credit card (you don't type your PIN)
      • Use it like a debit/atm card (you enter your PIN)

      If you use you card as a credit card, you are protected in the same manner as you would with a credit card, you aren't responsible for fraudulent charges above $X.xx and you can dispute charges, etc. If you use it as a debit card, if your PIN is exposed by some 3rd party (i.e. the store you are purchasing from, the company they contract with for their POS system, etc) you are fully on-the-hook when it comes to losses - if they steal $2000 from your account, you have lost $2000 - there is no disputing charges or limited liability like with a credit card.

      tl;dr;
      Use your card as a credit card, you have many protections, use your card as a debit card (you enter your PIN), you are liable for every transaction associated with your PIN.

      --
      Sleep: A completely inadequate substitution for Caffeine.
    9. Re:Ignorance, not indifference. by betterunixthanunix · · Score: 3, Insightful

      The problem is that social networking websites make their money by undermining user privacy; there is simply no incentive to actually listen to the users' complaints about privacy, and for a company that must answer to its investors, there is actually a disincentive to listen to the users. Users want privacy and social networking and social networking websites, and they do not want to pay for those websites -- it is just not possible to meet all of those demands at the same time. Privacy is the easiest thing to drop from the list of user demands you actually meet, since it is not the first thing most people will notice.

      --
      Palm trees and 8
    10. Re:Ignorance, not indifference. by Zironic · · Score: 1

      Atleast in Sweden you'll get your money back even if your PIN was stolen as far as I know.

    11. Re:Ignorance, not indifference. by Mashiki · · Score: 0

      No it's apathy with politics. The reason that most people don't see a difference between candidate A and B, is because they don't do research and instead rely on 3 man sources of information: Their friends, the news media, and preconceived notions they already hold.

      --
      Om, nomnomnom...
    12. Re:Ignorance, not indifference. by kevinmenzel · · Score: 2, Informative

      In Canada, or at least with TD, I've had fraudulent purchases made with a copy of my Debit Card someone made. They had the PIN and everything apparently. So I contacted the fraud department, and every fraudulent charge was reversed. It took less than a month, and it wasn't even that much, because I noticed it quickly (it was less than $40 at that point). Additionally, fraudulent transactions made with my web banking are also covered. Of course debit is, I suppose, different in Canada than in most places, given the Interac network...

    13. Re:Ignorance, not indifference. by MattSausage · · Score: 1

      If I'm being held responsible for the charges after disputing them in both cases? Then obviously it would be more trouble for ME if the thief is spending the bank's money. I have to pay interest on that. Therefore I'm out more of MY money than if they had just spent my money to begin with.

      Now, if I'm not being held responsible, I get the money back or I get the charges cancelled in either case, and neither case stands out as better. So in this situation, the logic points to the fact it is better if they steal a debit card than a credit card.

      Also, if you choose 'credit' when you use your debit card somewhere, you are covered by all the bank's anti-fraud protections and money back protections as if you had used an actual credit card. It's smart, and it is free, you should do it.

    14. Re:Ignorance, not indifference. by Anonymous Coward · · Score: 3, Insightful

      You overestimate how much the average person cares -- yes, some people skip voting, as a (seriously misguided, IMO) protest boycott. Most of the people who don't vote, however,do so out of apathy, not principle. There's always a third party candidate (at least in the presidential race, and surprisingly often in lesser races) so you can make your voice heard as being in opposition to those parties, and if there were _really_ anything like 50% of people so disgusted with the two parties we currently have, and (more importantly) the voting system that keeps control limited to two parties at a time, you'd think it'd be damned easy to organize a range-vote or approval-vote party whose sole purpose is electoral reform, and consistently get, if not an outright win, a vastly greater popular vote than third-parties normally get.

      With computers, you're not half wrong, but it's not like they don't have a browser in front of them -- if they really aren't apathetic, you'd think they'd seek to inform themselves...

    15. Re:Ignorance, not indifference. by vlm · · Score: 3, Insightful

      my check card (debit card that allows you to run it as a credit card anyplace that accepts mastercard, but takes the money from your account with 0% interest owed instead of racking up money you owe to faceless megacorp with 18% interest) has the exact same protections as a credit card.

      So, your check card is stolen, your account is zero'd. Now all your legit paid bills bounce. Each individual merchant wants $25 and up, directly from you, for bouncing a check. How does your check card protect you from that? My theory is, it does no such thing.

      Also I owe 0% interest on my CC. Simply pay your bill each month, no big deal.

      --
      "Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
    16. Re:Ignorance, not indifference. by Endo13 · · Score: 1

      If I'm being held responsible for the charges after disputing them in both cases? Then obviously it would be more trouble for ME if the thief is spending the bank's money. I have to pay interest on that. Therefore I'm out more of MY money than if they had just spent my money to begin with.

      Except it doesn't work that way.

      1. You have at least a few weeks to get it worked out before the charge would incur interest in the first place.
      2. It's generally pretty easy with a credit card to put a stop payment on a fraudulent charge, and when everything gets sorted out you're not out any money.
      3. Worst case scenario, if your credit card company happens to be the worst one on the planet and tries to leave you hanging (but honestly, I've never heard of a credit card company doing that) you can simply refuse to pay the fraudulent charges. Yeah, it might effect your credit rating in the short term, but once it all gets worked out, that gets fixed too. If it *never* gets worked out, (even more unlikely) well, at least you just took a hit on your credit rating and you're not actually missing any of your own money.

      Also, if they overdraft your bank account with your debit card, you're potentially on the hook for an overdraft fee that is enough to cover quite a bit of interest on a credit card.

      Not to mention, in the meantime you've no choice but to wait on your bank to replace your money. If you have a great bank, that might happen within a few days. If you have a bad bank, you might be out for several months.

      All the protections in the world don't help you if your bank account just got drained and you needed that money RIGHT NOW.

      --
      There is no -1 Disagree mod. Slashdot.org/faq defines mod options. USE IT.
    17. Re:Ignorance, not indifference. by Anonymous Coward · · Score: 1, Interesting
      While I disagree on some of the finer cultural points, without a doubt, the cause of our computer troubles are from the ignorance of the user.

      The blame doesn't necessarily fall on them - I've had extensive conversations with adults to teach them to use a computer, and among more complicated situations, they just don't think that way.

      They'll get old, and then people who know whats going on will be in control, and then we can move on. They are, unfortunately, obsolete. Many can be rehabilitated, but it requires a willingness - the culture shock and resistance that technology triggers astounds me (do you really need that smartphone?, do you really need an app for that?). They think it's a Big Deal that I can use my cell phone to tag songs I like while in a bar, at a concert, or at a friends party. To them, its a Stupid Big Deal - why would you get a phone for that? - when the reality is that I got a phone so that I could do useful things. I got it so it can be responsible for me. I don't have to write down the name of the song, listen to the station until they feel like listing their song titles, or shout to someone HEY WHAT BAND IS THIS, when my phone can do, and remember, all those things for me.

      There is a cultural difference here, where the tech-based culture will supercede the analog culture.

      Eventually.

    18. Re:Ignorance, not indifference. by blair1q · · Score: 0

      These days, anyone who fails to "see the difference" between a Democrat and a Republican is misinformed, not uninformed.

      They have doubtless been propagandized into believing that they're the same thing, by people who have ideas nobody wants.

    19. Re:Ignorance, not indifference. by VTI9600 · · Score: 1

      As with most security issues, you need to start the mitigation process at layer 8. That is, you need to educate yourself about your bank's specific policies on what will happen when your card (or the information on it) gets stolen. Since policies vary from bank to bank, you'll need to ask them what your liability will be in different scenarios.

      In most cases, credit cards offer more consumer protection in terms of your ability to reverse the charges (charge back) on purchases that you did not authorize. That also means that unscrupulous merchants who bill you for a product that they don't deliver face a much lighter penalty than those who take money directly from your bank account, but I digress. American Express has some of the most consumer-friendly policies in the industry (which is one reason why so few places accept it), so I would recommend you use them and just pay your bill on time every month in lieu of a debit card.

      On the subject of technological security, I think it's interesting how credit card companies are so aggressively pushing for RFID-enabled cards. They claim that those cards are more secure, and a cursory examination would seem to confirm that. However, I've recently read a couple stories about how they are ridiculously easy to read and duplicate...even without the user's knowledge. If anyone can provide some expertise on that subject, I'd like to hear it.

    20. Re:Ignorance, not indifference. by Smauler · · Score: 3, Informative

      Here in the UK they're both chip and pin - few retailers will take signed for cards AFAIK. My credit card has had the bit where your signature goes rubbed off for the past couple of years (revealing void void void), and I doubt very much it'll swipe through any magnetic card readers now. I still use it regularly though (I know it's pretty insecure, but if I lose it I'll just phone up and get it cancelled).

      In the UK if there are charges which are made to your debit card which you claim are not from negligent acts on your part (like your example), they have to reimburse your account basically immediately, then do the investigations. They are liable for fraudulent access to your account, as long as you've not been negligent. If you voluntarily agreed to the full transaction though, you're out of luck (ie. a business who went bust, or a scammer who didn't fulfil their side of the bargain) - it's just like giving cash to them. Credit cards have more protection though - any transaction over 100ukp you can get back, for almost any reasonable reason, ie. paid and did not get the goods, etc. Transactions under 100ukp are covered in the same way debit transactions are I think.

    21. Re:Ignorance, not indifference. by phantomfive · · Score: 2, Insightful

      One example is voter turnout: they say 50% of voters stay home because they don't care, when the real reason they stay home is they don't see much if any difference between candidate A and candidate B. It isn't apathy, it's a conscious decision to boycott the system.

      You're doing it wrong. If you actually care, but don't want to vote for any of the candidates, then you should vote for a third party candidate, write in a vote, or leave the response blank. That shows you are actually willing to do something. Not to mention, a boycott of the voting system doesn't do anything but give more power to the remaining few who do actually vote. Those people aren't going to feel very motivated to push you to vote.

      Otherwise you just get lumped in with the people who are apathetic. And there are a lot of them. Including me at times in the past.

      --
      Qxe4
    22. Re:Ignorance, not indifference. by innocent_white_lamb · · Score: 3, Insightful

      The problem is that social networking websites make their money by undermining user privacy;
       
      Since the only exposure that I have had to Facebook and the like is comments on Slashdot and I have never knowingly visited the Facebook website, your comment here strikes me as very odd.
       
      Isn't the POINT of Facebook to get yourself "out there" and be-your-own-celebrity? If so, isn't it contradictory to say "OMG they are stealingj/invading my privacy!" since that's the point of the website in the first place. After all, the only information that they have to "make public" is information that you have voluntarily provided to them for that exact purpose.
       
      What am I failing to understand about this issue?

      --
      If you're a zombie and you know it, bite your friend!
    23. Re:Ignorance, not indifference. by Mashiki · · Score: 2, Insightful

      Bitter mods aside this weekend, there's not much of a difference between the two. One you believe what you're told because you enjoy that pov and refuse to look outside your safety box. The other you believe what you're told because you don't know any better, and refuse to examine the data yourself.

      --
      Om, nomnomnom...
    24. Re:Ignorance, not indifference. by frosty_tsm · · Score: 1

      my check card (debit card that allows you to run it as a credit card anyplace that accepts mastercard, but takes the money from your account with 0% interest owed instead of racking up money you owe to faceless megacorp with 18% interest) has the exact same protections as a credit card.

      I'm not sure where all these debit card stories come from. assuming that they are not urban legends, then perhaps people need to find a better bank.

      You may have these kinds of protections. However, since it's tied to your bank account you are immediately missing the $2,000 you need for your mortgage payment. Some banks take days or longer to credit your account as a result of fraud. With a credit card, there is a buffer between your bank account and the card.

      Also, your comment about 18% interest only applies if you don't pay your bill off every month. If you are restrained, credit cards insulate your checking account plus give you points for flights or gift cards. If you aren't restrained, you'll get screwed over more by a debit card with overdraft fees.

    25. Re:Ignorance, not indifference. by Anonymous Coward · · Score: 1, Informative

      When I first used Facebook, I (perhaps mistakenly) thought the point of Facebook was as a tool to connect with and communicate with my friends whom I selectively granted access to my profile. I gave up on Facebook though the day that every stupid little update I did was visible to all my friends (I had turned off the feature that made it visible to the world) and as it became increasingly difficult to figure out how to change my privacy settings. That and the fact that 99% of my messages from Facebook started to be crap like "You've just been turned into a zombie!" just made it into a huge steaming pile of crap. I never thought that Facebook was supposed to enable me to pretend at being a celebrity and I was always irritated when it became more difficult to close off access to my profile and my updates. Not even my friends need 10 conflicting updates while I screw around with my profile.

    26. Re:Ignorance, not indifference. by theqmann · · Score: 1

      The thing that gets me is that most CCs offer a 28 day grace period on interest, not the 30-31 that most months have. Wouldn't that mean that you are being charged 2-3 days of interest each month?

    27. Re:Ignorance, not indifference. by Darinbob · · Score: 2, Insightful

      Another silly analogy. Imagine that these people made houses. They could say "we're focused on features and functionality that customers are asking for in houses. They inquire about square footage, number of bathrooms and bedrooms, proximity to schools, and so forth. None of them have ever asked about what types of doors or locks they houses have. We will start including doors when customers start asking for them."

      Of course, the very first customer will say "what the hell, where's the door?" Or if they have a door but a shoddy lock that can be opened by any persistent neighborhood cat, then it may take some time before a house is broken into and something stolen, then they'll say "what the hell is this cheap lock doing on my luxury condo?" And then the manufacturer could say "most customers have had no complaints about people wandering into their houses and are happy with the products we delivered."

      The problem is that many people who visit online sites implicitly assume there is security, and so they don't explicitly ask for it. You have to essentially be a pessimist and/or cynic to worry about this stuff, when it should be built in by default.

    28. Re:Ignorance, not indifference. by dAzED1 · · Score: 0, Troll

      oooohh, so if I take off from work (thus having to stay later than normal) I get the privilege of standing in a long line to put my name on a blank ballot so it can be counted along with all the ballots cast by the dead. This will show the people controlling the parties that I want something different, they will see the error of their ways, and tada! Peace and happiness will happen.

      No it all makes sense. And here I thought rejecting the single-party system and stirring discontent was the way to reach my goals...

    29. Re:Ignorance, not indifference. by murdocj · · Score: 1

      Huh? If you wait 25 days (say) and then pay off your bill, they are loaning YOU money, not the other way around. You bought something and then had an interest-free loan of the cost of the item for most of a month.

    30. Re:Ignorance, not indifference. by phantomfive · · Score: 1

      Way to stick it to the man, bro. You sure show them.

      --
      Qxe4
    31. Re:Ignorance, not indifference. by dAzED1 · · Score: 1

      I'm not the one preaching change-via-wasting-your-time, bro.

    32. Re:Ignorance, not indifference. by PostPhil · · Score: 1

      Isn't the POINT of Facebook to get yourself "out there" and be-your-own-celebrity? [...] What am I failing to understand about this issue?

      You're failing to understand that:

      1. Social networking isn't about people trying to be a celebrity. It's about some people trying to be a celebrity, while others just want to keep in touch with friends (e.g. for many, social networking sites are just the replacement for Instant Messaging). It's about access to information that is controlled and owned by the user.

      2. Even for those that want to be celebrities, even they just want to be visible to other party-goers, students, and friends-of-friends. Nowhere does 3rd-party advertising companies mining their personal data figure into the equation. That is NOT what motivated the person to join the site.

      3. The idea that the information is always "voluntarily provided" is bogus. That implies a conscious decision was made by the user. Clicking OK to a Terms Of Service agreement may cover a site legally, but in the real world it has nothing to do with whether or not the user understands the consequences of the legal double-talk a TOS agreement implies. If you misunderstand it's consequences, then it is not informed consent (regarding real-life informed decisions, regardless of any legal definition of "informed consent"). For example, if the TOS says that certain types of content won't be provided to third-parties except in special cases A and B, the user might not expect that this is just Cover-Your-Ass talk and that special cases A and B unwittingly happen most of the time from actions the user didn't expect would cause special cases A and B. Various sites are better or worse at this, of course.

      4. All these sites have verbiage saying they "respect your privacy" (of course), but where is the transparency? Laws aren't magic wands. How do I verify whether or not my privacy is truly being respected. When potential profit is involved, it's the corporate norm that it's "better to ask forgiveness than permission". And if they get caught doing something wrong, they get a slap on the wrist because apparently corporations have more rights than citizens do, and then they continue to do what they've always done before.

      5. Just because you may be disinterested about something only other people seem to be interested in, doesn't mean this doesn't eventually have implications for everyone.

      6. Simply put, the point of the issue is what you're failing to understand.

    33. Re:Ignorance, not indifference. by bazorg · · Score: 1
      Mod parent up, cos I can't :)

      What facebook needs these days is moderation points to go around and allow people to filter out the rubbish. Some users will be clever enough to use them, some will just get all sorts of rubbish on their walls, pages, etc. At this stage in time, I see some people using facebook messaging as a white-listed email system, essentially leaving their normal emails to rot or to accumulate messages they only clean up once in a while.

      The way I see it, the general public is using facebook and similar sites with the same carelessness the early adopters of the internet had a few years ago for email, forums and newsgroups. They will suffer the same spam, ID fraud, etc. that others have endured before and they will adapt. In the same way that my slashdot id is not my name, soon enough my facebook id will not be name.

      Many of my true friends are on facebook and then there's a lot of contacts i would normally class as something different from "friends" if I had the chance. As years go by, it will be complicated for others like me to manage message feeds from hundreds of thousands of contacts, and moderation points and rules will be demanded by people in the same way that other online resources have had to provide solutions for trolls, noise and spam.

    34. Re:Ignorance, not indifference. by mcgrew · · Score: 1

      If you actually care, but don't want to vote for any of the candidates, then you should vote for a third party candidate

      That's actually what I do, and furthermore when the primaries come around I vote in the primary with the least acceptable candidate so I can vote against him/her.

      The Ds and Rs are both beholden to the corporations, and the corporate-owned mass media have convinced the average voter than any vote for a "third party" is wasted. Most people are like the 1930s humorist Will Rogers: "All I know is what I read in the papers".

      Personally I think voting for tweetle dumb or tweetledumber is a wasted vote, especially if, like most of my generation, you enjoy smoking green stuff. How stupid could one be to vote for a man who wants you in prison? Talk about wasting your vote!

    35. Re:Ignorance, not indifference. by Chardish · · Score: 1

      Sadly, I don't know if 50% of voters (at least in the US) can name Candidate A and Candidate B, much less something they disagree on.

      There was some poll done a couple years ago in the US that showed that more people can name all of the Seven Dwarfs than can name two of the nine Supreme Court justices.

    36. Re:Ignorance, not indifference. by Mr.+Slippery · · Score: 1

      my check card...has the exact same protections as a credit card

      Not really, because you have very different things at risk.

      If I get your check card and clear out your account, you have *no* *money* over the days or weeks it takes to get it straightened out and the protections to kick in. Plus checks/ACH transactions bounce and you get hit with fees.

      If I get your credit card and max out your account, you owe a debt -- which you don't end up having to pay -- over the days or weeks it takes to get it straightened out and the protections to kick in.

      --
      Tom Swiss | the infamous tms | my blog
      You cannot wash away blood with blood
    37. Re:Ignorance, not indifference. by mcgrew · · Score: 1

      I don't know where I first heard this, but

      Q: What's the difference between ignorance and apathy?

      A: I don't know and I don't care.

  3. We just need legislation by MobyDisk · · Score: 4, Insightful

    The actions made by these companies, right or wrong, are legal. You can't expect companies (or governments... or individuals) to stop doing this if it is convenient, profitable, and legal. We need some legislation that basically says that they can't publish, transmit, or sell personal information without prior consent. And that any such release - intentional or accidental - must be reported to the individual.

    In the US, we have such legislation but it only applies to medical information. That is silly - there's just no reason for companies to be giving this stuff out.

    Actually, let me go a step further -- they shouldn't even store this information. I walked into Target and returned some merchandise. It was really simple -- because they kept my credit card on file. I never told them they could do that. As I walked away, they said "Thank you [my name]" so they knew that too. Why is it okay for a store clerk to have this? Why did my credit card company give out the credit card number and name? They don't need that. They need to know "User 81234756897 authorized purchase for $57.34 to vendor 9234857 on 2010/05/23 17:24 with authorization #239485768934." That's it. It should have been illegal for my credit card company to even give the information. Then for Target to store it. As a nice side-benefit, this also prevents fraud since no one in the chain can use my credit card.

    1. Re:We just need legislation by selven · · Score: 3, Insightful

      Has it ever occurred to you that some customers actually like that kind of customer service? That's why you can't just ban everything and make everyone happy - some infringements of privacy have good uses, and some people actually prefer convenience to privacy. Letting the free market sort it out, with some companies offering convenience and others dedicated to privacy, is in my mind the best solution.

    2. Re:We just need legislation by Anonymous Coward · · Score: 0

      The actions made by these companies, right or wrong, are legal. You can't expect companies (or governments... or individuals) to stop doing this if it is convenient, profitable, and legal. We need some legislation that basically says that they can't publish, transmit, or sell personal information without prior consent. And that any such release - intentional or accidental - must be reported to the individual.

      Easy fix... put it in the EULA. Done. You have now consented.

    3. Re:We just need legislation by Todd+Knarr · · Score: 4, Informative

      Actually they probably didn't record your credit-card number. What they probably recorded was the sale number (basically a receipt serial number), the receipt information (what was bought), and the type of credit card and the authorization number. They knew your name because it was recorded off your credit card at the time of sale. To handle the refund they just use the authorization number, which the credit-card company can match to your card (but they won't tell the store the card number, they'll just give out another authorization number for the refund).

      Now, the store probably doesn't need to store your name at the time of sale. But if you're paying with a credit card, you know you're leaving a connection between you and that sale anyway so IMO it's not a major thing. If you really want no connection, pay in cash and don't give them any identifying information, not even a phone number.

    4. Re:We just need legislation by raving+griff · · Score: 1

      And then whichever is less popular will die out as the other reaches critical mass. Either that, or people's data will be fragmented between two very different camps that likely will not be able to interface with one another as one service lacks privacy and the other does not. You'll end up in a situation where half your friends are on one social network and half your friends are on another--you'd be forced to use both services to keep in touch with one group of friends.

    5. Re:We just need legislation by Rene+S.+Hollan · · Score: 1

      Did you return the merchandise with your receipt or credit card?

      If the purchase was made with a credit card, store policy is usually to issue an offsetting credit on the same card (though I suppose some might issue other store credit or a corporate cheque when the card charge clears, which is somewhat inconvenient).

      If you provided your credit card so the charge could be reversed, they could issue a query to the credit card company by number and amount -- no need to store your card for this (though they probably do for reconciliation in accordance with the credit card company's privacy policy). When you provide your card a second time, they see your name.

      Not arguing that they didn't keep information longer than necessary, but they could have had the same interaction with you without necessarily doing so: the credit card company might have had it, and released it when you provided your card. Hence, my question about handling the return with your credit card or receipt. If you just provided your receipt, AND they did not need your credit card to reverse the transaction, THEN they kept information longer than necessary.

      --
      In Liberty, Rene
    6. Re:We just need legislation by clarkkent09 · · Score: 3, Insightful

      I agree, if online privacy was really as important to the majority of people as it is to some /. posters there would be companies advertising "guaranteed" privacy the same way they advertise lower prices or whatever other advantage they claim over their competitors. The reason companies don't care is that their customers don't care. Those of us who do just need to be more careful about who we do business with but IMHO it's a losing battle as long as the public awareness of the importance of privacy is nonexistent.

      --
      Negative moral value of force outweighs the positive value of good intentions.
    7. Re:We just need legislation by Skarecrow77 · · Score: 1

      that's why i never installed a half dozen different IM clients. ICQ, AIM, Yahoo, MSN, blah blah blah. Anybody not on the one I used must not want to talk to me that much, so email can suffice for them.

      Now of course I get all the networks under one communicator, so I do have multiple IM network accounts, but that just reinforces the original point.

    8. Re:We just need legislation by Anon-Admin · · Score: 3, Interesting

      The problem is that all the companies are data gorging. The CC Merchants are the worst. They insist that you send them not only the total but a list of what the person is buying. They also monitor your advertising and who links to you on the internet. I use to run a lab supply company. We had a affiliate link when we first went online. The merchant account found two sites that linked to us, these sites were in other countries and were drug related. Well drug related in the US but they appeared to be legal in there country. They killed our account with no warning. $3000 a day in sales through the web site gone. They would not turn it back on and added us to a black list. We were unable to continue selling online. We still have the brick and mortar but the online store it gone. We broke no laws and there was no published list of what not to do.

      All in all, not only do they collect all the information on every one and there sales, they spend a lot of time monitoring and collecting information on the stores. They need to be dinged on this, some Merchant accounts go as far as to tell you what products you can and can not carry. The second one we had would not let us carry or sell any pipettes, agar-agar or 10cc syringes that had 1.5" 18 gauge needles on them. They considered them "Drug paraphernalia"

    9. Re:We just need legislation by Anonymous Coward · · Score: 0

      I think everyones movements should be tracked in micro detail, the government does it, it's time for the public to watch the public (which also includes all government employees)
      Think Cathedral and the Bazaar, but for information (biometrics,location,crowd content) instead of software.

    10. Re:We just need legislation by ElectricTurtle · · Score: 1
      You contradict yourself:

      [...]there's just no reason for companies to be giving this stuff out.

      ...right after saying:

      [...]it is convenient, profitable, and legal.

      It's also nothing new. Do you think that never before the interwebs was data collected about demographics and metrics? That supply and demand occurred randomly? The internet makes it easier, but fundamental economic relationships have existed as long as economies themselves. Businesses have kept ledgers of their clients and transactions for as long as there has been writing. It was generally in the interests of these businesses to keep such ledgers private, and they did so out of those interests to build trust with their clients, but that was a practical thing, neither a moral nor a legal obligation.

      Oh and vis a vis Target, hate to break it to you, but your credit card # is your 'user #' and they must know your name because presumably you carry ID against which they could verify that you are who you claim you are. Otherwise anybody could make purchases in your name not merely unchallenged but unchallengable. Granted most vendors assume people are who they say they are, which negates its value, but that is just one of many flaws of the system.

      --
      I support the Slashcott and will not be reading or commenting from 2/10/14 to 2/17/14. Beta is steaming pile of dog shit
    11. Re:We just need legislation by TomXP411 · · Score: 1

      Actually, your name and credit card number are both encoded on the mag stripe on your card.

      As to storing your credit card number: stores have always stored your credit card number as part of the transaction. Back in the pre-mag stripe days, they used an imprinting machine and made a copy of it. Today, it's just stored on a database somewhere.

      The end result is the same: the number is required as part of the transaction, and the Track-9 data from your card is the only real proof that you were there for the transaction.

      I do tend to agree that personal data should be kept private unless the user explicitly authorized to do so, but the question then becomes "what, exactly, is private?" You could have a whole discussion on just what is truly private information and how an automated system can determine this.

      For the record, my simplistic answer is: anything a user enters in to a data system is private unless otherwise specified, either by context (a public forum) or explicit designation (a check-box that says "public" access).

    12. Re:We just need legislation by xednieht · · Score: 2, Insightful

      No we don't. We need the government to get involved like Andy Rooney needs another eyebrow!!!

      Let innovation take it's course.

      --

      Hope is the currency of fools
    13. Re:We just need legislation by LandruBek · · Score: 5, Interesting

      "Making everyone happy" was never on my to-do list. "Not get reamed by the corporatocracy" is on my list and remains there. As much as others might enjoy the familiarity of having complete strangers call them by name, and the convenience of having merchandise instantly charged to their accounts, *I* am selfish enough to sacrifice all those pleasures just so that I might exert a little bit of control over what others know about me.

      This is a job for government regulation. We don't trust the free market with important things like ensuring food safety, protecting the environment, or verifying whether pharmaceuticals are effective. Why should we trust the free market with personal privacy?

      --
      $META_SIG_JOKE
    14. Re:We just need legislation by MachDelta · · Score: 1

      No one in the history of anything and anywhere has ever read the entirety of an EULA *and* understood every word of it.

      They're the digital equivalent of the guy and the end of the commercials going "side effects may include... nauseavomitinghypertensionswollenheaddeathdepression, anorexiaspontaneoushumancombustionsorethroat, tumourscancerdiabetesparkinsonslossofvisionandnumbness." The stuff said so fast no one can comprehend it... but hey, it's there because the law said so!

    15. Re:We just need legislation by LandruBek · · Score: 1

      it's a losing battle as long as the public awareness of the importance of privacy is nonexistent.

      Well, I hope you are wrong. One good thing about Facebook's recent spastic blunders is that at a few, at least, have realized that privacy is something fragile that deserves some protection. If those of us who care will beat the drum from time to time, others just might wake up. In other words, I'm not yet willing to call it a hopeless battle.

      --
      $META_SIG_JOKE
    16. Re:We just need legislation by MobyDisk · · Score: 1

      I think they *could* do it from the authorization number, but I am skeptical that they actually did it that way. I find that places that use the authorization number ask me for my credit card and punch that number in when doing the return. So I think they just store it. Considering that all the online stores do this too, I don't find it unlikely that retail chains are starting that practice.

    17. Re:We just need legislation by MobyDisk · · Score: 3, Insightful

      Has it ever occurred to you that some customers actually like that kind of customer service?

      Nothing I've said decreases the level of customer service. The return could have been done without them saving the credit card number.

      Letting the free market sort it out, with some companies offering convenience and others dedicated to privacy, is in my mind the best solution.

      I always prefer free market solutions, but I don't see how to make one work here. The free market only works when the buyer is aware. Companies don't tell me what information they disclose about me. I only find out when I suddenly get charges on my credit card because the store clerk got all my credit information, or because some hacker broke into the stores and took it. I would be open to laws that require them to disclose it to me, but I don't want to read a 25-page legal document to buy something from a store. Since there is no benefit to me from them keeping the information (see the first paragraph for the explanation of why) the restrictive solution is the best one.

    18. Re:We just need legislation by JWSmythe · · Score: 1

      I always love hearing that list, when the side effects may include a
      rambling list, that starts with headaches, and ends in death. It makes me not
      want to take anything ever again.

      --
      Serious? Seriousness is well above my pay grade.
    19. Re:We just need legislation by MobyDisk · · Score: 1

      The reason companies don't care is that their customers don't care.

      From my experience, they do. When credit cards first came out, people were afraid to use them because of fraud concerns. Same with the internet. It was only 10 years ago that my grandfather would not enter his credit card into a web site. But today, people take the technology for granted and no longer think it through.

      But if you talk to someone, and educate them on the issues, they respond like "what can you do?" And when I explain that a simple change to the credit system, such as generating disposable credit card numbers, or smart chips - they get interested, and then angry that no one is doing it. So people definitely care, but they don't know, and don't think they have any control over it.

    20. Re:We just need legislation by MobyDisk · · Score: 1

      I think that was his point. :-)

    21. Re:We just need legislation by AthleteMusicianNerd · · Score: 2, Insightful

      That's what OPT IN is for.

    22. Re:We just need legislation by Abcd1234 · · Score: 1, Offtopic

      I use to

      Random grammar tip: It's "used to"... "use" is present tense, "used" is past tense.

    23. Re:We just need legislation by clarkkent09 · · Score: 3, Insightful

      Well take slashdot. It is owned by a for-profit publicly traded corporation. True we don't give our names and addresses but many of do give our personal readily identifiable email address and of course IP and probably 1000s of us can be identified if somebody choose to do so and linked to quite detailed overview of our political and other opinions - valuable data for advertisers, political parties, potential employers and who knows who else. This data will still be there years from now and who knows what can happen with it, the financial incentive is certainly there to sell it. Now, I tend to trust slashdot (famous last words?) but I am just trying to illustrate how difficult it is to truly guard your online privacy unless you are a kind of person who only ever communicates through encrypted messages or something like that.

      --
      Negative moral value of force outweighs the positive value of good intentions.
    24. Re:We just need legislation by Anonymous Coward · · Score: 1, Interesting

      I walked into Target and returned some merchandise. It was really simple -- because they kept my credit card on file. I never told them they could do that. As I walked away, they said "Thank you [my name]" so they knew that too.

      They do this because people like it and it encourages them to buy - my wife will buy stuff she's unsure of at Target, then decide if she's going to keep it or not. She knows it's easy to return, and she does return stuff regularly, but she'll also keep some of it & get more when she's back there doing the return. Home Depot also can do the return just from the receipt. Just like everything else with cards, they want you to use it more & they don't really care about a little fraud, the overall benefits are much bigger.

    25. Re:We just need legislation by natehoy · · Score: 1

      "Social Network" and "Privacy" are diametric opposites. They are the modern equivalent of bulletin boards (not electronic ones, I mean the cork thingies you still find at the entrances to many supermarkets) except everyone has fingerprint readers and knows who has posted what.

      Social networks exist, as a business model, so you may sell aspects of your privacy in return for the convenience of keeping in touch with your friends. Large-scale sites need money in order to survive, and if you aren't paying them money you are paying them in something for the services they provide. Frankly, I'm more concerned about sites that offer to protect me from Facebook "free of charge". Because the First Rule Of Acquisition is that almost no one does anything without a motive for profit. Google? Facebook? I know their motive for profit. I can choose whether or not to participate, knowing what they offer and knowing exactly what they intend to do - sell the shit out of anything I divulge to them to anyone with a bag of gold.

      Half of my friends are on a social network, and the other half who really freak out about their privacy are not on a social network. I'm on it, but I post very little that I wouldn't post, say, here on Slashdot or say to my boss at work. And I still understand that other people might say things about me on Facebook that my boss could still read, or Google (or Reuters) could catch me snogging CowboyNeal, whether or not I join and participate in any of the services they offer. There's not a whole lot I can do about such things, and those risks have existed a lot longer than Google or Facebook have been in business. It all started with that nasty invention of the written word, and even Ogg could say nasty things about Zogg and his nasty mastadon fetish behind his back.

      --
      "This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
    26. Re:We just need legislation by MobyDisk · · Score: 2, Insightful

      They insist that you send them not only the total but a list of what the person is buying.

      Part of that is for their fraud detection algorithm. (Which would not be as necessary if they didn't give out the information).

      As for the other stuff - sounds like you should have sued them.

    27. Re:We just need legislation by webheaded · · Score: 1

      You do not use an authorization number to do a refund. The same authorization number can be given out from the same bank more than once on the same DAY. This number means nothing. You do, in fact, need the card, but that data can be looked up by the processor or even the software they use on their computers. I'm guessing the computer though, because processors (like the one I work for) don't usually store the name from the card in their system. That is something specifically done at the point of sale and it is taken from the card itself. Your name is there because that's part of verifying that you are the person that is supposed to use the card. You can't have security without having a way to verify the person using the card SHOULD be using the card.

      That is pointless anyway though because we all know that no one actually checks the name or signature, but still. They have the data because it was actually necessary at the time of sale and the system probably just stores it with all the other data. It's not that they're trying to breach your privacy...they used the data at one point for something valid. You may have a point about them storing it afterward though. I don't see why that is okay. You'd think the security standards would frown upon this. They are actually quite strict about this thing. You aren't even allowed to have the card number print on any copy of the receipt (including the merchant copy) anymore. Hell, our terminals won't show it ANYWHERE anymore. Receipts, reports, on the terminal itself...nowhere. They don't dick around with this stuff and they don't take it very lightly (usually).

      --
      "Those who would sacrifice essential liberties for a little temporary safety deserve neither liberty nor safety." - BenF
    28. Re:We just need legislation by palegray.net · · Score: 2, Insightful

      It should have been illegal for my credit card company to even give the information.

      You know, I've got a story on this topic. A couple of months ago I bought a piece of furniture (Ikea, got a nice dresser for a nice price). Upon unpacking it, I discovered it was broken. Given that the store is 60 miles away, I waited awhile before taking it back for an exchange. My wife and I finally made it out to Philadelphia with the broken item in tow, only to realize that while my wife thought she had the receipt on her, she didn't.

      Their official return/exchange policy requires a receipt, but they were able to look up the transaction by credit card number. Thus, I received a replacement dresser 15 minutes later, and has happily on my way. I'm perfectly fine with them having my credit card information.

      If fraudulent transactions occur on one of my accounts (and I have been though that, three times in fact), I simply dispute the charges and submit an affidavit on the matter. Boom, I get my money back. To be perfectly frank, I don't see any value whatsoever in what you're proposing, and it seems to ring all too much of "sky is falling" cries over something that is a solved problem.

    29. Re:We just need legislation by MobyDisk · · Score: 1

      You contradict yourself:

      Granted. The contradiction was because of my wording. I should have said "There is no benefit to the consumer for companies to be giving this stuff out."

      It's also nothing new...

      I never said it was. It is just much more dangerous now, due to the scale of it.

      hate to break it to you, but your credit card # is your 'user #'

      Exactly. That is the part that needs to be changed. Automatically generated numbers, smart cards, etc. solve that problem. But common-sense when handling transactions can minimize it. The store only needs to keep the authorization number, not the credit card number.

      ...they must know your name because presumably you carry ID against which they could verify that you are who you claim you are.

      Actually, in my state, it is illegal to ask for a driver's license when using a credit card. I know that sounds crazy, but it is the case. After a very cool and understanding manager at a Lowes explained this to me, I switched to a credit card with my picture on it.

    30. Re:We just need legislation by MobyDisk · · Score: 2, Insightful

      and the Track-9 data from your card is the only real proof that you were there for the transaction.

      I can see how the number was needed before the systems were electronic. But now, they get an authorization number right away. The Auth# and signature should be sufficient for them to go back and prove the transaction was valid.

      I agree with your definition of "private data" and I think that is where we need to go. Private, unless otherwise stated.

      Also, food for thought:

      Actually, your name and credit card number are both encoded on the mag stripe on your card.

      Several people pointed this out to me. I think people assumed that I didn't know because I said that the credit card company gave it to the merchant. In my opinion, they did. I never told the merchant my name. And the cashier never looked at my card to read it. So the fact that the credit card company encoded it onto a magnetic stripe, and then I scanned the card into the machine, should not mean that *I* gave the information. That would allow a big loophole.

      Now, if it was printed on the card and they physically saw my card then one could argue that I knew it was on there and I gave it to the merchant. But I think the definition needs to be such that the companies can't do an end-run around me by putting my marital status on the card, then making me scan the card, and thus concluding that I told the cashier my marital status. (Or replace "marital status" with "address" or "purchasing history" or whatever other information should be protected).

    31. Re:We just need legislation by MobyDisk · · Score: 1

      What innovation is going to fix this? You can't just blithely say that innovation, or technology, or the free market will solve whatever problem is happening. That's the same as those who say that the government will solve it. Just pushing responsibility to someone else.

      I made a proposal. You obviously prefer a free market solution. I'm open, let me know what it is.

    32. Re:We just need legislation by Sir_Lewk · · Score: 2, Funny

      That use to be how grammar worked, but now nobody gives a shit.

      --
      "linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
    33. Re:We just need legislation by blair1q · · Score: 1

      would not let us carry or sell any pipettes, agar-agar or 10cc syringes that had 1.5" 18 gauge needles on them

      You mean "eye droppers, jell-o, and glue applicators."

      At least, next time you apply for a merchant account from them, that's what you mean.

    34. Re:We just need legislation by blair1q · · Score: 1

      I can think of a lot of reasons for demanding itemizations, but it's probably to keep them from becoming the market-maker for money-laundering schemes.

      If all they got from your company were reams of $4999 charges for "merchandise" they'd have no way to fend off the FBI.

    35. Re:We just need legislation by LandruBek · · Score: 1

      I think you might be confusing privacy and anonymity, which are not the same thing.

      --
      $META_SIG_JOKE
    36. Re:We just need legislation by MobyDisk · · Score: 1

      Just playing devil's advocate here, since this is a privacy discussion: How did the FBI find out about your hypothetical $4999 transactions? Should I assume they went to a judge and obtained a warrant?

    37. Re:We just need legislation by LandruBek · · Score: 1

      People are less concerned now about CC fraud not because in the USA they simply are not liable beyond the first $50 of fraud. They seldom think about it because there is little reason to.

      --
      $META_SIG_JOKE
    38. Re:We just need legislation by blair1q · · Score: 1

      Just playing devil's advocate here

      Does your boss know you just identified him?

      How did the FBI find out about your hypothetical $4999 transactions? Should I assume they went to a judge and obtained a warrant?

      No, you should assume that the $5k breakpoint is for determining what must be reported, not what can be reported or examined by the authorities. I'm pretty sure there's nothing in the banks' privacy agreements beyond what they'll give to merchants.

    39. Re:We just need legislation by treeves · · Score: 1

      "...in my state, it is illegal to ask for a driver's license when using a credit card."

      To ask for any form of ID or just a driver's license? What is the purpose of such a law?

      --
      ...the future crusty old bastards are already drinking the Kool-Aid.
    40. Re:We just need legislation by MobyDisk · · Score: 1

      Granted, that is part of it. But I know several people who were affected by fraud, and it costs a lot. It is often tough to get the charges taken off. Then you have to get new card numbers, file police reports, check your credit scores. Everyone I've known paid for their own credit reporting after the free year that they get - so it definitely costs them. It's a major pain in the butt.

    41. Re:We just need legislation by MobyDisk · · Score: 1

      I dunno. I was surprised. Not sure if I like that or not. I certainly don't like when they scan IDs since they store and scrape over information off of them. But checking a picture seems reasonable. That's why I had the picture added to my card, although no one even looks at the card.

    42. Re:We just need legislation by MobyDisk · · Score: 1

      Does your boss know you just identified him?

      ohhhhh... *snap*

      This kinda gets back to the start of things. Under the system I proposed, they actually would legally not be permitted to give this information to the FBI. Which is how it should be.

      Right now, warrants are only needed if the company refuses to give the information. What we have learned today is that if the government comes asking, you probably should give. Even if you aren't allowed to, they will just grant you immunity retroactively. I would rather the law say that they legally can't give the information out unless there is a warrant, rather than making it an option.

    43. Re:We just need legislation by TomXP411 · · Score: 1

      I never told the merchant my name. And the cashier never looked at my card to read it. So the fact that the credit card company encoded it onto a magnetic stripe, and then I scanned the card into the machine, should not mean that *I* gave the information. That would allow a big loophole.

      I'd bet that if you check your credit card agreement, you'd find that they have the right to share information necessary for the transaction... which would include your name. The vendor is required to cross-check the name on your card with the name on your ID. They're also required to check that the name and number on the receipt match the name and number on the card. Finally, the signature on your ID is supposed to match the signature on the back of the card and the signature on the signed receipt. If any of those don't match, they're supposed to reject the card.

      So if a checker is NOT looking at your card, they're actually putting the store at risk for a chargeback.

      As to keeping the CC# on file: the approval number is only half the transaction. The physical CC# is the other. Once you've swiped your card, the rest of the transaction is between the CC processor and the merchant; if you don't like that, you'll have to take it up with Visa or Mastercard.

      If you have a problem with that, or with a store tracking your purchase history, then there's always the cash option.

      As people repeatedly pointed out to me when I spoke out against the Google Buzz privacy breach: the only sure way to ensure our privacy is to not give out the information in the first place.

    44. Re:We just need legislation by MobyDisk · · Score: 1

      I'd bet that if you check your credit card agreement, you'd find...

      Probably so.

      As to keeping the CC# on file: the approval number is only half the transaction.

      Perhaps that's the issue right there. The point of a transaction is that you need a certain amount of information to perform it, but once the transaction is complete, you don't need all that information. You only need the transaction ID - which is the authorization #, in this case.

      Why does the merchant need to keep all materials that lead to the transaction? What benefit does that provide the merchant, other than the possibility of fraud? Since the auth# proves that they had the CC# at some point, so they don't need it as "proof" of anything. As others pointed out in the discussion, they can do a return with just the authorization #. I just don't see why they keep it at all.

    45. Re:We just need legislation by SolitaryMan · · Score: 1

      Letting the free market sort it out, with some companies offering convenience and none dedicated to privacy, ...

      There, fixed that for you.

      Seriously, though, how many companies do you know that "dedicated to privacy"? Free market leads companies in the direction of money and coincidentally this direction is the opposite of privacy, because nobody cares [I hope I can add "yet" here]

      So, basically, you have to options: go with the flow and give up privacy or stick with the privacy and become an "antisocial freak". Most slashdotters, though, already made that choice when they were considering career options. :)

      --
      May Peace Prevail On Earth
    46. Re:We just need legislation by Anonymous Coward · · Score: 0

      I worked for Home Depot just under 4 years ago and can tell you anyone who handled returns had access to the credit card type, credit card number, exp date and full name (HD CC or Visa CC, it didn't matter). Not a 'receipt' number. I know this because when a customer wasn't sure which card they used for the original transaction we'd use the numbers (last 4 digits, but the whole number was there) to identify the correct card.

      This may have changed by now due to regulation or requirements by the various CC services (I know Visa and MC tightened their restrictions for merchants holding customer info after the TJ Maxx breach), but it was SOP at the time.

  4. Online privacy never existed by h4rr4r · · Score: 2, Insightful

    There is no online privacy, anything you do online is public. If you would not say it in public do not say it online.

    1. Re:Online privacy never existed by allo · · Score: 1

      but if i say it at your home, you will not say it to other people. but if i say it in a private facebook message to you, some hacker will read it. the problem is, all "rooms" on the internet are built by others, and the security is weak sometimes. if facebook does not read the content, a hacker will read it.

    2. Re:Online privacy never existed by Skarecrow77 · · Score: 1

      people want their sacred cows. reality need not interfere.

      Instead of asking "is what I'm doing keeping my identity private", it's far more useful to ask "is anybody likely to pay attention to what i'm doing."

      The information is out there, the question is what is going to be done with it. The answer, for the vast majority of things, is "not a whole lot"

    3. Re:Online privacy never existed by Hatta · · Score: 1

      Sure there is. Send a GPG encrypted email, and that's private. Or chat over Pidgin-Encryption, that's private too. The internet defaults to public, but it's easy enough to secure your privacy when it matters.

      --
      Give me Classic Slashdot or give me death!
    4. Re:Online privacy never existed by TomXP411 · · Score: 1

      Take it from anyone who's ever been married to a vindictive spouse: anything that ANY other person hears is no longer private; I don't care if you're in the middle of the desert. The day you move out, your ex-wife (or husband) will call your most trusted family and/or friends and air all your dirty laundry.

      The real question is "what will a company do with your 'private' information?" I think that on-line privacy policies are a good place to start; what we need now is legislation that forces companies to stick to those policies - despite their disclaimers that say "we're not liable if we break our own rules."

    5. Re:Online privacy never existed by Abcd1234 · · Score: 1

      Sure there is. Send a GPG encrypted email, and that's private.

      By doing that, you are implicitly conceding the OPs point. There would be no need for email encryption if it weren't for the simple fact that sending data over the Internet is a public action.

    6. Re:Online privacy never existed by e2d2 · · Score: 1

      So email isn't private and I should consider it public? No thanks. I'll take the "yes this is my private data" instead. Just because someone can read it doesn't mean it's not private. Just like snail mail is private, yet it's in the open, anyone can open it and read it. But no one would consider that public information.

      As for public posting, this is why you create pseudonyms. Even if all the data is accurate except for your name. Just don't give them that. So now they know Nigel Weisnewski from Buffalo NY likes cheesy fries. But Nigel isn't real.

      Tell me who I am and I'll send you $50. Bet you can't find my name. You may find an alias but not the real me. I think this type of thing will be more acceptable as people realize the implications of having your life exposed. It will be more important to obfuscate your data and people will get better at it.

    7. Re:Online privacy never existed by skids · · Score: 1

      That's exactly the blame-it-on-the-user attitude that is corrosive to developing the social boundaries we need to bring social networking to the next level -- it's a fad now but it will fade as the chickens come home to roost and privacy violations rack up a rap sheet of awful real-world consequences.

      Society needs semi-private venues to work. In the real world it comes from social proprieties. People who go squawking to your girlfriend that you said, no, actually, you don't really like the new curtains are generally shamed into behaving themselves. Companies that do the same will eventually be shunned as user expectations evolve/mature. Developers need to find the online equivalent to those boundaries and apply them. It's not an either-or "broadcast to the world" versus "take this with you to your grave, encrypted." That's a common view among the socially deficient, but it is not how the rest of us live.

      There's also an "if you have nothing to hide..." attitude that is destructive. You may not want to hide something until, say, it suddenly becomes outlawed for no good reason -- not that hard to imagine with some of the loonies running for public office.

  5. let 'em fight in the courts by jkinney3 · · Score: 2, Funny

    Use the same arguments as Intellectual Property proponents. Everything I say and write belongs to me. You have to ask permission to hear it.

  6. laziness by Anonymous Coward · · Score: 1, Interesting

    it's all laziness. Laziness on the part of the companies, and laziness on the part of the users of said services. A lot of people leave their stuff wide-open for the world to see. I think it's because overall, people like to feel like they're important, and their written words need to be shared. From the company perspective though, it seems to me the majority of security flaws are due to two things: 1) greed over content control, and laziness.

  7. Odd and Misleading Summary by eldavojohn · · Score: 5, Insightful

    One of the more trite and oft-repeated maxims in the software industry goes something like this: We're not focusing on security because our customers aren't asking for it. They want features and functionality. When they ask for security, then we'll worry about it.

    Let me counter that with one the more trie and oft-repeated maxims from businessmen in the 80s: Don't you worry about security, let me worry about blank.

    Not only is this philosophy doomed to failure, it's now being repeated in the realm of privacy, with potentially disastrous effects.

    And yet Facebook thrives and not until last week did Google offer secure searching and they're a giant. Sounds to me like companies that don't worry about privacy are doing pretty well -- maybe even the industry leaders. Maybe they're on to something about it being unimportant to the consumer?

    A quick search of recent news on the privacy front reveals that just about all of it is bad.

    Oh give me a break. Ninety percent of news stories are negative. Because it sells eyeballs. Really, do you expect a news article about the really great privacy that Slashdot offers Anonymous Cowards to appear? When privacy works, it's not news. Hell, when privacy is kept intact people don't even know. Your reasoning here is severely flawed.

    Facebook is exposing users' live chat sessions and other data to third parties.

    Yep, marketing's a bitch, ain't it? But then again, we're getting Facebook for free and I don't think there's been any case of someone suffering serious harm from Facebook dumping a chat to marketing. Certainly unsettling but has there been any sort of actual case of abuse and harm to the user? I use Facebook and I don't care much. I'm putting my data on their servers and they had me agree to some BS impossible to read ToS so I just mitigate that by keeping anything sensitive off it. If Diaspora takes off -- hey, great -- but until I can communicate with all my friends and family on it who are half a continent away no thanks.

    Google is caught recording not only MAC address and SSID information from public Wi-Fi hotspots, but storing data from the networks as well.

    "Caught?" That's funny. If you don't want to "catch" people "recording" your shit, stop broadcasting it and put some encryption on it and use a hidden SSID. You know, like the hundred or so Slashdot posts have pointed out.

    But the prevailing attitude among corporate executives in these cases seems to be summed up by Google CEO Eric Schmidt, who famously said this not too long ago: 'If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place.'

    "Prevailing?" So prevailing that you need to reference a half a year old quote that is about all we have of that attitude. That's the predominant force out there? Care to come up with more companies using that sentiment? Care to put that quote into context for me? Put the pressure on them and the companies will change. Fact is that nobody's putting any pressure on them so why should they stop doing something which allows them to better market to you with ads and make more money?

    If you look beyond the patent absurdity of Schmidt's statement for a minute, you'll find another old maxim hiding underneath: Blame the user. You want privacy? Don't use our search engine/photo software/email application/maps. That's our data now, thank you very much. Oh, you don't want your private chats exposed to the world? Sorry, you never told us that.

    [citation needed] Prosecutor is leading the witness. Seriously, you're putting words into their mouths. Evil, yes they are. Saying that they claim your data is now theirs by way of their actions is ridiculous. Then from there y

    --
    My work here is dung.
    1. Re:Odd and Misleading Summary by joelsanda · · Score: 1

      "Caught?" That's funny. If you don't want to "catch" people "recording" your shit, stop broadcasting it and put some encryption on it and use a hidden SSID. You know, like the hundred or so Slashdot posts have pointed out.

      It is amazing how people scramble to have them fix their security so my data (which I give them, because it's spelled out in the TOS) is 'secure.' I would have agreed with Schmidt's statement if he instead had said:

      'If you have something that you don't want anyone to know, maybe you shouldn't be doing it out in public where everyone can see it in the first place.'

      Lock down your home's access point and read the TOS before you start posting crap about your boss or employer. Can't get much simpler than that.

      --
      The Luddites were ahead of their time.
    2. Re:Odd and Misleading Summary by LandruBek · · Score: 1

      I think you are giving the Goog too much credit. Were they not sniffing wifi packets, like wardrivers? To their credit, they weren't caught: they turned themselves in. But what they were doing involved no TOS -- the traffic they intercepted and recorded (which might have been encrypted, for all you and I know) simply wasn't theirs, and they should not have been recording it.

      Lame analogy: if I don't lock my front door when I go to the store, I'm pretty stupid but it still doesn't give a passerby the right to come in and photograph my belongings.

      --
      $META_SIG_JOKE
    3. Re:Odd and Misleading Summary by joelsanda · · Score: 1

      I think you are giving the Goog too much credit. Were they not sniffing wifi packets, like wardrivers?

      Yeah, you may be right. I recall reading an article where they admitted guilt for that, and the reason they gave was the tool they were using had capabilities they did not intend for it to have.

      Plausible? Sure ... I've been in software DEV and QA for 12 years and know it's possible to merge with unintended consequences and release with functionality you didn't intend to.

      --
      The Luddites were ahead of their time.
    4. Re:Odd and Misleading Summary by martin-boundary · · Score: 1

      Care to put that quote into context for me?

      Here's the context for you: Google blackballs CNET reporters for a year after they publish freely available data about Google's CEO Eric Schmidt.

      It's users's fault for leaving information about themselves available on the net, but it's reporters' fault when Erich Schmidt leaves information about himself available on the net.

      I guess you didn't know about this, since you appear to think that any history which is more than six months old is obsolete and must never be used to inform the present.

      Sadly, I don't have time to debunk your other points right now.

    5. Re:Odd and Misleading Summary by ukyoCE · · Score: 1

      *sigh* Thanks for making a good response to the awful summary. It's too bad this place doesn't have editors to weed out bad summaries that draw inane conclusions from totally out of context quotes.

    6. Re:Odd and Misleading Summary by Anonymous Coward · · Score: 0

      The CNET FUD article is totally unrelated to Schmidt's quote about the government having access to all information you share with 3rd party companies.

      http://yro.slashdot.org/comments.pl?sid=158155&cid=13255523

      Sadly, I don't have time to tell you about all of the many other ways you are wrong and a terrible human being.

  8. anyone vs everyone by xs650 · · Score: 5, Insightful

    Google CEO Eric Schmidt, who famously said this not too long ago: 'If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place.

    There are very few things that I don't want anyone to know, there are a host of things that I don't want everyone to know.

    1. Re:anyone vs everyone by starglider29a · · Score: 2, Funny

      There are very few things that I don't want anyone to know

      Gimme a 'fer instance'..

    2. Re:anyone vs everyone by Anonymous Coward · · Score: 2, Insightful

      There are very few things that I don't want anyone to know, there are a host of things that I don't want everyone to know.

      Takes a single trusted 'someone' to disclose your info to everyone. It's a sad, losing battle. People can say 'happy birthday' or 'sorry that your wife died', 'sorry you got fired,' etc and the damage would be done before you could delete the comment and have a chat about what is too sensitive to disclose freely to your other friends.

    3. Re:anyone vs everyone by Bigjeff5 · · Score: 1

      I think Schmidt flubbed it, what he should have said was: "If you have something that you don't want everyone to know, maybe you shouldn't be broadcasting it in the first place."

      Google wasn't hacking into anything, they were connecting to open WiFi networks and collecting information that is necessary to connect to the network . The only thing that was a potential booboo here was they didn't dump the information, instead they chose to save it.

      If you don't want the whole world to know it, don't broadcast it.

      --
      Security is mostly a superstition... Avoiding danger is no safer in the long run than outright exposure. - Helen Keller
    4. Re:anyone vs everyone by Anonymous Coward · · Score: 0

      Fer instance, the list of things I don't want anybody to know.

    5. Re:anyone vs everyone by Deosyne · · Score: 1

      That's why I keep the 'anyone' material in an offline format, typically not even on paper. Not 100% effective, as was hammered home one Monday that I decided to take as a personal day and wander through Sears while countless busybody housewives babbled incessantly to one another about shit that they regarded as scandalous all around me. I now know more about the sex lives of random strangers than I do my own. But keeping it offline is still an improvement over posting the material to the world's first global communication network. That is strictly reserved for the 'everyone' stuff.

    6. Re:anyone vs everyone by egcagrac0 · · Score: 1

      Suppose I'm seeing another girl on the side. My friends probably know. I'd rather my main girlfriend didn't know.

      It's not against my moral code nor the laws of my community to be seeing more than one woman at once.

      However, out of courtesy, I'd rather be discreet about the second relationship.

      (To you fiends who will surely scoff at a basement dweller like me having two women: He said "fer instance". He didn't say it had to be true. I know it's a he, because girls don't say "gimme" and "fer instance", they'd say "give me an example".)

    7. Re:anyone vs everyone by Anonymous Coward · · Score: 0

      > Gimme a 'fer instance'..

      I got the hots for Gina Lollobrigida.

  9. Stupid argument by e2d2 · · Score: 1

    You know it's funny. These guys spin the word privacy so much that the idea of sharing becomes twisted. Yes I want to share; But with friends, not with faceless businesses so they can solicit me. The idea that these two things are inseparable is idiotic. I share my personal pictures with friends. That doesn't mean I want them beamed to the world.

    All of these sites need to stop playing stupid. They know wtf is going on and they know what people want. The problem is their customers are not their users, so the users get treated like chattle to feed the machine.

    You want longevity? Heed the wants of your users. It's not hard, and hell you may even make a dime off of it.

  10. How is 'privacy' defined in the US constitution? by UBfusion · · Score: 1

    Could a lawyer please enlighten us about the definition of 'privacy' US Constitution and in US Legislation, specifically for the electronic media (if available)? TIA.

  11. I call TROLL by Gorimek · · Score: 4, Insightful

    Both the Facebook chat bug and the Google recordings are unintentional mistakes. If they show anything, it's that completely bug free engineering is hard to do. I think we knew that already.

    The Schmidt quote is just a statement about how this flawed world is, not how it should be.

    The concept of privacy in these times and the future is a very interesting topic, but this post is just a whiny mini rant, not a serious attempt to understand the real issues.

    1. Re:I call TROLL by TomXP411 · · Score: 1

      What amazes me, Gorimek, is that you and I know this (that bug free code is hard.)

      But an amazingly large number of people are willing to cry foul and call this intentional. Intentions won't really matter: it will hurt the company's credibility despite the fact that it's really a non-issue.

      Does anybody remember the AOL swap file controversy? Essentially, the AOL client allocated unused space on your hard drive to use as a cache, and people found all kinds of snippets of data in there. Right or wrong, people claimed AOL was spying on them.

      I guess people will believe what they want, regardless of what the truth is.

    2. Re:I call TROLL by blair1q · · Score: 1

      completely bug free engineering is hard to do

      No, it's easy to do.

      Once you know what constitutes a bug.

      They didn't, so they got what they engineered: a shitstorm.

    3. Re:I call TROLL by shakuni · · Score: 1

      talking about bugs i have documented my experience here http://diagonalslash.blogspot.com/2010/05/google-is-messing-with-my-profile-data.html

      While the bug exposed it there is something going on here which i didn;t expect as a user.

  12. They said the same about cars by mbone · · Score: 3, Interesting

    I can remember very vividly GM and Ford (and Chrysler and even Packard) saying basically the same things about cars - they could put in safety features, but they didn't because there was no customer demand for it. This was, mind, when cars had metal dashboards and spear-your-heart driving wheels. This went on until the Federal Government started forcing changes, and until Volvo and other foreign manufacturers started making sales touting safety. I expect to see a similar story arc about piracy on-line.

    1. Re:They said the same about cars by Bigjeff5 · · Score: 3, Insightful

      Federal safety standards are pitiful compared to insurance company standards.

      Federal standards mandate airbags, but only for the driver, not the passenger or side airbags they've been putting in. All of that is coming from the insurance industry - and except for the fact that all drivers must have insurance, it's completely free market. Things like better crumple zones and such are all designed to boost their ratings with insurance companies, because people look at how much the insurance is going to cost them when they think about buying a car.

      --
      Security is mostly a superstition... Avoiding danger is no safer in the long run than outright exposure. - Helen Keller
    2. Re:They said the same about cars by blair1q · · Score: 1

      Yeah, but the cautionary films in defensive driving school will always be cooler than the safe-surfing vids...

      (nb this is apocryphal and meant only as a joke. dd school no longer shows the gore. the actual view it gives of driving danger is probably less than the implied danger of surfing the web in these stories...)

    3. Re:They said the same about cars by Spril · · Score: 1

      Federal safety standards are pitiful compared to insurance company standards....Federal standards mandate airbags, but only for the driver, not the passenger or side airbags they've been putting in. All of that is coming from the insurance industry

      Wrong. They've been required for both driver and passenger since 1999.

  13. When ads are more important than users by dominion · · Score: 4, Insightful

    The whole idea of "if you don't want it public, don't put it on the internet" always reminds me of this Onion video:

    Google Opt Out Feature Lets Users Protect Privacy By Moving To Remote Village
    http://www.theonion.com/video/google-opt-out-feature-lets-users-protect-privacy,14358/

    There's no reason that we can't have a reasonable expectation of privacy, even in our online lives. Especially from a technical standpoint. If I share some photos with 10 people, and one of those people decides to copy that photo into an email and send it off to 100 people, then that's a social failure, not a technical one. People I trusted betrayed my trust, on a social level.

    But on a technical level, I should be able to share videos or photos or journal posts with a small group of trusted people, and be reasonably secure in the idea that only they will see them. That advertisers won't have access to that photo, that an api won't be able to pull the data without permission, etc. There's nothing extraordinary about that requirement, and that it's treated as absurd and unreasonable shows how far we've fallen from a basic perspective on internet privacy.

    Open source can fill the gap. Our incentive, as open source software developers, is to provide the best software possible, and to not skimp on important features like privacy and security. We aren't trying to cater to advertisers, or to build empires based on fads and hype. I've been working on an open source, distributed social networking alternative to Facebook (and Myspace and other "walled gardens") that called Appleseed that focuses on strong privacy.

    http://opensource.appleseedproject.org/

    But most of all, by distributing these services, and allowing users to cancel their profile on one site, sign up for another site, and plug right back into the network they lost, it creates a level of competition so that social networking sites *have* to listen to the concerns of their users. They can't take them for granted. Not just in social networking, if we can continue push for open standards, open protocols, open platforms, etc., it means we have some leverage when a popular service decides to privilege it's revenue stream over the privacy of it's users.

    1. Re:When ads are more important than users by UpnAtom · · Score: 1

      Just want to say, get a move on and you'll clean up. There are hundreds of millions of FB users waiting for you or someone else to put out a decent alternative they can move to asap.

      It just has to be easy - FB's success was all about convenience. Ideally, users could access on Appleseed the same info from the FB network they can already access. Cross-posting options are a must. Interfacing with Facebook XMPP chat is a must.

  14. That's our data now, thank you very much. by kurokame · · Score: 1

    But not on Slashdot, right? Right?

  15. Privacy is a socio-political construct by rwa2 · · Score: 1

    There's no technical way to guarantee privacy and anonymity... quite the opposite: technology should be used to increase transparency.

    Privacy is to be respected. If someone doesn't respect your privacy, then by all means take socio-political-legal action. But you sort of have to implicitly trust your infrastructure provider - be it your ISP, your phone company, your email provider, etc. to not abuse your trust. And by all means don't use that infrastructure to transmit anything you don't trust them with.

    The good thing about the increased transparency the technology has provided us is that now it's easier to find out if our trust has been abused.

  16. Privacy is your own responsibility. by Hatta · · Score: 3, Interesting

    There's no identifiable information in your MAC or SSID. So big deal there. If you don't want your packets sniffed, it's easy enough to enable encryption. If you don't want your emails shared with marketers, no one is forcing you to use GMail. No one is forcing you to use Facebook for that matter either. These companies provide a service that's free to you, but in exchange for your privacy. If you don't know that's the deal, you have no one to complain to but yourself.

    It's really quite trivial to maintain your privacy on the internet. Use encryption whenever possible, and don't use services from companies who's business model is selling your information. Problem solved.

    --
    Give me Classic Slashdot or give me death!
    1. Re:Privacy is your own responsibility. by Anonymous Coward · · Score: 0

      don't use services from companies who's business model is selling your information

      The problem is that Joe the Plumber doesn't know that Google's and Facebook's business model is selling their information and browsing habits. They're only just starting to find out as the government has started taking a serious look at Facebook, and they have no clue as to how large the scope of the practice is.

    2. Re:Privacy is your own responsibility. by Anonymous Coward · · Score: 0

      Nothing identifiable in your MAC are you serious, its a unique number in the whole world only embedded on your one network device. Every major Government on Earth can track your dumb butt if you leave the office or home and go plug into open wifi at starbucks they could lock the MAC in 1 second and see that you went for a latte.

      No identifiable info to the kid next door sniffing wifi maybe but to the Government it is one of the main tracking mechanisms that never changes since IP, Cookies, Cache and Even OS are not static, but that little MAC address is static for life outside of hacking that is.

    3. Re:Privacy is your own responsibility. by ImprovOmega · · Score: 1

      They would first have to tie the MAC to you personally. That would require cooperation from the company that manufactured the card, every supplier in the chain on down to the retail store, and the final point of sale itself. Not to mention that it may have been sold in the interim, bought with cash in the first place, or even possibly stolen. A MAC is just a number. Tying it to a person is a whole other trick entirely (despite what the various CSI shows may try to tell you).

  17. When? by WillyWanker · · Score: 2, Insightful

    When are we going to start taking responsibility for our own privacy? If it's a concern to you then do what's necessary to protect yourself.

    I just don't get why this is suddenly such a big deal. What exactly did Google do that other's couldn't have? If you leave your wi-fi unencrypted and someone accesses it it's somehow THEIR fault???

    If you don't want people to know your business start by not announcing everything you do in a public forum.

  18. I'm Over It by Anonymous Coward · · Score: 1, Interesting

    I'm so over so-called "cloud" computing and social networking sites, webmail, etc.

    I've started to roll my own IT infrastructure. All it takes is a domain name, some time and skill (or the desire to acquire said skills) and away you go.

    i will no longer use anyone else for email, etc. I'll host my own domain name, my own blog, my own email. I'm going to own my data, not someone else.

  19. The blame game by masterwit · · Score: 2, Interesting
    Finger-pointing should be reserved to politics while those not necessary to blame mitigate and/or find a solution to the problem.

    Blame the user. You want privacy? Don't use our search engine/photo software/email application/maps. That's our data now, thank you very much. Oh, you don't want your private chats exposed to the world? Sorry, you never told us that."

    I am all for the world deserves more privacy, privacy laws should exist, etc..."trust" me! But jokes aside, there will always be entities that operate outside what we consider the ideal privacy as long as they are allowed to do so. The problem is not that of each company's policy: since when did we decide that each respective business should and would always hold itself to a higher standard?
    In the corporate world these days, one of the common phrases to encompass a moral code is: "if you wouldn't want your mother reading it on the front page of the newspaper, you probably should not be doing it." That is all fine and dandy as they say for a corporate environment and ethics, but this does not necessarily apply to my personal browsing. The problem therefore, as I argue, is that of a conflict of interests:
    ---We want transparency with privacy. Security and privacy in a corporate viewpoint need to be high. Certified public accountants are held liable for transactions, and audits happen...very often. If the security system itself does not allow tracing of fraud, or even a way to raise a "red flag" of sorts, well then the security system is flawed in the eyes of the auditor.
    ---We want privacy on personal matters. This fact alone can contradict not in implementation or even feasibility, but perhaps in theory - which is enough to cause problems. As a hypothetical CEO of a corporation, I do not have much understanding of personal privacy of internet actions...I have to deal with lawyers (yes those people...), auditors, and general liability. When I am told that I need to up user privacy and not record any data, etc... this may go against what I fundamentally see my company doing!
    I mean to say here that there is a bridge of "thought" between privacy and liability...even though this should not apply to the end user: us.

    We assume that big companies are playing fast and loose with our personal information and that there's little we can do about it.

    On another front, many Americans are complacent...we know this to be a fact! I don't care about Republican this, Democrat that, Ron Paul, whatever...the world will always have ignorant individuals. Individuals will except a sacrifice of privacy and that overused term liberty in exchange for a bit of "piece-of-mind", and in many cases they just don't care.

    A quick search of recent news on the privacy front reveals that just about all of it is bad.

    Lastly, I'd like to say, outside of the fact that bad news means more audience, that this all is bad philosophy might not be what is needed. Sure the breaches on my personal privacy and what I like to coin as my "personal liberty" are disturbing...but in a general sense unless the actual source of the problem, a complete lack of laws protecting our privacy, is brought to light, I do not expect any real change.
    I agree with this posting in the fact I want privacy and I have little patience...but I just wanted to play the devil's advocate on Slashdot for a bit...
    My question to you all: How can we balance security and corporate liability today? && How could the general public be informed the "real" issues, not just the latest privacy breach?

    --
    We should start a new Slashdot and return control to the geeks. It actually wouldn't be that hard to get some users to
    1. Re:The blame game by Setsquare · · Score: 1

      but in a general sense unless the actual source of the problem, a complete lack of laws protecting our privacy, is brought to light, I do not expect any real change.

      I'm pretty sure there a plenty of laws protecting real privacy. Facebook users seem to have a different definition : not about protecting their personal individual information but protecting their clique's information. Protecting cliquishness is probably a bad thing. You'll eventually have a nation sized clique gossiping (in facebook defined privacy) about how awful neighbouring nations are.

  20. Claiming privacy for public actions? by TopChef · · Score: 1, Insightful

    I guess I'm just not seeing what the big deal is with Google scanning and recording MAC addresses and SSID's. These are being broadcast in the open such that anyone driving by can see them. How is this an infringement of privacy? It is akin to undressing while standing in your front yard and then complaining when the neighbors watch you.

  21. Public/Unencrypted WiFi = Town Square by Anonymous Coward · · Score: 0

    Please note that anything broadcast over public / unencrypted WiFi is akin to standing in the middle of town square and shouting out loud. The latter is more obvious, but it's basically the same thing.

  22. Article is crap by Anonymous Coward · · Score: 0

    You can also NOT create a Google/Facebook account, NOT save those cookies until they expire and NOT use unencrypted or semi-encrypted wifi APs. But hey, it's not a good article if it doesn't try to scare everyone. Try to see the big picture, it's still pretty damn hard to create an accurate and detailed profile of someone you don't know who just happens to issue a bunch of HTTP requests to your webservers. Also, unless you're in China or something, no one is going to look at your web habits. Google is only interested in targeting ads at you, so you can have a nice search engine whenever you need it.

    Just be careful what you do, sensationalist articles like this are just that and it pisses me off. It does nothing to actually inform people what to do but scare, it only briefly mentions a problem with Facebook that (after clicking through) appears to be a vulnerability that was discovered and fixed 19 days ago. Woopdedoo.

    TL;DR: Nothing to see here, move along.

  23. The real "private" problem here by Anonymous Coward · · Score: 0

    The real "private" problem here is that every time I hear somebody whinge about Google collecting data that was being BROADCAST on an OPEN CHANNEL I want to rip off said complainer's privates to ensure that level of stoopid is kept out of the gene pool. But that might just be me.

  24. Privacy Schmivacy... by scottwilkins · · Score: 0

    Is it time to put aluminum foil on our heads yet? It would be if we let these privacy screamers run the parade.

  25. You ARE to blame by ADRA · · Score: 4, Insightful

    Sorry, but please take some responsibility for yourself. If in fact there is something so important that you don't want anyone to know, then don't do it online, PERIOD. This is nothing new and there are very few if any technological measures that can ever be deployed that will guarantee that your privacy / security will ever be secure. The level of hassle involved with making really improbable-to-break security is really hard and requires diligence on the part of the individual. If Vista taught us anything, it is that users do NOT want real security. They want to do what they want and not worry about how the system does it. Well guess what? The system isn't perfect and neither is the security. We live with the imperfection for the sake of simplicity.

    "Facebook is exposing users' live chat sessions"
    This was a defect in their IM system. This could happen in EVERY SINGLE store and forward based messaging system (AKA basically all of them).
    If you expect each facebook user to generate their own Public/Private key then you're diluted (plus it breaks the online chat thing unless you're sharing your private key with facebook which would defeat the purpose).
    If you expect software to be perfect then you're an idiot.

    "and other data to third parties"
    You agree to this when you clicked through their EULA (which is your fault).

    "MAC address and SSID information from public Wi-Fi hotspots ..."
    Data was wide open (which is your fault) and the company erroneously captured it.

    --
    Bye!
    1. Re:You ARE to blame by hachidori · · Score: 1

      If you expect each facebook user to generate their own Public/Private key then you're diluted

      Water you talking about? If you phrased the security concepts properly I bet people would distill the meaning.

    2. Re:You ARE to blame by cortesoft · · Score: 1

      If you expect each facebook user to generate their own Public/Private key then you're diluted

      May I ask what I have been diluted by? I tried to stay away from the water........

    3. Re:You ARE to blame by Kaeso · · Score: 2, Funny

      If you expect each facebook user to generate their own Public/Private key then you're diluted.

      So what's the solution?

    4. Re:You ARE to blame by ACS+Solver · · Score: 2, Interesting

      "and other data to third parties"
      You agree to this when you clicked through their EULA (which is your fault).

      This is something I've been wondering about for a while, I'd love if anyone can enlighten me.

      My country has a constitutional provision saying everyone has the right to know their rights. I don't believe the US constitution has such a provision but I'm sure there's something similar in the legal system. Anyway, I'm wondering about the highly complex legal language used in EULAs and the like. Does that not, essentially, violate one's right to know your rights? Understanding such texts is pretty much impossible without legal training because of how certain words have meanings that differ from their meanings in daily life, and how certain phrases actually refer to something that's defined in another law, etc. Why is it legal to give people agreements they can't reasonably understand?

      To use an analogy. Let's say I have a shop and for an item that costs 50$, I choose to post a visible price tag that doesn't say 50$ but says integral(0, 10) xdx. It's the same thing largely. People who have taken calculus will recognize that as amounting to 50, people who haven't will recognize the numbers and letters but won't understand what it means, similar to how people without legal training sort of understand the words in the contract but not actually their meaning.

      I suppose my question also applies to the language laws are written in. Over here, they're written (largely due to the country' short history, I assume) in fairly simple language. Of course you need to be a lawyer to understand all the details, but a simple understanding of the language is enough to understand most provisions. This is unlike US law - I've read a few sections from the US Code and the language there definitely seems unlike everyday English, with very complex and unnatural sentences, to the point where understanding the law is really hard.

    5. Re:You ARE to blame by Mr.TT · · Score: 1

      "You ARE to blame" only if you do not at least try the tools that are available to you. The notion that security and encryption are not easily achieved is just not true. ThreadThat.com is a new website that is dedicated to protecting your privacy. It is simple, effective and free. We're waiting for you.

  26. Re:Online privacy never existed BUT... by starglider29a · · Score: 2, Insightful

    ...Statements of Privacy Policy do. When a site gives explicit guidelines, to which you agree, and THEN they erode or drop the wall that THEY TOLD YOU was there, THAT is evil.

    I'm looking at you, Facebook.

  27. Been saying it all along--now will you believe me? by erroneus · · Score: 3, Insightful

    Google is an advertising/marketing company. Their motives and actions are consistent with advertising/marketing companies. They seem to be more "generous" than many other advertising/marketing companies in that they give away better "swag" but they are still an advertising/marketing company... and a very successful one at that.

    Within their motives you can determine your expectations of them... and altruism isn't one of them.

  28. How Precisely Could P2P Solve This? by eldavojohn · · Score: 4, Insightful

    If we had continued improving on P2P instead of giving in to centralized servers we wouldn't be there...

    Alright, I know that a few projects like Diaspora are supposed to utilize this but I am still largely confused by this. Peer to peer implies that by owning my own personal data, it is on my home computer or laptop. Some people only have a laptop and some people like to power down their machines when they're away. So this seems to imply that you need to either have this disseminated to other peers in order for people to access it while you're offline. On top of that if you're disseminating photos or videos, this could get crazy for upload speed. So then your stuff is on another person's machine and who knows if they didn't just take and modified the Diaspora code to record all your stuff. Can you trust their node anymore than Facebook? Sure, it might be encrypted but it's hard to believe that it wouldn't be susceptible to a man in the middle attack or eventually crack the encryption by brute force. So you're kind of at that point back to the same problem as you are with entrusting Google or Facebook with your data. Otherwise you need to pay for a dedicated hosting server and they're not going to be cheap if you're miss popular with thousands of photos and that's not really P2P.

    So how was P2P supposed to fix this problem? Especially for people with just a laptop or even like my parents who have a dial up connection out on a farm house with very tiny upload bandwidth. I'm just not getting a clear picture of how the average person would handle this.

    --
    My work here is dung.
    1. Re:How Precisely Could P2P Solve This? by betterunixthanunix · · Score: 4, Informative

      There are a few ways P2P would solve the problem. The first that comes to mind is that it would reduce the incentive to undermine privacy, since the social network would not be funded by the sale of personal data (or data derived from personal data). It would also increase the cost of undermining privacy, since people would not just be throwing their data at a single centralized datacenter.

      As for distributing the data across the network, it is very easy to solve that problem cryptographically. You encrypt your data, and the decryption key is distributed as part of the "friending" process. In theory, if your friends are out to get you and want your privacy to be undermined, they could distribute the key further, but this is not much different than the current situation, where they could just copy your data from a website and hand it out to people.

      --
      Palm trees and 8
    2. Re:How Precisely Could P2P Solve This? by eldavojohn · · Score: 3, Insightful

      As for distributing the data across the network, it is very easy to solve that problem cryptographically. You encrypt your data, and the decryption key is distributed as part of the "friending" process. In theory, if your friends are out to get you and want your privacy to be undermined, they could distribute the key further, but this is not much different than the current situation, where they could just copy your data from a website and hand it out to people.

      The difference there is that your relatively small key holds the potential for everything on your page. If someone copies and mails a few pics of me, big deal. But that key could be easily copied and sent covertly with the copier taking their sweet time to look at all my stuff -- and for how long before I catch on? And how long before key collecting viruses run rampant and phone home to a black market provider's server where all Diaspora data is cached? The killer there is that you'd never even know and two if you had to change your key then you need to refriend everyone to get the key out. I understand how asymmetric key encryption works in PGP but that requires that you have a single person you are sending the message to ... do you need to build a PGP public/private key for each of your friends? Then I guess my next question is where does this decryption take place? Obviously it has to take place on your friend's box otherwise the people in the middle would have your key and your unencrypted data. So your friend logs on to check out your picture on Facebook ... but he's on his netbook so he has to wait to get the encrypted data then decrypt the data on a possibly low CPU intensive device.

      And then when people start posting unlicensed songs and movies to their pages you'll have the MPAA and RIAA trying to sue the crap out of everyone ever connected to it and then they'll start caching as a Diaspora node ... and wait for legal action to get a potential file sharer's key by court order ...

      I don't know, my imagination just takes off sometimes but it's not like your proposed method is a silver bullet for Social Networking ... there's gotta be a lot of storage donated from people getting absolutely nothing in return from using that storage. My gigs of pictures need to be hosted by dogooders who have no access to them when I'm offline and my friends want to see them. I just don't see that sort of mentality happening. People seed on bittorrent because they can use the files that they're seeding but they're not going to be able to use my encrypted files that people might want when I'm offline nor will I be able with a netbook to help them out with hosting their files.

      --
      My work here is dung.
    3. Re:How Precisely Could P2P Solve This? by alexandre · · Score: 3, Informative

      Alright, I know that a few projects like Diaspora are supposed to utilize this but I am still largely confused by this.

      Among other projects wit different aims like I2P, FreeNet, bittorent, aMule, OpenID and many more that could interact together in very interesting ways:

      http://groups.fsf.org/wiki/Group:GNU_Social/Project_Comparison

      So this seems to imply that you need to either have this disseminated to other peers in order for people to access it while you're offline.

      Yep, and you could have close friend in your circle mirror your files / profiles and share them as needed... Or an encrypted fast repository (think, maybe, Firefox weave?) to which you lend a key to those you want to read it.

      On top of that if you're disseminating photos or videos, this could get crazy for upload speed.

      Well, Bittorent totally solved that issue and with friend mirroring you it'd be awesome.
      Also, this would help weed out asymmetrical connection in the long run, giving back citizens the expressive voice they deserve.
      (Fiber to the home is the only viable way forward...)

      So then your stuff is on another person's machine and who knows if they didn't just take and modified the Diaspora code to record all your stuff.

      They have what you allowed them to have, you won't backup your sex life on your ex's computer if you don't want to... ;-)
      They can hack all they want, a well thought out system with crypto will solve any such issue.

      Can you trust their node anymore than Facebook?

      Definitively, why would you trust the middle man more than the person with whom you want to share your data?
      Who are you afraid is going to spy on you, the person who you are sending the data to anyway or the middle man?

      Sure, it might be encrypted but it's hard to believe that it wouldn't be susceptible to a man in the middle attack or eventually crack the encryption by brute force.

      As discussed, don't share what you don't want where you don't want it and use proper encryption.

      So you're kind of at that point back to the same problem as you are with entrusting Google or Facebook with your data. Otherwise you need to pay for a dedicated hosting server and they're not going to be cheap if you're miss popular with thousands of photos and that's not really P2P.

      see above ...

      So how was P2P supposed to fix this problem? Especially for people with just a laptop or even like my parents who have a dial up connection out on a farm house with very tiny upload bandwidth. I'm just not getting a clear picture of how the average person would handle this.

      dial up are really on the way out but even with that, their initial upload is akin to sharing it with someone else that might help afterward with spreading the file to whoever else you'd want it shared.

      Also, at some point, you can't control the information you release to someone, trying to build a social-DRM system is not going to work anymore than it did for bluray, DVD, music and whatnot ...

    4. Re:How Precisely Could P2P Solve This? by Naturalis+Philosopho · · Score: 3, Insightful

      In theory, if your friends are about as technologically inclined as most people, they could distribute the key further, but this is not much different than the current situation, where they could just copy your data from a website and hand it out to people.

      FTFY

    5. Re:How Precisely Could P2P Solve This? by alexandre · · Score: 4, Insightful

      The difference there is that your relatively small key holds the potential for everything on your page.

      Why does it have to be a global key?

      I understand how asymmetric key encryption works in PGP but that requires that you have a single person you are sending the message to ... do you need to build a PGP public/private key for each of your friends?

      Why not, it's cheap? You don't have 1M friend either...

      Then I guess my next question is where does this decryption take place? Obviously it has to take place on your friend's box otherwise the people in the middle would have your key and your unencrypted data. So your friend logs on to check out your picture on Facebook ... but he's on his netbook so he has to wait to get the encrypted data then decrypt the data on a possibly low CPU intensive device.

      It's not so much about encryption solution (that could be worked out anyway) as it is about access control.

      The main question is actually how are update going to be disseminated and validated chronologically... beyond that it's already an improvement on the current situation.

      And then when people start posting unlicensed songs and movies to their pages you'll have the MPAA and RIAA trying to sue the crap out of everyone ever connected to it and then they'll start caching as a Diaspora node ... and wait for legal action to get a potential file sharer's key by court order ...

      FreeNet integration?
      Popular files get spread more...

      I don't know, my imagination just takes off sometimes but it's not like your proposed method is a silver bullet for Social Networking ...

      Nothing is, just much better socially than what we currently have, let's talk about its weaknesses and improve on them :-)

      there's gotta be a lot of storage donated from people getting absolutely nothing in return from using that storage.

      Oh, like everyone's hard drive is not on average 70% empty or such?

      My gigs of pictures need to be hosted by dogooders who have no access to them when I'm offline and my friends want to see them. I just don't see that sort of mentality happening.

      The concept of being offline is not really trendy these days and is going away very rapidly in any case, you should really think about running a small home server like Eben Moglen suggested in that case to solve the issue.

      People seed on bittorrent because they can use the files that they're seeding but they're not going to be able to use my encrypted files that people might want when I'm offline nor will I be able with a netbook to help them out with hosting their files.

      Some people also don't upload on Bittorrent cause they are selfish fools. If we want this to work, just like FOSS, we need to have enough people willing to share bandwidth for the model to work.

      And it seems like P2P and FOSS has proven to work up till now quiet well in that respect despite the morons... And in a social case you'd be dealing with your friends who are much more willing to share with/for you.

    6. Re:How Precisely Could P2P Solve This? by mrogers · · Score: 2, Interesting
      The difference there is that your relatively small key holds the potential for everything on your page.

      Yes, that's intentional. In cryptography it's known as Kerchoff's principle: only the key should be secret, everything else (the encrypted data, the system design, the source code) should be assumed to be known to an attacker. That approach leads to strong designs because the designers can't rely on handwavy arguments like "Oh, nobody's likely to hack the Facebook servers" and "Facebook's thousands of employees are all trustworthy".

      And how long before key collecting viruses run rampant and phone home to a black market provider's server where all Diaspora data is cached?

      The same argument applies to Facebook passwords, except that with Facebook, the black market provider doesn't even need a server. Viruses are a problem, but they're just as relevant to client-server systems as P2P systems.

      I understand how asymmetric key encryption works in PGP but that requires that you have a single person you are sending the message to ... do you need to build a PGP public/private key for each of your friends?

      No; you only need to generate one public/private keypair, regardless of how many people you want to communicate with. But PGP's probably not the best model for a P2P social network - something like Tahoe is a lot closer (I hope the Diaspora guys have the sense to use it rather than reinventing it).

      Then I guess my next question is where does this decryption take place? Obviously it has to take place on your friend's box otherwise the people in the middle would have your key and your unencrypted data. So your friend logs on to check out your picture on Facebook ... but he's on his netbook so he has to wait to get the encrypted data then decrypt the data on a possibly low CPU intensive device.

      Encryption is cheap. Seriously, it's cheaper than water. Once you've established a shared key with your friend, which only has to happen once when you first friend each other, all the rest of the encryption is symmetric. Again, PGP's not the best model here because it does asymmetric crypto for every message. Think about HTTPS web browsing or a GSM phone call instead; mobile devices have no trouble handling those.

      And then when people start posting unlicensed songs and movies to their pages you'll have the MPAA and RIAA trying to sue the crap out of everyone ever connected to it and then they'll start caching as a Diaspora node ... and wait for legal action to get a potential file sharer's key by court order ...

      That's still a lot more secure than Facebook, where copyright holders can get stuff pulled from your page by sending a DMCA takedown email with no court oversight at all, and you're subject to arbitrary censorship by Facebook itself.

      People seed on bittorrent because they can use the files that they're seeding but they're not going to be able to use my encrypted files that people might want when I'm offline nor will I be able with a netbook to help them out with hosting their files.

      Yup, downtime and mobility are major challenges for P2P networks. The most likely solution I see is a little fanless Linux device that sits beside your cable or ADSL modem and participates in the P2P network 24/7, trading some of its storage with other devices so your data stays available during its occasional periods of downtime. Another possibility is that if you can't run a node yourself, you rent or borrow a share of someone else's node, just like you do with email servers. That's more like a federation than true P2P, but, crucially, like email and unlike Facebook, there's no single party providing accounts to everyone, and you're always free to change providers.

    7. Re:How Precisely Could P2P Solve This? by Anonymous Coward · · Score: 0

      >Some people also don't upload on Bittorrent cause they are selfish fools
      Some don't upload because they don't feel like paying the RIAA/MPAA $100k in a settlement and being financially ruined. People in the USA, for example, are subject to the DMCA. Sharing files online is incredibly stupid for us to do. Right, wrong or otherwise that's what happens in reality. It's illegal. If wanting to be able to put my son through college and pay my mortgage makes me selfish, I'm one selfish bastard.

      Then again I don't download via p2p either. I buy all of my media, without exception. I can buy the latest mp3 album from amazon and have it in a few minutes, for under $10. Occasionally I spend $50+. It's a drop in the bucket compared to some of these RIAA settlements.

    8. Re:How Precisely Could P2P Solve This? by alexandre · · Score: 1

      Well i wasn't targeting that reason for not sharing which can be dealt with with I2P and whatnot...

      As for buying album, that's a completely different thread :)

  29. But he's right by alienzed · · Score: 1

    If you don't want anyone knowing about something then you should not be doing it. Give me one example to the contrary.

    --
    Never say never. Ah!! I did it again!
    1. Re:But he's right by vlm · · Score: 2, Informative

      If you don't want anyone knowing about something then you should not be doing it. Give me one example to the contrary.

      Leaving your house empty at a specific time with a specific valuable object in it ready to be stolen.

      --
      "Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
    2. Re:But he's right by Overzeetop · · Score: 3, Insightful

      No he's not, at least not when taken out of context. There are a lot of things I don't want people to know. I color my hair, for example. I'd rather people just think I'm not quite as old as I am (or conversley, I'd rather people not think I'm older than I really am). Hair coloring isn't an illegal act, or even immoral for that matter.

      Put into context:

      If you shouldn't do something, or don't want people to know about something, you probably shouldn't do it in public.

      Now, if you were to substitute "public web site" or "public places on the internet" or even "in a business establishment" for public, you'd be talking about the same thing. See, these are public places, and there's really no expectation of privacy except a wink and a nod.

      Now, lets change that and make it a place you own. Your own bedroom. Your own living room. Your cabin in the mountains. Your own server. You can do just about anything you want. Clip that ugly toenail. Watch Glee. Revel in mounted animal heads. Store all your balloon porn. But if you're going to go do those things in the local pub, you probably shouldn't be thinking that they are private.

      See, most of these sites are "free" (as in beer). Even if they didn't make money on selling your eyeballs and preferences for marketing, they still wouldn't be private places. There are places on the internet which are private. You can sign up and encrypt all your stuff, and keep the key. But they're not convenient for sharing. Just as drinking a fifth of Jack in your kitchen isn't nearly as much fun as drinking it in a bar with fifty friends.

      Privacy isn't dead, it just needs a bit of explaining. Just remember - if you didn't pay for it, it's probably not a private place.

      --
      Is it just my observation, or are there way too many stupid people in the world?
    3. Re:But he's right by AthleteMusicianNerd · · Score: 1

      I had sex with my girlfriend last night. I'd rather you didn't know about that.

    4. Re:But he's right by blair1q · · Score: 1

      Then you're no kind of nerd.

    5. Re:But he's right by vlm · · Score: 1

      Somewhere, just beneath the surface, lurks a "your mom" joke...

      --
      "Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
    6. Re:But he's right by natehoy · · Score: 1

      And corrected:

      If you shouldn't do something, or don't want people to know about something, you probably shouldn't do it or talk about it in public, or in the presence of someone who is known for revealing secrets.

      --
      "This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
    7. Re:But he's right by AthleteMusicianNerd · · Score: 1

      I thought about that but I thought I'd...keep it relatively classy...at least unmalicious.

    8. Re:But he's right by AthleteMusicianNerd · · Score: 1

      Perhaps not, but I did succeed in giving him a contradictory example. Unless of course you think I shouldn't be having sex with my girlfriend...although I'd never accept that.

    9. Re:But he's right by MRe_nl · · Score: 1

      AthleteMusicianNerd (1633805) "I had sex with my girlfriend last night. I'd rather you didn't know about that."

      Eric Schmidt "If you have something that you don't want anyone to know, maybe you shouldn't be posting it on slashdot ; )."

      about keeping it relatively classy; sorry for that.

      --
      "Kill 'em all and let Root sort 'em out"
    10. Re:But he's right by AthleteMusicianNerd · · Score: 1

      Hey, I succeeded in giving an example.

      I trust that Slashdot will not contact my ISP or email provider to identify me, and then pass that info on to you, alienzed (732782), or any other internet user.

  30. Thoughts on privacy and Google from 2003 by ahodgkinson · · Score: 1

    The news is that it's not new news, but rather a trend that's been apparent for nearly a decade..

      http://www.softxs.ch/alan/essays/googlebomb.html

    --
    ---- It won't be as bad as you fear or as good as you hope, but it will take twice as long as you plan.
  31. Re:How is 'privacy' defined in the US constitution by LandruBek · · Score: 1

    IANAL but privacy is not explicit in the US constitution; however the Supremes have found that it is implicitly there; e.g., the Fourth amendment is about privacy even though it doesn't contain the word "privacy." You might appreciate the Wikipedia article.

    --
    $META_SIG_JOKE
  32. They make money from violating your privacy by Anonymous Coward · · Score: 0

    The reason companies don't do more to protect your privacy is that they earn their living from violating your privacy. Google uses all the data it gathers from your searches, email, chats, ad clicks and the like to target ads at you. Facebook does the same. All of the behavioral targeting ad nets pay more to publishers because they are tracking you and gathering detailed information about you from multiple sources. There is BIG money in hoping you aren't paying attention and don't know or understand all of this.

    Think of this analogy. If Google asked you to give up your right of free speech and let them censor what you read and send in order to use Gmail there would be a revolt and no one would use the service. But without asking they are taking away your right to privacy when you use any of their services or browse any site where they place an ad and that is just about everywhere.

  33. Dip-Schmidt: a game of ignoble "Maybe"s by Anonymous Coward · · Score: 0

    'If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place.'

    So what does dip-shmidt not want people to know that he 'maybe' shouldn't be doing?

    Should we not be exercising our democratic and shareholder rights by voting in private ballots? Maybe Mr Schmidt spent too long doing business with the Chinese government? Maybe? Pfft!

  34. Stop spreading disinformation by Aqualung812 · · Score: 5, Informative

    If you use it as a debit card--snip--you are fully on-the-hook when it comes to losses - if they steal $2000 from your account, you have lost $2000 - there is no disputing charges or limited liability like with a credit card.

    I worked at a financial institution, this is completely incorrect. Your liability is limited by law to $50, and most small banks and credit unions just limit it to -0-. Just make sure you have email alerts on so you know your card is being abused & call your bank & police if so.

    http://usa.visa.com/personal/security/visa_security_program/zero_liability.html

    http://www.fdic.gov/regulations/laws/rules/6500-1350.html

    --
    Grammer Nazis - I mod you "troll" unless you actually add something on-topic. Yes, I know I have mispellings in my sig.
    1. Re:Stop spreading disinformation by ciggieposeur · · Score: 1

      The reason that most people don't see a difference between candidate A and B, is because they don't do research

      No, they do the research just fine. But in a two-party where (for instance) both parties agree that the USA should have a hundred military bases in the Middle East and only disagree on the specific priority of the various missions performed by those bases, any voter who wishes those bases closed has no one to vote for.

    2. Re:Stop spreading disinformation by Nukenbar · · Score: 1

      It's sad then that you have it wrong. Generally a credit card caps your loss at $50, but a debit card is a different beast. If you don't give timely notice about the theft of your debit card, you can be liable for up to $500.

      Read about it here.

    3. Re:Stop spreading disinformation by Aqualung812 · · Score: 1

      The very article you link to points out the limit is $50 if you let them know within 2 days of YOU knowing that you lost the card. That isn't a hard thing to do. Also, it also points out that all of the 25 largest banks have zero liability. If you can't be bothered to get a bank that has no liability OR pick up a phone after you know your card is being misused, then you get to pay $500 of stupid tax.

      --
      Grammer Nazis - I mod you "troll" unless you actually add something on-topic. Yes, I know I have mispellings in my sig.
  35. Re:How is 'privacy' defined in the US constitution by im_thatoneguy · · Score: 1

    It's not defined in the US constitution except in relation to government investigations and entities acting on behalf of the Government.

  36. Context by shish · · Score: 1

    Eric Schmidt, who famously said this not too long ago: 'If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place.'

    Less famous than the quote was the context: "All online services hold some amount of data, and the Patriot Act allows the government to access this data, so it's best for you to keep it offline"; but of course reasonable and helpful suggestions don't make good headlines...

    --
    I mod down anyone who says "I will be modded down for this", regardless of the rest of their comment
  37. Well, duh... by adamofgreyskull · · Score: 1

    A quick search of recent news on the privacy front reveals that just about all of it is bad.

    To paraphrase Peep Show:
    Nancy:Why don't they ever talk about all the buses that made it safely?
    Mark:Yes, I suppose the news should just be a dispassionate account of all the events of the day - except it would take forever.

    Surprise surprise, the media only reports on data leaks, hacks, privacy infringements. Because who wants to hear "Today, x00,000 online businesses took over $Xbn in a completely secure manner and did not store any personally identifiable information. A further x00,000 required registration from their customers but have a well-defined privacy policy.".

  38. security isn't asked for because it's assumed by DaveGod · · Score: 1

    One of the more trite and oft-repeated maxims in the software industry goes something like this: We're not focusing on security because our customers aren't asking for it.

    Most people don't ask for security because they already assume there is a certain minimum security. The vast majority of things people do is very heavily regulated, though government, industry codes and at a minimum market forces. It's also deeply implicit in corporate branding - the whole point of which is "trust us".

  39. Privacy is a myth by rockhome · · Score: 1

    People like to make so much of the Internet into an analog of the so called "digital town square". The irony is, in the town square, everybody can see you and know who you are.

    Many are up in arms about "online privacy" forgetting that what they are really trying to do is make something that is essentially public private.
    I've never been under the impression that anything I access via a web browser or other network service is anything but public. I've never trusted that Google or anyone else would protect my data and I don't create Internet artifacts that would embarrass me.

    Look, would go around your neighborhood asking people about strange fetishes, your strange wart, or about anything else that you'd prefer people not know about you? No.
    So why expect that every piece of information that you put on the Internet should be so guarded?

  40. Privacy does not make money by Anonymous Coward · · Score: 0

    Privacy does not make money, in fact, it costs money. Why risk the profit$ of your $hareholders?

    Fix this and we will see privacy matter. Till then, tough luck.

  41. Doesn't make it right though by hannson · · Score: 1
    To quote south park:

    Giant Douche: We've got spirit, yes we do; Giant Douches me and you!

    Turd Sandwich: We've got spirit, yes we do; we are sandwiches filled with poo!

    With the episode concluding with:

    PETA: But Stan, why on earth wouldn't you want to vote?

    Stan: I think voting is great; I just didn't care this time because it was between a giant douche and a turd sandwich.

    PETA: But Stan, don't you know... it's always between a giant douche and a turd sandwich.

  42. Mrs. Mellinger always said I had stupid fingers by LandruBek · · Score: 1

    Sorry, please ignore the first "not." Yeesh.

    --
    $META_SIG_JOKE
  43. Over and Over Again by b4upoo · · Score: 1

    Just why would anyone connect the concept of privacy with chatting with another person. Anything that you share with another person is pretty much public information. If it is private keep it to yourself and stop trying to control the entire world that surrounds you.

  44. It could be stronger than that by PopeRatzo · · Score: 2, Insightful

    customers aren't asking for it

    Why should they have to ask for it?

    Why isn't our private information considered intellectual property? Corporations try to make every aspect of their business protected, why should consumers do the same? I guess it would require a Supreme Court that not only are corporations considered "people" but that people are considered people.

    A corporation can distribute data on a DVD or CD and yet claim that it should be illegal for me to copy and pass that data along. Why shouldn't I be able to give my private information to companies that I want to do business with and expect the same sort of protections?

    I'm proposing the People Are Almost As Important As Corporations Act of 2010. I wonder how many legislators I'd be able to get to sign on as co-sponsors.

    --
    You are welcome on my lawn.
  45. There are generally 3 "schools of thought" by Opportunist · · Score: 1

    At least when it comes to privacy.

    The first is the one of the computer clued, slightly paranoid geek. He knows just what info gets around the net, and that the net never forgets (if it doesn't want to). In other words, be careful what you release into the world because it can be snooped, recorded and altered and soon you're a meme without a chance to stop it.

    The second is the one of what I find in younger users, a complete lack of oversight and wariness and a rather blatantly ignorant handling of privacy problems. They either don't know about the possible problems or genuinely don't care. Teenagers and young adults exchanging their sex stories through services that are anything but secure and posting videos of themselves on YouTube that even I would consider embarrassing (and there's very little that embarrasses me... but I'd NEVER show my face online!), and they don't even seem to care or understand that these videos will NEVER EVER cease to circulate. They have zero control over it.

    And finally there's people like my dad who are paranoid enough that he doesn't answer the phone with his name (as is customary and a courtesy thing here) because then someone could connect his name with his phone number if he just called without knowing whose cell it is. He doesn't sign up for anything, never uses his real name and doesn't even open pages like YouTube and Facebook because he thinks that alone gives them any and all info about him.

    And slowly I start to think my dad's got it right...

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  46. You inc. by mindbrane · · Score: 1

    This dance has been in full swing for a while now and seems not to be going anywhere but round and round, which is OK as far as dancing goes. There are informed people who have made informed posts from various countries but I keep coming back to two main points. One: if social sites, or, any person or company is profiting from your personal information then that information has value. If your personal information has value and you contract for it's use then it's up to you to limit the use the other contracting party can make of your personal information and the consideration you should receive for giving up your personal information. Capacity (old enough to contract), Consideration (value received) and Agency (legal right to contract for the goods and services) are fundamental. Basic contract law, like basic statistics, is fundamental to negotiating one's way in a modern world. It must be part of any grade school curriculum. Evidently most people are as woefully ignorant of the basics of contract law as they are of statistics and aren't able to competently navigate a modern market place. One option might be for everyone to incorporate and seed their Me corp. with their private information as an asset. I recognize this is in some ways an outlandish proposition but OTOH it may be a good way to instruct individuals from the age of majority in how to conduct their affairs in a market place where contracts have an air of sanctity and much legal weight. Secondly, (just as an aside I don't have a face book account, no myspace, no youtube) the whole social networking scene reminds me of ancient news reels from the 20s and 30s when people sat atop flagpoles and swallowed live goldfish just to get their mugs front and centre on a newsreel and make a splash in the shallow end of the new medium. Don't dismiss the possibility that all they big market cap social networking sites will just die off like personal web sites from the late 90s. As people realize they're being ripped off and as people become versed in technology the reliance on big social sites might fade as fast as they appeared and the content they hosted will be, for the most part, lost and forgotten.

    --
    ideopath @ play
  47. Palin's emails by Anonymous Coward · · Score: 0

    So based on google, Palin's emails and their executive emails should be open to the public and we should stop the lawsuit.
    Google employes that read this dig into the network and post Eric's emails to the world, lets see how he feels about a private conversation with his wife or friends being google by everyone.
    Sure I don't always do good things, but I also don't want everyone to be able to see my kids photos. Or my mom to see my private sexy chat with my wife. Or some burgular being able to find out I plan on taking a vacation for a week, and can't find anyone to dog sit, so he is getting shipped of to boarding school.
    Privacy is there to protect us from people that may want to get sensitive information as well.

  48. We're not focusing on security because our.... by Thaidog · · Score: 1

    Your customers are not asking about it because they assumed you've handled that.

    --

    ||| I still can't believe Parkay's not butter.

  49. Public key cryptography by Anonymous Coward · · Score: 0

    Such systems would use public key cryptography. What is shared is the data, not private keys. Friends would share public keys, and trade data encrypted with those keys. Only the owner of the private key would be able to decrypt the data. Privacy would be ensured by (a) only friending people who weren't out to get you, and (b) selecting what is available to any particular friend.

  50. What is your social security number? by OFnow · · Score: 1

    I'm looking forward to your printing your social security number, birthdate, name,
    bank routing numbers, and credit card data here, "alienized". You just said you would,
    since there is nothing wrong with having those numbers, right?

  51. The problem. by Eskarel · · Score: 1

    Someone putting their drunken photos up on Facebook for all their friends to see is not a privacy violation. It's opt in and no different than taking the photos and showing your friends. Yes, people have too many friends who aren't friends, and yes sharing that information is probably questionable, but sharing it is perfectly within the right of the individual and not a privacy violation. Facebook constantly changing their privacy policies and settings so that people get to see your drunken photos who couldn't see them when you put them up, that's a privacy violation. If we don't separate those issues then we'll never win the privacy battle because no one will understand how someone voluntarily sharing their information is a privacy issue.

    Google is just another problem all together, and one I'm not sure there is a solution to. Google has always been the way google is, but because they offer really good products a lot of us seem to forget. Analytics and the search history was bad, street View should probably never have been allowed, cool as it is, and this whole wi-fi thing is just absolutely obscene. Just the fact that they were collecting anything let alone the fact that they collected extra. Might have to change my default search engine to Bing.

  52. About Schmidt by w0mprat · · Score: 1
    So Eric Schmidt won't mind someone videotaping him and his wife making love then?

    'If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place.'

    Cool, it's going on YouTube.

    --
    After logging in slashdot still does not take you back to the page you were on. It's been that way for 20 years.
  53. Windows + Morons = Bot Nets by Anonymous Coward · · Score: 0

    Come on folks use Linux and don't be a retard all your life, MS wins in Ads budget only. Besides the Direct X monopoly they are allowed to run for selling you all out LOL, they pretty much have consistently gotten worse as a predatory company fueled by their Gov license to steal. Learn linux and then just change your MAC and hostname when using Wifi etc and actually you will be quite hard to identify.

    Who uses Windows ?

    Morons who don't know any better thats who.

  54. Re:Been saying it all along--now will you believe by yuhong · · Score: 1
    Yea, Google is an advertising company, yes they do give away many things in exchange for advertising.

    Within their motives you can determine your expectations of them... and altruism isn't one of them.

    Not exactly, though.

  55. Re:How is 'privacy' defined in the US constitution by Anonymous Coward · · Score: 0

    Thanks for the clarification. Not that in Europe things are any better, but IMHO if privacy does not get explicit in any constitution, then there is no hope of getting a human right established as such.

  56. Move the control point to the user side! by cloudusb · · Score: 0

    Hi all, We at CloudUSB have studied the data privacy problem and how it can be preserved while using distributed on line resources; we focused on online storage, used for backup or for making data available all over the world. The idea of the control point (http://cloudusb.net/sep/?The_control_point) is to keep on the user side the key to security, that is not only the password, but the software to encrypt the data, and we propose a portable solution keeping both operating system, programs and data in a small USB stick: all the information going out of the stick are already crypted, so the user is the one which as the complete control on his data. The solution is particular easy to use: after the setup, the user has just to store his data in a directory, and it will be crypted and syncronized on-line (in crypted form): everything based on open source or free software and free on line services to make the solution usable from the first moment by everyone by just downloading it at http://cloudusb.net/ ! bye giammy

    --
    The computer without computer - http://cloudusb.net
  57. Not Broken, Changing by cjb110 · · Score: 2, Insightful

    It's not online privacy that's broken. All that's changing is people's awareness (or more importantly lack of) of what privacy means in the digital connected world.

    Street view is a good example, no one bothered to drive around the world taking 360 pictures of everything and logging the gps coords, so before Google did it, that information just wasn't accessible but more importantly it wasn't private either. By making it easily accesible to all, made people jump to outragous claims of privacy invasions. But afaik there isn't a single country where the roads aren't owned by the 'public'. So everyone has the right to go down a street and 'look' and so the drunks, cats in windows and people leaving sex stores with Black Mamba dongs where doing so in public and could have been seen by anybody. Just because Google 'looked' and stored what they saw, doesn't change this fact. If you don't want Google or anybody else to see what your doing, don't do it in a public or publicly visible space. You've never had the right to stop people looking through your windows, but you do have the right to block those windows, that's your choice.

    The wifi mac/ssid issue is similar, you are publicly broadcasting those bits of information, anybody can retrieve them from the 'public' electromagnetic waves and store it. You decided to make those bits of data public when you chose to use WiFi tech, the fact you (and a lot of others) don't understand or care how WiFi works is irrelevant. Again you have the choice not to use WiFi.

    Similar with FaceBook, you are choosing to publish information to a third-party. At the end of day it doesn't matter what privacy you thought you'd agreed to when you hit 'submit'. You've choosen to make it less private.

    I think it boils down to: "People are slowly realising just because no-one gathered or analysed the information before, doesn't make that information private."

    --
    ----- I refuse to have an argument with an unarmed person
  58. Facebook... by Anonymous Coward · · Score: 0

    Facebook is to a user... A way to reconnect with friends and family.
    Facebook is to Zuckerberg... A way to have users give away all their information for free, and then charge advertising companies out the nose for the data.

    Why can't we just get rid of the middle man and sell our personal info to the companies ourselves?