Slashdot Mirror
Stop Saying, 'We Take Your Privacy and Security Seriously' (techcrunch.com)
Security reporter Zack Whittaker writes: In my years covering cybersecurity, there's one variation of the same lie that floats above the rest. "We take your privacy and security seriously." You might have heard the phrase here and there. It's a common trope used by companies in the wake of a data breach -- either in a "mea culpa" email to their customers or a statement on their website to tell you that they care about your data, even though in the next sentence they all too often admit to misusing or losing it. The truth is, most companies don't care about the privacy or security of your data. They care about having to explain to their customers that their data was stolen.
I've never understood exactly what it means when a company says it values my privacy. If that were the case, data hungry companies like Google and Facebook, which sell data about you to advertisers, wouldn't even exist. I was curious how often this go-to one liner was used. I scraped every reported notification to the California attorney general, a requirement under state law in the event of a breach or security lapse, stitched them together, and converted it into machine-readable text. About one-third of all 285 data breach notifications had some variation of the line. It doesn't show that companies care about your data. It shows that they don't know what to do next.
I've never understood exactly what it means when a company says it values my privacy. If that were the case, data hungry companies like Google and Facebook, which sell data about you to advertisers, wouldn't even exist. I was curious how often this go-to one liner was used. I scraped every reported notification to the California attorney general, a requirement under state law in the event of a breach or security lapse, stitched them together, and converted it into machine-readable text. About one-third of all 285 data breach notifications had some variation of the line. It doesn't show that companies care about your data. It shows that they don't know what to do next.
And politicians don't really care about their constituents or the country. And SJWs really don't care about equality. The list is endless.
I have a pretty simple test for whether people take a thing seriously. How does it compare to how they handle payments?
Consider:
I ask you to stop spamming me, and you say I need to allow you 30 days to stop.
I ask you to take $5 from my bank account, and in under 10 seconds you have successfully resolved a transaction in a thorough, secure, and traceable away, even if my bank isn't on the same continent as your bank.
Which of these do I think you "take seriously"?
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
The only companies that take data privacy seriously are those that DON'T nudge you towards their cloud, that sell software that encourages local storage, preferably in encrypted form.
We took your privacy and security.
It's gone.
The problem is all these companies forgot a semicolon. Let me help.
We take your privacy and security; seriously.
Ads are customers who have to be taken very seriously.
The security to protect the ads all the way beep into the OS and browser.
The privacy to protect the ad tracking from any as blockers.
Domestic spying is now "Benign Information Gathering"
I have a real easy way for companies to care about privacy when they say they "care about privacy":
Penalties:
-- $2 for each name + password
-- $5 for credit card number
-- $10 for social security number
etc.
And multiply for combinations of the above. You'll see companies start fixing their processes (or simply refusing to store unnecessary data, right quick.
They all pay lip service to security. That's all. They don't do what they should, because it is simpler, and most cost-effective, for them to do damage control when the inevitable security breach happens than really trying to prevent it. We have heard about huge security breaches in Equifax, Target, Visa etc. Those companies are still there, business as usual. They sure took a hit, but it probably impacted on their bottom line less than having to invest on minimizing the probability of such breaches in the first place.
About one-third of all 285 data breach notifications had some variation of the line. It doesn't show that companies care about your data. It shows that they don't know what to do next.
"We take your privacy and security seriously" is the data tech equivalent of saying "We send out thoughts and prayers". It means nothing concrete, and is meant to end inquiry/discussion into what actions should in fact be taken (or should have been taken).
- First they ignore you, then they laugh at you, then ???, then profit.
It';s right up there with "we value your call, that's why we've been claiming unusual call volume and long hold times since 1982". "Speaking of holding since 1982, hang in there Betty, help is only days away".
We were doing nothing for security that didn't happen accidentally before. We got caught. We now will do the absolute minimum required by a regulatory body. If we have no regulations, we're just saying this because we have to. We want money and couldn't care less about your privacy. Suckers.
Be Excellent To Each Other
Century
Consumers need to take their Privacy seriously too. This means:
- Demand to buy Android Devices with unlockable Bootloaders that can run Lineage OS.
- Maps provided by Osmand on Android
- Self Host a Federated NextCloud/OwnCloud Service for Roaming Storage on a PC they own with a Dynamic DNS Provider.
- Handle Contacts, Calendaring,and Task related services on a Groupware service.
- Instant Messaging/Social Media done Via Libpurple based Spectrum2 Servers. (again, hosted on the same set of Devices as the NextCloud/Groupware Solution.)
This is so that if you have a Discord/FaceBook/Skype/etc account, It can't track you.
These are the only things that will really change the privacy game.
...just not very much at all.
Please. Poor Norbert is spinning in his grave.
Strange things are afoot at the Circle-K.
They care about your privacy means that the unique data that you provide to them is more valuable than the data you give everyone. They care about your security means if you feel insecure about their offerings you won't engage with their site.
we "take" (stolen) your privacy and security, seriously
Politics is Treachery, Religion is Brainwashing
"...your call is very important to us. Please remain on the line and..."
If it's so important, why did you just make me navigate a 3 minute tree and then wait 5 more, only to hear this malarkey?
It's all lies, from all the corporations (and many small businesses, too, dishonests are everywhere)
The "Civilized World" jumped the shark ca. 1973.
I ask you to take $5 from my bank account, and in under 10 seconds you have successfully resolved a transaction in a thorough, secure, and traceable away, even if my bank isn't on the same continent as your bank. Which of these do I think you "take seriously"?
Interestingly enough, a credit to your bank account can take up to an order of magnitude more time to post than an instantaneous purchase.
Perhaps the banking powers that be are tipping their collective hand here... when it is in their financial interest to do so, they've developed the uncanny ability to be as fast as they need to be or as slow as necessary to maximize daily balance computations.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
- Pay for your email - Don't use social media - Don't use a smartphone That gets you like 95% of the way there, but I don't know anybody other than myself who lives like this.
I don't respond to AC's.
"We take your privacy seriously, but profits even more seriously."
Table-ized A.I.
Even more:
... {whatever.}
Your call is important to us, please hold.
Our menu options have changed, please listen to them all again.
Elect me, and I'll
Order Now! Supplies are limited.
Thank you for holding -- so how can I make you hang up faster?
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
My E-mail is free, but its IMAP4. There are no Ads with it.
Smart phones are only fine in the circumstance that you have Android, have a spin of Android with LineageOS, Root, Magisk, etc, and do NOT have GApps flashed to your device and largely rely on F-Droid and ApkPure.
Coincidentally, we value it exactly the same amount that the highest bidder does.
"We take your privacy and security seriously, as long as it's easy & convenient and doesn't cost us any actual money"?
I suppose next I'll have to stop saying "I love you and I'll still respect you in the morning."
Have gnu, will travel.
It's "We're taking your privacy, seriously."
Those values are far too low and that's the problem: companies do value our privacy and security but the value they assign to it is woefully low. If your information is leaked the cost of clearing up any identity theft that results is far, far more than the numbers you gave. Indeed, you can't even lock your credit report for this.
A better way would be to simply make companies liable for all "reasonable" costs resulting from a violation of a customers privacy and security. This will make them pay for the time, effort and money it costs to either prevent or clear up identity theft which will make them very much aware of the monetary value of privacy and security.
Well, to be completely fair by the time a company is sending out one of these breach notices they probably are taking our privacy and security seriously, or at least a lot more seriously than they were before the breach. The problem is that it is now far too late.
You have to admire Equifax's completely brazen approach to privacy and security though. They get paid to collect and curate a database of extremely private and sensitive data and then, when they screw up and it gets breached, people pay them even more money to lock their credit reports. That's why they do value our privacy and security: everytime it gets violated they make more money.
This win-win model is almost as good as the one the phone companies pull where they sell you a phone number and service, then sell your name and number to advertising services and finally sell you a call blocking service to prevent ads from reaching you: that's win-win-win!
That is what I'd like to know. :P
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
What a worthless story.
Hey, and that works just as well for the same situation!
If that were the case, data hungry companies like Google and Facebook, which sell data about you to advertisers, wouldn't even exist.
A security researcher who seems to know about data and privacy doesn't understand the business practice of the two biggest companies in the data and privacy related fields.
Congratulations Zack Whittaker, you've just shown the world that you're out of your depth. Maybe you should go make instructional videos of how to build computers for the Verge and leave the security, data and privacy related talk to someone who actually knows what is going on in their field.
Let's break this down:
- Demand to buy Android Devices with unlockable Bootloaders that can run Lineage OS.
You just lose most consumers with this line.
- Maps provided by Osmand on Android
This is one of the few things you said that's doable.
- Self Host a Federated NextCloud/OwnCloud Service for Roaming Storage on a PC they own with a Dynamic DNS Provider.
You now lost a good chunk of the remaining technical crowd and narrowed your solution to only the top tier of nerds.
- Handle Contacts, Calendaring,and Task related services on a Groupware service.
What's a groupware service? Asking for a consumer.
- Instant Messaging/Social Media done Via Libpurple based Spectrum2 Servers. (again, hosted on the same set of Devices as the NextCloud/Groupware Solution.
That's good and all but I just checked and my friend's aren't on it. Regards, a consumer.
These are the only things that will really change the privacy game.
Consider your game lost before the users even got through the instructions for it.
My E-mail is free, but its IMAP4. There are no Ads with it.
That doesn't mean there isn't a privacy implication. Google also provides an IMAP4 server and you get your emails without Ads. So does Microsoft. Two companies which openly admit scanning your emails for marketing related reasons.
Isn't this the technical equivalent of "thoughts and prayers"?
the title needs to be adjusted to;
Stop saying, 'We take your seriously'
it's just a template sentence that everybody uses when something goes wrong with their product/company.
car company has issues with airbags - we take your safety very seriously
tv broadcast company has outage - we take your leisure time very seriously
etc.
you can find the reason why in the legal department's extensive writing excuses guide.
On a long enough timeline, the survival rate for everyone drops to zero.
Interestingly enough, a credit to your bank account can take up to an order of magnitude more time to post than an instantaneous purchase.
The settlement procedures are pretty much identical once the transaction is processed for purchases or refunds. You just don't notice because most of the time the cash flows are out of your account and not in to your account and because your bank hides some of the details. Many types of transactions don't actually close for some time (days) even if they show it posting immediately. My bank will post a transaction immediately because I'm considered a safe risk based on my banking history but it's technically in sort of a "pending" status for a day or two (sometimes longer depending on the counterparty) until the settlement procedures finish. If you want the transaction to finish faster there generally are higher costs associated with that. To your point, how long a company takes to get around to posting the transaction can be telling but the actual transaction itself happens just as fast no matter which direction the cash flows.
Perhaps the banking powers that be are tipping their collective hand here... when it is in their financial interest to do so, they've developed the uncanny ability to be as fast as they need to be or as slow as necessary to maximize daily balance computations.
Sure, they know how to play these games to their advantage when they feel the need. But that mostly happens when the bank is the counterparty rather than simply being an intermediary. If you and I are exchanging money and the bank is just facilitating the transaction they reap no benefit from delaying one side or the other in the transaction.
And politicians don't really care about their constituents or the country.
Awfully broad brush you are painting with there. Yes that is too often true but there are people in positions of political power who actually do genuinely care about the people they were elected to lead/serve. Such people are to be treasured when found.
And SJWs really don't care about equality.
A) The term "SJW" is lazy nonsense catchall pejorative like "hipster" that means almost nothing and accurately describes almost no one. Including your use here.
B) Equality and equity are not the same thing. You're right they don't care about equality because equality isn't necessarily what's fair or necessary. You can charge a rich person and a poor person the same tax rate and that is equal but it isn't equitable because 20% of a poor person's income has a much bigger impact on their life than 20% of a rich person's. Just because something is the same for everyone doesn't mean it is fair or good.
And here's where it's shown that the submitter knows nothing.
Google does NOT sell any information to advertisers. They keep the data to themselves. Google will USE that information to decide which ads are shown to which people. But the advertisers don't get to see any of this data.
You may still not like the fact that Google gathers all of that personal data, and that's a legitimate concern, but you should make a basic attempt to understand exactly how they use that data before spouting this sort of misinformation.
I'm a leaf on the wind. Watch how I soar.
"We take your security and privacy seriously."
Is a synonym/lawyer speak for:
"We done fucked up. Please don't sue us."
-Miser
"Sorry about that, OK? We are with you. We are strong. We will not be intimidated."
"Thanks for coming. Coffee on the white table; tea on the blue."
"Till next time? ..."
It little behooves the best of us to comment on the rest of us.
Next you'll be telling me that my call isn't important to the people who put me on hold for 45 minutes.
Here's what a lot of people don't seem to understand: Apple's Facetime problem is a bug. Facebook's issue is a feature. Governments, particularly left-wing governments, get their jollies punishing people for being less-than-perfect. Perfection isn't a standard that's achievable. Ergo, Apple shouldn't be punished for a bug. Facebook, on the other hand, sold the data to a third party. It just happens that the third party that brought this issue to light was working for the right side of the American political spectrum. I'd be willing to bet that if the Clinton campaign had won and used Facebook information to do so, you'd either see news stories about how the campaign was so modern and effective because it leveraged social media or you'd never hear about it. One should never think that a political weapon can only be fired in one direction.