Privacy in the age of Big Data

[Kodos]

Why using Google VPN is a terrible idea

Google putting out a VPN to "protect people's privacy" is pretty ironic, considering their whole business model is to invade users' privacy as much as possible to better target people with their advertisements. When you choose a VPN, you should keep two things in mind:

1. Never use a free VPN, because those are generally run by companies who will turn around and monetize your data. The saying "If it's free, you are the product" certainly applies here.
2. Never trust Google to respect your privacy.

Make no mistake, despite what they might claim, Google’s VPN is an attack on internet privacy. What we need is not an internet that puts Google first, but an internet that puts people first, and puts people in control over their data. We can all take a step toward this better internet by saying ‘No’ to Google VPN.

[ISiddiqui]

Your post may have had the exact opposite effect as I was like, there is a Google VPN? How much? It turns out it's now part of the 2TB Google One plan. So a nice new perk.

[sterlingice]

Opera also has a built-in VPN but it was bought by a Chinese conglomerate a few years ago so that's probably not the safest spot for your data, either

SI

[Kodos]

Originally Posted by ISiddiqui

Your post may have had the exact opposite effect as I was like, there is a Google VPN? How much? It turns out it's now part of the 2TB Google One plan. So a nice new perk.

You can lead a horse to water...

I just try to provide useful info. It's up to you folks what you do with it.

[Kodos]

https://www.nytimes.com/2021/03/31/t...-browsers.html

You can do a lot to improve your privacy just by choosing a good browser. Personally, I use Firefox with some add ons (uBlock Origin, Privacy Badger, HTTPS Everywhere, and DuckDuckGo Privacy Essentials) on my laptops. On my phone, it's Firefox and DuckDuckGo. Safari is a good browser as well. Basically, anything but Chrome, the most popular browser in the world. Anything you do in Chrome is sucked up by Google and used to target you better.

By the end of this column, I hope to persuade you to at least try something else: a new type of internet navigator called a private browser. This kind of browser, from less-known brands like DuckDuckGo and Brave, has emerged over the last three years. What stands out is that they minimize the data gathered about us by blocking the technologies used to track us.

That’s generally better than what most mainstream browsers, especially Chrome, do. While some browsers like Safari and Firefox also include tracking prevention, the smaller brands have been focused on even more privacy protections.

--------

In the end, though, you probably would be happy using any of the private browsers. Even if you don’t make one your default browser, it is useful for certain situations, like a sensitive web search on a health condition.

[Ksyrup]

I guess I'm in the minority, but I don't necessarily see targeted ads as a negative or invasion of privacy. Now, what ELSE they may do with information they collect is another question, but focusing on advertising as the primary evil is a losing argument to me. I rarely get ads that are in the way anymore, so it's just a matter of out of sight, out of mind as I scroll past stuff. If I get targeted for dog bones because I was on chewy.com ... *shurg*

[Kodos]

It's more stuff like this:


1. Companies that collect lots of private info about individuals have been really bad about protecting that data. Sometimes they just keep it in an unencrypted file that anyone can access.

2. I don't mind advertising related to what I just searched on. If I search on a car on DuckDuckGo and it shows me a Honda advertisement, that's fine. I'll get annoyed if the ad follows me elsewhere around the net.

3. I just believe in a fundamental right to privacy. Companies don't need to know everything I've ever searched on or every site I've ever been to. I'm not here to be monetized.

[Kodos]

Home | Okuna

I'd love to see a privacy-centered social network like this one take off, but I realize it's a longshot because it's hard to reach the critical mass necessary to really become successful.

On the other hand, they're small, so FOFC can dominate it from the start.

Edit: Actually, it appears they have found an investor and are rebranding to be Somus. Currently, they are getting their ducks in a row for a launch with the new name.

https://medium.com/okuna/the-path-forward-8d56ccf37b5c

[Kodos]

https://www.nytimes.com/2021/05/20/o...ection=Opinion

Kudos to Apple for giving users a chance to say they don't want to be tracked.

Many of the biggest tech firms have long insisted that consumers care more about free services than the privacy they surrender to use them.

Companies like Facebook pointed to their own exponential growth and insisted that consumers were voting with their feet.

Turns out, that was nonsense.

When offered an actual choice in the new operating system that runs iPhones, Americans are all in on privacy.

Just 6 percent of U.S. daily users of Apple’s latest mobile software are opting to allow companies like Facebook and its many affiliates to hoover up data about them and sell it to advertisers, according to Flurry Analytics. (The figure is higher globally, at about 15 percent.)

-----

“Facebook is really saying: What can we do to protect our business model?” said Jonathan Mayer, an assistant professor of computer science at Princeton. “It’s entirely unsurprising that they would oppose a change that introduces more control to consumers and less opportunity to collect data that can be fed back to advertisers, even if that’s what consumers are saying that’s what they want.”

Early data shows that consumers overwhelmingly want more privacy. Apple’s new operating system for phones forces each app to ask permission to track users across the internet — a choice that was previously available but difficult to find.

Almost all users opted out.

[Kodos]

https://www.nytimes.com/2021/06/14/o...-big-tech.html

Stuff like this is why I extracted myself from everything Google. They don't have any respect for their customers.

With little regulatory accountability, this pursuit is a particular fixation for the biggest tech companies, which have the unique ability to pinpoint customers’ every online move. As part of this economy of surveillance there is perhaps nothing more valuable than knowing users’ locations.

So it was that Google executives were dismayed over a most inconvenient discovery: When they made it simpler to halt digital location tracking, far too many customers did so. According to recently unredacted documents in a continuing lawsuit brought by the state of Arizona, Google executives then worked to develop technological workarounds to keep tracking users even after they had opted out. So much for the customer always being right.

Rather than abide by its users’ preferences, Google allegedly tried to make location-tracking settings more difficult to find and pressured smartphone manufacturers and wireless carriers to take similar measures. Even after users turned off location tracking on their devices, Google found ways to continue tracking them, according to a deposition from a company executive.

[Kodos]

Betty White knew computer security.

[Kodos]

Signal, WhatsApp and Telegram: Here's which secure messaging app you should use - CNET

If you're looking for privacy in a messaging app, Signal is the gold standard.

[sovereignstar v2]

Originally Posted by Kodos

Signal, WhatsApp and Telegram: Here's which secure messaging app you should use - CNET

If you're looking for privacy in a messaging app, Signal is the gold standard.

I started using Signal on January 6th of last year and haven't looked back.

[shinebrights]

just use vpn or proxy cause it always helps

[Kodos]

Stealing this link from the Biden thread.

Key Senators Have Voted For The Anti-Encryption EARN IT Act | Electronic Frontier Foundation

Law enforcement and some in the government are always pushing to weaken encryption in the name of stopping child porn or other egregious things. They try to frame encryption in the worst possible light and highlight its application in organized crime. They ask Google and Apple to put in backdoors to encryption so they can monitor text messages, email, and internet usage. Strong encryption is crucial to protect journalists, banking systems, internet commerce, etc., as well as people's basic right to privacy.

[Kodos]

Abortion Ruling Puts User Data Privacy in Focus. Here’s What to Know

I'm just going to repost something I just put on Facebook:

The end of Roe v. Wade highlights just how vital data privacy is. Some states that have anti-abortion laws will look to prosecute individuals who they suspect may have gotten an abortion or helped someone else get one. They will subpoena tech companies like Apple and Google for evidence that an abortion took place, including location data, internet searches, texts and emails. Even though Apple's iMessages are end-to-end encrypted, law enforcement can still get access to texts if you use iCloud backups.

If you want the gold standard for end-to-end encryption in your texting, use Signal (don't worry, it's free). For email, use an end-to-end encrypted email service such as Protonmail (they have free and paid tiers, but every tier gets the same encryption). Be aware that anything and everything you search on in Google is recorded and kept forever by Google (even if you never hit the enter button). Use a privacy-protecting search engine like DuckDuckGo if you are searching on sensitive information. Also, ditch Chrome, as it is just another avenue of data collection for Google. Use the Firefox or Brave browsers as an alternative. They are built around respecting the privacy of their users.

I know I've said all of this before, but now is a perfect example of why this stuff is important. Protect your privacy, and just say no to the rampant data collection of Google and Facebook (go to Facebook through a browser rather than use their app--the app tracks everything you do, including your location). That's why Facebook knows you're dating somebody before your friends and family do. They also know if you are pregnant or having an affair.


From the end of the linked article:

"Are there ways to limit the exposure of these types of data?

Women can use an end-to-end encrypted messaging platform, the Electronic Frontier Foundation, a nonprofit digital rights group, says and recommends Signal.

Women also can check the health and privacy policies on their period-tracker app. Some are more privacy friendly than others, The Wall Street Journal previously reported.

Additionally, women who want their search histories to be private can use a search engine such as DuckDuckGo that, unlike Google, doesn’t save or share user search histories.

“We are not yet sure how companies may respond to law-enforcement requests for any abortion-related data,” the Electronic Frontier Foundation said. “But you can do a lot to control who you are giving your information to, what kind of data they get, and how it might be connected to the rest of your digital life.”

[RainMaker]

Good article. I'd recommend Signal to everyone regardless. SMS is as unsecure as it gets and you should assume anyone can read those messages.

[sterlingice]

“We are not yet sure how companies may respond to law-enforcement requests for any abortion-related data,” the Electronic Frontier Foundation said.

Let me help you out with this one. They almost all universally go along with whatever now to sell your data or provide it to law enforcement except in a handful of high profile cases. Assume they will do the same here.

SI

[Edward64]

Originally Posted by sterlingice

Let me help you out with this one. They almost all universally go along with whatever now to sell your data or provide it to law enforcement except in a handful of high profile cases. Assume they will do the same here.

SI

To be fair, these mega tech companies have to follow the law and have fiduciary duty to their stockholders. I think the only answer they have is "we will follow the law but we'll take every legal avenue available to us to protect the information".

[sterlingice]

Originally Posted by Edward64

To be fair, these mega tech companies have to follow the law and have fiduciary duty to their stockholders. I think the only answer they have is "we will follow the law but we'll take every legal avenue available to us to protect the information".

Lawyers cost money and data is profitable - they're not protecting shit

SI

[RainMaker]

Twitter and Reddit do actually fight for their users in court. The rest just do whatever they are told.

[Kodos]

The privacy podcast that I follow recommends Eufy as a privacy-respecting option for video doorbells.

Eufy video doorbell. This is a much more private product than Ring. I have one and love it. Videos are stored locally on an SD card, but you can still access them from your smartphone anywhere.

The Wall Street Journal has an article about Ring and some of the other video doorbells. Ring (owned by Amazon) is very cozy with law enforcement, and police departments regularly promote Ring adoption. If you want to protect your home but also control whether any video you take is used by law enforcement, Eufy is the way to go.

Why You Should—or Shouldn’t—Buy a Home Security Camera - WSJ

Why You Should—or Shouldn’t—Buy a Home Security Camera

----

Amazon.com Inc.-owned Ring gave surveillance footage to law enforcement 11 times this year without a warrant or customers’ consent. The company said the requests met its exception for emergencies. In the past, hackers with stolen credentials broke into Ring camera web portals and scared the living heck out of unsuspecting families with the devices’ two-way talk capabilities.

“Ring holds a high bar for itself and deeply scrutinizes each emergency request,” a spokeswoman said. The company might provide information to law enforcement when there is danger of death or serious physical injury, such as a kidnapping or attempted murder, she said. “These emergency requests are reviewed by trained professionals who disclose information only when that legal standard is met,” she added.

If you’re uncomfortable with a company making that determination, there are settings you can enable to prevent sharing, as well as platforms that make privacy the default. Here’s what you should think about when installing a smart surveillance camera.


End-to-End Encryption

When Ring, Google’s Nest or Arlo send footage from the camera to the company’s servers, that data is automatically encrypted. Translation: It’s protected if a hacker gains access to those servers.

However, the companies themselves can decrypt that data and—if legally or morally compelled—share it. A spokeswoman for Alphabet Inc.’s Google said that to date, the company has never given camera data to authorities without customer consent, but it reserves the right to do so if it considers a situation an emergency.

There is a method of protection, called end-to-end encryption, that would hide videos from both hackers and the companies. “It means that only your device, for example, your phone, can see the video that is recorded,” said David Choffnes, executive director of the Cybersecurity and Privacy Institute at Northeastern University.

End-to-end encryption, while recommended by Prof. Choffnes and others, isn’t always an option. Neither Google Nest nor Arlo offers the ability to fully encrypt camera videos. Ring has an opt-in setting for many products, but not its battery-powered models. A spokeswoman confirmed that Ring wouldn’t be able to decrypt such videos for law enforcement.

There are, however, trade-offs for turning on Ring’s end-to-end encryption. You can only view video on authorized mobile devices, not through your web browser. Some features are disabled, such as image previews within notifications and the ability to watch streams on other Amazon devices.

[sovereignstar v2]

In regards to Eufy, are the SD cards just installed inside the video doorbell? What's to prevent someone from just stealing your video doorbell and busting it, preventing you from having access to the video storage?

Edit: So it looks like the SD card would be installed in the chime, which would be inside your house.

[Kodos]

Originally Posted by sovereignstar v2

In regards to Eufy, are the SD cards just installed inside the video doorbell? What's to prevent someone from just stealing your video doorbell and busting it, preventing you from having access to the video storage?

Edit: So it looks like the SD card would be installed in the chime, which would be inside your house.

Yes. The SD card is installed inside the house.

[Kodos]

[Kodos]

https://www.nytimes.com/2022/11/02/t...smid=share-url

If you're getting a surveillance camera for your house and would like to control whether or not police have access to the footage, you should avoid Amazon's Ring cameras and go for something like a Eufy camera, which allows you to store footage locally on storage media located inside your house, rather than in the cloud.

Matt Guariglia, a policy analyst at the foundation, which publicly protested the legislation before the city’s Board of Supervisors approved it in a 7-to-4 vote, said San Francisco’s ordinance posed threats to consumer privacy. Although the legislation requires the police to get permission from camera owners before viewing live footage, he said, the police have been able to obtain Ring recordings directly from Amazon.

A Ring spokeswoman confirmed that the company provided camera data to law enforcement when required by court orders, and that it had provided footage to the police in extreme cases, like kidnappings, without a court order.

The San Francisco ordinance will probably not have an immediate effect on many people’s cameras. That’s because the most popular devices like Ring and Nest Cam lack a software feature enabling a police officer to tap into a camera to view its live footage. (According to my conversations with the mayor’s office, the authors of the legislation were unaware of this limitation.)

It’s unclear whether the tech companies will eventually design such a feature. Amazon and Google say they don’t have plans to do so.

If you’re worried that the police might gain access to your camera without your permission, there are ways to navigate those concerns, like using an offline camera that records to a physical storage drive or a picture card in your home, said Chris Gilliard, a community college professor who has been an outspoken critic of surveillance technologies.

“There’s a stark difference between putting yourself and your community in the Amazon web, and having cameras where you fully control the footage,” he said.

In addition, you can avoid using cameras to monitor indoor spaces like bedrooms, and you can disable their microphones.

[Kodos]

Ah, looks like I am repeating myself from August! Oh well.

[Ksyrup]

We're all getting old, we understand.

[RainMaker]

Originally Posted by Kodos

https://www.nytimes.com/2022/11/02/t...smid=share-url

If you're getting a surveillance camera for your house and would like to control whether or not police have access to the footage, you should avoid Amazon's Ring cameras and go for something like a Eufy camera, which allows you to store footage locally on storage media located inside your house, rather than in the cloud.

This is good advice but I think one of the benefits with cloud storage is you can't just steal the storage device (guessing this runs on an SD card?). Seems like there are ways to set up your own storage remotely, but I imagine very few customers have that technical knowledge.

[sterlingice]

"You know, the courts might not work any more, but as long as everybody is videotaping everyone else, justice will be done."

SI

[Kodos]

Originally Posted by RainMaker

This is good advice but I think one of the benefits with cloud storage is you can't just steal the storage device (guessing this runs on an SD card?). Seems like there are ways to set up your own storage remotely, but I imagine very few customers have that technical knowledge.

Well, if they’ve come in to your house to steal the storage device, you have bigger problems.

[sovereignstar v2]

My god

Major tax-filing websites secretly share income data with Meta | Ars Technica

[sterlingice]

Boy, it's a good thing we don't have a social credit system like that backwards country of China

/nervous chuckle/

SI

[sovereignstar v2]

Ruh roh.

https://www.reddit.com/r/EufyCam/com...tly_dropped_a/

[Kodos]

Huh. I’ll have to check that video out when I’m on my laptop. Disappointing for sure. (I don’t have any cameras personally.)

[sterlingice]

I feel like I'm the only house on the street without a Ring doorbell at this point

SI

[bhlloy]

None of that is remotely surprising to anyone who has worked in IT and has the slightest idea how most companies view the trade off between cost/performance/simplicity and security IMO. And that’s assuming that it’s an honest mistake and not a blatant attempt to gather and monetize data, which may not be the case seeing where this company is based.

With that being said, I had a ring for years in the US. I worked for Amazon and had a good friend/ex coworker who worked for Ring pre and post acquisition. I had no illusions about how secure and private that solution was either, I just have trouble getting worked up over somebody theoretically deciding they want the bother to have access to a camera feed from my driveway in near real time. Maybe I should have been more bothered about it, but eh. I assume anything I’ve ever done over the internet is available to somebody somewhere if they care enough to find it.

[Kodos]

Most VPNs (especially if they are free) are not a good privacy tool. The Freedom of the Press foundation recommends:

TunnelBear
Mullvad
VyperVPN
IVPN
ProtonVPN

Most others are harvesting your data and selling it.



Consumer Reports had a good article about VPNs.

[sterlingice]

Facebook is now having notification for their lawsuit settlement in Facebook, which sounds good in theory. However, in the world we live in, I'm just assuming FB is going to turn around and sell my settlement information, too.



SI

[Kodos]

‘Unprecedented’ Secrecy in Google Trial as Tech Giants Push to Limit Disclosures

“These things are warfare,” he said. “You want to get the information, and you don’t internalize the cost to the public or reporters.”

But Mr. Wu noted that there was an inherent irony in Google’s push to limit disclosure.

“It’s ironic for a company to suck up all our information and know everything about us and we can’t know a damn thing about them,” he said. “We deserve a better look at them.”

[sovereignstar v2]

Whoops

23andMe says private user data is up for sale after being scraped | Ars Technica

[Ksyrup]

I wonder how long until that data finds its way into a free database where law enforcement uses it to locate a murderer and then chaos ensues when it's determined to have originated from 23andMe.

[sovereignstar v2]

Lovely

Access to this page has been denied

[Edward64]

Originally Posted by sovereignstar v2

Lovely

Access to this page has been denied

I saw that. I'm sure they have it covered in the "small print" agreement but yeah, hope they get slammed for it.

I've worked in software where the vendor says they will use the data but it'll be consolidated and used for performance tuning and maybe shared with other clients as best practice etc. However, nothing will not be individually identifiable.

[miami_fan]

Haven't we reached a point in our society where the expectations should be that companies are going to share the data that is collected either directly or indirectly? Obviously, I don't think that it is right and this may sound defeatist. I just don't know why we would have the expectations of companies to not use the collected information as they see fit whether in a consolidated or individual manner.

My mother had the tracking device under a usage based insurance plan before she stopped driving. Every incident where she went above the posted speed limit, sudden braking, accelerating too fast from from a complete stop and a host of other things were captured with date, time, street/intersection location of each incident. Why would the insurance companies not pay for such information for every driver? Why would the car companies not sell it to them? Why would we think that they are just going to track "them" and not "us"?

[Kodos]

Privacy should be considered a fundamental right. Stuff like this should be banned. First of all, the car companies should be forced to get your consent to track your data, instead of the current situation where you are defaulted into being tracked with few or no options to opt out. Second, if someone profits from your data, it should be the consumer who has consented to having their data tracked. The surveillance state has to be stopped.

[miami_fan]

Originally Posted by Kodos

Privacy should be considered a fundamental right. Stuff like this should be banned. First of all, the car companies should be forced to get your consent to track your data, instead of the current situation where you are defaulted into being tracked with few or no options to opt out. Second, if someone profits from your data, it should be the consumer who has consented to having their data tracked. The surveillance state has to be stopped.

Yeah I am not sure that the concept of fundamental rights exist anymore but that is a topic for another thread.

I agree with what you are saying in general. My point is we as a society have gone too far down the road of consenting to having data collected and tracked to be shocked that the data that is collected and tracked is used against us and for profit. If you weren't able to read that Times story, the driver of the leased Chevy Bolt EV who had his rates jacked up was the owner of a software company. Without casting aspersions at this man, I will just say that I am confident that more than a few software companies are collecting and tracking data and then selling that information to companies like LexisNexis without their customer' explicit consent. At the very least, they are selling software to other companies to do the tracking and collecting.

I have seen no reason to expect that the companies won't share the data. They rarely suffer any consequences either legally or from the public in terms of their bottom line

[RainMaker]

Originally Posted by miami_fan

I have seen no reason to expect that the companies won't share the data. They rarely suffer any consequences either legally or from the public in terms of their bottom line

Same. It'll come down to consumers demanding it if it'll ever happen. And right now, it doesn't seem like most consumers care.

I think it would take a massive data breach where everyone's e-mail or messages were exposed to cause people to take it serious.

[JonInMiddleGA]

Originally Posted by miami_fan

I agree with what you are saying in general. My point is we as a society have gone too far down the road of consenting to having data collected and tracked to be shocked that the data that is collected and tracked is used against us and for profit.

This.

And it's really not even that new a thing, certainly nothing that depends on cutting edge tech or the social media era.

Some of the earliest things I learned when I switched over to ad agency side of the media business was how to buy things like mailing lists that targeted people with certain characteristics. And you could get pretty granular with those lists. And that was the 1990s.

Those evolved to email lists, junk mail evolved into spam, and so forth.