Hacker News new | ask | show | jobs
by phmagic 2524 days ago
(disclaimer: I work at a big tech firm, but I've had this opinion before working here)

I'm confused by the lengths people have gone through to "protect" themselves from internet giants while freely giving away their info to credit card companies, traditional retailers, small businesses. Credit card transaction data have been sold for years without most of us knowing about it. Small startups, boutique stores rarely have the security or data governance resources to ensure your data is stored and used properly. Data breaches are common even at large brick-and-mortar retailers.

Given the state of data security outside of big tech, my best option is to trust only big tech.

8 comments

> I'm confused by the lengths people have gone through to "protect" themselves from internet giants while freely giving away their info to credit card companies, traditional retailers, small businesses.

You are invalidly generalizing. I try to eliminate all contact I have with the tech giants, and I do not have a credit card, I am at a privacy respecting bank (GLS Gemeinschaftsbank), and I use cash.

Additionally, by sharing your data with a company, you give that company power over yourself and others by enabling them with the knowledge they have over you. Considering this, it is less problematic to give access to data to a small company compared to a tech giant.

> You are invalidly generalizing. I try to eliminate all contact I have with the tech giants, and I do not have a credit card, I am at a privacy respecting bank (GLS Gemeinschaftsbank), and I use cash.

You do you, but I'm happy to get free airline tickets and other perks from using my credit card at the expense of....... having someone else know I bought a mechanical keyboard last month?

I respect your choice but I honestly do not understand why people go to such great lengths to hide mundane data. I'll tell you the color of my underwear for free, I don't care.

Maybe at the expense of buying that mechanical keyboard you thought you really wanted but actually you ended up purchasing because of continued, subtle advertising?
Assuming you have the income to support your spending habits, I don't see this as much of a risk? Occasionally buying the wrong thing for whatever mistaken reason is a fact of life. Live and learn.

I would be more worried about scams, bad investments, bigger purchases, or a pattern of impulse buying.

> You do you, but I'm happy to get free airline tickets and other perks from using my credit card at the expense of....... having someone else know I bought a mechanical keyboard last month?

That's not why you're getting free airline tickets. You're getting them because you're a) subsidized by people who carry a balance and b) pay higher prices on goods to make up for the merchant fees, while being partially subsidized by those people who pay with cash and aren't getting free flights.

I'm not hiding, I'm just not exposing myself. It's a matter of perspective.

More significantly, you are understating and trivializing the kind of information that many services force us to expose. If you share your buying history, that may reveal locations, your movements, your schedule, etc. What a set of data reveals is not up to the one the data is from, but the one analyzing it. For you it is mundande, for them it is enough.

> Credit card transaction data have been sold for years without most of us knowing about it.

In practice, yes, most of us are clueless. In theory, if you've seen one of these[1] (and if you're an American, you most certainly have) then you "know about it." The Gramm-Leach-Bliley Act has a whole lot of room for improvement, but the single-page uniform privacy disclosure it brought to financial institutions is infinitely more consumer-friendly than 90 pages of 10pt grey legalese used by big tech.

[1] [PDF] https://www.ftc.gov/sites/default/files/attachments/press-re...

I think you're thinking of a different threat model from these users. If you're concerned about breaches by malicious actors, then yes this defense makes sense.

However, if you're worried about data mined from tracking your personal behavior, which is what the users here are worried about, then it makes sense to spread your data out. Traditional stores are not going to send each other your transaction history to build a profile of interest and personality, and each store won't have a complete enough history or even the expertise to mine it.

>Traditional stores are not going to send each other your transaction history to build a profile of interest and personality, and each store won't have a complete enough history or even the expertise to mine it.

"Traditional" as in "before the age of Amazon"? They do, through store rewards cards. Harris Teeter knows what I have bought and has figured out what I only buy on sale, Target can identify pregnant women with stunning accuracy, and I'd be surprised if other retailers didn't do similar stuff. You're probably thinking of independent/mom and pop shops.

I would point out that many organizations collect data, but tech companies are the most effective at abusing it. Their competence makes them by far, the most dangerous.
It's the breadth and depth of data which Google, Facebook, and Amazon have access to (and their ability to leverage it) that changes the privacy threat model entirely.

A mom and pop store I give my credit card to in town can't track me across the Internet and correlate my browsing activity to my purchases, for whatever nefarious purpose, for instance. They can't read my email and correlate it with my location data. And so on. That's the difference.

Worse, Google in particular is financially incentivized to track me and perform all that correlation for the purposes of advertising. A family owned business I visit downtown, not so much.

I don't think I have knowingly met anyone who took significant steps to limit exposure to big tech firms who hasn't also taken significant steps in other areas of their life. And people I have met who do take this stuff seriously do things like cash-only, PO box only, no (nearly) online accounts etc. They are certainly making their lives less convenient on this principal.

Where are you meeting people who fit the description you give?

For another anecdotal example, I have only met the exact opposite: people who take steps to avoid big tech tracking but happily use credit cards etc
How does this argument come up every time? If I can't have absolute privacy, I should just give up? The same way I'd love to give up every last bit of dependence on Google, I'd love to get decentralized fintech. But the popular one is a bad word that starts with B and I fear has spoiled the well. (Though it's been interesting traveling through Europe and seeing Bitcoin signs all over Prague, the ticket machine offering bitcoin top up at the Bern train station, and a tradesman/construction worker wearing a Bitcoin advocacy shirt while walking to the beach in Bern today. And don't get me started on how much time I've spent triple-re-verifying my identity with Mastercard or waiting 5+ days for critical ACH transactions.)
No but there's a good argument there in terms of priorities.

What is more likely to impact you negatively: Google building an internal profile based on your information and targeting ads based on it or your card information being stolen from insecure smaller vendors?

Obviously those 2 choices are picked arbitrarily but they may explain why the OP chose to prefer the former over the latter. I would think every time we decide to share some of our information we do so because we stand to gain something (otherwise why do it) and it's up to us to decide if what we stand to lose is worth it. As technically minded people we tend to be more focused on technical problems and what we consider more dangerous may be more related to our familiarity with the subject matter rather than the objective potential negative impact it has.

I mean, "my card information being stolen" is literally only an issue because credit card companies won't force US retailers to accept proper chip and pin. It just is not an issue everywhere I've been in Europe because it is categorically impossible for them to steal my card information with contactless payments.

As for the magnitude of privacy invasion regarding financial transactions, I feel very safe in saying the data Google has about/from me is far more revealing than relatively opaque transaction logs.

Google is worse without question. Having your card number stolen is a minor inconvenience whose danger is inflated by services offering to protect you from it. Happened to me once, they charged $1500 before my credit union called me. I had to spend a total of an hour on the phone with a few different people, and the money was credited back to my account within 48 hours. This is with a debit card, which are constantly subject to FUD on this issue from the vendors of credit cards.
Note that you provided reasons as to why having debit/credit card information stolen isn't such a big deal, if you get protection from fraudulent transactions, but haven't provided any reasons as to why Google targeting ads based on some profile they built on you is worse than that.
Some do. Some don't.
> while freely giving away their info to credit card companies, traditional retailers, small businesses.

No, we don't. We are just not given a choice by this bullshit capitalist society. Just like many people "freely live on the streets" or "freely get murdered by the police".