Ask HN: I don't get this privacy awareness outburst, can anyone please explain?

[rick_2047]

Really, I don't get it. For a few months now everybody on HN, reddit, slashdot, stackoverflow or any other god-damn hacker hangout is talking about how everybody is ripping us off off our privacy. Facebook has been crucified already, maybe they will target google as here on HN I can see people moving to DDG just for the privacy (and not for the excellent programmer friendly results it gives). Every morning I log into HN and see a new article from someone's blog which tells how everyone and their uncle can attain more privacy. We have had privacy scanners and fixers we have had intense discussions on this topic.

I read all of this, understand most of it but I could never comprehend the idea of "privacy" online. I always assumed that whatever I put on the internet would be public now or in the future. Come to think of it, I put most of the stuff on internet just so a large mass of the world population can see me. My blog, my twitter, my facebook account all are there just so people who want to find me (or someone like me) can find me easily.

Google knows where do I live from my IP, so what? Facebook knows who I am friends with, so what? All this stuff was put up there just to make it public. If I don't want anything to be found I won't put it on the internet. It's not like they would steal my identity by knowing whom do I friend on the internet or what TV shows I like to watch. Nor would it harm me if webmasters know what word I searched to get to there website. All they want to know is what makes people want to come to there website. Where is the harm in it?

Maybe most of the people here would develop a deep seeded hatred for this post (maybe for me), but I just need to ask this question. Everyone I like from Cory Doctrow to the HN community wants to talk about something which I don't get. I know its a matter of principle to most of you. But I even can't understand that principle. So can you please explain all the privacy awareness outburst to me (without,preferably, flaming me)?

[jdietrich]

We all have a vague, intuitive sense of what the appropriate degree of publicness and privateness is in a given situation. Although vague, our sense of privateness is incredibly fine-grained and what is perfectly normal in one context can be a massive violation in another, almost identical context. While some of us geeks might think of "public" and "private" in a binary, cryptographic sort of way, most people have a much more nuanced approach.

Consider for example the difference in privateness between two people sitting on a quiet park bench and two people sitting on a bus seat. They are both obviously public places, but there is a subtle but significant difference in our expectations of privacy. In one context, eavesdropping is perfectly normal (within certain bounds), in another it is quite sinister.

On the internet, these intuitions are frequently confounded. Someone who assumed that their facebook feed was fairly private discovers youropenbook. User 927 assumed that his search terms were just noise in the crowd until AOL published them all. Countless iPhone users didn't know that their photos contained their exact geographic location until 4chan had a go at ruining their life.

The problem isn't the level of privateness or publicness of a particular service, it's not even particularly about leaks or breaches; it's about people being completely unable to judge the level of privateness of anything digital. I expect most people simply would not use a 100% public medium for their private communications, so the "if it's on the internet, it's public" mantra isn't a great deal of use. I think this is one of the reasons why Twitter has been so successful - it provides a platform that implicitly communicates its privacy or lack thereof. Twitter's simplicity makes it easy to understand and integrate into your existing model of social appropriateness.

I think we come back to a very old and very simple principle of interface design - don't surprise the user. We should be trying wherever possible to design systems that are as private in practice as they would seem to be intuitively. Users don't read much of anything, so we need to think about other ways of communicating "publicness" and "privateness" in our software. We need to recognise that designing social spaces is not a primarily technical problem. Small differences in architecture, interface and even general ambience can create enormous differences in how a platform is used. This stuff is really hard and really easy to completely cock up and I think we need to think much harder about it. Nod to PG here - HN is IMO a great example of a subtly, intelligently designed social platform.

[mechanical_fish]

This is what you are looking for: Danah Boyd's SXSW keynote: http://www.danah.org/papers/talks/2010/SXSW2010.html

It's important to realize that "privacy" actually means "control over how your personal information is presented and revealed". Because having a magazine photographer with a telephoto lens take a naked picture of you and post it on the web sends a different message than posting that picture yourself, which in turn sends a different message than mailing that picture directly to a younger member of the opposite sex. Even if the pixels are exactly the same.

This is about the important social meanings encoded in the way you present something: Steven Pinker on "indirect speech as a window onto social relationships":

http://fora.tv/2007/10/15/Steven_Pinker_Games_People_Play

It's a bit abstract and academic, but this is HN, right?

[brazzy]

One problem is that not everything people put on the web is intended to be public for everyone in the world to look at. Especially Facebook is seen as (and used to be) a way to communicate with people you know, not to be stalked by people you don't. It's a mix of broken implicit promises and false (but absolutely natural) expectations.

Another, perhaps bigger problem that you seem to have completely missed is that Facebook, Google & Co. don't just collect information about what you put online, but also about what you do online, and can correlate it to a frightening and potentially harmful degree:

"Dear Rick,

By analyzing your search and websurfing profile we are able to offer you products that are tailored to your personal interests. Included is your personalized catalog: "Kingsize anal dildoes".

Christmas is near, and you still haven't found the right presents for some of your family friends and colleagues? No problem! Just send us the name and address of the person you want to surprise with a special present and for only $5 you get a personalized gift catalog tailored to that person's interests!

42 of your acquaintances have already asked us about special presents for you."

[retube]

In some respects you are right. However most people have, to date, assumed some level of privacy. The issues can probably be summarised as:

1) Lots of people using these services assume only friends can see/access their data. They don't realise that much of their stuff is actually visible to a much wider audience, or if it wasn't before, it is now, due to privacy policy changes. This problem is exacerbated by extremely complex and lengthy privacy options.

2) It's not just about what you are putting out there, it's what others are putting out there about you. Whilst you might be happy for a friend to post a picture of you puking at the prom, or smoking a fat reefer, and to have that image accessible by only your friends, you probably wouldn't be so happy for your prospective employer to see it, and would, I imagine, be pretty hacked off if an image like this became accessible through some privacy change.

[kenjackson]

There are different levels and types of privacy, and people believed they had certain types of privacy, while understanding they didn't have others.

For example, I fully get that Google has my IP address and search queries. But I fully expect that you do NOT have that information. Likewise for my email on gmail. If Google were to take my old emails and post them on a public site I'd be upset.

Likewise, I'd be upset if Google went around my neighborhood gathering wifi data. Unencrypted or encrypted (which given their computing power, they could likely break, given the state of current implementations) I'd not be happy -- it breaks the unwritten assumption I have about what data is private.

And the relationship with advertisers is another issue. This is more an issue that I have finite time to deal with things and the last thing I need is for Facebook giving my name and email address to thousands of advertisers. And companies like Apple probably even have your credit card info. You probably don't want them giving that info away to advertisers either.

And lastly, there is also a component, at least in the US, of fear of intrusion by the government. If for some reason, the government wants to start auditing supporters of gay marriage, they could use the Patriot Act to narrow down the real name of [email protected]. The less info Yahoo and other sites have on you, the more difficult this becomes.

The fundamental question is why give up your privacy? What are you getting out of it? What do you potentially have to lose? Not today, tomorrow, but what about in ten years? There's very little upside to losing privacy, but _potentially_ huge downside.

[edw519]

It's not about privacy. It's about trust.

People aren't upset that their data is publicly shared.

They are upset because they understood that it would remain private.

Tell everyone my favorite color and I don't care.

Tell everyone I have an STD after you promised me that you wouldn't, and we've got a problem.

It's that simple.

[iamelgringo]

I agree, Ed.

I'd also argue the it's not really about geeks being upset that their own privacy is being violated. It's about other people's privacy. A huge percentage of normals don't understand the difference between a desktop app and what's inside a web browser. That ignorance can put them in very awkward if not dangerous positions. Here's why I've been part of the privacy propaganda mob on HN (without the flaming)

1. My niece and my geek friend. She's a very sweet, naive 15 year old girl who is the daughter of a conservative pastor. She loves to post pictures of her and her friends going to the beach, and camp, looking cute and goofing off. For the brief month that I tried Facebook out seriously, I had my niece posting pictures of herself in a bathing suit as well as geek friends posting comments like "MySql sucks dog cock" on my wall. Those online "friendships" needed to remain separate and in different circles of friends. And, I certainly don't want the "suck dog cock" friend ogling my niece in a bathing suit. I needed to have those relationships compartmentalized and kept private. Even had I figured out how to maintain that separation, Facebook could change that at will. I opted out, but my family still doesn't understand why.

2. My mother. She's now 74 and she bought her first laptop last year. She's on "the Facebook" because her grandkids are on Facebook. There is no way to easily explain how to maintain private/public information on Facebook. While she wants a tool to share status updates about medical conditions with friends/family, she doesn't want those broadcast to the world.

3. Rafael. I work with Rafael at my hospital. He worked in a 3rd world country as an agricultural minister before he got a visa to work in the US. After he got his green card, he packed up, moved to the US and changed careers to work in the health care field. He's been homesick so he's been catching up with old friends via Facebook. He went to a university 20 years ago with very communist leanings, and he's been talking to his friends/intellectuals about the political situation in that country. He personally knows several journalists who have been killed because of what they've written in the press about government corruption and drug cartels. He was shocked when I told him that his wall posts/conversations with his friends on Facebook were publicly searchable.

4. Alan. A former coworker of mine is a nurse, and he has issues. For a while, our hospital administration was in a tail spin about missing narcotics. Alan didn't show up for work one day, and I haven't seen him since. Another friend said that he was friends with Alan on Facebook, and several weeks prior, Alan had posted a status update on Facebook: "Vicodin, Valium and Vodka... the Holy Trinity".

I think you're right, Ed. It's about trust. But, for me it's not just that Facebook is changing their privacy policy. I, as a geek, know that anything I do online is inherently public. I use online tools with open eyes. Many Normals intuit wrongly that they are having private conversations when they interact with friends in a dark room via a laptop. That wrong belief can cause no end of problems for people.

That's why I'm on the privacy propaganda bandwagon.

[ErrantX]

Why would you post that somewhere even vaguely public though? The vast majority of people I know are aware that Facebook isn't completely close. They may of course be surprised how easy stuff is to extract.

But the truth is that better and more secure privacy exists today than it did six months ago. And a pretty large number of people are aware of that.

[mahmud]

It doesn't matter until you're denied a loan application or a job interview because of what is out there about you.

[slyn]

This is something people have been saying since long before facebook when myspace was the undisputed king of social networks. As early as my freshman year of highschool nearly 8 years ago teachers and administration were telling us to be careful what we put on the internets and the myspace because our prospective colleges and jobs would be looking at them.

I hate to generalize and single out a group, but of the people I know I feel like the only people who didn't understand that facebook had very little privacy were the older parents and family and such who all joined after they saw all their kids doing it.

[pyre]

+1 This is exactly the issue. There are many, many people out there that don't feel like something is a problem until it literally bites them in the ass. This applies on and off the Internet.

[proexploit]

It's currently a trend like any other trend. There's a huge amount of the public (specifically the younger generations) both content to follow and eager to conform and fit in. It's my guess that a huge amount of people are doing that. Of course, the whole privacy debate started because of what was viewed as an actual issue that was uncovered. While you may have the common sense to think what you post online might not remain private, many people do not understand that. When Facebook made a conscious decision to make privacy options essentially off by default, a lot of people had a problem with that. They felt tricked that they didn't have a say in the matter.

As any other popular topic, it's going to have a long wind because any blogger or news outlet wanting a little extra attention is going to rewrite posts, come up with new accusations, and highly publicize every development.

I'm for privacy, not because I expect it, but because I prefer to control what other people can learn about me. The real issues with privacy are situations like an abusive ex-husband being able to relocate his wife due to a privacy breach or a private matter publicized.

I hate those posts too, I'm tired of them but it's not going to go away and the best you can do is ignore. When this issue is over, there will be another equally unreasonable issue making headlines.

[jacquesm]

When you become a member of some website, you look it over, you weigh the advantages and disadvantages, and maybe after reading their various policies (ok, probably the majority of the people doesn't read them) you decide to sign up.

You do that with the website as it is at that moment.

If at a later date the website owners decide to use the data that you gave them under your previous image of that website in new, creative and unexpected ways they are effectively breaking the unwritten contract between their users and themselves.

This will usually cause a backlash, but only in a small portion of the userbase because most sites are too small to get significant mainstream press coverage.

When sites like facebook get involved in this sort of thing the media will latch on to it immediately because of the potential audience for the information. This will then piss off more people that otherwise would not even have realized something has changed and so on.

It's a side-effect of the network effects that facebook profited from when they established themselves, I don't think it is possible to have the one without the other.

[Dysiode]

As I see it i's just part of the elastic bouncing between extremes.

Just 10-15 years ago privacy was a huge issue between parents and their children. People assumed -any- personal information made their kids targets for predators (which isn't necessarily untrue, but that's another discussion).

That view morphed into people blindly shouting personal details of their lives at the Internet.

The natural trend is to become more privacy aware. As more people use the Internet those people are more concerned with who see their content (my addition to the examples is Daughter: O_O I'm pregnant. Mom: WHAT). Sure, people argue to only post what you want everyone to know; however, Facebook is artificially stretching the concept of privacy from blind shouting into radical openness.

This artificial manipulation in one direction causes the opposite side to recoil (perhaps violently) in an attempt to maintain a sort of homeostasis.

That and people don't like having some faceless corporation take control from them.

[y0ghur7_xxx]

It's probably to late to care anyway. Google probably has your searches of the last 10 or so years, your email, it knows the places you have been, your parents, your friends, the pages you visit every day, the kinds of porn you like, what disgusts you, what you really like, what you buy, how much money you can dispose of, and so on.

I don't like that. I probably would give that information only to some of my best friends, and maybe not even all of it. I don't intimately know google enough to trust it with all that data, google is not my friend. The only thing I know about google is that they make cool online webapps, and that they have a great search engine, but that does not make them my friend, so they don't have my trust. That's why I try not to give it too much info about me. The same holds true for facebook, and every other online service I give info about me.

But this is just me, and what I think is probably not what the majority thinks.

[loup-vaillant]

When you are right about something, people tend to eventually share your point of view. Don't give up.

[lucasoman]

People don't comprehend how insecure the Internet is. They take for granted that their information will remain private unless they explicitly wish to share it publicly. This may be naive, but ideally this is how things ought to be.

The reason these issues have been at the forefront lately is that mainstream media has picked up the story. Facebook has, to use a cliche, reached critical mass. Everyone and their dog has a Facebook profile, so when something involves Facebook, even if it's a slightly more technical topic than usual, people are interested and want to understand.

Combined with other coincidental events, like Google being compromised by Chinese hackers, and people start thinking about it.

[rue]

I disagree that it is just about "trust", as someone above asserts, although that is a big part of it. Many people indeed are upset mainly about the violation of trust rather than the underlying privacy issues. (The intrusions are not advertised, explained clearly, and the amount of interconnectedness is quite beyond most people's understanding.)

However, one component of all this I find distasteful is the more or less explicit coercion into revealing private information to use a service which, in some cases, is perceivedly or de facto necessary for one's livelyhood, social life or whatever. In particular because the offline equivalents or predecessors never needed such. You can argue that a teen does not need to use a virtual (no pun intended) monopoly like Facebook, or that no-one really needs to use unencrypted e-mail but that is just not realistic.

The (soon-to-be) ubiquity of the WWW or internet in general means that it cannot for long be allowed to go so radically against people's privacy expectations (some countries already offer better protection than others). The solutions may well be created by the private sector - say, making HTTPS and encryption for e-mail or equivalent the defaults.

Disclaimer: For this and other reasons I have avoided Facebook, MySpace et al., do not exclusively use Google's services, handle my own e-mail and so on. I am under no illusion that I am particularly secured against a concentrated effort, but I am satisfied I have limited my exposure somewhat.

[bbsabelli]

You're right, there is no problem with privacy. At least, for me & you.

That's because we know that our facebook data went from private to public a long time ago, and we have modified our behaviour accordingly.

However, you should also therefore know that not everyone in our social network understands the implications of these default changes.

So, the geeks are upset on behalf of the non-geeks they know and love.

And they should be. If you don't think so, I challenge you to question 5 of your less techie friends and family on this issue. You will be amazed at how few of them (a) understand what the hell you're on about, and (b) care.

[known]

http://en.wikipedia.org/wiki/Physician%E2%80%93patient_privi...

[jarek]

Out of curiosity: when did you start your Facebook account, at what age (approximately), and were you in school at the time?

[steveklabnik]

I agree with him, I started my Facebook account in fall of 2004, and I'm 24. It was about a month or two into my freshman year of college. First day Facebook was out.

[rick_2047]

I started facebook when I got into freshmen college, which was this year. I mainly started to use it as people like to share assignments on there fb accounts(we are not emailed our assignments)

[butterfi]

How much of this is perpetuated by 'echo chamber' I wonder?

[qw]

As someone who can be described as a Gen X'er, I have the same position now, as I did when I first saw Myspace and Facebook - I don't want to be part of it. The lack of privacy is a huge problem, and the worrying part is that it seems that the younger generation has a much lower threshold than others. I guess they are not old enough to have fully experienced or thought about the potential risks.

I take great care in how I present myself on the web. I have blogs and share photos online, but only on personal sites that I have full control of.

[jlgosse]

I don't understand. Are you trying to be funny, or just really lame?

[ahoyhere]

The bottom line is, other people don't have the attitude you do about online privacy. That explains it all.

And maybe they didn't think about it, or they trusted it, and they just woke up and realized how much dirt there is to put together on them. They weren't consciously deciding that online = open.

They're realizing that these free "tools" aren't tools at all; they are big, nasty companies. And their user data is the product.

Nobody likes waking up and realizing they're a product.

Also, trends come in waves. The 'privacy' thing comes in waves. The 'openness' thing comes in waves. Everything in life is a pendulum, from boom & bust economies to the level of religious fundamentalism.

Nobody seems to put that all together, but these waves of trends are largely BS, almost totally ineffective, nothing will happen, and it will disappear, only to reappear again in a year or two when the next big co. sells its user data without warning.

[buro9]

I don't think the author has the attitude he says he does. No-one truly can stand by the statement that everything they put online they expected to be public at some point.

So, your banking is online, your email is online. Clearly you expect some things to not be public. The question is about where that line is and whether someone moves it without your say so.

People would indeed freak at Google and banks if they revealed what they promised they wouldn't. And that is the issue with facebook, they told people they wouldn't share this stuff and so people used facebook to tell their close friends stuff and facebook moved the line, repeatedly.

[jraines]

Actually, I'd say most people do have the attitude he has about privacy, which is what makes the wave of privacy hand wringing mildly annoying. Most regular users of Facebook or Google couldn't care less. I can't back this up with data, but I'd bet on it. Even if its a lot in absolute numbers, the materiality threshold is really high. If ever HN user and every techcrunch reader quit facebook tomorrow, I doubt that would be enough to provoke a drastic course correction from fb.

[rick_2047]

As promised I am back with a longer post explaining what I learned from this thread of interesting discussions (after studying and taking a 6 hour sleep). First of all I thank again all the people who explained things so well and enabled me to infer things which otherwise I would have overlooked.

In my first year of engineering I took a course in communication skills. Our second lesson was titled "Barrier to communication" in which we studies what type of inter, intra and organisational barriers are there to communication. I read whatever was written here with an open mind I tried to infer what went wrong in terms of those intra-personal barriers. I found myself guilty on 4 counts of barriers. Let me list them all out.

1)Wrong Assumptions: As I had stated in my original post, I always assumed that internet == public. To me posting something on the internet was like posting it on the bulletin board of the classroom or college. Thus, when all this concern over privacy started I had incongruent thoughts from the privacy aware people.

2)Varied Perceptions: Due to my wrong assumptions, I perceived whatever I read in a very wrong way. It felt like people were suddenly and randomly picking up on something to argue about and hate. This was not so. People had different notions of what to keep to certain circles and what to make entirely public. Thus this barrier further confused me.

3)Differing Backgrounds: Now this is perhaps the most strong and significant barrier that I had. I failed to understand that most of the people who are writing such essays do not have the same cultural background as me. Most of these people were from a developed country and there is certain culture of independentness there. People have different circles of people who are oblivious to each other. But this is not true for me. I grew up in a liberal Indian family. Now a "liberal" Indian family knows everything about each other. And I am not talking just about my nucleus of mother father and sister. I am talking about relations till first cousins. I meet these people every few weeks and they know all about me. Thus everyone in my FB stream knew something or the other about each other and had a actually posted keeping in my that those people would be seeing all this stuff.

4)Impervious categories: I must be ashamed of my self that I fell for this trap, a trap which I like to avoid like a disease. I didn't come in to this discussion with an open mind, I only responded to notions which were congruent with mine. This way I was not able to get to grips to all these thing before.

When I posted this question I had decided keep my mind open and try to understand what happened here. I think I got to grips with most of the problems people have been talking about. Here is a list of what people claim to be the problem with them

1)They do not have total control over there data. So they cannot separate things among groups.

2)Sites like FB violated there trust when they made things public. I read some history and found that when the site was started people joined up so they can share things in private, but now that is very hard to maintain.

This is all I have learned from this brief discussion here. And I again thank you for explaining this to me.