
What's the worst that could happen with my phone data? - edward
https://www.nytimes.com/2019/12/26/reader-center/location-tracking-phones-questions.html
======
quelsolaar
When someone asks me why privacy matters, usually followed by "who cares about
the details of my life?", or "I have nothing to hide", I ask them if they know
who Milly Dowler was.

Milly Dowler, was a 13 year old girl who was abducted and murdered on her way
back from school. It took months to find her body. During this time her family
keep leaving desperate messages on her phones answering service. What they
didn't know what that, news papers had hacked her voice mail and listened to
and printed their pleas for her to return their calls.

When the voice box eventually became full, the reporters deleted messages from
the phone service so that they could get new materiel. When the family noticed
that the voice box had been emptied, it gave them hope that she was still
alive and was listening to her messages. Much later they where devastated to
learn the body had been found.

If you would have asked anyone in the Dowler family the day before Milly's
disappearance if they where worried that some one might hack their voice mail
they would probably have replied "No, Not really, we have nothing to hide and
who would really care to listen to that?"

~~~
thaumasiotes
So... given the Milly Dowler example... why _does_ privacy matter?

Did the family suffer harm through other people listening to their messages?

The false hope is unrelated to a privacy violation; it came from unauthorized
message deletion. It would have happened equally if messages had been deleted
unheard. And, for related reasons, there are already laws against this type of
conduct which do not draw on the privacy concept. ("Ownership" is sufficient.)

Was the family interested in hiding the fact that their daughter was missing?
That they were desperate to get her back?

How would more privacy have helped?

The argument that

1\. A bad thing happened;

2\. Behavior X occurred while it was happening

does not actually show that behavior X is bad or had bad consequences. And a
case in which all the relevant parties were intentionally publicizing their
affairs seems like an odd vehicle to draw privacy concerns from.

~~~
boomlinde
_> The false hope is unrelated to a privacy violation; it came from
unauthorized message deletion. It would have happened equally if messages had
been deleted unheard._

You are using a unique definition of privacy here to say that meddling with
data you have understood to be private is not a privacy violation.

 _> How would more privacy have helped?_

Unscrupolous journalists would not have had any reason to hack the phone to
listen to and delete messages. Ultimately, because there wouldn't be any
messages or because their storage was encrypted and guarded beyond reasonable
means to access it without permission.

~~~
thaumasiotes
> You are using a unique definition of privacy here to say that meddling with
> data you have understood to be private is not a privacy violation.

I'm saying that meddling with someone else's data isn't a privacy issue in the
same way that if I enter your home and cut your table in half, the destruction
of your table isn't a privacy issue. It's a destruction-of-property issue.

~~~
boomlinde
_> I'm saying that meddling with someone else's data isn't a privacy issue in
the same way that if I enter your home and cut your table in half, the
destruction of your table isn't a privacy issue._

If I had written a message on the table that directed the recipient to destroy
it to communicate something to me, it would be. Then you'd have entered our
correspondence and communicated on their behalf in a setting I understood to
be private, which in turn might prompt me to change my course of action and
further correspondence.

------
2T1Qka0rEiPr
If you want to shock your colleagues into action, one effective way is to plug
their email addresses into haveibeenpwned, and tell them:

> Alice, _YOU_ were exposed in the XYZ breach. Your $identifiable_information
> _IS_ publicly available. If you used the same password on XYZ as you do on
> other services, those services _ARE_ vulnerable. If any of those services
> allow you to access your email, _ALMOST ALL_ of the services you used are
> vulnerable. You should change them as soon as possible.

~~~
trashcat
It's a shame that most people will just add a number to their current password
though.

~~~
nothrabannosir
After talking this through with many non technical people, I have become of
the opinion the shame is ours. Why do we keep pushing this patently unsafe
authentication mechanism? It should never have been allowed in the first
place, but now with hardware keys readily available there really is no more
excuse. I understand there is a first mover disadvantage to disallowing
password-only auth, but that’s on us. Our collective timorous prevaricating is
to blame for the misuse of passwords by end users. Because, unlike them, we do
know better.

~~~
kardos
Hardware keys get lost, what is the fix for that?

~~~
thomk
Hardware keys embedded under your skin. What could possibly go wrong with
that?

Joking aside, hardware keys will absolutely get lost. Even car keys get lost
around here on a fairly regular basis.

Fingerprints maybe?

~~~
kardos
Probably not: [https://www.csoonline.com/article/3268837/busted-cops-use-
fi...](https://www.csoonline.com/article/3268837/busted-cops-use-fingerprint-
pulled-from-a-whatsapp-photo-to-id-drug-dealer.html)

------
heurist
I've directly sampled a lot of mobile location data. The data is sparse. Most
people do not have their location data distributed, and of those who do most
have very few pings, and with Apple/Android now explicitly asking for location
permissions the utility of the data which is available will decrease
dramatically. Google, Apple, Verizon etc have significantly more due to their
centrality in the technology but to my knowledge directly sell none of it. I
understand the concern to for privacy but NYT makes the issue seem larger than
it is.

~~~
darkkindness
Do you believe the piece linked in the first paragraph[0] describes an outlier
in terms of data collection? It shows how location data from a single low-
lying location tracking company had enough pings to reliably pinpoint home and
work locations of individuals, enough to de-anonymize and interview them. This
does not seem like sparse data.

[0]
[https://www.nytimes.com/interactive/2019/12/19/opinion/locat...](https://www.nytimes.com/interactive/2019/12/19/opinion/location-
tracking-cell-phone.html) (discussion
[https://news.ycombinator.com/item?id=21833718](https://news.ycombinator.com/item?id=21833718))

~~~
heurist
It's definitely possible, but when I have looked at the movement data myself
maybe 0.5% of houses in my city had any pings. Half the time there is no way
to tell if the pings come from residents or visitors. So the odds of being one
of those people is low. Minimal effort to secure your privacy can prevent you
from being one of these people. People should also be aware that their name
and addresses are already available without mobile data.

My opinion is that the data has tremendous potential to make retail/housing
markets more energy efficient and should be available for commercial
applications, though maybe sellers/consumers of the data should be licensed.
Won't go into detail but I think it will ultimately help in the fight against
climate change.

------
toohotatopic
Are most people not worried that at one point, algorithms will understand us
on a subconscious level? Like the existing algorithm that can tell if somebody
is depressed by the way they are dancing?

Life will be like entering an evil cult, where advertisers can abuse our
deepest vulnerabilities to the benefit of whoever pays the most.

------
8bitsrule
I'd be very surprised to hear about how to track a particular phone with the
battery removed.

~~~
georgeplusplus
The answer However, is not surprising.

You add another power source the user doesn’t know about.

