Do you keep your money under a mattress too?
I have ~$30K in gold and silver, in plastic boxes hidden under my bed. But you'd need to remove floorboards to access it. I bought for cash at swap meets, years ago.
Nothing, hence my confusion.
> No, my argument is that security is theatrical.
Claiming this in a general sense is a strong claim. Are you suggesting that end to end encryption is theatrical? Or by sidechannels do you mean that anyone can come along and beat you with a hose until you reveal your password? You're being very coy, speaking only in vagueties, and that makes it difficult to not overinterpret what you're saying.
In fact you seem self-contradictory, saying that security is theatrical yet appearing to claim a bank is safer than a mattress. Which is it?
But since you ask. A fireproof safe is significantly more prudent than an ordinary mattress. And if I had such a thing, I wouldn't be bragging on the internet about where I keep it. Happy?
> Your trove of personal data has monetary value. With a few pieces of info, your identity can be stolen. If a company gets hacked or an employee siphons data, it's sold and used, with you facing severe consequences and maybe them too.
is exactly the same as
> Your trove of actual money has monetary value. With a few tricks, your money can be stolen. If a bank gets robbed or an employee embezzles, it's stolen and disappears, with you facing severe consequences and maybe them too.
Yet we don't appear to have any issues with putting our money in banks.
> You're concerned with literal cash money, I'm concerned about personal data.
No, I'm concerned with things of equivalent value. If I have $1,000,000 in cash, I'm happy to entrust it to a bank. I doubt my personal information is worth that much, yet you appear to suggest that I shouldn't feel comfortable giving a group something much less valuable. In other words, your ELI5 about privacy risks isn't compelling, except to you, who is already concerned about privacy. But you're not the intended audience. The person who isn't concerned about privacy is, and you still haven't done anything to convince them, because banks.
Here's one argument against what I've said, as an example: information is not like money. Its very difficult, and often impossible, to "take it back". So we should bias away from doing so.
Excuse me, but your approach to this conversation has been rather uncharitable. The assumption, that you omitted from earlier replies, is
>> Your trove of personal data has monetary value...
> is exactly the same as
>> Your trove of actual money has monetary value...
Which is factually incorrect, which is why I was unable to read your mind in this particular regard. Rather than present your concerns with an omission in my answer in a clear and constructive manner, you challenged me to defend a position that I have zero interest in taking. The latter half of your response here is clearer, so thank you for taking the time to explain your concerns.
> The person who isn't concerned about privacy is, and you still haven't done anything to convince them, because banks.
That's the conclusion you've jumped to. Next time, this could be rephrased without the implication that I'm an idiot for not jumping to the same conclusion. A more generous approach to this conversation could look like, "Can you explain how data stored by an online company differs from money held by a bank? I don't think your argument is adequately differentiates the two."
As you note, "information is not like money." What I presented was a process by which the monetary value of information can induce people to steal it. As you note, money is fungible, and data is extremely personal -- so these assets are not exactly the same.
With regards to banks. A bank robber does not have the power to empty your account -- only the bank's cash on hand. This isn't the wild west, banks are insured, and cash on hand is an insignificant fraction of a bank's holdings. If an employee embezzles, there is a remote chance that your personal account will be targeted. However, banks are regulated and these actions will be traceable and correctable -- you might be broke for a few months, but you'll almost certainly get your money back. As we have both mentioned, banks are not without risk -- but there is significant infrastructure in place to mitigate that risk. For instance: if you have $1m in cash, you might want to proceed with extra diligence when entrusting it to a bank -- FDIC only insures deposits up to $250k.
As you note, there's no take-backs when your data is stolen or scummed. There's a possibility that your livelihood will be ruined, and that loss can actually exceed $1m. Your identity is not insured in the same manner as bank deposits.
Companies which peddle personal data have almost zero regulation -- the actions of employees and hackers may be traceable in some cases, so they might face punishment. But that punishment will not remediate the damages you'll face -- and if they are caught, you can try to sue them, but you likely won't receive even a fraction of the damages.
> Ok, now explain why I should trust a bank with my money, but not $any-internet-company with my personal info.
Instead of a good faith response, like, for example "money and personal information differ, here's why", you said
> Trust is an emotion, I won't rationalize it for you. You can distract yourself and others with math and rules and sturdy construction, but there's always sidechannels.
Which is mostly meaningless to me, and I'm quite confident completely meaningless to someone who isn't familiar with security.