I would bet hard earned money that the average person installed this application because a friend told them and they were curious. This bit about what happens to their image and what data does the app save locally verses pushing out to the network, etc. is something that never even crossed their mind. If there was a window with legalese they ignored it as they have been trained to do (by Microsoft, Apple and every other commercial software product they ever purchased). Certainly they didn't go clicking around and looking for it.
Because EULAs and "terms of service" and "privacy policy" are all bullshit that nobody reads and should not have legally binding consequences or obligations. Peope have come to treat those things like a simple OK button but the law says otherwise. This company could produce deep-fakes with users heads on them and claim it's OK by their ToS and they might be right.
Am I really going to change whatever is going on in my day because maybe, someday, some evil corporations will match my likes on twitter to my real-life preferences?
I'm aware of all that can be done with the data. I program for a living and have an 'internet' business. It's just that the claims made here in HN make it sound as if everyone is retarded for giving away their 'privacy'.
We are asking the general population to give up tangible benefits for hypothetical downsides. It's just not convincing enough for people to change their habits. Get in their shoes. HNers mostly can't because we cannot imagine what it's like to see technical details as a burden. Most people don't have the knowledge to make safeguarding their privacy 'a breeze' (multiple identities/passwords/oss/avoiding gmail/etc).
Usually the medical test thing is enough to shut them up.
Anyway there are many such example arguments around the internet, just DuckDuckGo "nothing to hide". There's even a Wikipedia article about it [1].
Edit: Oh, I often give Uber's deleted posts about how they know their users had one-night stands as an example too. See [2] and [3] for one of the deleted posts.
[1] https://en.wikipedia.org/wiki/Nothing_to_hide_argument [2] https://money.cnn.com/2014/11/25/technology/uber-prostitutes... [3] https://web.archive.org/web/20140827195715/http://blog.uber....
The only argument I've had even a little success with is "it makes it easier for identity thieves to get and use your CC / bank info". That usually get a pause before "oh well my bank has fraud protection".
Anyway, I was going with "defeatist" mostly because it reminded me of an attitude I personally sometimes display when it comes to being overweight: "I already ate above my maintenance window today, I might as well just eat everything in the pantry and fridge and order some family-size pizzas". So, "I've already failed once, might as well keep failing."
Moreover, their actions do not affect only themselves, but also all of the people with whom they regularly interact, regardless of whether or not those people themselves have “chosen” to “opt in”.
There is only one solution to this problem, and it is political in nature.
Example article: https://www.nytimes.com/2018/08/31/smarter-living/pay-secrec...
Or, it's not hard to imagine this even bring a completely legit company. I'm sure it's easy enough now for the Russian government to find something wrong they did and demand to see all the data they collected.
And finally, even if it's a legit company and they somehow have enough legal protection in Russia to about sharing data with the government, they're probably not the hardest security target in the world for any rogue operator to steal their data.
Bottom line, don't put all your trust in a ToS.
I know plenty of people that think this way.
I know my uncle Doug would pay for it.
Like any app, you launch it and you accept the EULA. Then it asks you for permission to use your camera and for your contacts: it makes sense you want to take selfies and share them.
That's it, now all your data belong to them. There is no functional difference between an app that will siphon all your private data and an app that won't.
for the vast majority of users, at no point did they stop and ponder whether they were ok giving up their 'face' for a filter app.
The only way to know would be to read the terms, and even then if you are not a lawyer you won't see the traps (e.g. understanding that "User Content" actually refers to your face).
You don’t need to read the terms. You “just” need to assume nefarious intent unless demonstrated otherwise.
They expect their phone calls not to be recorded. They expect that their emails are treated with the same inviolability as their letters were. They expect their letters to be as they were before the advent of technologies that governments are now using to mass record the contents of letters without opening them, of which technologies and practices they have no knowledge.
All of these expectations, and many more, are now ritually violated in the most outrageous manner.
It isn’t the responsibility of the individual to combat every violation of his person. Not only is it an unreasonable expectation for society’s “default setting” to be the casual violation of its citizens, but it’s also literally impossible for even the richest, smartest, and most diligent among us to avoid getting screwed... in some way... when there are so, so, SO many ways to get screwed.
Because, in 2019, if your highest priority is NOT getting screwed, you might literally have to live alone in a cabin in the mountains.
Which is why you can take your atomic-individual libertarian “oh you “just” need to somehow avoid every omnipresent feature of contemporary life” and take a fucking hike.
I demand the right to walk to the grocery, buy a sandwich, walk to the park, eat the sandwich, and walk home, without having my minute-by-minute location invisibly and undetectably recorded and sent to ANY corp/gov, my purchase recorded and sent to ANY corp/gov, my face/gait/person scanned and analyzed by ANY corp/gov, etc. and so forth.
And I should have to take no special action for any of this, because this is the default setting.
It would have to be not overly restrictive limits, or you'd end up with a prop-65-like scenario.
Or hell, just make a standardized "Privacy Facts" panel.
For the vast majority of people—who are boring, non-activist, law-abiding citizens—the value they assign to privacy of things like name/face/products they're interested in is nonzero, but very low. They know their name/face, along with far more sensitive information, is already in a lot of databases that matter more than anything some random app developer can do, and they get some greater value from the marginal privacy impact of that same information ending up in one more place.
There's a good bit of research to support this. For example, there is a study showing you'd have to pay someone on average $1,000+ [1] to give up their Facebook account for year, suggesting that's the value they assign to the service. At the same time, if you ask them how much they'd be willing to pay for an ads-free, more privacy conscious version of Facebook, studies show only a small fraction would pay even $15/month [2]. In other words, people are making a conscious assessment that their privacy is less valuable than the services they can get by giving it up.
We make these kind of trade-offs and decisions every day. It's much the same reason people can be both deeply concerned about child labor in the Global South, but still make the decision to buy the cheaper version of a product rather than the one they know is ethically sourced, even if they could afford the latter. These decisions certainly have societal impacts that are worth contemplating and being concerned about, but it's wrong and infantilizing to simply dismiss people's conscious and rational (for them) choices.
[1] https://journals.plos.org/plosone/article?id=10.1371/journal... [2] https://www.vox.com/2018/4/11/17225328/facebook-ads-free-pai...
It seems to me that you’re complaining about infantilizing people’s choices while simultaneously telling us that, yes, people indeed don’t care about privacy very much.
There is no such thing as an "ad-free, privacy conscious" version of Facebook. If Facebook offered such a product, we'd have a rough idea about what privacy is worth to people in terms of money. All the Facebook "alternatives" are not Facebook.
Of course, if you look at history that can change overnight. Or actually it won't, it's more likely a "boiling frog" kinda thing where nobody's aware of anything bad happening until it's too late.
I just pictured 4chan hacking into a photo database and putting people's faces on a bunch of billboards.
Surely if this happened to more people, the public would become more privacy-conscious, no?
They post their name and picture to Instagram 12 times a day. Most people have public profiles so there is no new risk. Of course by the time every street corner has facial recognition running "for our safety", it will be too late.
Even as someone who knows the risks, this doesn't scare me as much as DNA testing. Even worse is that if any of my relatives do it, I'm just as screwed. There is also the "let's all install hackable video cameras on our front doors" problem. Clever fear mongering to prevent a random package being stolen that is already insured and will be resent automatically. Instead we paid to create our own surveillance state.
This is I think the most scary possibility. If you think faceapp is processing this in the app with your phone's hardware, learning that they save all pictures sounds like a vast conspiracy and not so believable.
However, if you understand the technology and that most things online are not processed client side, the privacy implications are suddenly obvious because of course the company will keep that data that passes through their hardware. No shareholder will let money be left on the table so all data you put online should be assumed to be kept for later profit.
People have to be better educated on how the software they use every day actually works, at least in broad strokes. This can come in a high school media/technology literacy class or something.
Until that day comes, we have two classes of people: those who understand how the tech they use works and makes a company money, and those who will be forever manipulated by the first group so long as they have a dollar or a right to vote. It's a hard problem to overcome when so many technology companies are entirely dependent on profit from people's continued ignorance and tech illiteracy.
But, I do think they would care if their photos ended up on a billboard or used in marketing material without their explicit permission.
Most understand that the company needs some kind of access to photos for the app to actually do anything, but there is a limit.
It's not that people don't care; privacy is probably undervalued in the context of making privacy vs. convenience/utility decisions. (Digital) privacy's value isn't really tangible until it's actively used against you.
People don't care that much, but also don't realise the implications that would make them care marginally more in some instances.
Google already have millions of face tags from Picasa, etc.; Facebook has had image tagging for ages; ... governments already have all that data from passports and driving licensee and ID cards ... so why not give it up again. It's a drop in the ocean situation.
Russia having my face data is likely to make much less difference to me than someone in UK having it, which might also make people not care. [But of course they can sell the data on.]
The latest case -- going beyond anything I can parody -- is this first-person NYTimes tell-all about a married couple being overheard in the midst of a sexual morning.
https://www.nytimes.com/2019/07/12/well/family/when-our-daug...
Why bother sounding alarms about Alexa, Google Voice, etc. perhaps listening to our bedroom conversations? There's a slice of the public that will go to a lot of trouble (write article, etc.) to make sure that such moments become public.
There is an established term for this innate human trait: "dancing pigs".
> In computer security, the "dancing pigs" is a term or problem that describes computer users' attitudes to computer security. It states that users will continue to pick an amusing graphic even if they receive a warning from security software that it is potentially dangerous. In other words, users choose their primary desire features without considering the security.
The smartphone is giving them funny shit. Any permissions prompts or legalese that occur in the meantime are incidental.
I think the devs of this app need a slap on the wrist for being party to this nonsense as well.
No harm, no foul until the signs are visible, and it's probably too late.
There are two possible conclusions to draw.
One is that the general public actually doesn’t care about privacy at all. It’s a niche concern.
The other is that the general public cares but is completely and utterly clueless about how to defend themselves, to the point that an app can literally say “give us your name and face and we can do whatever we want with it in perpetuity throughout the universe” and people will happily oblige.
I don’t know which one is correct but neither one is great.