People wonder why I don't want to use smartphone apps for, well, almost anything.

This. This is why.

At least browsing someone's web app using a real browser on a real PC, I know I'm in control of what data they do or (usually) don't have enough access to read.

I was looking into some of the new banks in the UK recently, and it is apparently becoming common to not only provide but require the use of their mobile app to identify yourself and set up an account with them. Oh, and by the way, their terms imply that they might also use that app to track a few little details, like your location at all times. Perhaps they just need "to make sure it's really you"? I will enjoy the Schadenfreude if the data protection regulator gets involved... but not as a customer of any bank that tries that!

My girlfriend's father, who works at an insurance company, heard I was looking for work while I was over at dinner, and starting talking about one of the hot new technology things they're investing in, which was real-time location monitoring in-app. I tried to be polite—as I am with most people who hear that I do computers or whatever— but he did seem taken aback by my lack of enthusiasm for my insurance company being able to know where I am at all times.

Banks in Brazil came up with something called a "security module". It's a kernel driver that intercepts all network connections. It makes everything slow and probably leaks highly sensitive private information back to the bank and god knows who else. I had to boot windows in safe mode in order to get rid of this thing.

Apparently, malware is perfectly legitimate if it serves the business interests of the rich and powerful.

Back in the day if you played a audio CD from Sony, you got a rootkit for your added enjoyment. To this day I have never bought a Sony product due to that debacle and never will until someone goes to jail for hacking millions of computers. Which pretty much means I will never buy a Sony product again.

Don't forget the part where the subsequent software supposedly provided to fix the problems actually made things worse.

https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...

I suspect if they'd tried something like that today, it would have been a much bigger deal in the media and the resulting legal actions would have cost them a lot more. At least the fiasco probably increased awareness of the danger and prompted changes in various computer misuse laws around the world.

My personal view is that the operating systems we trust to be the foundation of our modern devices simply shouldn't allow that kind of access to most applications. Installing software that genuinely does need some level of privileged access to do its job -- perhaps device drivers, or diagnostic tools for people who work in hardware development and really do need to test low level I/O -- should require a different process from the user's perspective.

That process for privileged installation should come with prominent warnings telling the user not to do it unless they're sure you know who's asked them to and why, and perhaps require the user to enter some sort of text confirmation in response to avoid accidental/auto-pilot click-throughs. The need for this kind of installation should be rare enough for normal users, particularly if the OS is designed to run most third party drivers in user space anyway, that this wouldn't be a big deal for usability.

Maybe then even banks might think twice about trying to pull that kind of stunt, if they would have to field many calls from concerned customers over the next 48 hours asking whether someone was trying to hack their bank account. Perhaps they'd even make it into the news as a result, and have to explain why their software was triggering security warnings, which could be nicely embarrassing PR too.

Oh god, and I thought anti cheat kernel crap was bad .

Yeah. At least those only accidentally introduce vulnerabilities into your computer, right? God I hate these anti-cheat software companies... They think they can just own people's computers for the sake of some game. The sheer audacity of it is what pisses me off...

I agree with your argument on principle but cheating in multiplayer games is a real problem and for now kernel level anti-cheat is pretty much necessary until better methods are developed like server-side ML detection. For what it's worth anti-cheat software is routinely disassembled by cheat developers so at the very least it doesn't do anything obviously malicious and likely doesn't have glaring security issues (any of which would get immediately exploited by said cheat developers).

If your game company “pretty much requires” you to install “anti cheat kernel modules” on my machine, unless you’re supplying that machine to me as part of my game purchase price exclusively to play your game with, you can just go broke thanks. Flawed business models do not give you the right to break into and exploit my hardware.

So what if it's a problem? Are these game companies entitled to stop cheating by any means necessary? No. It's my computer and game companies have no right to tell me what I can or can't do with it.

If I want to cheat at their game, that's my right. The game is running on my computer and I should be able to modify anything I want whenever I want. Cheating at games is just an exercise in computer freedom. It shouldn't be prohibited to begin with as a matter of principle.

I actually have little interest in cheating though. What happens often enough is these anti-cheat services will scan my processes, detect my development tools or virtual machines and label me a cheater because of them. Some games literally refuse to even start because of this. They also ensure a lack of Linux compatibility due to their proprietary Windows drivers.

> so at the very least it doesn't do anything obviously malicious and likely doesn't have glaring security issues

Remember capcom.sys?

https://mobile.twitter.com/TheWack0lian/status/7793978407622...

If it's an online game you cheating ruins the experience for other people who have their own rights and interests in a purchase they made. I still don't think it justifies a rootkit but it should be made clear that the impact of cheaters is often to the detriment of thousands of other people.

What's broken is the online gaming model. It's wrong to play with random untrusted people and expect to not find cheaters among them. Just like it's wrong to place a computer on the open internet and expect it to not be scanned, probed and possibly exploited by malicious actors.

The horrible truth these companies don't want to face is people should be playing only with trusted friends. This would destroy their "massive online game" model so of course they don't want to do it. They'd rather own your computer instead.

I don't want to play with just my friends, I as someone who's been playing online games for about 20 years, don't think the playing with many other people part is broken and that is very enjoyable. What's broken is often the choice of server architecture and decision to not have the right amount of moderators to handle reports.

Many games use either partly or entirely P2P decision resolution which is easier to game then purely server side. Then also the gaming industry has been downsizing and automating moderation for years now which means typically the companies with the largest online presence (looking at you ActiBlizzard) don't have enough actual moderators to handle reports and they resort to leaning more heavily on these grey area technologies to catch cheaters. It's fundamentally an issue with expense cutting imo.

There are other ways to attack cheating. Besides, trusting a remote system you don't control is a case study in Security Failures 101. It's about as likely to work in the long term as typical DRM schemes: it does create a barrier, and it will deter casual violation by most people for as long as that barrier holds, but if there's enough incentive then sooner or later someone who knows what they're doing will break the barrier, and then they might share that ability with everyone else anyway.

This is reminding me of the time I changed an abbreviated word in my job title to its spelled out form and I got dozens of connections congratulating me on the new job.

I use to change my birthdate on a few social networs every few months and I would get always the same people sending best wishes and such.

Would you have preferred that they wrote down everyone's birthday, or not have wished you their birthday? I don't see how this applies to the LinkedIn situation.

I always assume birthdays on social networks are lies like mine is and never wish happy birthday or I ask in person.

I'm pretty sure I've sent those kind of misguided congratulations, probably twice that I can remember. One was a guy who I knew had moved to India, so I congratulated him on moving back to the U.S. - I think he had really just changed the status of his online consultancy. The other was just updating the name of the company because it had just been bought out. I never got a response from either of them.

I could practically set my clock by this...when I would get an announcement email from someone asking me to join LinkedIn and connect with them, I would know they (1) just got a new phone and (2) fell for the grey pattern during sign up/new login to share all of their contacts.

This is one of the most compelling arguments against the laissez-faire attitude to sharing personal data that has permeated the tech industry as we've become an increasingly connected society. It's all very well saying the person who owns the device consented to RandomNotMalwareAtAllApp accessing their address book, or listening in on their mic, or accessing their camera or photos, but what about everyone else who is now being observed or data mined as a result of that action?

Obviously there has to be some reasonable middle ground, because otherwise no-one can ever provide an online service that offers a genuinely useful facility, say hosting email, even if it's done in a way that is respectful of privacy. But hoovering up someone's entire address book or photo collection or whatever, and then dumping the details into some database of shadow profiles or using it for other purposes that affect the data subjects? At some point, I think you are clearly across the line of what should be considered acceptable behaviour.

What reasonable middle ground does there need to be? If I share my contact book with an app I want:

1. That data to go exactly nowhere. 2. The company to not profit from the data except by profiting off me directly using their service. 3. That company to not allow anyone else (including me!) to do shady things with that data.

It’s not really complicated. It does make some business plans impossible, which causes some people to make absurd rationalizations.

That is exactly the sort of middle ground I had in mind. You aren't entirely prohibiting sharing data that might involve other people, but it is only shared for a specific purpose requested by the person providing the data and never used for anything else.

My actual last name is impossible to spell if you just hear it. Even if you enter what you heard into Google, you won’t find it.

Took a class. After a couple months I gave a presentation which included my full name spelled out on a PowerPoint. That same day I got a few friend suggestions on a certain social network which included girls in my class who I otherwise had no connection with (no previous suggestions, no mutual friends). This was either an incredible coincidence or they had looked me up.

I haven’t looked at a profile on any site without considering this day since.

Sadly not linking your address book is probably not enough. I use 1 email address for almost all online shops and site registrations, and sadly I also used it for Facebook. The result? Shops upload their customer data to Facebook (I think it's an FB "feature" so they (the shops) can target ads at their customers), and guess which identifier they use? Yeah, I'm quite sure the customers' email address.

Hah, even if I used different emails, my name is very very unique. And writing this I wonder how GDPR compliant the whole thing is, or if they just trade md5s of emails with each other..