I work in the security field and let me tell you something I realized: nobody cares about security. If someone cares about security, it's because they've had many many incidents in the past. We humans are not a species that is good at preventing, we are good at reacting.

the security handbook[^1] has a chapter on that actually, and they basically say that role playing is the only way of not getting burned. Humans are excellent at role playing, and it can help you prevent a lot of catastrophe without having experienced them before.

[^1]: https://securityhandbook.io/

I think part of the problem is that many orgs see security as an overhead that engineers do to sleep well at night. A few more breaches, a few more fines and it will finally be seen as a feature to keep the CEO out of jail.

This is just it. I also work in the security industry, and the fact of the matter is that we (security professionals) can't give guarantees. I don't know what exotic exploit or bug will exist tomorrow. Security professions basically offer what (to me) seems like a crappy insurance policy. Depending on your orgs threat model, it is often just cheaper to deal with the breaches. --- I am not saying facebook falls into this category. ---

Security is not a replacement for a data breach insurance. Security is basic hygiene for insurance to work at all.

To me, a good parallel is home insurance. If you get robbed, a good insurance will cover your losses. However, if said insurance determines that you were negligent -- say you never lock your front door -- you are on your own.

Do you have precious art at home that you want insured? No problem. Just make sure you add an alarm and sprinklers.

That is how I want discussions around security to be held. Are you a start-up with 10 users? It's okay to do minimal security. Are you a bank whose wires carry $1B? Make sure you throw sufficient "bodies" at the problem, from the top of the hierarchy to bottom.

Probably 2/3 of billionaires belong in jail.

Probably most of them if not all.

"Behind every great fortune is a crime."

The problem is that companies don't care about securing their data, because the data is not theirs, it is about their users.

Mark Zuckerberg probably spends more on personal and family security and privacy than Facebook spends on their users' security.

That site is a scam. The listed email address does not exist and I have not received a book.

"This is old data that was previously reported on in 2019. We found and fixed this issue in August 2019."

https://twitter.com/Liz_Shepherd/status/1378398417450377222

What a pathetic response. Does it mean users changed where they live? Change their names? Deleted and started a new account so the ID is different?

> Deleted.

"You keep using that word. I do not think it means what you think it means."

I "deleted my account" in the run-up to the 2016 election, because I could see how social media was being manipulated, and what it is doing to society. And I mean I _deleted_ it. I took the extra steps of researching how to REALLY delete it; not just suspend it.

A couple years later, I needed to get a new account to help admin a page. You can guess where this is going. I tried my usual email -- since it should be free, and it was deleted, right? And... what do you know? Everything was still there. All my posts. All my connections. Everything.

Facebook never deletes anything.

I think this is because is very expensive to delete and also to develop true delete process. I think that is not acceptable and cost shouldn't be an excuse for keeping content forever. Even if you manage to get deleted from the live servers, chances are your content is still going to live in backups and will never be deleted. Some backup systems are write-once and could only be deleted by physically destroying the medium. I wish this was properly addressed in legislation.

That kinda sad, because that is what’s going to happen and then we’ll nothing more.

At this point I’m not really sure what it will take for companies, like Facebook, to understand that you need to not fuck around with peoples private data.

Put a monetary cost of holding user data, and a steep monetary cost on losing user data.

Ex, pay x amount per month in perpetuity for each piece of information about a user your keep. And have to pay the "net present value" of those payments if you lose the data.

Having to pay for hoarding user personal data changes the incentives from gobble up as much as possible, to instead only pay for a users data that is worth the cost to your business.

And as an extra incentive to not hold unneeded user data, know the costs you'd pay if it was breached.

Who would get this money? I agree that it needs to be some solution involving a cost, given that most of these companies have shown multiple times that profit isn’t just their main concern, it’s the only concern.

Think of it like a class action lawsuit on behalf of investors. Instead of entrusting their savings to a company, people are entrusting them with their personal information. If there is gross negligence on part of the company leading to that data being leaked then all of the people whose data was stolen should be able to claim monetary damages. If a legal precedent is established so that these claims can be pursued whenever this happens it should provide enough motivation for these companies to take preventative measures.

The government typically... who might in turn do something like a tax rebate (write a check to everyone, ontario has been doing with the carbon tax) or just stick it into the general pool of taxes (reducing everyone's taxes).

So the American government gets a cheque for every other nations citizens that use FB, or FB has to determine where each of their users reside?

Respectfully, I'm not sure either of these lead to outcomes we want

Sounds interesting. Shall we call it "GDPR"?

Honestly the EU need to finans a organisation to deal with GDPR violation, hell it could finans it self. The GDPR is the single best piece of legislation ever written, in term of privacy, but enforcement is lacking.

They already do. The Data Protection Commissioners in each state are growing rapidly to try and tackle the volume of work.