Of course, once a lawsuit was underway, many backups were placed under legal hold and no longer pruned old versions.

You won't tell us your mother's maiden name or the street you grew up on any more, so now we're trying new questions. Have no fear, it's all for your security.

Store less data, store it better, and make loss of control of that data less important.

Although we can’t store nothing, and we can’t store anything perfectly, and we can’t make everything legal, we should try to maximise each of these objectives.

Or maybe I've been watching too much Battlestar Galactica

So yes, we have WAY too much shit on the Internet that has zero reason to be there - and we have way to many connections and content flowing between orgs without any kind of assessment as to what the content is, it's authenticity, etc.

The vast majority of ransomware incidents happen via spearfishing over email - pretty nuts that literally one erroneous click by a user can take down an entire network.

Think about that. Talk about inherent fragility!

And its hella hard to hack paper in a locked filing cabinet, in a locked building, filled with police.

In person documents:

     requires being at a single location in the world
     single copy
     in secured storage
     in a secured building
     filled with people who can shoot you legally

     Can be done from anywhere in the world
     infinite copies can be made easily
     1 hack can un-secure the data
     threatening to shoot a computer doesn't have the same impact

Other documents, will need a whole process of retrieving information, copying it, adding info, sending it, checking it, sharing it with other people. Police officers' own personnel records might be an example. If you only store these on paper, informal access procedures might be developed. For example, the civilian secretary is used to certain people requesting copies of 6 or 7 files at a time, so they don't always keep track of what was asked for. Unofficial copies get made and kept in someone's desk drawer so they don't have to spend a morning going over to the main HQ. And so on.

Now you have the worst of both worlds - lax security, but also no hope of the traceability and fine-grained access control of an electronic system.

It's also why SMS text messages do not meet the criteria for 2 factor authentication - it's trivial to social engineer phone companies into moving a phone number to a new phone - presumably one you would not have. Authentication apps are a PITA to move to new devices because having a way to move your keys around without some reliance on meatspace defeats the whole goal of "something you have".

Obligatory "if you're in the US, then yes - elsewhere, it depends". In the UK, obtaining a PAC code is a bit more complicated/non-trivial for the attacker. I'd consider it fairly safe to use SMS 2FA over here.

A threat actor intent on extracting the informant list of the DC police will have a completely different approach to the hack, probably involving advanced surveillance, infiltration, bribery, etc.

[1] https://www.thetrace.org/2016/08/atf-non-searchable-database...

Think how insane it was for the OPM to keep clearance files in one big networked database.

A society would need to be both liberty focused and tolerance focused to reduce the potential for someone to be blackmailed, but this runs counter to the notion that the fallout of blackmailable material being released is a just occurrence.

Blackmail is a side effect of punishment, legal, social, or otherwise, and the only cases where I think the majority will agree to reduce punishment to reduce blackmail is cases where people already believe the punishment isn't deserved.

Since drugs are a black market with lots of money on the line and no legal protections for the business, things get violent rather quickly. Gangs can also use the violence of the police against their rivals, in a deep twist of irony.

There is a long and nuanced discussion to be had that blackmail can actually serve a useful societal function and laws against it make things worse, but I don't want to get into that here.

(No, I'm not sure the word infiltrate can be used that way, but it should be)

Plus, there is probably personal information (payroll). Not that it matters how much anyone makes (that's probably public record already), but ACH banking details and things like that.

Some of these things we can't really reduce, need to be kept online for significant time frames, and can't be made public.

That being said, I agree that we should plan on having less perfect security (and then design for that sort of world).

C and Unix is absolute dark age crap. We know how to prove programs correct. We just don't want to pay for it. There still be social engineering, etc., but that is much harder to pull off.

I also think better programming techniques will eventually make programming more productive, as there is less to mentally worry about, and good libraries with lemmas exist. That means rather than being a expensive defense -- expensive offense escalation, it's a 1-time capital investment for defense vs permanent increased operational costs for offense.

This is a quite unpopular opinion with security people, I'll grant, but people are also not used to thinking about technology as demand-constrained not supply constrained in general, which is exactly what's going on here and in so many other ares.

A better understanding of economics and development not CS I think will be the thing that corrects this.

I think about this exactly the opposite from you, and this is why. Humans are the weakest link in most technical systems. The only secure device is one that's turned off and buried a mile deep, because if someone has to use it, they can always leak/allow someone else to use it by proxy.

Perfect defense does not exist. Especially once we get down to people. Even in your scenario, those "good libraries with lemmas" are now the point of attack. Find a weakness in that and you find a weakness in thousands of systems.

And that does happen all the time. Commonly used libraries are found to have privilege escalation vulnerabilities. They get patched, then something else, somewhere else, is discovered. And sometimes the patches themselves open up other vulnerabilities.

As for social engineering being more difficult to pull off, that's not true at all. We're all looking to streamline the process, we're tired, we're sleepy, we're bored, we just don't care, we hate our boss, we just want to watch the world burn. Those are all ways we fail even the most airtight security measures.

Tell me the provably correct patch for willingly handing over my credentials to a malicious party.

It is? In what sense? I've always understood the wisdom to be that people are one of the most leaky bits of any system.

This is imo the most feasible/pragmatic approach for privacy issue.

Instead fixing it by hiding the information, we should fix the actual issue that cause misery when the information is public.

My point is it doesn't have to. Ask what is it that makes people prefer to keep secret then fix that instead.

Not saying its going to be easy but at least we should spend the effort on fixing that, instead of spending the effort on hiding the information.

>society will still have its own opinions.

So we need to spend the effort on minimizing the misery caused by that

Likely the homosexuality has changed because society's view towards it has changed.

That would be situational. It sounds like the old rule was that just being gay was a show stopper. What you describe has little to do with sexuality and everything to do with extramarital activity which could offer leverage to straight people too.

Part of the problem is that it sounds like there were baked-in "hard-checks" about things that were automatically assumed to be shameful secrets that could be used for leverage.

Watching the number of accounts grow over the years on haveibeenpwned has only reinforced that belief in me.

There's more leaked accounts out there than actual people on the planet, tendency rising fast.

The longer something is out there, the higher the likelihood it will get shared/leaked in some way or another.

This just covers the current crop of behaviors we can imagine (e.g. your weed example). But, as long as you have a society, you'll have/need some laws, behavioral norms and a social contract. Violation of any of these would be blackmailable.

You're arguing we shouldn't put up, "don't feed the bears signs" because some people are going to do it anyway.

first off, privacy and legality and confidence and sharing are all interrelated but different. to merge is to simplify and lose context.