No. First, there are security measures that wreck privacy, e.g. sending all your data to some company's servers for virus scanning. Routing all your traffic through some filtering VPN provider. That kind of stuff. There are privacy measures that wreck security, e.g. not using personalized user accounts for certain things.

Security is also mostly up to definition, a secure computer system is a system that only does what it is defined to do. What this definition entails is up to the vendor, which isn't necessarily the same definition a user might want for security or privacy.

But generally, there is a large overlap between privacy and security.

> No. First, there are security measures that wreck privacy, e.g. sending all your data to some company's servers for virus scanning. Routing all your traffic through some filtering VPN provider. That kind of stuff. There are privacy measures that wreck security, e.g. not using personalized user accounts for certain things.

Aren't those examples more examples of bad security by introducing single points of failure?

Maybe, but there are more examples along those lines that don't introduce single points of failure.

E.g. very all-encompassing logging is generally good for security, and if the logs are stored in a secure fashion, there is also no security problem created. However, privacy suffers because one might log things one shouldn't log.

In the other direction, file and traffic encryption is good for privacy, and the less "permeable" you make it, i.e. the less readable for admins, system task, scanners, the better for privacy. However, for security, encrypting just for the user's eyes is a huge problem, because you cannot do malware scanning, you cannot do exfiltration prevention. Having users bring their own device into a work network is good for privacy, because those devices don't have central admin access, but bad for security, because same reason.

Yes, they do, and GrapheneOS is heavily focused on both. The purpose of the project and what it provides is being heavily misrepresented by the comment above.

GrapheneOS treats bypasses of privacy features as security vulnerabilities. It offers substantial privacy advantages of CalyxOS and doesn't come with the privacy drawbacks it introduces. See https://news.ycombinator.com/item?id=28095033 (above) for a more in-depth explanation.

I actually praised you here for pioneering important security features into AOSP :) Please don't view my comments as attacks or Calyx fanboi-ism. I'm not using either and I think you're doing great work. I just wanted to highlight the difference in approach as I saw it as a potential user when I was considering buying a pixel phone.

Disclaimer: strcat is the GrapheneOS developer.

He's not "the GrapheneOS developer", he's the lead developer and one of many developers. It's a collaborative open-source project which has made a production-grade OS and whose contributions have been upsteamed for AOSP.

I think the distinction is such that with a private (but not secure) application, the only person getting my data is a malicious actor.

With a secure (but not private) application, the only person getting my data is the owner of the code & anyone they are willing to share it with (Governments, Ad-tech, etc.)

So if your hard requirement is 'nobody can know anything about what I do with this software' you are correct. However in-practice, security requirements often exist somewhere between the above two scenarios.

Yeah. Mostly, the difference is whether you're protecting against big tech or smaller hackers.

The only other difference is that computersecurity also protects your computer as a resource say against mining trojans.

I see it as:

Private = not sending data out of my device unless I want it to.

Secure = resistant to someone trying to get into my device.

They do overlap a bit, to be private a device needs some base level of security. But a device can be very secure and still not be private as it's sending data out for analytics, tracking, etc.

Another way of looking at it:

Privacy is what about you're trying to protect, security is about how you are protecting it.

They don't go hand in hand in real life. Can imagine that happening in digital world too.