Your Phone Is Your Private Space

Re:Your Phone Is Your Private Space by angelzen on Sunday September 05, 2021 @02:42AM (#28422080)

There have been 24 years between Therac-25 and IEC 62304, with a clear smoking gun that everybody agreed it was a horrific smoking gun. With privacy, we're still in 'if you've got nothing to hide, you've got nothing to fear' stage, and we may be stuck here perpetually.

How do we move the needle of public opinion?

[ Parent | on HN ]

Re:Your Phone Is Your Private Space by triska on Sunday September 05, 2021 @02:51AM (#28422109)

I strongly hope we are not stuck here perpetually: There are powerful companies that require privacy even in their conditions of use. For instance, to obtain a credit card from a bank, you have to sign a document stating that you will hide the PIN of your card. For example, quoting from Section 5.5 in the contract you have to sign to get a Visa Card or Mastercard https://www.cardcomplete.com/media/medialibrary/2021/03/AGBs...:

"The Cardholder must not disclose the assigned PIN, nor any personally chosen PIN (see Item 17.8.), nor the Secure Code to anyone, not even to employees of card complete. The Cardholder is responsible for ensuring strict secrecy concerning all card security details – PIN, Secure Code and mobileTANs received on his/her telephone (to be used for authenticating a ViS/MCID transaction and valid for a maximum of 5 minutes afterreceipt) – and must take all reasonable precautions to ensure that they cannot be discovered by others. The Cardholder must refrain from writing them down on the card, keeping them in the same place as the card, telling them to anyone, or acting in any other way that would allow others to discover these details."

Hence, if you have a credit card, you must hide something. A bank, for example, would likely benefit from requiring a secure device for transactions as part of their conditions of use, otherwise it is unclear how exactly we can satisfy this contract as customers, and who is liable in case of problems. A common way to ensure such technical requirements is to refer to a technical standard that the device must conform to.

As a closely related example, here is a recent Austrian law, the Registrierkassensicherheitsverordnung (regulation for security of cash registers):

https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundes...

Note to how many technical standards the law refers to in order to ensure the security of these devices, including AES-256, SHA-256 etc. These technical standards ensure that multiple vendors can participate in bidding and all adhere to the required specifications regarding security etc.

[ Parent | on HN ]

Re:Your Phone Is Your Private Space by Sebb767 on Sunday September 05, 2021 @05:56AM (#28422894)

but it's just the algorithms of the nice corporation, they are only looking for crime and don't care about my pin

Most people really don't get how much processing is happening and how much of it is a mechanical turk by the way of minimum wage contractors.

[ Parent | on HN ]

Re:Your Phone Is Your Private Space by PeterisP on Sunday September 05, 2021 @07:47AM (#28423561)

If I look at EU legislation (not only GDPR but in general) then it seems that the needle of public opinion with respect to privacy is already there and well known to the legislators.

A problem for places like USA is that the legislators are unwilling to regulate against the interest of big companies unless the needle of public opinion is very, very, very strong to the point of it becoming the primary issue (which IMHO is not going to happen, privacy is important but there are and will be other priorities as well) - but if we're simply looking at the preferences of the population, then the public opinion is already there.

[ Parent | on HN ]