Hacker News

>I simply stopped worrying and began to love the bomb

This may apply to the consequences of ones data being subject to so many breaches and leaks and thefts, but it should not be the attitude one adopts towards the idea of ones data being taken and used by so many parties. At some level, my data is my personhood - it is my evidence of myself, and my record of myself, and my proof of myself. It encodes who I talk to, what I'm interested in, where I go, and what I do. My health, my finances, my habits, vices, schedule, family, friends, coworkers, beliefs. People more clever than myself use this data to advertise to me; people more powerful use this data to surveil me. When will people more malevolent use this data to persecute me?

I should not have to love the bomb because the bomb will kill me.

It’s not the current use of the data that’s concerning, it’s its future use. Who’s to say that some facet of your life that is ordinary now will not one day paint you as the target of some future regime? It happened in Europe a few decades ago, and in many other countries around the world.

To be zen about one's privacy is easier for some people than others.

There are situations in many a person's life that if revealed to the public would have life-altering consequences.

Rather than the world give up, we should have better tools and laws to flood the internet with spurious personal data.

Similarly. My browser was carefully containerized, with a ton of anti fingerprinting measures, VPN, Linux, Librewolf, everything. Even on my phone, I restricted whatever possible. Then one day I went to the YouTube main page, and I saw that Google somehow got to know that I played Minecraft again after a decade. I gave up right there. I suffered to avoid this, and it was pointless. I knew at that point already that probably all my PI is public information anyway, but I wanted to restrict whatever possible, and no, everybody sells my data anyway, and it seems that avoiding fingerprinting is impossible without turning off the internet completely, and ditching smart phones.

These swings can be avoided by not doing stuff so hard but instead more effectively.

For example, matrix sucks ass. It's terrible. Everything about it is a bad experience. Of course you'd want to eventually stop using it and go back to the previous life.

But that is not the correct take-away.

The correct take away is to include UX (and honesty to yourself about it) in the calculation and to not go all in on an unsustainable compromise, just to then snap back to doing the opposite ca 3 months later.

Same as with loosing weight, really. If you replace 100% of the pleasure of eating with the "right" but unpleasant solutions, you will not be able to keep that diet going indefinitely.

This makes me think: how would someone like Mark Zuckerberg handle this for his own internet presence? Or does he sidestep this issue completely by having assistants for nearly everything? I can imagine he doesn't do much more than look at .ppts and fire off emails. Do data brokers have any information at all on this guy?

The next frontier is to maintain 'limited privacy'.

That's denying most culprits the opportunity to use the collected data against you.

Like always on VPN, turning off personalization, ad guards and using open source products where possible.

I agree.

And most people on the behavioral side do too, but not at the cognitive level. EU is the best example with EU AI Act, strict data regulation as well as privacy rights, on the other hand demanding that Apple does serve the EU with AI.

I have mainly one distinction: the state is the worst protector of your data and the most ruthless gatherer of all your details.

Opposite to the open sourcing of your data in the end by the state are private companies who live by your data but do this for 20+ years - battle tested protection and hardening against malicious hackers.

Security is their business while security for the state is a cost factor.

Being at the mercy of some ignorant politician is not the best way to talk about data security.

Berlin, Denmark - those are the known one. And there are many more to come.

And regarding cognitive dissonance: politicians demanding high standards and punishing data loss ruthlessly on the one hand, giving oneself a pass on a hack is nothing to increase trust into the system.

X got fined for a missing blue mark. Berlin? Denmark? Others?

A second aspect is that the average guy doesn’t get that part of the whole spectrum must be the degooglers, the home server guys.

So it is relatively easy to get data on them as well just by filtering out the other data.

In other words: 95% not doing degoogling makes for a great small sample of 5%. Negating and interpolating other demographic and psychographic factors and you get a great way of gaining insights.

And remember: being the one who is not using google when being around other guys who do - magic.

So my idea is simple: what’s in it for me, and the state offers way lower value than Google and co.

Pick your fate.

I think both are possible. To have a goal and to accept reality. I would not draw the conclusion that all privacy measures are meaningless. It is hard, but I think it is still worth working towards a goal of better privacy for citizens.

> wasted effort

That depends. One thing is following precautions, another the Principles. Precautions may have a limit ("due diligence done, I'll stop there"), Principles do not.

Remember also that many phenomena occur because the individuals in the masses have not said "no". Acceptance enabled them. So the acceptance of some ill conceived systems is criminal - it is what lets them exist.

Two problems with that:

1. I don't want to love it. I hate it. You can learn to live with things you hate though, and not have it impact your day to day life or mental health though.

2. Its still a bomb. Until we find out how we can de-value the data, it will have an incentive to be stolen.

One thought here that I don't personally agree with, but might be important regardless:

Imagine a society without secrets or privacy at all for example.

I don't personally like the sounds of it, but it is sort of where we're headed at the moment, and if the fundamental reality is that obtaining data is much more easy than defending it, then perhaps we need to come to terms with a world without privacy, and how to create the best version of that unconstrained world.

Again, I don't like the sounds of this, but I'm curious to read more about it. Can someone give a philosophical pitch of why GDPR style regs on personal and company data are so important?

LoL. We are all dancing naked on the table and hoping our clothes and wallet or purse and some of our pride will be where we left them.

Evidence is pretty clear after decades of this: big data breaches are inconsequential for an average person.

They happen all the time, nobody cares, criminals who want to target you will target you anyway, criminals who don't target don't care about you specifically, legitimate entities cannot use this data anyway, and legitimate scammers (marketing) will find different ways to get you to give them the data you need.

At this point I thing privacy obsession is modern copium, a way for people to deal with the fact that we're all individually a speck of dust on the face of human civilization. It's about asserting, "I am not an NPC, I have this richness of experience", and then trying to hide it all in case the world wants to check.

All of the popular surveillance apps correlate your email address and phone numbers mostly, but if you used 1@gmail.com to sign up for 2@gmail.com google knows and marks it as your altnerate account, it could give them all your 30 rando gmails, you're then linked by phone activations through those emails to everything else, whatsapp, telegram, credit card purchase, etc. the biggest link in the chain is always the phone number though. They also have a big "Alternate Emails" button. Everything fans out from those.

I don't know how deep palantir can build profiles on someone, like digging into comment histories and extrapolating you are x y or z sort of stuff. I'm sure they've learned a lot about people via public irc logs and discord servers. But the only screenshots I've seen have been way more simple than that, basically a facebook UI that gives them buttons for all the apps with the phone # that has been identified as you the user, so it would be your list of social media apps accounts and they just click in and read messages. These screenshots have popped up in court cases recently.

We need to stop using the same phone numbers and rotate them constantly. Ideally back to something like fi that masks your "real" isp account phone number. They need to stop being a 2fa and especially stop being able to identify a person. Carry a dumb 2fa. I've always been on the "dont ask for my phone number to use your service" bandwagon but absolutely now.

And now some banks are doing instant voice recognition. I don't pick up my phone for any number I don't know anymore.

>I just don't want to stop living - flying abroad, going to doctor

Good, you're not throwing out the baby with the bathwater. I don't get why you think throwing out the bathwater itself was wasted effort though.

The point is to get rid of things you can live without. If you're going to get rid of something but then spend every day thinking of its absence, then yes, that may be bridge too far. Otherwise, getting rid of it has some value.

I don't see the harm of asking, "Do I need this entity's services enough to justify forking over this data" for every entity that you interact with. Everyone draws their line in the sand at a different place. Data hygiene is a good phrase for that reason, everybody's acceptable level of hygiene (or lack thereof) is different.

I gave up when i realised Firefox had google analytics and noone even knew or cared. That was about 10 years ago now.

It is definitely worth asking for a copy of those notes, verbatim, as-is from the automatic transcription, to check for errors while the session is fresh in your mind.

If your doctor is worth seeing at all, they will be glad for the corrections.

Then this is something for you https://shop.digitalcourage.de/themen/ak-vorrat/lichtbildaus.... Either get it online, or buy at events like Chaos Computer Congress.

I use my password manager to maintain unique answers to all of the useless verification questions about pets, movies, teachers, etc. Only way to scale it.

Was Signal an option you have considered? It's designed to be secure even if the user is non-technical.

Why? I would assume encrypting and sending the key via a different channel would be sufficient. Or are lawyers still not technically apt to do so?

What punishment does the country of Denmark get here, if you had to guess?

Pretty ironic to be extolling the virtues of the EU's privacy approach on this story in particular...

It is a basic police requirements on most countries. Hotels must collect visitor id's and keep it for several weeks.

I just tell them they can look at it but not copy it and that's satisfied them, for now. Sometimes had to get a manager in, but never had them deny me fully. I'm sure sooner or later I'll run into a stubborn one and have to scramble for a day-of replacement hotel, and that just adds to my list of reasons to avoid travel.

And why are politicians immune to all of this shit??

Why can’t WE spy on them 24/7?

> As much as I don't like the cryptocurrency ecosystem, I don't think facilitating and encouraging kidnapping and torture is the way to go.

The cryptocurrency ecosystem is used to not only avoid taxation but to enable criminal activity. How many people are being held hostage and the ransom will be payed thanks to cryptocurrencies?

I do not like the cryptocurrency ecosystem either. And I totally agree that it should be abolished. It is just a way to finance crime and terrorism.

>previously they could be on paper - a secret between you, the pen, the paper, the pharmacist and the gods

Excuse me?

If you weren't paying with cash whoever paid for the prescription (govt, insurance) has a record of it. The pharmacy that filled the prescription has a record of it as well as the doctor who wrote it.

Too much is stored in computers. In the EU, you own the data about yourself. In the US, whoever owns the computer owns all the data on that computer - you own nothing and you will love it. We need to make PII radioactive and fine everyone who had that data stored on their computer when it leaked.

It looks like you punish yourself unnecessarily, for things that are out of your control.

There’s nothing lucrative in abusing privacy, and yes the government is busy but it has nothing to do with a "corporate agenda", any government or any country with more than a few millions of people is busy, agenda or not.

Yes, we had phone books. And it was useful. But they didn't generally include personal information such as birthdates, salary, etc. And it was easy to opt out. Additionally there were not a bunch of online services with financial impacts that used phone numbers are primary keys.

And, importantly, they were physical in a time when it was hard to collect and collate the data in all of them. In 1990, there were about 5,000 distinct "white pages" phone books in the US. And OCR was pretty crappy.

Also, in all the places that I lived, mobile numbers didn't end up in the phone books, only residential landlines did. I don't know if that was universal.

In the UK, you could always choose to go 'ex-directory'. More and more people did over time I think and the personal part of the phone directory got slimmer and slimmer, basically just leaving the business part.

I've been told back in the day it was quite normal get a physical, dead-tree book with similar information sent out to you every year, until people decided that was a waste of paper.

When I lived Norway, my gf at the time would look up the license plates of cars that annoyed her and could see how much debt they had on the car to make fun of them. Scandinavians are oddly very open with this type of personal info.

I learned this (public info) about Sweden a few years ago and as an American it really pissed me off.

In the US you can get the exact same info and probably more by simply paying a private corporation/middle man (background check services).

It seems like a huge trend in many sectors. We have the same setup as other countries, but shittier for consumers because there are lifeless leaches as middle men to make a quick buck.

Yes, it is possible to have a protected identity.

> Are there no murderers, crazy ex-boy/girlfriends, targeted harrassment and spam calls in Sweden?

Of course, contrary to popular belief, Sweden is not a perfect country without violence and shit people!

It seems to be somewhat respected overall though, but I'm sure it'll eventually disappear. For the people who are stalked and what not, it's relatively easy to apply and get "protected identity" if you're affected by those things, and then eventually all those 3rd party websites remove the stale data.

Personally I solved this problem for myself by moving away from the country.

There are. You can get a protected identity if you have that issue.

The current system has been in place around 1770. There's some pushback against it the last few years.

>Because the demo was done with politicians

I feel like this should be the default. Responsible disclosure to the affected company, followed immediately by disclosure to every politician in the dataset. Once we start collecting high profile cases this way instead of waiting X days for a faceless corporation to release a fix, companies will think twice about their security and the data they collect if that could make them end up on the shit list of the local government.

  The review conducted shows that the unauthorized access does not include the names and addresses of individuals who have chosen to register with name and address protection.

This probably improves economic efficiency a lot. Want to build something and remember meeting a relevant expert 3 years ago at a party? Easy to find that person and start doing business...

You do have to request them and the person you requested them for will know you did so

Not in full as it doesn't have the last 4 partly random digits, though personal numbers aren't that useful even if it was the full one.

That is not what I have heard.

AFAIK those with protected addresses has not had their address compromised. But ID and name still is.

And with the rest exposed it is now trivial to see what adresses are "interesting".

Finland uses whatever the equivalent of a SSN is as a password, US style?

What's a protected address, witness relocation programs...?

I learned a few days ago from a friend, when the other leak at the university was reported in the Danish media, that the "random" part is only 4 digits and as a bonus is sequential. So if you register in the country as foreign citizens together with your partner those are likely sequential.

Then again, in my country some municipalities handed out numbers starting with your birth year....

A good time to remember that cramming data into your identifiers will come back to bite you... It hasn't really been necessary since databases replaced library catalogs anyway.

Maybe 10 years ago, but other nations have caught up. Italy has their Sistema di Interscambio. Germany and France have taken digital sovereignty serious. Spain is big on open source (and ruby for some reason). Estonia has been miles ahead for more than 10 years. It's true that we have some ease of use systems compared to most of Europe, but we also have a lot of horror stories.

That being said it's not like us being shit at cyber security doesn't mean other countries aren't also shit. Look at Australia getting hacked by AI. I know it's all the rage to blame OpenAI, but really, shouldn't Australia count itself fortunate it wasn't an enemy nation state? Or that their lacking security got exposed before it was.

Another Dane here, and that is absolutely not true. Where's your source to back up this claim? (I'll show you mine if you show me yours)

Can't speak for the Danish govt in general, but you should look up the history of the property tax scandal and the projects that tried to fix it. I was part of the third attempt to rectify the problem at SKAT.

Just because we cannot identify any disadvantages does not mean that there are none.

Imagine a foreign state-sponsored agent waiting at the door of a public or private decision-maker, convincing them to cooperate. Home addresses are no joke. Especially if you can grep through the whole family tree.

according to this article which I linked earlier because I thought the non-Danish readers might appreciate it, it "can include" family relationships

https://cphpost.dk/2026-10-05/life-in-denmark/cpr-data-breac...

ah yes, sorry, I worked on the NemID project and I often put NemID in place of MitID when I'm tired.

"and absolutely toothless when it comes to taking on more powerful interests. "

Like Google and Apple?

"and countless examples of making it worse."

Which would those be? I would be interested to know.

"it's those criticizing the leak by governments"

If this is a general trend in the EU, what people went to jail for criticizing the leaks?

Oh no, the evil EU police will throw us all in EU jails!

What's with the state jab, this was a business leaking it

Its the MitId app that don't run on Graphene OS?

Yeah, it's probably easy to bypass too, if they are not actively maintaining it there are definitely holes in the system.

I think bad and expensive government software systems are a global norm, still the Danish system is more private than the Swedish where all it takes is a name and everyone's home address can be searched for.

You are right lol, damn!

On positive side maybe now there is no reason to use it for authentication anymore. When it was always unsuitable for that reason.

Scorned AIs taking revenge? :)