How do you argue against "I have nothing to hide" in relation to privacy and security?
Just came up with my father again.
He blames me that mother forgot her phone's and Google password because I recommended against it being a word.
I mentioned encryption, "not necessary unless you're doing something illegal".
When mentioning lack of privacy with targeted advertisements, he said that he actually really likes them, because he bought a couple of things he wanted for years.
I don't really have good arguments.
265
Comments192
2 big things for me.
First is that everyone, and I mean absolutely everyone has something they want to hide. People assume "I'm not a violent person or a criminal" except yes you are, and you've done something. A great example is everyone in the US speeds, absolutely everyone. Does that mean you want every office to know every instance of you speeding if you get pulled over? So, yes everyone has something they'd rather not say.
Second is more of an example of you should be allowed to go places without everyone knowing. The example was about 5 years ago police used location data to find a person who broke into someone's home. Problem is that the location data they used returned one person who happened to be on that street around the same time. They were riding their bike down the street. To the police they had the person there, they had proof, it was good enough. Except it wasn't, and he obviously wasn't the person they were looking for. Location data put him there though, and sold him out. So maybe not the best thing for whoever to know exactly where you are at any given time.
As for encryption, ask him for his porn history. If he gets upset, just say "why it's not illegal"
but, I agree with the other person. If you're dad is like mine and countless others, you're not fighting against him but propaganda. If that's the case, you aren't going to win this. The only winning is turning off the source.
I wouldn’t say everyone speeds as not everyone even drives. The biggest thing for me is that even if you don’t have something you’re ashamed of it could still be something you could be targeted for, like political views, disability or gender identity etc.
If I was to answer that type of argument, I would consider those:
but I tend to ignore people using the "I have nothing to hide" argument
I'm going to be real. I was part way through an explanation before I deleted it. What you are dealing with sounds like a situation where you simply won't win by using logic. To continue to labor under the presumption that a good and logical reasoning will have an effect is just going to stress you out and achieve nothing.
IT nerds help me out here, but I've been under the impression that the best defense against brute force attacks is a very long password, and the idea of sprinkling in special characters or numbers is outdated. Something like "iwenttothestoreandboughtabirthdaycake" is a more secure password than "$6jds_*WghP6".
edit: Also the mantra to never write down any passwords is more of a workplace piece of advice. I personally think, and this would probably be helpful for older people, that writing down passwords in a notebook which is kept secure in their home is pretty safe. Short of a home invasion, that notebook is safe, and having it can encourage them to diversify their passwords on different accounts. So, if you are going to keep at the issue, taking an angle of using something they are more comfortable with like a paper notebook is going to be accepted more easily than trying to sell them on a password manager or something.
It doesn't even have to be that long. 12-16 characters and it'll be infeasible to brute-force for the foreseeable future. But unless you're talking a high-value target like government, military, or executive suite at a company, no one bothers to brute-force anyway because there's easier ways to gain access.
The biggest issue with password security is reuse and sharing. The most secure password in the world doesn't mean a damn thing if you use the same email/password combination across a hundred different websites, because all it takes is for just one of them to suffer a leak and now your credentials are in a dump with millions of others that can be bought for a song and a dance.
This is why it's imperative to use 2FA for your most important accounts, because it can mean the difference between an attacker getting access and hitting an error page and trying the next poor fucker's credentials instead.
But also, no one wants to try to remember a hundred different unique passwords so it's also a good idea to use a password manager. Chrome and Firefox both have them built-in (note that Firefox stores passwords unencrypted on disk unless you set a master password!), but there's also services like OnePass or Bitwarden that have stronger guarantees.
While being aware that leaking passwords and reusing them is a major risk, I was just asking about the construction of the password as it relates to being attacked directly.
Absolutely. I recommended the notebook approach only because I think people of a certain mindset would be more open to it than a password manager, even if it isn't as elegant of a solution. At the end of the day it still diversifies passwords. I'm vividly picturing my mom throwing a fit any time a doctor or other office wants her to fill out a form on a tablet instead of paper.
Bitwarden sold keys recently. Chrome and firefox are the same product now and neither should be allowed to hold anything important.
If you can't get keepass going, I second pen and paper.
Source?
Source?
Is there something that would perhaps also work on Android? Also, how do you move the passwords from password manager into the fields? My problem with clipboard is that anything can read it. Of course, that means there has to be something to exfiltrate the data, but 1 problem is better than 2.
Most of those password managers are also available on android, and automatically clear the clipboard after 30 seconds.
But that's a bit like plugging a leak when the tanks empty. If they managed to get a tool onto your device to read the clipboard, what else is there to get? They'll almost certainly have a key logger installed as well, if not a full backdoor.
And that's assuming they'll even go through the effort of installing anything and not just using ransomware to brick your device.
The first thing about security is knowing who you're defending against, and you're not defending against targeted attacks by nation states (if you as an individual are, you've already lost). Your main adversary is spray-and-pray "script kiddies", maybe the occasional private actor.
Clearing the clipboard also makes it less likely that you'll accidentally paste your password in a text box somewhere when you meant to tap "Copy" and missed.
I was thinking of Android, and whatever some apps may be doing. They should already be pretty limited in what they can do, so it might be forced to just read the clipboard from time to time and hope you don't notice (android now shows pop-up when something reads clipboard).
Password managers on Android (and frankly all platforms) actually try to avoid using the clipboard. They prefer the auto-fill service, which is intended for applications just like this. Unfortunately this isn't working in all cases, but you can also set your password manager as a keyboard (temporarily), so it can directly input a selected username/password without anyone else seeing it.
Examples where I know this is the case are open source keepass options (Keepass2Android, KeepassDX). But I'd assume bitwarden and the like also work this way.
Keypass has apps which supposedly support autofill (I've never bothered with setting them up because I hate using a phone), but it might go through the clipboard. You can also set it to clear the clipboard so its at least not just sitting there indefinitely.
As far as I know, the thing is that randomly chosen words will be more secure because there's simply too many words. However, sentences will be more predictable. And a single word will give quick access to someone with a sufficient wordlist.
Honestly, I don't remember what exactly my recommendation was, just that I recommended against something quite simple (common word), and that she shouldn't tell me or anyone else what it is.
Edit: but I am not a professional, so don't use me for advice.
The difference for random Vs chosen sentences is when brute forcing a password (short of a few common or predictable sentences) the attack works by trying out combinations of different words randomly (if they're even that advanced in the first place instead of using characters). That means any sentences you come up with, based on 3 things in the room, are so unpredictable that it doesn't matter that they aren't truly random.
You can also change the space characters. Use - then _ then + and repeat:
Instead of
iwentshoppingformilklastsaturdayuse can usei-went_shopping+for-milk_last+saturday. The amount of variables are just too high for it to truly matter.Now all you need to deal with is the banking login being so poorly designed it only allows a max of 8 characters or BS like that, in which case you've lost before you even started.
And once I came across even better limitation. "Only English characters and numbers are permitted. Passwords are case-insensitive."
OK, the last one wasn't actually mentioned, but I just found out the case didn't matter either.
Yikes, you just know those are stored in a file called
passwords-donotsteal.txt...The fourth largest bank in America, Wells Fargo, has cases insensitive passwords
https://xkcd.com/936/
For my parents I save their passwords into my password manager whenever I set stuff up for them after learning the hard way several times.
Word based passwords are (typically) not more secure, but they're easier to remember than random text, which makes them more secure than the lesser alternative, but not more than the better alternative: just as long, but fully random text stored and generated by a password manager. You're right that substituting text with numbers or symbols is bad, those are easily cracked. But fully random text with symbols and numbers is the best.
Why? Badly remembered passwords are often reused and written down, sometimes even on the computer itself, in emails, chat software, text files. And any password created by a person inherently will fall victim to shortcuts, as humans are often just not as creative as you might hope, there's patterns. Common words might be used, too little words might be used. With a dictionary attack that checks common words, the entropy of such passwords can become drastically smaller to the point they can be cracked very quickly, and you have to be aware of that constantly when using words. Using uncommon words or more difficult words can prevent that, but that's typically not what people do, when "password123" is the best they come up with otherwise.
A notebook at home would suffice, but it's not great for the same reason as word based passwords. A password manager can create passwords that are guaranteed to be entropically complex passwords that can't be cracked basically ever. There's no guessing, no shortcuts to take, no human laziness to slip in and curse the password to easy cracking. And it does so uniquely for every login you have. That's essentially unbeatable.
I'm aware. I've explained it elsewhere, but having dealt with irrationally tech adverse older people myself, I've learned sometimes decent solutions they'll actually use are better than great ones they'll resist. I've found that any new software, like a password manager, no matter how user friendly and logical is treated with suspicion and disdain.
I gotcha, yeah then it's probably better for them. As other people in the thread explained, it should save them from most crackers that just give up if the password isn't cracked easily.
Everyone's got something to hide.
For example, I like to keep my credit card number secret from criminals.
"arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say." -Edward Snowden
Ask them to unlock their phone and give it to me. If they have nothing to hide from me, then they truly have nothing to hide from anyone since I probably dont hold power over them (nor do I care to).
If they say yes, I show them that im going through their photos, location history, browsing history, texts, emails, all the usual suspects for surveilance. If they're ok with all of that, then by God they truly have nothing to hide.
If they say no, I ask them why. Try to let them find the answer for themselves.
Most just refuse, which is a good reminder to them that everyone has some secrets to keep. Even if they're completely innocuous.
I think this is why the privacy argument has never worked on me. I have just let whoever go through my phone cause what's the worst that's gonna happen? You see my 100k+ unread emails that are pretty much all spam that doesn't get filtered, my porn tabs, and texts to my gf about Sonic the Hedgehog? I only have a password on my phone cause when I didn't it somehow pocket dialed the police and they came to me at work annoyed that I wasted their time.
Granted that was an older phone, but I ain't ever risking that one again.
That's why you ask for things like PIN numbers or bank passwords. Things people are constantly being told not to share.
I mean mine are the same things I've used for everything. My PIN is the same 4 numbers I've used for everything that asks for a 4 digit code dating back to when the PS2 would ask for one when watching movies. My bank password is the same except with an extra number copied cause they wanted a 5 digit code on the app (I think for the website it's also just the same password I've been using since I made my first ever website account on RuneScape).
If you're wanting details like routing numbers or whatever, can't really help you there. Every time I've been asked for that info I go to the bank and get it, put it in whatever asked for it, then throw the paper away. Someone could probably dig in my trashcan or the trash of the carwash I go to and steal the small amount of money I have, but I don't really care.
OK, now give your phone and wallet access to anyone on the net.
Including the government, that other government, Kim Jong Un, a pimply broke teeneager in some failed ex-soviet state who doesn't extradite to your place, Mike the Pervert (not allowed within 100m from any other living or recently deceased human by a court order), Mario NotAMobstero and Ranjin who works for $2.50/h in a scam call center.
Not really sure how to give them my phone when they're nowhere near me. If they came up and asked, I probably would tbh.
You do realise it is not about the physical phone, but what you do / have on it? That's why I said access, and on the net.
My physical device is worth what, $50 with the half dead battery and all the scratches.
My bank and savings account is worth quite a bit more, and my non-felon status, citizenship of a (for now) democratic country and my private and professional reputation are as well.
See mine isn't worth all that much. I have barely anything in my bank account and I'm pretty sure all of my account info for so many sites have been posted somewhere. My work offered one of those privacy services for free and within a week or 2 I was told they found stuff on the "dark web" or whatever. I've been told that for years and nothing ever comes of it cause what do I got worth taking?
I don't know about you, but:
I have some money. Not much, but I'd like to keep it, because food and rent is kind of required.
I don't have a criminal record, and I would hate it if someone used my identity to commit crimes. At the very least, doors and lawyers are expensive.
Figure out how to simulate and scam me and a few million other dudes like me, and you have pretty good chances of getting elected here. That stuff is happening in all major elections now, and the results are, well, I assume you read the news.
I would really hate it if you send my detailed porn habits to my boss and my grandma. At the very least my boss would think I'm an idiot and don't deserve a job working with computers and expensive machines.
Bonus argument:
I've known people who drive without a seatbelt for years, and they haven't died yet.
I got a feeling if either of my bosses saw my porn history, they wouldn't really care. It's ultra vanilla cause I'm boring like that and it doesn't affect my ability to pull around cow carcusses. And if you're gonna tell me to just show them, I'd get fired for having my phone anywhere near them. The place is ULTRA strict about having no phones anywhere near the work floor. Only allowed in the locker room and break room. I have seen people get fired on the spot for taking a quick 1 second peek at their phone when they had nothing to do at that second.
The other stuff is still just things that don't bug me. Like I said, I have basically no money and could honestly care less about getting hauled off to prison for something. I guess I just never really valued my life all that much. I value it enough to keep living (despite what my thoughts keep telling me), but not much beyond that. Helps that nobody depends on me for anything.
Now start deleting everything or maybe sending some texts
That's not making an argument for privacy, that's being a jerk.
Yes it is, luckily I was joking, but having a bad password, technically that can happen
Tell him to leave the bathroom door open anytime he’s taking a shit in public then.
Compare it to free speech. Saying you don't need privacy because you have nothing to hide is like saying you don't need free speech because you have nothing to say. Eventually, through no fault of your own, there will come a time when you have something worth saying or hiding, and you will regret having surrendered your right to do so.
Another way to put it is: I don't need privacy because my judgment and intentions are shady, but because the authorities' judgment and intentions are, or one day will be. Allowing the authorities to invade your privacy and suppress your speech diminishes your ability to hold them accountable.
"I need privacy not because my actions are questionable, but because your judgement and intentions are."
You can find just about anyone guilty of something if you have access to everything they do/say
"It's ok that we're being spied, it lets people better take my money on stuff I wanted anyway"
Richelieu had them beat by 400 years:
"If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him."
Cardinal Richelieu
You don’t lock the doors of your house because you have something to hide, you lock it because you have valuable things you want to protect.
Your dad’s fear is not the government (whether or not it actually should be), but he should have a reasonable fear of criminals taking his money. Technology has made it easier than ever to be robbed but also created better locks than ever to fight the criminals.
"If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him."
Cardinal Richelieu
"Take your pants off then jackass."
It's a stupid comment, treat it with the contempt it deserves. Do they shut the door when they take a shit? whyyyyyy???. You close your blinds there at night? Why ya lockin' the phone there buddy.
Have the IRS audit him..
Easiest way to explain privacy imo is simply just saying: "If you have nothing to hide, then why do you shut the door when you go to the bathroom?"
Thats not the argument you think it is. Plenty of people dont shut the door
I posted the following somewhere else recently:
"nothing to hide"
Secrecy and privacy are two different things.
Secrecy is hiding something you don't want anyone to know because it's "Bad/illegal".
Privacy is acknowledging that it's none of ANYONE'S business where you put gas in your car, what route you drive home, what brand of underwear you buy, what kind of music you listen to, your eating habits, etc.....
The more you are ok with data being collected, the more data they will try to collect until finally your life isn't yours anymore.
You don't close the bathroom door because you're doing something illegal, you close the bathroom door because it's none of anyone's business and you aren't interested in being watched.
Our personal data is valuable and holds power over us. Unfortunately it's only been recent decades that this concept REALLY started to sink in and unfortunately big corporations figured it out a little quicker than we did
I'm reminded of a story I heard about a woman in South America (I don't remember the country.) Her best friend attended a protest one year. She makes a post on Facebook about supporting her best friend. A few years pass, and the government started becoming more and more authoritarian. Finally, she gets a visit from the police, asking about her ties to her best friend, and is threatened with arrest unless she can prove she's not tied to the protest as well.
I'm probably getting some details wrong, but it's a thought that stuck with me. She didn't have anything to hide at the time. But things change, and you can't always predict what you'll have wish you had kept private before.
Ask if he closes the door when he's on the toilet. Everyone knows what is going on in there and it's nothing illegal, but it's still something most people rather do behind a closed door, because... privacy matters.
Privacy is important so that nefarious individuals don't steal your identity, and everything you worked hard for, in your lifetime.
If they have nothing to hide ask for all of the following; all passwords, to everything (internet, bank, shopping accounts, investments, etc.) Bank statements Tax returns Get a set of keys for their homes, cars, businesses, etc. Remind them that you will be allowed to come over at any hour of the day or night and look through every nook & cranny of their property. If someone really is an open book, let the snooping begin. And also remind them that you will share whatever information you feel like with anyone you choose to, publicly.
Privacy prevents people from being abused, stalked and taken advantage of. Privacy is a form of personal security. That's why we lock the doors at night.
Ask him to share the passwords to all his bank accounts, when he refuses to just highlight that there are plenty of non-illegal things that you want to keep hidden.
"Why do you shit with the door closed? What are you doing there, drugs?"
Great, can you give me your phone and unlock it so I can scroll through it?
You have nothing to hide right? Also if you could keep the door to the bathroom open that'd be great!
Usually gets the point across very quickly
Do they lock the door to the bathroom? Why? What illegal activities are they doing in there?
If you lock the door to the bathroom you must acknowledge that there are valid reasons for privacy even if you don't do anything illegal.
"May I see your browser history?"
or "give me your credit card number."
While targeted advertisements may be nice because it's only showing you things that they think that you'll want/need/like, the other side of surveillance based advertising is surveillance pricing.
https://www.eff.org/deeplinks/2024/08/fight-surveillance-pricing-we-need-privacy-first
If you have the right relationship for it, ask him about the porn he watches, his banking details and how much money he's got in his account, and tell him you'll go buy a billboard to put those on.
Those usually get people quite quickly, but they're also kind of "gotcha!" moments, and people will generally not respond well to them.
If you want a more structured argument, I think you'll need to reframe the issue. As I read your comment (I'm almost certainly missing huge amounts of context that could change this answer drastically) your father's argument is "privacy is bad because it is only used for bad things" and you're actually arguing back "privacy is good because I want to be left alone". But your dad thinks that you shouldn't be left alone, because being left alone means you're doing something bad.
So, don't argue why privacy is good, you need to argue why privacy isn't bad. Find some examples of things he likes that only happened because of privacy. Try to avoid things like revolutions, resistance movements or stuff like that, because it will only reaffirm his view that privacy means you're doing something bad/anti establishment.
This is where the aforementioned porn/finances comes in, since those are usually things people want to keep private, without having negatives attached (depends a bit with porn on morals). Any guilty pleasures that come into mind would also be useful for this.
Also, make the consequences of no privacy more personal. Government whatever, but what about Janet two doors down? What about his boss? What about his parents?
In the end I'd say it's all about the framing of why privacy matters in the first place. Establish a minimum need for privacy, then expand from there. Hope this helps you (or someone else)!
I want privacy for the same reason I do not want a module installed in my brain that takes every single thought that I have and delivers it to the government for review.
I am an acceptable member of society. In public, I abide by all of the social norms. What I do in private is my own business, and I would like it to stay that way.
"Do you shit with the door open?"
"Why? Are you hiding something?"
"To make sure you're not hiding anything, I need you to shit with the door open from now on."
Eventually, they'll justify their need for privacy. When they do, agree with them.
I skipped that step and went straight to cameras in the toilet pointed up.
Hey it's me ur pooper
How'd it go?
Someone who says "I actually really like ads" is a broken person. No exceptions.
Hate to break it to you. Dad has abandoned (or never had) critical thinking capabilities.
There isn’t a reasonable argument you can make against his emotional judgements that will get through and change his beliefs.
You might be able to trojan horse some ideas into his head somehow, but taking the direct path of just giving accurate information will not work
They may have nothing to hide but probably something to protect like their credit card numbers, social security numbers and much more. Or they are on the playground with their grandchildren and there's that weird guy with a camera taking pictures of the little ones. Maybe nothing to hide but really something to protect.
Gold angle, I didn't hear that before
"Maybe nothing to hide, but something to protect" is a nice one.
Cool, he has nothing to hide, but when people want to get at you, they will invent things. They will decide regular human behaviours are morally abhorrent, and they will have an infrastructure to enforce that.
It's not about things that are wrong, it's about preventing abusable tools from existing.
If someone is willing to just invent things to get at you, privacy isn't going to save you.
Absolutely, that's why we need to prevent things that would enable abuse.
There's always going to be people pushing for more power, and we need to be alert because that power will endanger people. We've seen that in America, we've seen that time and time again throughout history. Unchecked power causes abuse and dead people.
It's going to be a balancing act, naturally the role of government will require some level of power over it's people, but ideally the people also get a say in that.
The biggest roadblock to our own safety in that regard is complacency. Why else are we being turned into passive consumers? Those with money know it's easier to manage a docile consumer population than it is to manage something like France. Strong consumer rights, and the general willingness of the population to actually get mad and start wrecking shit have left them in a largely advantageous position.
So yes, I believe you should push back even on the small abuses of power and privacy, both because it's important, and because it gets you used to pushing back when actually abuses of power start occurring.
If he’s old he’s not going to understand…plain and simple. My boomer mom is completely unable to grasp privacy no matter how I explain it to her.
The reason you want security is because of scams and viruses…generally not because the government is trying to bust you for something you’re hiding.
I'm not worried about what I'm doing, I'm worried about the intentions of those looking
"Can I look at your browser history and show it to your mom?"
gimme your phone and your password i wanna look around.
A quick quip is: I dont suppose you own curtains? Humans have a harder time conceptually thinking of privacy like curtains.
I like to think I have nothing to hide but who decides what is worth hiding and what is not?
If you have nothing to hide why go into your bedroom to have sex when you can do it in front of the window where everybody can see? I mean it's not like you are doing anything illegal? Right?
Right?
In front of the window? Outside!
Ask if they're chill leaving the bathroom door open next time they use the restroom so you can watch. They have nothing to hide, right?
Edit: fixed a typo
Years ago, I heard a lecture by the guy who investigated the case referred to in the article below. Thieves and con artists are a legitimate concern. Or at least they should be.
From the Batesville Daily Guard - Batesville, Arkansas
I call it the bathroom analogy. When you're dropping a deuce, you're not doing anything illegal or immoral, indeed you're not doing anything anyone else isn't also doing, but I'd wager you probably don't want people watching you do it.
EVERYONE has stuff to hide.
It may not be illegal, but there are a lot of stuff I don't want to be public knowledge, as it would be highly embarrassing if they got out.
This is the same for everyone.
Then we need to discuss the illegal stuff, I am talking about stuff you wont even realize is illegal, or things that you did decades ago that is so minor that you never even thought about them.
In my generation, one classic part of growing up was torrenting just about anything you could find. I never considered it illegal at the time, but I sure as hell wouldn't want the popo start investigating me.
I see it like this, if you have nothing to hide, you can't be trusted.
As for your father's misplaced blame, he should be annoyed that neither of you wrote down the password, not that you used a word as a password.
being monitored (even if you are not aware of it) changes your behaviour via the 'big brother' effect.
Your behaviour is most of what makes you an individual, and is the means through which people express their autonomy and social existence.
putting these things together gives you the result that you cannot fully be 'yourself' while you are being watched. At best you are performing what you'd like 'yourself' to be for an expected audience.
Self actualisation, or the process of developing and becoming 'yourself' is therefore disrupted meaning that you can never be or know yourself while you lack real privacy.
Another (more dramatic) way to say it would be you cannot be fully human without also enjoying a default privacy
tl:dr when they say 'I have nothing to hide' you respond with 'you aren't even really you without privacy so you can't really say what 'you' have to hide. Then when they give you a confused stare you walk them through the previous logical steps. I'm not sure it's incredibly persuasive IRL especially to the kind of person who would argue against their own fundamental human rightd in this way (i've had similar chats with my own father fwiw) but it's a good starting point.
Following up with concrete examples of harm (which don't rely on a logical chain of propositions) is a good follow up.
I usually answer that with some version of “OK, do you mind if I put cameras all over the inside of your house and have my neighbor watch the feed?
I ask them if they have curtains.
This is what I do, along with 'okay, unlock your phone and hand it to me'. Less often the second because if someone complied I would really not want to actually go through all their personal stuff, feels gross
Ask them to unlock their phone and let you snoop on it for 30 mins
Yet.
Giving extensive surveillance and anti privacy powers away is a one way street.
While you might like the fuckers harming OTHERS for now, they won’t stay in charge forever and the next group could target you
It is sadly something that some people will never understand. You could question why he does the things he does (closing curtains, using envelopes for letters instead of just using a postcard, having a password at all), but that would likely just make him feel attacked.
Something you don’t need to hide today may be something you need to hide tomorrow. And there’s no going back.
Who do you trust more, the neighbor who keeps his blinds closed, or the neighbor who goes around trying to look in everyone's windows? What do you they have to hide?
Q "What do you have to hide?"
A "I have nothing to share."
"Take off your pants, then."
Unless they are totally nude, they are hiding something.
The real answer is that you may not be doing anything illegal TODAY, but with a government as capricious as MAGA, you might easily find yourself on the wrong side of the law tomorrow, for something that has always been perfectly legal in the past.
For instance, they just arrested two journalists for doing exactly what journalists do, and have done for 250 years, but suddenly, it's illegal. What did they do? One of the pieces of evidence against them is that they were "asking questions."
Asking questions is now illegal, especially for a journalist.
If they decide they want to get you, they will go through all your communications, and spin some perfectly innocent statement into something nefarious.
You can NEVER trust the government, that's why.
The problem isn't always governments or police, but other bad actors. What if criminals get in? And they can be quite creative in how they can use personal information to extract money from their victims.
Surveillance pricing is my go-to argument against that. Using the “leave-the-bathroom-door-open” or “give me your unlocked phone” is not a good counter because in their mind those are different things. So you need to use something that they aren’t aware of but will be offended by when they realize.
In Texas they are using personal data collected from ALPRs to accuse women of getting abortions. There were also concerns that personal data collected by period tracker apps would be used to accuse women of getting abortions. You could be doing something that suddenly becomes illegal and then those data could be used to harm you
ICE is using facial recognition and a database of questionable veracity to accuse legal residents of being illegal immigrants. They are collecting facial data of protestors and, apparently, using it compile of list of domestic "terrorists". You could be doing absolutely nothing illegal and the state could use your personal data to harm you.
Social media companies use data they collect about you to try to get you addicted to their products because you are easier to manipulate when you are addicted. They know a lot of their products have harmful impacts on people, but they don't care because they make more money that way.
Its not that people have nothing to hide.
Its that they haven't become aware that there are people who will harm them if they get a hold of certain information.
The easiest example now would be Trump's fascist regime mass cracking down on dissidents and establishing a mass surveillance and blackmail system with Palantir.
But we don't even need to go that far. Ever buy anything online? Got any financial or tax info stored on any electronic device that connects to the internet? I doubt you'd want some random criminal to get a hold of that info.
I don't have anything to hide does not imply that anyone needs to know. Not you, not a neighbor, not the internet, and absolutely not the government.
Ask him why he doesn't have a t-shirt with his card details on it
It's not necessarily about "the government", well it is, because governments often contain, or may come to contain, bad people, but they shouldn't be the only concern.
It's about not making it easy for bad people to interfere in your business, even if what you're doing is all legitimate and above board; and not making it easy for bad people to harm you or those close to you either.
Mobile telephone numbers aren't strictly a secret, especially those on monthly contracts. Names and numbers are linked in a provider's database somewhere. But for an untrusted third party to know that information? It's bad enough when someone who needs to know it sells it on to a telemarketing database. Imagine what would happen if any old crank got a hold of that.
Likewise we all have real names, home addresses (for the lucky majority anyway), etc. There are people who know these things. Perhaps even people we'd rather didn't, but it would be incredibly stupid to leave that information in plaintext for anyone else to find, especially if it can be linked to our online activity.
You might be the most fair and balanced Internet user in the world, but if your name and address is public, any crank who takes exception to you anyway will be at your door shouting and raving before you know it.
If we have to give it over, presumably to a trusted individual or organisation, we need a method where it can't be intercepted. So it's either a slip of paper at a clandestine meeting place or you need encryption to send it over the Internet.
There's plenty of other personal information that I haven't mentioned here where similar rules will apply.
You're not the one who gets to decide if you have nothing to hide.
"Under current legislation".
only thing i can think of is ask them really personal questions and then ask if they have something to hide if they dont want to tell you. And then escalate to ask access to their stuff so you can check for yourself if they still dont get the point. And finally point out that companies dont have to even ask, they just get that information without telling you because you agreed to whatever terms they have presented to you.
Any data that anybody collects of you today, they will keep. You might not be doing anything illegal today, but you have no way of knowing what will be declared illegal tomorrow, or by the next government, or the one after that, or if those will honor the principle of not punishing you for past breaches of new laws retroactively.
People in 1930 Germany did not know it would soon be illegal to have a relationship with a jew, or to talk negatively about Hitler. People in the 2024 USA didn't think they would soon be in danger for filming ICE raids, or tracking their movements in chat groups.
Another argument is that your data that advertisers or the government collect doesn't necessarily stay with them. Car manufacturers were shown ( article in German ) to have location tracking data of their customers' vehicles on virtually unprotected servers facing the internet. Researchers were able to deduct from this data alone who worked for e.g. secret services, who likely cheated on their wife, where their kids went to school and so on. What do you think a malicious actor could do with information clearly showing at which times in a week your house is likely to be empty?
Information about you and your family and social contacts and chats can also be used to better scam you by impersonating somebody you know. "Hey dad, it's X, got a new number. Can you transfer me some money till next week maybe?" Many people fall for that.
There are also other ways in which data can be used against you without anything strictly illegal happening. Do you really want your car insurance to have data about your driving habits?
Do you want your health insurance to know how often you order pizza? Both might get the idea to increase your payments for that in the future.
Would you want possible future employers to know you have a chronic disease that might mean you'll call in sick more often than others?
Last but not least, have you never said or done anything really embarrassing that you'd just prefer nobody to know?
a) Bullshit you haven't ever done anything illegal that you got away with
b) There is a whole galaxy of shit that isn't illegal that you don't want shared. How often do you jerk off dad? What was the last porn video you watched?
He said "illegal" but the word should be "wrong" and YOU don't get to decide what's wrong. THEY could decide you're wrong for having blue eyes or, I don't know, not liking TACO.
Sounds like a frog in boiling water to me.
May I have a copy of your birth certificate, driver's license, SSN, along with credit card info, bank and trading accounts, and a video of you naked to post online in multiple public forums?
No? Guess you like privacy more than you thought...
People having varying levels of desired privacy. I don't like to give out things just because someone wants to know, and by law I should be protected so as not to be compelled to.
Privacy isn't about hiding things, it's about not giving them away because someone else wants them.
"everyone does something illegal/has something they're ashamed of" I have that type of autism that doesn't let me do anything I know is bad; I pay my taxes and rent well before they're due, I don't drive over the speed limit, always push the shopping cart back to the corral.
The reason why privacy is important to me isn't because I'm bad, it's because being a good person makes you a target when the world is run by bad people.
Why do you not let someone look over your shoulder when you vote?
And if that is an unfair comparison, look at Cambridge analytica, and how things have gone downhill with AI and all that since then.
If you want some pathos, it is your civic duty as a citizen who wants to preserve liberty in a democratic coutry, to be at least somewhat independent and unpredictable from a state that wants you to be predictable and controllable.
Tell him that you've installed a keylogger on all of his devices and will be listening in on all of his phone calls and reading everything that he types into all of his devices going forward. See how he reacts.
Some reasons for "I have nothing to hide" that I see and that need different reasoning are:
Naivety: Some people simply have no idea how much data and what kind of sensitive data is collected. How do you convince them? Well, it seems like even a lot of "privacy-aware" people seem to act purely on suspicion and never requested a data collection report from a service or at least looked up other people's results on the internet. They claim that it doesn't matter, because you don't know how much they are actually collecting. But you will definitely convince more people, if they see on paper what data is definitely collected "officially".
Acceptance, but naivety about life changes: Some people are aware, but they accept it and may even want it, because they enjoy the benefit of personalized content. They don't think their data would ever be used for anything else and they claim to be "not interesting" enough to be looked up. Where is the problem? Well, if they accept it, that's fine, but you should remind them that life and our world can change in unexpected ways. Not everyone who is prosecuted now, knew beforehand they would be and if it comes to that and you were not at least aware of your internet identity, you are carrying a big vulnerability with you.
Full acceptance: Some people don't even care about that. They'll just let the future happen. What can you say about that? Well, you can raise the point that their decision on their privacy does also also affect the people around them. But, honestly in my opinion it's not their responsibility to handle that problem. At that point, the question is who that person is to you and whether or not you are responsible for them.
Someone compromises your password. Now they can "find hub" to know exactly where you are. If they are a criminal, they can wait and strike when you're online data says you are vulnerable.
You lose your unencrypted device. Someone launches your browser and logs into your bank...
Advertising knows your financial situation and might, for example, present a higher price because it sees that you generally are willing to pay more.
It's not that you have something to hide sure to dubious behavior, it's that all these others will exploit that knowledge to commit crimes against you or have unfair advantages in their relationship with you.
In digital world, there's no backdoor that only the good guys can access. The possibility of a bad actor accessing the same data that a court order would provide always exists. The true way of being safe against bad actors is being privacy focused as much as possible.
Change your moms password to my-husband-is-a-doofus
Obligatory
YoUR PaSSwOrD muSt cOntAIn nuMbErs aNd SpeCiaL ChARactErs
Everyone has something to hide and you do not even know how valuable your data is because criminals and malicious state actors like North Korea, China, Russia, Iran, Saudi Arabia, the US government, and others always will have the upper hand relative to private citizens.
Most pero people that say don't have anything to hide close the bathroom door when going to pee / poo / shower and they don't have anything the rest of us haven't.
Agreed, so when are we getting clear glass doors, and can we take all these curtains down?
I have nothing to hide, and I also have nothing I want to show to the corpo-government oligarchs who use mass surveillance as a tool of oppression and social control, because almost everything they are doing is evil.
"If you have nothing to hide, why do you close your blinds to keep your neighbors from looking in? Why do you lock your doors if you have nothing to hide?"
Ask him for his banking details.
In the end of the day, we have digital security for the same reason we have physical security, like a lock on your door. You can take a horse to water but you can't make them drink, so let him learn the hard way.
"it's not about hiding things, it's so people don't steal your identity and your money. You want anyone in the street to be able to access your bank account if you lose your phone?"
Once scammers get your phone number you'll learn to hate the sound of your ringtone. Once scammers get your email your inbox will be flooded with phishing. Once they get one of your passwords, you better hope you haven't used the same one somewhere else. If they get access to any embarrassing photos you can expect an uncomfortable ransom request. You never really know how they'll use your information against you but you can sure as hell bet that they will.
And those are just the illegal threats. The legal ones are worse imo.
Then give me your house key.
Depending on your relationship with your parents they might just say yes...
I meant more in a general sense
Never try to convince someone of anything mate, just let them do it the way they want at some point they will come back to you for help then you choose if you want to help or not.
Some people need to experience problems first hand.
Until the wrong person gets in power, and then you do have something to hide.
That's generally how I feel about it.
You have nothing to hide, but you do have vulnerabilities that can be exploited. In the capitalist context, right, your car tracks the way you drive to sell your data to insurance companies, so the insurance companies can raise your rates. There's nothing stopping a company from, say, targeting you with discounts to induce an infrequent consumer to build a habit then raising the price after you developed a routine and preference for the product. Or, let's say you recently purchased flights to a ski town in Colorado, a company can raise the prices on outdoor activity gear as you're likely to purchase regardless of the cost.
Google sucks, but one thing I think they did right was giving you a way to print out a list of one-time passwords that can be used to recover an account if you forget your password.
Ask them for their Facebook password
Ask to see their browser history
What if they change the law and suddenly you wish you could hide something from the government? being trans is a good example.
The US government is currently steering straight into authoritarianism. Do you really want more information about yourself out there, catalogued and ready?
If they have access to your phone and/or email, they will have access to your bank. There won't even be much friction because the things your bank uses to trust that its you, are your phone and email.
The privacy aspect is also important, but secondary to that, and more of a drawn out discussion.
Privacy and security are two different things.
but they affect eachother a lot
Something like "Yeah, I've heard that, but if you start scrolling through someone's phone or listening to calls over their shoulder they don't like it. Because nobody actually feels that way, they just have trouble understanding they're being watched if they can't physically see it"
Being really indirect is important. People say that, but people don't actually want you looking through their stuff. If it came up point blank maybe that won't even work. Nobody listens to attacks even when they make sense.
Now there's the other less deontological argument that they just shouldn't trust who's watching, as well. Maybe it's the cops and for their own good, but maybe it's Google reselling the info to perverts, or maybe it's a hacker trying to steal their identity and take out a loan.
You have nothing to hide now. What do you do when they make your favorite hobby illegal?
(Speaking from experience, because they’re about to make 3D printing illegal.)
And if you truly have nothing to hide, why keep anything private? Why even have passwords? Or a bank account. Just keep all your money in a big pile on the front lawn.
What now? Who and how? It's a fucking industry at this point and the equipment is already out in the wild.
https://www.electronicdesign.com/blogs/nonlinearities/blog/55352019/electronic-design-states-ban-guns-mags-and3d-printers-and-cnc-machines
Encryption also prevent malicious actors from inserting data, and helps prevent malicious actors from impersonating you.
Yet
Why bother arguing with them?
If they want to be stupid, that's their decision.
If I have nothing to hide, then I have nothing to prove.
"take off your clothes then"
and if they proceed to do that
"now let's go shopping"
If you have nothing to hide, you wouldn't mind if I borrow your credit card, right?
Here's how Bruce Schneier approaches it: https://www.schneier.com/essays/archives/2006/05/the_eternal_value_of.html
I do have things to hide
But they’re not illegal so fuck off about it
"take of your pants."
"Show me your butthole, then"
I feel like if you are in the US and can still make that ‘defense’’…. You aren’t paying attention.
I think there is no short and easy answer to that. To understand your arguments and follow your logical chains, one needs to be knowledgeable enough in politics and history.
They asked this question in the TNG episode The Drumhead.
"YOU aren't the one that gets to decide if you have something to hide!"
For one example, it's likely relatively easy to determine with 95% accuracy if you are pregnant or trying to get pregnant. Would you want your job to know that before you have federal protection for your job? They might let you go before having to deal with the FMLA headache, even if you are a potential father who might also take time off and be protected. Also, though current Obamacare rules disallow preexisting conditions, that could always change. Would you want something like your search history raising your premiums? "Oh I see you likely experience migraines, that puts you in a higher risk category for X. Your premium will be higher." Same for job applications "oh, [sees you might get migraines which are FMLA protected], we decided to go with another candidate"
“…yet.”
Simplify it for him.
How would he like if somebody would look trough his mail all the time?
How would he like if somebody would just come to his house and start to look around?
How would he like if all his conversations with his friends were taped?
Amd most importantly, how would he feel if all that information that previously was collected had no guarantee to only be accessible by the people he is giving the permission, but there is very real change somebody malevolent can access that information too.
How much trust do you have in your executive and justice system? Data is great for associating people and making up reasons for just cause when there was none and even when there is none.
Targeted advertising must pay tracking and advertisments. It must be more expensive by default. Worse than that, it can make it more expensive for you specifically, and timed when in need. Instead of product based and on a competitive neutral market, the one paying most who consequently must also pull the most money from you wins, and you lose the most.
Investing inconvenience into authentication security means someone can't just grab your phone and clear out your bank accounts and all accounts linked to your email address. Does every app need 2FA? Maybe not, you can consider a convenience vs security risk assessment. But if you don't have the technical and security expertise to do so you risk gross misinterpretation.
Even if you lock stuff, if your communication is not encrypted, people can learn if you're a worthwhile or vulnerable target. Even if you're careful, phishing can be designed specifically for you and your weaknesses, and with knowledge about your persona, behavior, and views.
Even if it doesn't affect you, it can enable and ease attacks on those close to you, those you are in contact with.
Any systematic weakness is not only a weakness in that aspect but an entry point into the whole system. Be it personal connections, contracts, services, your bank, your insurance, whatever.
Your on your way to work and one day you witness an ice raid and then everything goes dark.
idcaboutprivacy
Nobody making these sorts of arguments is going to go through a list of over a hundred links. What an absolutely ridiculous way to try to convince anyone of anything.
Isn't that part of the problem? There shouldn't be that many links. That's sorta the point.
In reality, if they were all catalogued, there would be hundreds of thousands, maybe millions.
Also: The most important part of this page is the essential reads section. That part doesn't change.
Whether you read em yourself or send em to your person to read—that's up to you.
But the point of that is to gather arguments and POVs that you might otherwise miss and apply to your offline life.
I, for example, really like Schneier's essay. It's very concise and powerful in translating the "why."
I sent this to an old family member who doesn't know the first thing about technology, and they understood it.
If it's not helpful to you, then it is what it is. Might be to someone else.
They (whoever gets access to private life of so many people) have plenty to hide, including how this info is used. If this needs proving, might as well just drop any attempts at meaningful conversation
Online: ask what their address is. Tell them how every website uses https (encryption), and the stuff that can happen if it's not used.
If they can access it, they can plant stuff.
it's the same as not caring about free speech because you have nothing to say
I may be ill and want to keep it from my family and work for as long as possible in order to complete and prepare some things. Privacy should exist for all under this type of scenario but it should not overpower the publics right to know when the public is affected (example...possible pedophiles or sex ring at the top levels of government).
By changing the framing. Ask about how he'll feel when (not if) a bad actor gets his info? Steals his identity? Opens a credit card. Takes out a loan. Tanks his credit. His info is all right there conveniently compiled by unknown entities and data gets breached all the time. Enter his info into a website like https://haveibeenpwned.com/ and show him just how many times his data has already been compromised without his knowledge. Point out data security isn't JUST about privacy it's about DATA SAFETY.
"Any people that would give up liberty for a little temporary safety deserves neither liberty nor safety."
Gotta also point out, if they were things he 'wanted for years,' he already knew about them, knew he wanted them, and would have bought them. The ads were of no value in that situation.
But the big thing I have to question in this is, does this person have anyone they care about? It's not all about them. Do they want those they love to be tracked and manipulated based on the data? Would they be comfortable with a system that tracked their daughter's menstrual cycle based on the data they collected? If so, would they still be okay with it if the companies used that data to push unhealthy options on her when she's being hit with PMT and feels like shit? What if the ad space was bought by a group who wanted to push her into a religion? Or an abortion? Or a political position they disagree with?
And let's say they don't have any problem with the people who they know have access to it now. Do they think the people who have it now will be unwilling to sell it? Is there someone out there they wouldn't be comfortable with having access to their data? Because basically anyone can buy info from a data broker. Would they like it if their porn history was shared with potential employers? Or their health history? Even if they don't put in anything they aren't comfortable sharing, do they think no one else might put in info they don't want shared? What about just plain misinformation? Do they want the data on them to be available to employers after someone with a grudge has had a chance to order BDSM gear in their name and create a profile for them on a fetish site or twenty? How about someone with no grudge, just who taps into his wifi because he hasn't updated his security firmware in a bit? And all that info would be delivered to anyone who asks and is willing to pay <$20. He'll never be told, 'you didn't get the job/loan/invite because of what we found on you.' It'll just be a silent wall between them and the other things they want, just because they liked that one time the company, which didn't actually care what he wants, convinced him to buy something he would have bought anyway and spent the rest of the time selling access to him and his information, benefitting him not at all.
That was kinda shit guidance. Shouldn't be relying on memory at all except for maybe a single password to a password manager. A password can be written down & stored securely.
Moreover, passwords are shit when they could be using passkeys. Passkeys are more secure, aren't memorized, & google accepts them. Decent password managers store them.
As for privacy & security: not your problem. They can leave their shit wide open to attack & deal with identity theft & fraud the hard, expensive way.
Am I missing something or are you conflating two different issues? Why isn't anyone saying anything about this?
Password security and internet privacy are totally independent issues. I obviously don't want random people to be able to log into my bank account and steal my money.
But I'm sorry, I'm one of those people who don't care about "privacy", even after reading all of your comments here. Everyone is keen on using "slippery slope" sentiments like "suddenly the government is going to go after you for 3D printing" or "suddenly the government is going to throw you in jail for chronically going little bit over the speed limit" or even that the government is going to hunt you down for using Lemmy.
It's like well...yes...those are technically within the realm of possibility. I'll give you that. But is it likely to ever happen? No, not really. Some of us are ok with that probability. It's ok if you aren't. But it's ok for those of us that are.
Most people on Lemmy read as doomsday preppers to me. I'd wager many here are preppers. You have to understand how outside the norm you guys all are and how outside the likelihood of what you're saying can be. Check out some prepper communities if you're interested in what I see in you all.
I hope this doesn't offend anyone. I also just hope that you can see why it's ok to let non-preppers continue to be non-preppers. Idk.
So you're okay with anyone seeing anything you send over the internet, in the mail, or on the phone? Why would this not be a problem, even if you are totally innocent of any current crime? Would you be fine if someone were spying through the open windows of your home? You've got nothing to hide, and they aren't hurting you, right?
If there is a reason for officials to come looking for information about a crime, they have other ways to do so. Why make it easier for them and violate the privacy of everyone else who is doing nothing wrong?
This borders on "well, they aren't after the group I'm in, and probably won't be, so whatever". If you don't think that's a danger, you have not been paying attention.
Let's turn the question around - why is securing any sort of communication between two parties such a bad thing? What happened to innocent until proven guilty of doing anything? Encryption isn't a crime, at least until it becomes an inconvenience for those in power who want to mind other people's business. It's no different than pulling the window curtains closed.
The issue was choosing a password, which not being a single word, my mom ended up forgetting. That part is security. The privacy part comes with my father arguing that setting a more complicated password is stupid because they have nothing to hide.
Plus he mentioned usage of Google Photos backup system, which in this case wouldn't really be secured. But he says the photos also aren't private, because it's just photos made in public and old photos of me as a kid (which I hoped he lost with his old phone).
How old are you? I'm just curious.
31
Thanks.
No prob lol. Hope that satisfied whatever hypothesis you had!!
I just find it interesting how values about seem to correlate (with my limited data points) strongly with age. From my son and his friends, who are around your age, to my parents and their friends who are generally 85+. That's the only reason I asked, not for some "ah, gotcha <kid, grandpa, whatever>", just interested.
Well...I am only one person, but if it adds to anything, I have literally never cared. Not when I first got internet as a pre teen and not now.
I find this is a typical privileged response from some who is usually a white male. Or maybe even just a male.