undefined | Better HN

0 pointsJoshTriplett11y ago0 comments

When implementing technology intended to provide user privacy, both fall under "attack on user privacy", and should be treated as such. Either the service has access to user data, in which case it can be arbitrarily compromised for reasons of varying "legitimacy", or the service does not have access to user data, in which case the legitimacy of the request is irrelevant.

0 comments

jaredklewis11y ago

Unless the courts ask you to modify your software to access the user data next time they login (iirc, this was the case with bit mail).

JoshTriplettOP11y ago

That's a strong argument against creating services where JavaScript code served by the server has access to user data.

jaredklewis11y ago

So don't, but then when the government wants some user you have, they'll ask you to modify the code so the JS does access their data and send it back to you. Comply or shutdown.

My understanding is that in the bit mail case, the government didn't just ask for data. They also asked for code to be modified. So really, any technical solution done by coding, well, the government can just ask you to un-code it.

1 more reply

j / k navigate · click thread line to collapse

0 pointsJoshTriplett11y ago0 comments

0 comments

jaredklewis11y ago

Unless the courts ask you to modify your software to access the user data next time they login (iirc, this was the case with bit mail).

JoshTriplettOP11y ago

That's a strong argument against creating services where JavaScript code served by the server has access to user data.

jaredklewis11y ago

So don't, but then when the government wants some user you have, they'll ask you to modify the code so the JS does access their data and send it back to you. Comply or shutdown.

1 more reply

j / k navigate · click thread line to collapse