Post #4090945

2026-07-25 15:23 UTC

Flock cameras. 23andMe. Equifax. If you create a treasure trove of highly sensitive personal data, the odds of it being misused asymptotically approach 100% over time. No amount of promises or safeguards or legal constraints change this. The only thing that stops it is fully, truly deleting the data quickly, or never collecting it in the first place.

Replies (6)

@inthehands@hachyderm.io 2026-07-25 15:27

True liability would help; the Equifax hack should have been a company-ending event. But that’s a mitigation for necessary data collection. (And I’m not sure credit reporting in its current form is actually useful or necessary.) “Don’t collect it, don’t provide it” is always the best starting point.

Open ##4091193
@VoxClamans@infosec.exchange 2026-07-25 20:15

@inthehands@hachyderm.io (buy a server, leave nothing online).

Open ##4096327
@donw@mastodon.coffee 2026-07-25 16:22

@inthehands@hachyderm.io Chekov’s PII

Open ##4097866
@gnyman@infosec.exchange 2026-07-26 06:46

@inthehands@hachyderm.io yes! Let's add LLM chats (openai, meta ai, etc etc) into that list I use LLMs for some things, but I've started a habit of doing a takeout and then deleting all data regularly. Not perfect as it assumes they actually delete it, but I do think that they will do that (with maybe an exception of anything flagged for safety). Not deleting things when asked seems much less likely than loosing it in a hack or figuring out a legal way to use it even if you told them not to.

Open ##4105897
@notyourfanboy@kolektiva.social 2026-07-25 17:21

@inthehands@hachyderm.io That's the point of the exercise.

Open ##4219670
@RichardNairn@mstdn.ca 2026-07-25 20:05

@inthehands@hachyderm.io Things like 23 and me seem like a good idea or useful until you realize the potential for abuse when the data gets into the wild or is used in a new way. It must always be in your mind that money needs to be made from any service.

Open ##4219671