[ Personal note: this study was literally the MOST EXPENSIVE THING in my opex budget. For years. I'm so excited you all can see it now. ]
... on with the talk
I hear all the time that privacy is dead. But you know it's not. Every time you tell someone a secret, write something in a journal, have a thought inside of your own mind you're having a moment of privacy as trust or secrecy or freedom.
Started a worldwide study in 2015 with 60 questions about privacy and tech. Seeing consistent trends.
Example: In 10 years, will you have more, less, or the same amount of privacy as you do today?
Results [worldwide average]:
* 49% more
* 18% the same
* 33% less
Even if you don't think this, note that a majority of people worldwide believe in privacy.
We'll go through more key findings
#2: people say privacy is important
Question: how important is privacy? 89% across all countries say is extremely or very important.
But that's just telling us they think it's important.
Note that:
* all this data is self-reported based on answers which are provided (multiple choice) -- can't say "both more and less privacy in 10 years" for example
* no survey questions are perfect
* order and framing effects -- we asked people to spend 20 minutes filling out questions about privacy. That might be more time than they would usually spend thinking about this in a month! That can affect answers.
But we think this study reflects real lived experience. Why? One reason is that people have had a wide variety of negative experiences online. Even if some of these are rare, they can have major negative effects.
[this chart is a selection.]
Note that the range and forms of the negative experiences change by country and especially by gender, but 7/10 of respondents globally have personally had a negative experience online
#4 Regional differences matter
This is a complex and nuanced space -- don't think that everyone thinks of privacy similarly. There are some very big divides between different countries.
When we look at whether there will be more/same/less privacy in 10 years, we can see that there are very very different responses.
The developing world tends to be much more optimistic.
Country-level effects are the biggest demographic factor over all others.
In the importance of privacy question, we don't see those same types of differences.
Note that it's hard to compare countries directly:
* all the items were written originally in English and translated
* our panels, weighting, and differences between countries makes comparison difficult
For example: the folks who were recruited in Nigeria tended to be online, more young, more in cities.
In the US and Europe we were able to get a more representative sample.
There's stuff we can do to scale for this, but it's not perfect.
also note this was written from a Western perspective and reflects that, no matter how we try to take it into account
#5 should law enforcement have access to examine specific data related to a specific representation? should law enforcement have access to monitor individuals suspected of wrongdoing? ~6/10 for both
... should they be able to monitor everybody? ~1/6 for this
People think there should be limits and constraints to the uses of data by law enforcement.
#6 Is privacy possible?
There's a big gap between whether people think privacy is important and whether it's possible. It's hard to achieve and people recognize that.
People don't think privacy is dead. And when building for privacy, we need to understand and recognize and build for people and their desires.
Need to invest in three areas:
* deep foundational research that respects and attempts to understand how privacy manifests for different communities, especially non-Western, non-white, non-silicon valley
* privacy needs to feel more important and possible -- more usability
* need to shift the narrative. We need to maintain hope and more optimistic visions of privacy in order to build a more-private world.
[end of talk]
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Next up at #enigma2021, Alex Gaynor from @LazyFishBarrel (satirical security company) will be talking about "QUANTIFYING MEMORY UNSAFETY AND REACTIONS TO IT"
Look for places where there are a lot of security issues being handled one-off rather than fixing the underlying issue
We tried to fix credential phishing mostly by telling people to be smarter, rather than fixing the root cause: people being able to use phished credential.
Zoom's launched end-to-end encryption 5 months after the white paper was published
* prevents eavesdroppers between users who are speaking to each other
* protection against compromised servers
Last talk at #enigma2021 today is @iMeluny speaking about "DA DA: WHAT SHARK CONSERVATION TEACHES US ABOUT EMOTIONALITY AND EFFECTIVE COMMUNICATION STRATEGIES FOR SECURITY AND PRIVACY"
I dreamt of being a shark scientist and worked my ass off to get a scholarship to one of the top programs. My career took a loop, but to this day I find lessons from sharks for security and privacy.
Lessons:
Incidents are emotional
* Risks will never be zero
* Public is ill-informed and fear is common
* science-based policy is not the norn