Re: Security versus Privacy - moonwriting

moonwriting

Re: Security versus Privacy

Dear reader,<br>From time to time, I encounter people advocating for big tech products because of their asserted security advantages over smaller, privacy-conscious providers. ldstephens was the latest to claim this:<br>By choosing to avoid Google, many people end up using less secure alternatives. They've prioritized [privacy] while neglecting [security].

Like many people before, ldstephens fails to provide evidence for their claims.<br>What makes Gmail’s security stand out from its competitors? Why trust the world’s biggest advertising company over a trusted, open source provider like Proton? The reader is left wondering because the author doesn’t answer these questions. Instead, they make it seem that people’s only option is to use Google if they care about security. This is obviously not the case.<br>It’s already questionable to claim that Google’s security is better than anything else, but it’s straight up insulting to declare that people who prefer privacy-friendly providers are neglecting their security. In fact, the author presents zero evidence that Google alternatives would lack in security.<br>A great track-record won’t save you if Google hands your data over to authorities while disabling your account. Google could also be breached. As great as Google’s security is, the company isn’t immune to mistakes.<br>As the author admits, Google is notorious for collecting a lot of information about its users. When the data exists, the risk that something goes wrong increases. Since Google isn’t protecting this data with end-to-end encryption, people can never be certain if their personal information remains secure.<br>While privacy and security are distinct concepts, some features such as end-to-end encryption can improve both. While I agree that privacy requires a solid security foundation, it is silly to imply that big tech companies are the only ones whose security we can trust.<br>I don’t have issues with the author’s decision to prioritize security over privacy, but when one chooses Chrome and Gmail, you’re not just favoring security; you have turned your back on privacy. Using Apple’s apps to access these services doesn’t have the privacy-improving impact the author is counting on. Google can still access your data.<br>Another issue with the blog post is how it simplifies the decision-making process. The question shouldn’t be just about security versus privacy. Data portability, jurisdiction, and pricing are also relevant.<br>In the end, the biggest problem is the argument itself: that everyone needs to either follow in the author’s footsteps by embracing big tech platforms or accept the security compromise that comes from choosing more privacy-preserving providers. The following statement says everything you need to know about the author’s attitude towards privacy:<br>Don't let a vague, undefined sense of "privacy" dissuade you from the security you actually need.

You could say the same thing about security, since the post doesn’t make it clear why a regular person needs to achieve such a high level of security and ignore privacy issues.<br>The reality is more nuanced than this, and security shouldn’t be the only thing that matters. Deciding the suitable security level requires understanding your threat model; an important concept that is absent from the post.<br>Excellent alternatives to Google and other big tech companies exist, offering great privacy without compromising on security. 🌔

Subscribe to get a weekly digest of posts in your inbox