Spotify have apologised….

I’d love to have been a fly on the wall for all the panic, but that would have totally violated their privacy 😀

If you’re that much of a para wreck that this concerns you then you probably need to regress a bit, technology wise.

There may just be a happy medium where I can use my phone AND keep my information confidential and not have to use carrier pigeons and invisible ink.

(sorry, haven’t read the intermediate stuff, just replying to a point)

What exactly do you think your Tesco clubcard actually does?

I don’t have one. And, though trite, that’s an important difference: I can walk into Tesco and buy a tin of beans and walk out again without permitting them to know my exact location at the point in time at which I consume the beans. And without letting them have access to photos of, say, my kids in the bath.

Whereas with most apps I can’t do that. I don’t get the choice to say “actually, all I want is a tin of beans, so you don’t need access to all my stuff.”

And even if I did have a Clubcard, as far as I’m aware it’d only capture information about what I purchased, from where, and when. Obviously Tesco would have my address and some other details so all this information could be used to build general pictures of its consumer base, as well as specific ones about my purchasing patterns, but they wouldn’t be able to know where I was, or whom I associated with, or what I took photos of.

And the contacts access is super powerful if you want to do some neat analysis. Once you’ve got that, you can start building some interesting global social networks. Throw virtually any metadata on top of that and you can start doing some really fun things. Location data is pretty high on the fun list.

Now, of course, Spotify is probably just doing benign stuff. But people get hacked. And whatever you think of stuff that appears on Wikileaks, it’s not hard to see that some entities are going to be keen to get their hands on this sort of data (whether they can or will are of course different questions). Plus it just adds to the whole idea that to consume digital stuff you need to expose a whole raft of personal information. I’m sure we’ve all installed an app at some time where we’ve thought, “I wonder why it needs to access that?—ah, what the hell”. It’s a nice little softener for the one time you install an app that does do something you’d rather it didn’t.

So, no, I’ve never really wondered what my non-existent Clubcard does, because it doesn’t know where I am, can’t see my photos, doesn’t have internet access, and knows nothing of my social network. The data isn’t of much interest to anyone other than Tesco, and even Tesco let me use their services without having one.

A phone and its apps, though, are quite a different matter.

You can tell an awful lot about people from their shopping habits:
http://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/

Yeah, indeed. Now imagine that the same entity had access to contact information and photos. Might be in with a decent shout of finding the father. Access to sufficient location data and call records and it’s probably a shoo-in. Data’s pretty handy stuff.

Yep. Connections and patterns reveal all kinds of stuff about us, it’s not just letting something access your phone number, contacts or address.

It’s the kind of thing that can easily **** over someone who, say, has a secret to keep from their extremely prejudiced family members, or lives in a country where being gay provokes a death penalty (The Ashley Madison hack has exposed someone to precisely this risk; cheating isn’t the only reason people used a site that promised security and discretion), or people who’ve had a stalker and don’t want to be online with their real name, etc. We should demand better for the sake of those people, but instead, it’s a bunch of “I don’t personally feel at risk so I don’t see the issue with handing mine and others personal data over to some bunch of dickheads running a startup”.