Online privacy: a tale of irony and contradiction

This is the post that prompted me to start this blog a month ago.

I understand online privacy better than most. Unfortunately, privacy (and security; the two often go hand-in-hand) is often at odds with convenience. I have previously sacrificed convenience over privacy and security in many instances, because the latter two are important to me. Fair warning, this post doesn’t answer how to compromise between the above; it merely highlights my frustrations while trying to do so. Here are some of the more significant attempted compromises I’ve made, and the associated struggles:

Running free and open source software on my Android phone

I’ve had Cyanogenmod installed on my phone since shortly after I purchased it. For the past year or two, I’ve had it installed without any of the Google apps, such as the Play store, YouTube, Maps, Hangouts, Google+, and Gmail. Not having the Play store meant not being able to install any of the apps it offered. Instead, I made do with F-Droid, an app catalogue that exclusively contains free and open source apps.

This encumbered my ability to interact with other people, sites, and hardware. I couldn’t use common chat applications, some social media sites were clunky because I was limited to their mobile web page which is often a second-class citizen to their mobile app, and I couldn’t stream to my Chromecast. Eventually, about a month ago, I caved and installer the Google apps, because the disadvantage of missing out finally outweighed the advantage of knowing with reasonable certainty that my location data, contacts, and other private phone information was safe from third parties.

Facebook

I deleted my Facebook account in 2013 after it insisted on hounding me for personal information regarding my education institutions and place of employment. Initially, it was freeing. I had more time up my sleeve, and knew that even if Facebook didn’t delete the data for my old account, they weren’t getting any new data from me (though possibly from others; see Shadow profiles).

Again, though a couple of months ago, I’d gotten sick of the disadvantages. I’d occasionally get forgotten by people organizing events, because I wasn’t on Facebook to be invited. Many friends were difficult to get hold of because Facebook was one of their main communication media, and when I met somebody new in person and wanted to keep in touch, the first question I got was “What’s your Facebook”? My social life could be enriched, and so, with significant trepidation, I yet again forfeited my personal information to Facebook and started adding friends.

Gmail plus-addressing

I try to sign up to different sites with different email addresses (using Gmail’s plus addressing). This way, if i receive spam to a plus-address, I know which site disclosed that address (this, I admit, has never actually happened).

On January 21, a colleague and I were discussing various web services, and I mentioned that I used Gravatar, which serves up a picture for use as your avatar based on your email addresses, to any website that supports it. My colleague remarked that they were surprised that I, somebody reasonably privacy-conscious, used Gravatar. I considered this briefly. Gravatar works by asking you to supply all your email addresses, and upload one or more pictures, each of which can be associated with one or more email addresses. Then, when you sign up with one of those email addresses to a site that supports Gravatar, the site can send a request to Gravatar which includes your email address, and retrieve a picture that it can then use as your avatar or profile picture.

Gravatar is a free-as-in-beer service. They don’t charge members any money to use the service. Given this, they obviously need to make their money elsewhere, so it’s reasonable to assume they monetise their members, making members the product. Each request that a Gravatar-supporting-site sends to Gravatar likely contains a referrer stating which site made the request. This means that Gravatar could collect a huge database of all the email addresses associated with a member, and all the Gravatar-supporting sites they visit, then sell this information to the highest bidder. Because some of the sites I use plus-addressing on support Gravatar, Gravatar needs to know all thise addresses, making using Gravatar reckless, to say the least, because Gravatar can be used to unify my identities across all sites that support it. I signed up for Gravatar years ago, before I was quite so paranoid, so it hadn’t been subject to my now-more-stringent privacy analysis. Ironically, here I am blogging about Gravatar on a blog hosted by WordPress, who own Gravatar.

Solutions?

So how does one integrate with society while remaining reasonably private and secure? I’ve no idea, but I’m still looking, despite feeling a bit resigned to the reality that sometimes it’s all too hard.