Facebook addiction linked to staking your self-worth on social acceptance - <AUTHOR> https://www.psypost.org/2018/08/facebook-addiction-linked-to-staking-your-self-worth-on-social-acceptance-51987 <comment><USER2> Social media wasn't always like this. I think back to the ways I used Twitter, Facebook and Instagram in the early days and they were completely different than they way they are used today. They were personal, real time, and no one cared about "likes".

I think a lot of the problems with social media today could be solved just by removing "the numbers." If suddenly all the like, follower, following, and comment counts disappeared I suspect people would use these things fundamentally differently. I see people browsing through IG tapping to like for 20 minutes at a time and think to myself, "why are you even doing that?" It's a compulsion that does nothing.

<comment><USER3> Also sharing.

Taking the time to save a link/picture, go to another site, and typing in a description and comments on material? Great. Seeing a cat picture and instantaneously clicking "share"?

Screw that. That kind of behavior is in the website's interest, not mine. It creates an endless stream of slightly-interesting material from people I know, just enough to keep me watching but not enough to feel like anything got done.

Spending time doing something compulsively that later you realize was a waste of time, then doing it again? That's addiction. I don't know what kind of addiction it is. It's certainly less addictive than opiods. But it's no doubt addictive -- and it is currently affecting billions of people worldwide.

It's an amazing amount of societal damage that nobody will ever be able to quantify. We'll never know the books that weren't read, the inventions that weren't made, or the people that weren't helped because somebody was watching social media.

(And before somebody talks about how great it is to have the planet connected, it is! Being able to communicate and research is nowhere near the same thing as having your head stuck in your phone eight hours a day)

<comment><USER4> Most people in the US spend an amazing amount of time watching TV. The average for adults is about 5 hours a day[1]. Not sure if I really believe these numbers, as many people have the TV on when doing something else (I hope), but most people don't choose to do something "productive" with their free time.

Is social media better that TV? I would say social media has more value and is more likely to cause damage, but avoiding both is probably a good idea. I try not to eat much ice cream either.

[1][https://en.wikipedia.org/wiki/Television_consumption](https://en.wikipedia.org/wiki/Television_consumption)

<comment><USER5> I don't think it makes sense to draw a line. The same psychological manipulations we see going on with social media were tried and tested first with television decades ago.

Every minor thing is "breaking news!" and needless drama stirred up to keep you watching, in between the half a dozen tickers and counters on the screen with pointless metrics to look important and soak up your attention.

</comment></comment></comment></comment><comment><USER6> The way this is titled makes the relation seem directional, and in the wrong direction...

Basing self worth on social acceptance definitely predates Facebook, and Facebook addiction is a pretty obvious consequence of the positive feedback loop that you'd get form using Facebook to feed that part of yourself.

Not defending Facebook or any other social network here, I personally think Facebook is likely toxic -- but I think it's pretty hard for a social network to exist without having this flaw.

<comment><USER7> in any scientific article, if you reverse the causation in the title and it makes more sense, the author probably made an error.

As a wise professor sitting in the audience said to the lecturer: "Normally we put the dependent variable on the Y axis".

</comment></comment><comment><USER8> Social media is the new smoking. Cancer destroys you physically but these sites destroy your mental health. Not just Facebook but Instagram too for example, it's even worse. And don't forget Twitter.

<comment><USER9> That's just absurd. Maybe people with underlying psychological issues are somehow damaged by Facebook, but in my experience the majority of users (at the very least the people I know who use it) just see it as a convenient way to keep up with what friends are up to and share interesting jokes/memes, it's certainly not destroying their mental health.

If someone suffers when they see other people doing well, because their self- worth is based on comparing themselves to others, that's a character flaw. It's going to keep making their lives miserable until they learn to address it, without or without Facebook around. People blaming Facebook seems like a classic case of addressing the symptoms not the disease; some people are so unwilling to make any effort to grow and better themselves that they'll do whatever they can to find an external source of blame for the effects of their unhealthy thinking patterns. It's so much easier to think "Facebook is evil" than to think "It's not healthy for me to judge myself in comparisons to others, I should work to learn to be happy at their success".

<comment><USER10> > but in my experience the majority of users (at the very least the people I > know who use it) just see it as a convenient way to keep up with what > friends are up to and share interesting jokes/memes, it's certainly not > destroying their mental health.

It's a distraction. And a lot of people are addicted by it, so much they feel they need to "share" what they are doing or what they are thinking at least once a day. This focus on the Self and the ubiquity of social networks makes for a phenomenon that did not exist before.

As for whether it is positive or negative, well it's a net loss of time (and mental attention since social networks tend to disrupt you the whole time with notifications) that could be spent somewhere else, and it's difficult to argue with that. Are there emotional benefits? Sure. Are such benefits more rewarding than the ones you would get from real-life networking and real-life activities? That should be the proper benchmark to use to make a judgment.

For people who have lived before social networks existed, such evaluation could take the form of a simple question "has Facebook made your life any better?".

<comment><USER11> Like any other thing in live, facebook can made your life better for some people, can make your life worse for some other. It what you make of it.

<comment><USER10> I was not suggesting a positive or negative answer. Merely a question to consider at the individual level.

</comment></comment></comment></comment></comment><comment><USER12> What about TV addiction, video game addiction, addiction to foods laden with high fructose corn syrup, or an other number of "addictions"? Point here is anything can have a good effect or negative effect. Everyone on HN has an addiction to talking negatively about things people have built or are building. Very rarely is anyone speaking about the good that results from what people are working on. People have and will always gravitate towards staking self worth on social-acceptance regardless of the communication channel. Whether it is their family, friends, classmates, colleagues and interaction happens over IM, email, in school cafeterias, locker rooms, people are looking for social acceptance and depending on how that goes there is a good or bad experience with it. Nothing new here nor does Facebook have anything to do with it. Facebook exposes you to more people and it doesn't inherently do anything to you either negatively or positively. For every negative article there are hundreds of examples of good that comes from it. (My 2 cents)

<comment><USER11> Probably due to HN demographics like myself, mostly introvert people who understandably despise social media.

</comment></comment><comment><USER13> Pop science, but this probably helps explain why Facebook/Snapchat/etc are so popular with the teen demographic. I'm kinda glad we didn't have any of that when I was that age. Remembering back to how insecure I felt personally, I can't really begin to imagine the pressure of being on a 'social' platform at that age.

<comment><USER14> Anecdotal note (I'm in my early twenties)

What personally amazes me is how many people treat their social profiles with the same rigor and attention as a large PR conglomerate. Everything photo took dozens of takes, every post rewritten to maximize the number of keywords. Personal Branding has taken the 'social' out of social media a la Black Mirror (nosedive).

<comment><USER15> I came here to point out nosedive. I searched just in case and voila!

Black Mirror is amazing ofc. But specifically this episode, Nosedive, should be studied and analysed in public schools.

</comment></comment></comment><comment><USER16> Since modern philosophy has been teaching that reality is a social construct, why wouldn't it follow that each individual self is too? Further, we have been taught that values are socially determined (market prices, fashion, popular arts, ...) and that for the individual the highest moral compass resides in the well-being of others (e.g. utilitarianism, charity drives, altruism, welfare programs, ...).

Given this, wouldn't it be abnormal to eschew social networks and the daily, hourly, validation they provide? of course people used to seek social acceptance in person, but physical social intercourse has been shrinking, so the online world is now where we can most easily obtain it. And soon, virtual worlds will provide in even greater abundance.

<comment><USER17> Social highly-if-not-totally weights appearance over almost all other forms of human interactions.

In my experience, photos get about 10x the likes of text-based posts. We can argue the exact amount, but we all must notice that pictures get far most attention then everything else, correct?

Given this, isn't that quite obviously the wrong type of validation people should be seeking?

The superficiality of how one looks should certainly not be weighted 10x over all other aspects of one's personality, and brings to mind the worst aspects of high-school-based in/out-group mechanics.

At it's best, it's simply welfare for the rich. People who look good already get the lion's share of "likes" and attention in the real world.

It hardly seems like a good thing it should be so online as well.

</comment></comment><comment><USER18> How horrible. If I had a dime for every time somebody on the internet took a civil disagreement of opinion to an emotional level I would be a trillionaire. If this is how I qualified my self-worth I would be in a very bad place. This is also the reason I deleted my Reddit account.

God forbid you offer technical advise or attempt to explain a complex subject and the answer somehow becomes extremely political. The biggest example I remember is the folks at r/programming really REALLY want WASM to replace JavaScript. I, being a long time JavaScript programmer, explained how WASM isn't replacing JavaScript for technical reasons and the stated goals around that technology. Immediate emotional failure on an epic scale. I could have said something about harming children and would have been less reviled. This isn't even a political subject. I imagine an actual political subreddit being quite comical.

People get emotional online for all kinds of reasons. PRO TIP: there are many people online that cannot follow a conversation, possibly their own conversation, or who have trouble with basic reading comprehension. ANOTHER PRO TIP: echo chambers and conformity are very real qualities that easily feel threatened for nonthreatening reasons.

<comment> s-shellfish > I could have said something about harming children and would have been less > reviled.

Yes, but that's literally because people see their technologies as being more human than most humans. It's something that goes down to an individuals core and is intrinsically defining of how they understand and express.

Not saying it makes sense to average Joe. Just a different breed of person.

For example, the soundness property of a language. Think about why that might be what creates the echo chamber, rather than thinking about how the echo chamber reacts when whatever contributes to verifying soundness is modified. The reaction might be a side effect, rather than an outright planned action.

<comment><USER18> When I encounter echo chambers here is what I see: [https://en.wikipedia.org/wiki/Conformity](https://en.wikipedia.org/wiki/Conformity)

It is the opposite of wanting to learn, explore, or be challenged. It is all about harmony and using people as numbers to wrap yourself in a warm comfort blanket of emotional protection and qualification. It is the very idea that an opinion is truth when it can be made popular or false if it can be demonized by a congregation, particularly when every conversation is a contest with emotional validation as the prize.

When emotional harmony becomes more important than the subject matter of discussion I am done.

<comment> s-shellfish I agree, but this is the root of my dilemma from which my own understanding has grown.

If I agree with you right here and now, have we not technically formed our own 'echo chamber'?

Echo chambers from the outside look like inside out fishbowls because they are. But every set of agreeable statements, whether shared between individuals or distributed through time, same system - pieces are just labeled differently.

However, I do understand the emotional feeling that occurs when conforming is heavily pressured, from nearly every side. That's disharmonous emotionally to the people it is disharmonous to. The ones who get silenced.

I understand both sides. Can't say I know more than that. Can't say I have an opinion on the matter because it goes beyond the facts.

Another way to look at the problem: are math and logic an echo chamber?

<comment><USER18> > If I agree with you right here and now, have we not technically formed our > own 'echo chamber'?

Good point, but no.

Agreement is not necessarily an indication of conformance. You have to also consider to what degree that agreement, or disagreement, must be exercised. I agree and disagree with many political opinions, but I don't join groups who share my political opinions. My personal opinions often remain personal. Even if I did join a group of politically like-minded persons I would not go on regular protests to merely advertise my opinion. I certainly wouldn't take it to a higher level by going to a counter-protest or berating those I disagree with.

Typically the more important and advertised a social agreement becomes the less it is about the subject matter agreed upon and the more it is about exercising forced social norms of a group. In math and logic agreement is attained by a proof and not by some social pressure to force a predetermined outcome.

<comment> s-shellfish > In math and logic agreement is attained by a proof.

Of course I agree with this. Just makes me think of bad ways of understanding math and logic. Having to carry it around inside myself as though I am it, because nothing else besides myself, others like myself, and actual computers can test the understanding. Proofs can be written with the utmost rigor. There's still room for error. No proof is perfect.

I'm not sure if that's more so, an artistic interpretation of mathematics and logic, or, just the other side to it. Even if my memory was eidetic and I knew all there was to know about all existing mathematics and logic, I'm still not sure I'd be certain I know what I know. What's the difference between seeing a connection between two pieces of data, and identifying an inferential rule? Direction, intentional direction. Backwards chaining.

[https://en.m.wikipedia.org/wiki/Backward_chaining](https://en.m.wikipedia.org/wiki/Backward_chaining)

> and not by some social pressure to force a predetermined outcome

This is what I always find, I dunno, bizarre. It really seems like, overriding thinking in favor of something, some way of forcing an outcome.

<comment><USER18> > Having to carry it around inside myself as though I am it, because nothing > else besides myself, others like myself, and actual computers can test the > understanding.

I think that is an overly simplistic view. Perhaps the way to think about this is not an isolated fragment in the form of an abstraction but rather a product you can hold your in hands. You can test your understanding of that product in various ways and use it perform various tasks beyond which it was designed to achieve. These processes require problem solving and creativity which are forms of originality. Originality is a very lonely place, but its great when it solves a problem and reveals a reward. What is the greater virtue: solving for loneliness or solving for the problem?

This is better explained in the introduction to Nicomachean Ethics. [http://www.perseus.tufts.edu/hopper/text?doc=Perseus%3Atext%...](http://www.perseus.tufts.edu/hopper/text?doc=Perseus%3Atext%3A1999.01.0054%3Abekker+page%3D1094a)

Essentially a tool is of use for its own sake, an intermediate use, or existing solely for the use of something else. That which is of use for its own sake has the highest utility value while that which is only existent to benefit something else has the lowest utility value.

It seems, though, your thoughts are more concerning potential unity around theoretical concepts. For that I recommend reading upon Intellectual Virtue as an achievable ethic: [https://en.wikipedia.org/wiki/Nicomachean_Ethics#Book_VI:_In...](https://en.wikipedia.org/wiki/Nicomachean_Ethics#Book_VI:_Intellectual_virtue)

<comment> s-shellfish Stoicism is the closest I can get away from appealing to emotional harmony blindly (choose the happy way now but potentially make a grave error by doing so).

Thinking about things that aren't presented with a face... one face or many.

Unity with concepts. Read Nichomachean ethics in college, but funnily enough now that I look at it, the professors may have found much more literal value in it than did the students.

Humor, the Greeks, educational systems. Life, sigh.

The directions things go in.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Wow, this topic is so relevant to me.

I felt that I've became obsessed with "likes" recently on Reddit. Well, they call it karma. But, same thing.

Karma points are kinda hard to get. Mainly because there are 3 things that has to happen -

1\. Write your comment early enough 2\. Write something witty enough 3\. The thread needs to become somewhat popular

Sports threads, mainly Game threads, are a gold mine for karma. I found, recently that I wrote things there partly because I loved the team and atmosphere (Braves fan), but also because I love refreshing and seeing all 'dem karma points.

I've became so obsessed that I realized I had a problem. Each time I go onto Reddit (the new version), my eyes immediately darts to the top right of the screen to see if I went up or down. It became distracting that I looked for ways to turn it off.

Reddit's user settings, from what I saw, doesn't have anything that will hide those points. Luckily, I could revert back to the old Reddit layout.

Funny thing is, I'm barely on the Game threads now that I cannot see those points.

<comment><USER20> Substitute "Reddit" for "Hacker News". Same difference.

<comment><USER19> LOL, I just noticed I did the same thing just now. Ugh, the points.

I'm working on a site as well that has up votes. Mostly to eliminate spam.

I'm going to have the points hidden by default.

</comment></comment></comment><comment><USER21> Social media knows how to play the game. It knows how to keep the herds hungry, happy, and most importantly loyal to the system. It strikes where it matters most --into the heart and mind of users. Poking the ego of 'self- worth', counting likes of social acceptance, sharing ego driven personal stories or unmattered opinions to get more and more attention and standout above the rest of the flock. Everything is a contagious fabricated reality that could be a slow poison to a naive.

The bigger picture is it doesn't matter that much because that's the purpose of the business and it is sure succeeding. But we all have our own choice, we can use it either to advantage or disadvantage. Still, somehow it is fortunate for us present generation that we are now living in a complex system that makes things simple, it will keep on progressing and we must keep up so we can enjoy the minimum substantial benefits. I think we just need to understand the rules and we'll be OK.

</comment><comment><USER22> Facebook is a cesspit. How did people come to see it as somewhere acceptable - a walled garden, akin to AOL circa 1997. Awful,

Besides, what if it's not addiction, but something worse!

[http://www.netopia.eu/not-tech-addiction-something- worse/](http://www.netopia.eu/not-tech-addiction-something-worse/)

</comment><comment><USER23> The most surprising thing to me about this report is that it was self reported. I have no doubt that there are an immense, and seemingly increasing, number of people that stake their self worth on social acceptance. What is surprising to me is that people do this while being consciously aware of it!

<comment><USER24> To clarify for anyone reading this comment, self-reported means data obtained by questionnaires rather than observation by trained assessors. The key take- away is this paragraph:

""" In other words, people who agreed with statements such as "My self-esteem depends on the opinions others hold of me" tended to also agree with statements such as "I spend a lot of time thinking about Facebook", "I am using Facebook in order to forget my personal problems", and "I use Facebook so much that it has had a negative impact on my job or studies." """

So they were self-reporting is their feelings toward facebook and their feelings about their self-esteem, they weren't self-reporting the connection. They may not be aware of the connection between the two.

<comment><USER25> I'd like to see this replicated with a few tweaks for the « I am using $x » where $x could be porn, bets, games, books.. any means of escapism.

</comment></comment></comment><comment><USER26> Facebook, reddit, twitter, blind are like halfway betazoid telepathy on start trek. If you knew exactly how others judged you internally without them saying it, you would be devastated as a human. But the betazoids were fine. Maybe we just need time to develop coping mechanisms.

<comment><USER27> > _But the betazoids were fine_

They're also fictional. Privacy, _i.e._ the ability to hold thoughts and preferences to oneself, is intrinsically linked to agency. If everyone is looking for acceptance, we lose our places for madmen and geniuses.

</comment></comment><comment><USER28> Someone needs to figure out a way to clone Facebook circa 2005 and just call the site something other than 'Facebook'. Back then it was an amazing resource for university students and only allowed people with .edu email addresses from more reputable schools to join. You could use Facebook to access your course schedule and see lists of everyone that was in each of your classes. Gradually they relaxed the rules and started allowing faculty to join, then junior college students, etc.

</comment><comment><USER29> People should get rid of facebook.. not because of your privacy, but for your own state of mind. Teenagers should not be on such platforms as the social norm will change and grow.

</comment><comment><USER30> I actually had a discussion today about someone considering whether they should say "Happy birthday" because that other person didn't do that previously.

Finally my response was "who gives a shit, it's Facebook, it doesn't fucking matter. Just unfriend her instead of bitching about it."

That didn't resonate very well and the person had a very sullen attitude. but I stand by my statement. Facebook isn't that important.

<comment><USER31> They were probably more upset at your rude tone than your stance on facebook.

A nicer way to say it: "It's just facebook so i wouldnt worry about it. Do whatever you think is right and if theyre your friend in sure they'll appreciate it"

<comment><USER30> The person just wouldn't drop the issue and I did approach it softer and even attempted to change the subject. After 5 minutes of complaining about something so trivial I had enough. This is not the first time this person has obsessed and complained about something on Facebook.

And I totally agree at that point I was rude

</comment></comment></comment><comment><USER32> Anything about Twitter addiction? [That would avoid me the cost of a psychotherapy]

</comment><comment><USER33> Hacker News addiction linked to staking your self-worth on...

<comment><USER34> I came here to say this exactly. I'm only a hobbyist programmer even though I'm pretty darn good in my niche technical (non-programming) field. But almost every time I jump into the comments section my self-worth goes down a bit and I feel just a bit worse because really this is a community of programmers. And even though I'm not a programmer, I do write computer programs occasionally, and quite often I see people calling out my style of programming as the worst thing in the world.

I have a side business, but I haven't created fifteen startups with successful exits, so I feel less important than a lot of people here.

I don't have a Dell XPS 13 Developers Edition running Arch, so I'm not as pure as a lot of people here.

I use Facebook and not Mastodon, so I'm a sheep contributing to the downfall of society.

I live in the Midwest, where nothing happens and land is worthless and colleges are even worse and we don't even have the Internet here do we?

If you think Facebook or Snapchat or Instagram are damaging to the self-worth of its consumers, try being someone who doesn't live in SV and 10x some Phoenix/Elixir at an AI-owned biomed non-profit stealth-mode VC-backed startup collective. I've never even wheeled a suitcase into Paul Graham's office! I'm basically worthless.

</comment></comment><comment><USER35> I remember using Facebook in 2008, and creating a group for my class. I advertised so that people could join it.

It went horribly and a couple of student started insulting me for stupid things in the Facebook class group. It scarred me psychologically and emotionally, and I stopped using Facebook altogether and removed my account.

Until there is true and real accountability for things you say online, using real names should not be a standard. Facebook is a real example of murky online behavior. It's a haven for bullies and other tough playing egos. It's going to poison the internet for a long time.

</comment><comment><USER36> Seems right, but borders on being tautological.

</comment><comment><USER37> Considering the number of GoFundMe's I see for basic medical care, staking one's self-worth on social acceptance is not some weird psychological delusion. In this economy and country, social acceptance is the difference between life and death.

<comment><USER38> Somewhat ironically, the higher up you get on the socioeconomic hierarchy, the less true that is. Both in the obvious way (rich people have these little tokens called "dollars" that will make a surprising number of people and organizations do your bidding, particularly institutions like hospitals, colleges, and politicians), and in a much less obvious way: the most effective approach to acquiring these dollars is to become the monopoly provider for a good that lots of people need, and if you don't have lots of capital to buy up real estate and such, the most effective way to do _that_ is often to seek out psychological desires that people have but don't want to admit they have (for example, being liked by everyone) and provide that.

Yes, this is part of what makes social mobility hard. To move up the socioeconomic strata, you often have to abandon values that were essential to survival or self-worth at lower levels.

</comment></comment><comment><USER39> In related news, work addiction linked to staking your self worth on your bank balance.

</comment><comment><USER40> the real question is, is it intentional as a means of social control? I noticed that the messenger app intentionally delays messages at a rate that is linked to dopamine ups/down -- when another person sent me a message, and I went to another area of the website, and paused, there message would "appear" right when I lost interest, re-engaging me into facebook -- so there is some kind of thought put into creating a feedback loop to stay addicted to the platform. That, and the facebook scientists who were caught screwing with people's minds via social experiments years back and actually openly published their results, with zero ethical considerations, leads me to be concerned that this might also be some kind of sinister plot to control dehumanize subjects on their platform.

</comment><comment><USER41> How do free/open alternatives like Mastodon avoid this problem?

<comment><USER42> Not entirely, in so far it's happening when you provide the means to compare filtered perspectives on others' lives to yours.

They do by not having the business pressure to optimize for an engagement, which leads to artificially highlighting things, hiding negative personal posts, push-notifications and e-mails to pull people back in when they stay away for a day or two, ...

</comment></comment><comment><USER43> HNers: Others studies relating to this?

</comment><comment><USER44> What would hacker news addiction be?

</comment><comment><USER45> Black Mirror... Social scoring.

</comment><comment><USER46> That's a bit much

</comment><comment><USER47> I think one's self worth is intrinsically linked to acceptance, with or without Facebook, especially in younger people. FB (and others like it) just exploited the weakness.

</comment><comment><USER48> What about HN's addiction to news about facebook? I thought after a year of relentless facebook spam, we were past this. Now the top two posts are about facebook. We have to kick this habit.

<comment><USER49> 1) It's a phenomenally successful tech company.

2) It's not uncommon in HN to dislike and/or distrust Facebook.

</comment></comment><comment><USER50> My understanding is that humans have evolved to stake their self worth on social acceptance. Facebook just capitalizes on this need that we all have. It's the natural extension of capitalism and why pure capitalism without regulation is evil.

<comment><USER41> Could you elaborate on the connection with capitalism?

<comment><USER50> Capitalism = capitalizing on resources to make a profit. Facebook capitalizes on our need for social acceptance to make a profit.</comment></comment></comment>


Adobe has pity on Gimp ... - <AUTHOR> https://twitter.com/SamyPesse/status/303338759045386240

<comment><USER2> Obvious troll is obvious</comment>


Ask HN: If you could record your entire life from now going forward, would you? - <AUTHOR>

If you had an easy way to make and store, say, a continuous audio recording at minimal cost, would you use it?  Would it make a difference if you retained complete control over the recording?  How would you react towards friends/family who use it?
I believe this is a very relevant question, because:
a) most people carry around a portable microphone with an internet connection in their pocket
b) storage costs are now at a point where it would be feasible to do this on a large scale <comment><USER2> Ugh, no.

In part, how do you sort out the relevant bits? If it takes a lifetime to record, wouldn't it take a lifetime to watch?

My wife has kept a journal most of her life. I suspect it would be fascinating for me if I ever read it (which I will, if I outlive her). I'm sure it'll be fascinating for our children. But really, I don't want to look right now, even though I could.

So if I recorded my entire life, who'd want to watch?

<comment><AUTHOR> I've been considering building this as a personal project, because I never got to know my grandparents very well and sometimes I have conversations or experience things that I wish I could relive. I highly doubt anyone would ever bother with most of the recording. Sorting out the relevant bits is an open question, but I suspect a combination of speech-to-text with search and a timeline could help find interesting things.

</comment></comment><comment><USER3> No.

I prefer to not dwell on the past. I'm not sure I'd learn much from it either (via this means).

However - I would pay for a seamless device that would passively record the last 24 or 48 hours, deleting old footage as it adds more. To me, that is much more valuable.

</comment><comment><USER4> There is a relevant Black Mirror episode where the premise is a society where the majority of people have implants that record everything around them (and can then project and playback these moments) - like all Black Mirror episodes it has some interesting insights into how this affects society and people.

I definitely think we should hold some people to these standards (law enforcement, security guards, judges, politicians to name a few) - but for society as a whole? No thanks.

</comment><comment><USER5> It would have to be free (storage cost will continue to drop quickly to a level where they're irrelevant) and the killer app would be a way to sort through it.

I'm sure if you build it some people will flock to it.

</comment><comment><USER6> No. Would just pile up a bunch of garbage I would never go back and listen to and end up wasting money pointlessly.

I am sure for some out there, this might be something they want but personally I don't care

</comment><comment><USER7> No. There will be enough recording of me in public places and with Google Glass that I would not want anymore - even if it was self-inflicted.

</comment><comment><USER8> Why bother when the NSA is doing it for you.

<comment><AUTHOR> I suppose one could argue that it could just as easily be used to prove innocence as guilt. Pretty much the ultimate alibi, assuming you didn't actually do it.</comment></comment>


"Discrete Differential Geometry" Course by Keenan Crane at CMU - <AUTHOR> http://brickisland.net/DDGSpring2020/ <comment><AUTHOR> I'm not a CMU student, but keep my eyes peeled for new research / resources published by Keenan Crane [1]. He has a knack for making advanced topics very accessible.

Notably, this semester's DDG course has recently finished, and all assignments [2], slides [3], and notes [4] are available on the course website. Lecture videos for the second half of the course have been posted publicly online [5], presumably due to the coronavirus situation. Talk about silver linings!

I can also recommend the book by Edelsbrunner on Computational Topology, with corresponding course notes [6].

[1] Keenan Crane's website: [http://www.cs.cmu.edu/~kmcrane/](http://www.cs.cmu.edu/~kmcrane/)

[2] Assignments: [http://brickisland.net/DDGSpring2020/assignments/](http://brickisland.net/DDGSpring2020/assignments/)

[3] Slides: [http://brickisland.net/DDGSpring2020/category/slides/?order=...](http://brickisland.net/DDGSpring2020/category/slides/?order=desc)

[4] Course Notes: [http://www.cs.cmu.edu/~kmcrane/Projects/DDG/paper.pdf](http://www.cs.cmu.edu/~kmcrane/Projects/DDG/paper.pdf)

[5] Lectures: [https://www.youtube.com/playlist?list=PL9_jI1bdZmz0hIrNCMQW1...](https://www.youtube.com/playlist?list=PL9_jI1bdZmz0hIrNCMQW1YmZysAiIYSSS)

[6] [https://www2.cs.duke.edu/courses/fall06/cps296.1/](https://www2.cs.duke.edu/courses/fall06/cps296.1/)</comment>


How will the GDPR impact machine learning? - <AUTHOR> https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machine-learning <comment><USER2> Well, you have to hand it to the EU (Brit here): privacy has been legislated for in a way that is absolutely breathtaking. The GDPR is the first decent effort to curb the dreadful abuse of privacy that many massive multi nationals see as their right (omm nom nom data).

I am extremely proud to be associated with the GDPR (I'm still a European for now). It is an absolute belter of a set of regulations. If you read it, it is actually pretty concise for a legal thingie. It is also very prescriptive which is pretty odd for a legal thingie. It is up there with the "quietly enjoy your own property" basic right that is sort of enshrined in English Law nowadays (IANAL but a search would tell you what I'm on about).

If complying with GDPR is considered a problem then good luck with monetising that weakness.

<comment><USER3> Agree.

Not very long ago there were a bunch of articles posted on HN about how ML and deep neural networks produce knowledge, without humans being able to explain all the steps or any of the steps, and asked the question if this knowledge is still good.

The GDPR answers this question for business decisions regarding humans: No. It's not good enough. Your business is absolutely allowed to use ML for business decisions, but if a person asks how you reached that decision, you can no longer hide behind the machine, you can't treat it as some kind of oracle in a black box that spits out correct answers without any human knowing how the mind of the oracle works.

And I think that's an important foundation to have going forward. It's like how math tests work, you can't just print the correct answer, you have to show your work as well. Because the alternative is a dystopian "the computer is never wrong" future, and that's gonna suck for everyone.

<comment><USER4> You do not need to say how you reached a decision you at most may be required to identify which information was used to reach the decision and how it was obtained.

Businesses may be required to state the reason why a decision was made under other regulation but in those cases those are essentially one liners that do not provide any real explanation e.g. credit score does not meet our treshold.

There is however a real problem with GDPR and ML and by real I mean it's not you're getting fined out of business but that no one has a good answer for it and that is if I use your information to train a model and you then tell me to stop and delete all your information do I need to retrain my network? (While most would say no it's not that simple)

Because for example there are other questions like does a trained model constitutes anonymization or not? And again before you say "yes" there are ways to reconstruct the training data from models e.g. [http://www.deeplearningbook.org/contents/autoencoders.html](http://www.deeplearningbook.org/contents/autoencoders.html)

There's also the issue of using the data for decision making once a request to stop processing has been issued primarily does processing happens only during training or also during inferencing?

<comment><USER3> > There is however a real problem with GDPR and ML [...]

You are pretty much just repeating the questions and issues from the original article now. It addresses them better than I can.

<comment><USER4> I'll go read the article then :)

But again the fact that a blog post says X isn't enoguh and while I have no doubt that eventually sense will prevail it still doesn't fix the current problem and that is that the lack of prescriptive guidance from the 28 DPAs is problematic because it's not a small risk.

What people don't seem to understand is that most people who have problems with the GDPR don't have problems with its principles but rather with the fact that it has been rolled out without almost any clear guidelines and rulings. If you can't be 100% sure that your business model is compliant with the GDPR it can be a pretty big risk to take on and this ambiguity is much more disruptive than the requirements themselves.

BTW the machine learning problem isn't unique to GDPR, HIPAA also has this problem most companies elected to classify their trained models as patient data to be on the safe side unless they were only trained with public information.

</comment></comment></comment></comment></comment><comment><USER5> China is not going to care. Their complete obliviousness to privacy has made a lot of their machine learning projects move ahead at a breathtaking pace. I was at a presentation by a Chinese surveillance camera company last year and the amount of automated behaviors they can recognize that allow automatic crime detection, etc. is astounding! All the data processing will probably end up running through China as Chinese courts will ignore any GDPR violation fines for local companies, etc.

<comment><USER2> Why on earth would a Chinese court consider GDPR? GDPR is a EU thing.

If you want to do business with the EU then GDPR will probably apply in some way but not for say US to China relations.

However the GDPR is a damn fine set of standards to live up to - bear in mind that you personally are a person. Would you not want your rights as an individual protected in the same way. Go on ... live a little (and be decent).

GDPR may be what everyone needs.

<comment><USER6> I don't think it matters whether a Chinese court would consider it, the point is that if a Chinese company is doing business in the EU, or to any significant extent with EU nationals, then GDPR is an issue for them. Under threat of fines and worse for their EU subsidiaries.

No idea how much that's really an issue, but I'm pretty sure lots of people order from AliBaba in the EU (I have).

</comment></comment></comment><comment><USER7> If I ignore GDPR for the next year or so, waiting until this all simmers down to a level of abstraction below the surface level I care about, will I be any worse off?

<comment><USER8> I think that Jacques Mattheij has some thoughts about this that you can think about it in the abstractions that he gives. Note that IANAL and YMMV.

EDIT: Also Jacques is not a Lawyer either.

1: [https://jacquesmattheij.com/gdpr- hysteria](https://jacquesmattheij.com/gdpr-hysteria)

<comment><USER9> The most rational piece on GDPR I've yet seen.

So of course you are being downvoted.

<comment><USER8> I have been downvoted for both reasons on HN. I don't feel bad about it at all I think its funny.

</comment></comment></comment></comment><comment><USER10> Companies outside of GDPR-land _will_ have a competitive advantage over those inside of it, especially in the area of machine learning.

From the article: _"...one of the first major distinctions the GDPR makes about ML models is whether they are being deployed autonomously, without a human directly in the decision-making loop. If the answer is yes—as, in practice, will be the case in a huge number of ML models—then that use is likely prohibited by default."_

If users explicitly consent to it, then it's permitted under GDPR, but what percentage of users are going to do that? Most will be hitting the "decline" button by default on all websites, even if a given application of ML will be beneficial to them.

This is a showstopper for most ML in the EU. If you have an ML startup in the EU....either close up shop or move.

<comment><USER11> If you are using ML to make automated decisions for say insurance risk then you will have to say so explicitly. There is a pay-off for a customer to agree, and that is convenience. If all insurance companies are doing this then a customer will likely have to consent, or not get a fast insurance decision out of hours that they seem to want. I think the big difference under GDPR is that the user will be able to request that the decision is made by a human, but if this is the case they will not get to set up their insurance at 10PM for tomorrow morning like they can in the automated system. It is completely reasonable that a customer would have to wait a couple of days for this.

In practice I wonder if insurance companies (for instance) are actually doing a live ML evaluation on customers, or do they just use ML to develop some 'bandings' that they fit you in to? They could still do this of course, because they can use anonymous data to build a model.

I don't see where the competitive advantage you mention lies? Yes a company in the US could use ML on US citizens, but not EU ones. Presumably a company in France could set up a server in AWS US-West region and do ML on US citizens, but not EU citizens? Surely it is a matter of where the data-subject lives, not where the company is based?

<comment><USER10> _I don 't see where the competitive advantage you mention lies?_

Well, if you can't perform ML on data about the population that is most accessible to you, you are at a competitive disadvantage to those who can. I can't think of many EU companies that control large amounts of data on US citizens. Though I'm sure they exist, there are _many more_ US companies that would have larger volumes of data on US citizens.

<comment><USER11> So you are arguing that US firms operating in the US are in competition with UK firms operating in the UK? I don't see how they are in competition at all?

<comment><USER10> Humans are humans, regardless of what country they live in. If I have a larger dataset than you, and I can do more things with it, then I can predict human behavior in a given situation better than you can. That gives me a competitive advantage over you. I may be able to then go compete with you in the EU without ever having to violate the ML provisions of GDPR, because I know what humans - whether in the EU or US - will do.

Granted, there are some country-specific behaviors that this will not apply to, but then nobody will be finding out what those are in the EU because it's now illegal to do there.

</comment></comment></comment></comment></comment><comment><USER12> I want to live in a world where the individual has control over their data, but I don't think GDPR will help create that world.

Imagine you are a company that makes $500k+/year off of user data. You are not just going to stop doing it because of GDPR, you are going to spend up to $500k on lawyers figuring out how to get around it.

<comment><USER13> That world will come around when a majority of people will understand that running untrusted code on your computer is just madness (i.e. JavaScript). I wish some mainstream browser like Firefox created an easy UI for JS whitelists, and/or a dialog box asking consent for JS execution per FQDN, like it does for location etc. Among the big players, only Google has major reasons to not do such a thing, but FF, IE and Safari can try.

</comment></comment><comment><USER14> Is it possible to cover GDPR requirements with another line in an EULA that specifies consent?

<comment><USER15> No, you have to ask and receive consent explicitly for the processing you want to do, not as part of some larger package.

<comment><USER14> a modal pop-up dialog asking for consent will be required?

<comment><USER16> yes, that's the intent of the law

</comment></comment></comment></comment><comment><USER17> I can't wait to issue denial of service requests to every EU company when it comes into effect. I am going to send a nightmare letter to all of them.

</comment><comment><USER18> Does GDPR apply to animals too? I mean if its going to be hard to manage human data, perhaps replacing some with monkeys would be OK.

<comment><USER15> GDPR applies to "natural persons", which I think mostly excludes animals (I base this on us killing animals all the time and it doesn't count as murder).</comment></comment>


Welcome to the Land - <AUTHOR> https://statesider.us/utqiagvik-alaska-welcome-to-the-land/ <comment><USER2> I didn't read it; but to help you decide whether to do so: this looks like a personal story about traveling in Alaska</comment>


Engineer claims he has been blacklisted by Chrysler for 17 years - <AUTHOR> http://blacklistedengineer.blogspot.com/ <comment><USER2> Unfortunately I think this person seems mentally ill. I have a friend who in his 30s became a paranoid schizophrenic and although he was very articulate, he had major flaws in his logic and behaved erratically. He also filed many lawsuits and was litigious as well.

It sounds like this person was dismissed from his job (he mentioned it in one of his videos), and he hasn't been able to find employment because of his mental illness.

It's sad that we don't do enough to help those with mental illness. It would go a long way to making their lives better and the rest of our lives safer.

<comment><USER3> Don't you think there is a good chance his mental illness is actually a result of being consumed by such an awkward situation?

The details he provides about proof of employment and wrong-doing by Chrysler when asked to confirm it are very clear. If those are real, we can't tell - this looks like something a good journalist would be able to uncover, and maybe help achieving some kind of closure.

<comment><USER2> No I don't think so. It sounds like he was fired for at the very least strange behavior, and all of his potential employers picked up on it. If he were technically good, it wouldn't matter what Chrysler said. But it seems like he's not technically good.

<comment><USER4> Maybe an awesome engineer in tech can get hired even if his past employers deny employing him. But what about a perfectly average engineer in something more traditional like automobiles? It's my understanding tech is pretty unique in being "less" sensitive about pedigree.

</comment></comment></comment></comment><comment><USER5> I think we've all seen a good engineer get fired because he's a pushover.

You know who doesn't get fired?

Story time: We had the most brilliant and insufferable devops engineer I've ever met. I don't mean just your standard grump overworked sys admin. This guy was a treasure. 1) Previously all engineers had 20% time and would work on personal projects. We had a ton of extra servers lying around and it was fairly simple to provision some space to work on an idea. His first week he went to the CTO and had 20% time axed and demanded that all provisioning go directly through him and all physical servers be nuked from orbit. 2) They got him a personal secretary. He routinely had her go 5 blocks to get him gummy bears, buy him a waffle iron and make him waffles in the office, and routinely made sexist comments. 3) Op sec. We would have media come by the office once in a while so this guy instituted a policy of "security through shame" If you didn't have 2factor auth on your email he would send you snide comments. If you didn't use full disk encryption you had to go to a mandatory course on personal security. If you left your laptop unlocked at your desk to go the bathroom it was prank emails and screwing with your settings. On the 3rd time he would confiscate your laptop and lock it in a personal safe he had under his desk for the day. 4) This guy would use our internal channels and slack to shame anyone non-technical. One time the personal assistant to a VP in another department accidentally posted a listing asking if anyone had a bed for sale to the channel for asking about restaurants in the area. 24hours of shame where he got the entire tech team to participate emailing everyone in the company if they had any food shaped furniture for sale. Apparently she broke down crying and had to go home for the day. 5) Despite the fact that we had no QA team this guy refused to deploy hotfixes even for critical launches. You got one day a week to launch code. You got one chance. If there was anything wrong it was, "roll back and try next week." Unless of course the issue was you needed a CDN cache clear or there was something wrong with the build. Then you could email him (directly after the deployment) and have him refuse to respond or believe you for about an hour before he would actually do anything.

These guys get promoted. They run things.

They fire the pushovers.

<comment><USER6> Wouldn't have to worry about firing me, I'd quit.

<comment><USER5> I stuck it out until he confiscated the personal laptop of an engineer who had permission to use it on network.

After that I got permission to work from home for a month and used the opportunity to find a new job.

<comment><USER7> Do you know if (m)any of your coworkers also quit?

<comment><USER5> Several asked to be transferred to other departments. That's what prompted his demand to be the sole point of provisioning. He had final say over Finance, Analytics, internal reporting tools, if he didn't like you it didn't get a server.

I had been with the company for four years at that point and I knew a lot of other old timers. Overnight it went from a flat organization with a progressive expectation that "No one is going to tell you what to do. You are here because you kick ass and we expect great things." to a strict hierarchy with several layers of management and influence.

Everyone who had been there as long as I had was equally unhappy with the new direction. This was all done under the guise of, "Getting the budget under control." when we all clearly saw the budget was fatter than ever. Where we had a diversity projects and research going on before, now we had 1 or 2 large money making projects. Where we had an expectation that we needed to be competitive and lean and every aspect mattered before, now they were hiring more and more management instead of workers.

We were doing so well that many former co-workers contacted me and other old timers during this time and we warned them off. Many simply didn't renew their contracts because they saw the writing on the wall.

Only one other person outright quit and that was really heartbreaking to watch. He had just transferred from California and the bullying was so bad he told me he was going home to stay with his sister and start going to therapy. He couldn't stand the idea of working in tech anymore.

</comment></comment></comment></comment></comment><comment><USER8> Very weird; so long and detailed that it would be hard to fake - yet I don't understand why he's still in this position with the proof he claims to have.

I also feel like his case would be strengthened significantly if he simply took the time to write properly - capitalize, good grammar, etc.

Anyway if true, it's an outrage; hope he receives due compensation. If not, I don't know what to say.

</comment><comment><USER9> I do feel bad for this guy, because I feel that the majority of what he says is true, but it just can't be true that an employer saying he didn't work somewhere that he did is effective "blacklisting". I have worked a few places and received several job offers that I declined, and don't know of one case where my previous employer was contacted. I was told by HR at a fortune 200 company that I worked for as a mechanical engineer that they would not confirm or deny to anyone that I ever even worked there. I think that contacting previous employers doesn't happen much because so many people would lie. If the prospective employee was a charismatic fool, the previous employer could gloss over incompetence. If he was a great worker, but the previous employer was sore about him leaving, they could embellish on any shortcomings. Sir, if you are reading this, let go of the past and look inside for what needs to be fixed.

</comment><comment><USER10> My experience is not directly related but one of the things I have noticed working as an software engineer in the banking industry is how quickly management closes ranks to protect one of their own. No matter how much a manager fucks up, when your as an engineer tell on him/her, your ass will be handed to you. And the blacklist is real -- informal but real.You can't transfer out as all the managers will give you shitty references. So I can empathize with the plight of the blacklisted engineer. Its scary and it could happen to anyone.

</comment><comment><USER11> Why didn't he seek a (temporary) job in the service industry? Even flipping burgers would be better than being homeless. His story and writing style makes me believe he's a smart guy but possibly he unintentionally offends everyone he meets and either doesn't realize it or can't understand why.

<comment><USER12> A lot of service industry jobs won't hire people that are "overqualified" because they know those people likely won't stay long.

</comment></comment><comment><USER13> It sounds like a sad story of a guy who never learned to communicate properly.

<comment><USER14> Or he was great at communicating and has just suffered extreme mental trauma from the circumstances he was unfairly placed into.

</comment></comment><comment><USER15> _and a copy of my Chrysler contractor ID badge_

How is that not the end of proof needed to a court?

Unless they are claiming he made a counterfeit badge which is silly.

There also have to be tax records on the state and federal side that a court can order them to retrieve?

The saddest part of that whole story is what I recognize as the descent into the mental state of homelessness, because once you are there, it's REALLY hard to dig yourself out to start thinking normally again. He's been at it since 1999, he's not coming back out whole, maybe ever. Story starts to have grammatical errors and paranoia at the end too, not good signs.

<comment><USER16> descent*

I point it out not to be a grammar nazi, but to further a point: we all have different writing ability and/or attention to detail. The man made many more mistakes than you did, certainly, but I don't think it's necessarily a reflection of mental illness.

There's a lot of armchair mental health diagnoses in this thread, and I think they're a bit presumptuous.

</comment></comment><comment><USER17> Perhaps I am not understanding his situation properly. If Chrysler refuses to acknowledge that he worked there, why couldn't he apply for jobs without mentioning his experience at Chrysler?

</comment><comment><USER18> The last post was from April of 2015. Can we update the title?</comment>


Ask HN: Startup options and exercising - <AUTHOR>

I am approaching my first full year at a startup and my options cliff for 25% of my options. Should I exercise that 25% immediately or let it sit? What are tax repercussions on exercising vs. not exercising? <comment><USER2> IANAL. Advice is worth what you paid for it...

There is hardly ever any valid reason to exercise your options before an IPO or similar equity event. There is a small tax benefit to exercise and hold them for at least 1 year, but there is HUGE risk in the value being wiped out or diluted.

There _can_ be a small benefit in being an actual shareholder, as you are supposed to get minutes from the board meetings. But, you don't need to exercise all your options to do that, $1.00's worth would be enough.</comment>


SOPA and the oblivious - <AUTHOR> http://esr.ibiblio.org/?p=4009

<comment><USER2> A good read, but I don't agree with his conclusions at all.

Yes, a powerful government can abuse its power, but that does not mean it has to happen or that the alternatives are necessarily better.

There are some things individuals and cooperation can't, or won't, do.. I feels people arguing for "small" governments always draw an imaginary line between the things they _do_ expect the government to handle (roads, an army..) and the things they don't (healthcare..).

Is a "big" government that's actually working for the good of the people too much too expect?</comment>


Verified by Visa and Mastercard SecureCode are broken and need to be fixed  - <AUTHOR> http://www.cxpartners.co.uk/cxinsights/verified_by_visa_and_mastercard_securecode_are_broken_and_need_to_be_fixed.htm <comment><USER2> He's only complaining about UX, but the bigger problem is that this doesn't actually make things much more secure.

It is already really hard to teach casual computer users about security online. The one thing that used to work so far was "never enter your password on a website you've been redirected to" and "always check the site's identity in the address bar". Verified by Visa redirects you to some website on some random server and asks you to enter your password. There is no way for the user to check it's authenticity.

A much more reasonable design would be to control all sales via your bank's website, i.e. having an inbox with "purchase requests" and approving them through your bank's interface. That would be both secure and very transparent to the user, and the bank could easily control the level of security required (passwords, TANs, ...).

<comment><USER3> There's eFaktura in Norway[1]. Merchants send their bills to you electronically, and you pay them through your homebanking interface. As I never used it when I lived there, I don't know if the mechanism is fast enough for immediate purchases.

1\. <http://en.wikipedia.org/wiki/EFaktura>

<comment><USER4> It's not fast enough. Money arrives next day, at best.

</comment></comment></comment><comment><USER5> Even though there's no choice (here at least, when you want to use your Visa over the internet) I _HATE, HATE, HATE_ the concept and here's why:

For starters I thought it's a phishing attack, when the frame popped up for the first time.

But the worst is that I don't feel it protects me, despite the marketing crap dished out by CC companies. The only reason is to protect Visa.

What happens if I book a flight at a badly infected internet cafe computer in Chiang Mai and a key logger reads my password?

"No, Mr. Zapp, our logs show irrefutable proof that your password was typed with suchandsuch transaction. Sorry, you're liable, you obviously didn't protect the password."

Scary stuff.

<comment><USER6> That is, in fact, the exact opposite of how the banks operate. You are limited to $50 in liability for any fraudulent transaction in your account that you report in a timely fashion, guaranteed by law (in the US at least), and _every_ bank I am aware of waives the $50 for marketing purposes.

Essentially all financial risk for credit card transactions is borne by the merchants. (Which is one reason why the banks don't seem to do much about fraud -- why should they inconvenience their customers to protect someone off of the balance sheet who doesn't get a choice to not use their bank?)

<comment><USER7> While we are in public-service-announcement mode: I believe that the above protections are still a lot smaller for debit cards than credit cards. You still have $50 limit on liability with debit cards, but you must report the theft very quickly indeed _and_ the thief is emptying your personal account in the meantime:

[http://banking.about.com/od/checkingaccounts/a/stolendebitca...](http://banking.about.com/od/checkingaccounts/a/stolendebitcard.htm)

This is why I never use a debit card for anything.

We now return you to your regular HN programming.

<comment><USER8> In defense of debit cards, in the event you do lose it and someone's emptying your account, your bank should still restore your funds after the theft. I say this because it happened to my wife; Chase's fraud prevention kicked in after about $300, all of which was refunded as soon as she figured out what had happened.

<comment><USER7> Thanks, good to know. I've been waiting for these policies to kick in as debit cards become more popular.

<comment><USER9> It has actually been that way for awhile. Back about 9-10 years ago someone used my wife's debit card number and after reporting it the bank restored the funds.

</comment></comment></comment></comment></comment></comment><comment><USER10> An additional problem with the implementation is that it requires javascript. I was working on a project for a UK bank - their security guidelines required securecode, but their accessibility guidelines required that the site work without JS. Sadly achieving the two is impossible.

I agree this is an awful user experience, at a time where the trend in payments is to make the user's experience better this is a huge step back.

<comment><USER11> I did an implementation myself a month or two ago and noticed the same thing. The contradiction is hard to miss.

</comment></comment><comment><USER12> Could someone tell me why this idea wouldn't work?:

Your credit card comes with a simple communication port (usb, bluetooth, whatever) and a two line B&W text LCD display (like on cryptocards or cheap electronic watches). Every time you want to buy something, you connect the card with the merchant. (This works in person and over the internet.) The merchants sends the card an official merchant name ("Delta Airlines"), which is registered with the credit card company, and a price ("$234"). These appear on the first and second lines of the card readout. If you approve the charge, you hit a single button on your credit card. Your credit card then sends an authorization code to the merchant which is good only _one_ time, on _that_ date, for _that_ price, and with _that_ merchants (using some sort of RSA hash).

If a wireless connection is used, there is little risk of criminals trying to secretly communicate with your card sitting in your wallet; you simply won't approve the transaction (unless they have physical control of your card, at which point you're no more vulnerable than you are now).

Further, you'd know exactly how the name of the merchant would appear on your bank statement.

The only downside I can think of is that the card would by slightly thicker (like a crypto card), slightly less durable, and need a battery (which would last for the life of the card). But we already replace the physical card every few years, so is this a problem? Is the technology particularly expensive?

<comment><USER13> A very similar system is already in use in the UK and other parts of Europe. It's called "chip & pin". You plug your card in to a card reader and check the LCD display and type in your PIN to authorise a transaction.

In a shop, the card reader is owned by the shop and is similar to point-of- sale card readers used in the USA. However, most banks now provide customers with a small reader (that looks like a calculator) for logging on to online banking, or authorising payments made via internet banking.

For example, to authorise a payment you: put your card into the reader, type in the account number you want to pay, type in the amount, and type in your pin. You then get an cryptographic authorisation code to type into online banking.

Crucially, the scheme works using cryptography, and the cryptography is performed within the chip on the bank card - it is not possible to read the PIN off the card.

(edit: and, in contrast to the scheme described in the parent post, stealing a card doesn't help much if you don't know the PIN, and the card will disable itself if the wrong PIN is used too many times)

<comment><USER12> I see three problems.

> most banks now provide customers with a small reader (that looks like a > calculator) for logging on to online banking, or authorising payments made > via internet banking.

This means you can only make online purchases easily and securely at home. If I want to be able to make purchases at someone else's computer, an insecure back door must necessarily be left open _even when you're not away_.

> To authorise a payment you: put your card into the reader, type in the > account number you want to pay, type in the amount, and type in your pin.

This doesn't solve the problem (which people may not care about) that the merchant could now have your pin.

>You then get an cryptographic authorization code to type into online banking.

This seems like a huge burden. Physically typing in long cryptographic codes? Do people actually subject themselves to this?

Thanks very much for the perspective.

EDIT: I retract the second criticism for reasons explained below.

<comment><USER13> > This means you can only make online purchases easily and securely at home.

Fair point - I had this problem when wanting to use Internet banking at work, but these pin readers are compact (smaller than an iPhone, marginally thicker) so I just keep mine in my bag now.

> This doesn't solve the problem (which people may not care about) that the > merchant could now have your pin.

Only if the reader itself is compromised (very unlikely with the small ones provided by banks for online banking, and pretty unlikely in a shop too). However, note that the PIN is useless without the card, because the crypto chip is on the card, and it can't be cloned by a reader.

> This seems like a huge burden. Physically typing in long cryptographic > codes?

They are only 8 digits long. And yes, I don't want fraudulent use of my account so I don't mind.

<comment><USER12> > However, note that the PIN is useless without the card, because the crypto > chip is on the card, and it can't be cloned by a reader.

Ahh. So then the merchant could only really make use of a pin (which it would have to do by compromising the pin reader--a tall order for small time crooks) if he _also_ stole your physical credit card. I agree that this isn't much of a risk, and retract that criticism.

</comment></comment></comment></comment></comment><comment><USER14> There's an open secret in the Information Security industry (at least here in the UK), which is that the Payment Card Industry don't care about your security. What they care about is shifting as much of the liability onto the consumer, the merchant, _anyone_ other than themselves as is possible.

We have a system in place here called Chip and Pin (<http://en.wikipedia.org/wiki/Chip_and_PIN>) which was supposed to protect people by requiring them to type in a personal PIN code. The only problem was that there were plenty of ways to commit fraud without knowing the PIN, and until new regulations came into force the banks would reject claims of fraudulent transactions and require the victim to prove that such transactions weren't fraudulent.

If you want to see how bad the card industry and banks can 'do security', just look here: <http://www.cl.cam.ac.uk/research/security/banking/>

</comment><comment><USER15> VbV is badly broken, but the suggestions here miss one of the most important points. The use of an iframe means that users can't tell where VbV is coming from and can't be sure either that it is secured or that it's really coming from the bank.

This is just begging for copycat phising and MITM attacks.

<comment><USER16> Yes, this article is long on alarmism and short on serious critique:

> _The design of the form does not match the design of either the merchant or > the issuing bank. The design looks 'cheap'. It doesn't look trustworthy._

> _No telephone number. When a user sees a telephone number it gives them a > feeling legitimacy. They may not phone, they just want to see the number > just in case._

> _The calls to action at the bottom of the page really don't work. 'Submit' > is rather generic and does not give an indication of the next step. 'Cancel' > gives no indication what will happen next and really should be removed._

> _There is still very little recognition by users. Visa and Mastercard have > done a poor job of marketing and raising awareness._

> _The text is American "Expiration date" should be "Expiry date"_

> _Once the customer has overcome all 11 of those issues they can purchase. 11 > issues. 11 serious issues._

Serious issues? Let's tally: cheap design, no phone number, button names, lack of marketing, bad copy. These are not serious issues that make a technology "broken" -- at least, not in the sense that, say, MD5 is broken. The points about the phone number, cheap design, and lack of marketing should not even be in this list.

And then there is this gem, from the guy who is going to fix our "broken" security technology:

> _Firstly, the URL, well that's an easy one, embed the page within an iframe. > It does of course mean one can't check the security certificate but hey, who > ever does this?_

> _About the author: Joe specialises in designing every aspect of the user > experience from initial research to developing a robust, measurable online > strategy to producing beautiful, easy to use wireframes and website > information architectures._

Oh, I see.

<comment><USER17> You've taken a very specific definition of "broken", then decided that the article doesn't meet your definition, so the article is worthless?

If you're losing customers for a bit of security theater, I think "broken" is a pretty good term from the perspective of the retailer.

</comment></comment></comment><comment><USER18> 3DS being broken was known long before 3DS was finalized. It's not new. However, it's successful because of the security it brings to merchants. Merchants implement it because they get covered. It's the perception of security that works.

Until 3DS implements some out-of-band authentication, you won't have something secure. Implementing OoB auth isn't difficult, either. The technology has been around for a LONG time, with proven results.

</comment><comment><USER19> Very similar to the analysis by Steven Murdoch and Ross Anderson published in January: see <http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf>

</comment><comment><USER20> So, how common is the 3D Secure code on websites? I thought it was a local/European annoyance, since I haven't run into it outside EU webshops?

For instance, I've never had to put in my 3D Secure code on Amazon, BackBlaze, Syncplicity or ZumoDrive. The problem is that at least here in Finland, the only company (representing all the local banks) offering credit card processing practically requires 3D Secure unless you implement everything yourself (e.g. can't use their CC vault) - and no, unfortunately the US subscription API services don't work here, unless you somehow manage to get a merchant account in a UK bank.

</comment><comment><USER21> I've always managed to not enable Verified by Visa on any of my credit cards, but another huge problem with it is that doing so is nearly impossible. Once you get redirected to that popup, it's very hard to _not_ signup without canceling your transaction with the original merchant. Or getting dumped back to your shopping cart, trying to check out again only to get dumped straight back into Verified by Visa's signup process.

There doesn't ever seem to be a permanent opt-out, so anytime I want to buy something from a merchant that uses it, I have to hunt for the magic button to get around it again.

</comment><comment><USER22> Every now and then when I purchase something from a Verified by Visa-"friendly" site (Newegg comes to mind), I often find that I'm able to complete the purchase without entering my password.

It's disturbing to say the least.

<comment><USER18> 3DS doesn't work that way. It's not mandatory. Newegg isn't using it to fight friendly fraud. They are using it to fight actual fraud. You've done it once, why should they force it on you again? You are who you say you are, and if their is a problem with your purchase, they're confident that they can resolve it without a chargeback.

<comment><USER22> But then why bother using it at all? Do they assume that no one malicious could ever get into my account (for argument's sake)? If you're going to make me set a password, make me enter it each time I "use" your service. My gripe isn't with the vendors per sé, but with how Verified by Visa and SecureCode operate.

I'd much rather type an extra password during the checkout process instead of being charged $700 for hardware and Windows Vista DVDs (thieves aren't always the brightest).

<comment><USER18> > But then why bother using it at all? Do they assume that no one malicious > could ever get into my account (for argument's sake)? ... instead of being > charged $700 for hardware and Windows Vista DVDs

You're making an awful lot of assumptions you shouldn't be making.

First, 3DS doesn't provide you any more security than you really had before. It helps the merchant secure their transactions, however. But even if someone did charge $700 to your card, it's an easy phone call to get it resolved. Not only this, but I'm sure Newegg would require another check if something was amiss with the transaction. Any sizable operation will work to make sure that legit users can make purchases as fast as possible with as little hassle, but that doesn't mean it's not verifying things in the background.

So why would Newegg use 3DS? Simple. They want to verify that a new account is who they say they are, and not a stolen card. You're a legit user. You make a purchase. Next time you come back, you'll probably be making the purchase using the same billing address and the same shipping address. Even if you didn't make the order, you'll call up Newegg to complain, and they'll work to refund the order and resolve the matter as quickly as possible.

But you as a cardholder have always been safe. A simple call to the bank, and "No, I don't recognize the transaction" and you get your chargeback and you owe no money. However, with 3DS, you can't just say it wasn't you. If the merchant doesn't provide the service, then yes, you can still get it. 3DS for legit users prevents them from committing friendly fraud.

</comment></comment></comment></comment><comment> andrewl-hn Strange. I've never seen a VbV open a new frame or pop-up - it's always a series of redirects for me. May be it depends on what bank and/payment gateway is been used.

<comment><USER18> Not really. It's usually the merchant implementation that decides how it's displayed. All the 3DS I've implemented have also recommended using iframes in their API.

</comment></comment><comment><USER23> Nothing in the article is actually a technical flaw - it's mostly UX. That's not to say the system is good, but I think the title is misleading. If you look at the paper "Chip and PIN is Broken" by Murdoch et al ([http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=5504...](http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=5504801)) they actually point out a MITM attack which is a technical vulnerability.

<comment><USER24> User experience flaws are technical flaws.

</comment></comment><comment><USER25> Wow. This is entirely different here in India. First of all, it has been made mandatory (it's slightly inconvenient). This is not implemented as a popup. It redirects to the Issuing Bank's website for verification. Signup should be done in the bank's site as well (e.g.: [https://www.3dsecure.icicibank.com/ACSWeb/EnrollWeb/ICICIBan...](https://www.3dsecure.icicibank.com/ACSWeb/EnrollWeb/ICICIBank/main/index.jsp)).

</comment><comment><USER26> Verified by Visa is a horrible horrible implementation, I spent an hour in the bank last month trying to sort out why my company card wouldn't let us buy train tickets ) VbV had my date of birth wrong for some reason) oh yeah if yuo have any problems with VbV you have to call an 0845 number, which although only 5p a minute on my plan... it soon adds up

</comment><comment><USER27> I have credit cards at a bunch of banks here in Russia and what they do is they send you a one-time password in a text message every time you make a purchase online. It's the same VbV/SecureCode window and everything but you don't get to create your own password.

</comment><comment><AUTHOR> I found this interesting because it provides helpful advice on how to handles 3DS as it currently is. It's a flawed system but it's not going away any time soon. In the meantime finding ways to make it suck less is all a merchant can do.

</comment><comment><USER28> I wrote about this about a year ago. <http://paddymullen.com/2009/05/21/yaron- shohat/>

</comment><comment><USER29> Best part? If you ignore it and never set it up, it still lets payments through (at least with Mastercard). I really, really wish they had an opt-out button...

</comment><comment><USER30> For 3DS enabled site in France (don't know if it's the same elsewhere) it sends you a code by SMS that you have to enter in the popup. I think this is a much better way. But I have to agree, the process is really not well thought out and as bad as it can be UX wide.

</comment><comment><USER31> The best way to fix it is to nuke it from orbit. It's the only way to be sure.</comment>


I Hope My Father Dies Soon  - <AUTHOR> http://www.dilbert.com/blog/entry/i_hope_my_father_dies_soon/

<comment><USER2> Extensive discussion: [https://news.ycombinator.com/item?id=6789905](https://news.ycombinator.com/item?id=6789905)</comment>