As has become the norm, a new web security meltdown erupted recently, starring KissMetrics, among others. And as has become the norm, I think it’s much ado about nothing.
I was actually thinking about this earlier today, and Nik Cubrilovic’s post on yet another way to secretively store data just reminded me of it. There are a few reasons why I think the concern over this is mostly misguided.
First, it’s not new. Store owners can write down your shirt color, your height, your race, the time you came in, what you bought, etc. They can track plenty of “personal” information, which I put in quotes because I think the whole concept of some special class of information leads to more confusion than awareness. The key difference, obviously, is that computers make tracking this information cheaper and faster. I tend to think that we shouldn’t legislate against actions based only on their relative efficiency, so I don’t see why this should make a difference. Worse yet, it’s far more likely that real world businesses can connect your actions to your real “personal” information, like your name, family and address.
Second, it’s a never-ending game of cat and mouse. There are limitless ways to store data and acting like anyone can stop it is foolish. The whole thing seems eerily similar to the war on drugs, a failure I think we’ll have a hard time contending with any time soon.
Third, for the overwhelming majority of people there is nothing to worry about. Awareness of risks is great, but confused fear based on misinformed media reports is awful, and that’s mostly what we’ve created.
I’d liken responsible web security education to something along the lines of wearing your seatbelt and not driving drunk. What we have today is much closer to fear-mongering along the lines of urban legends about exploding engines or murderers at drive in movies. Those things can certainly happen, but I don’t think it’s reasonable for anyone to treat them as likely consequences of driving a car.
To be clear, I think it’s great if websites and web services don’t do these things, but some of them will and you should probably assume all of them do, particularly if it’s something that concerns you.