7 ms·

Permission Slip: App to take back control of your data

82 points by tony101 4y ago

m463 4y ago
I stopped using consumer reports online because they LOST their independence. Their website connected very intimately with the sales channels and they made their money from referrals. This reminds me of apple touting privacy, while simultaneously tracking all your activity with little or no recourse.
- bigmattystyles 4y ago
  It’s like how VPN providers say to use them to protect yourself from your ISP. Don’t get me wrong, Comcast has its many many issues, but I still trust them more than I would most VPNs. I guess it’s easier to create anonymity with VPNs, but still, most people just think they have a VPN so they’re good.
  - bradknowles 4y ago
    In contrast, I would trust almost any VPN provider far more than I do Comcast or any other major ISP that I know of. AT&T has already had major litigation against them for their activities with deep packet inspection, injecting their own ads, and blocking or traffic shaping other sites on the Internet that compete with services that AT&T wants to sell you instead (like Netflix). And Comcast is far worse in this space than AT&T.
  - kerkeslager 4y ago
    The word "trust" is pretty meaningless in a void--if you can't answer "trust to do what?" I think you're missing some nuance to the concept. For example, I trust my parents to do what they think is best for me, because I have decades of experience showing that is genuinely their goal. But would I trust my father to perform open-heart surgery on me? Absolutely not! The man doesn't have a medical degree of any kind. With corporations, my trust is largely based on their incentives. I trust Comcast not to sell my credit card data to Nigerian scammers, because they're clearly making more money by being a cable provider than they would by being a credit card data darknet wholesaler, and selling my credit card data to Nigerian scammers would put their more profitable business at risk. VPNs... might sell my credit card data to Nigerian scammers, because their profit margins aren't as high and their reputations are already not great. I don't trust Comcast not to report my metadata to the NSA or to reject MPAA requests for torrent data, because they already did both those things and have incentives to continue. I trust VPNs to request MPAA requests for torrent data, because as soon as that became known it would hurt their business model. I don't trust VPNs not to report my metadata to the NSA because acting as a honey trap for the NSA could be pretty profitable and probably wouldn't become public, so it wouldn't hurt their business model.
  - KyeRussell 4y ago
    This particular situation feels sufficiently far from the original point that I’d say it isn’t that fair a comparison.
- jcoq 4y ago
  > connected very intimately Do you mean hyperlinks? They're not hiding anything: https://www.consumerreports.org/cro/about-us/our-partners/commercial-partners/index.htm https://www.consumerreports.org/cro/about-us/our-partners/co...
  - m463 4y ago
    I used to subscribe to the physical magazine and I thought they had much higher standards. They accepted no advertising in their magazine. They bought cars independently, and tested them as customers. I think their "adaptation" to the internet might have been necessary to survive, but I believe it made them less objective.
bcherny 4y ago
Downloaded! Funny, I suggested building an app exactly like this a month ago. In unusual HN fashion, I was immediately shot down as “that would never work” [1]. I feel vindicated that Consumer Reports built this :p. [1] https://news.ycombinator.com/item?id=34194778 https://news.ycombinator.com/item?id=34194778
- KyeRussell 4y ago
  “YC et al would never fund this! You’d barely even become a billionaire.” Is how I read those responses when they come from Hacker News.
bradknowles 4y ago
The landing page tells me nothing useful about this app. So, I'm not inclined to trust it at all, because anyone can claim they are "Powered by Consumer Reports", and without any evidence to back that up, it's just an empty claim. Can someone please explain to me why I'm wrong?
- tony101 4y ago
  Refer to https://digital-lab.consumerreports.org/2022/11/16/introducing-permission-slip/ https://digital-lab.consumerreports.org/2022/11/16/introduci...
  - bradknowles 4y ago
    Okay. That link explains a little bit. Enough that I'd be willing to check it out now, in comparison to other tools like DeleteMe. But it would have been nice to see that same information on the landing page for the software. Or at least have that link included in the original post here on HN.
    - bradknowles 4y ago
      Well that was a fast fail. I decided to try to have them request that Home Depot stop selling my data, and then the program seems to have hung on a blank page. I hope the problem is that their servers are overloaded due to "HN Hug-o-Death", and not something else.
  - mhb 4y ago
    There are a lot more words there, but no more explanation of what it is.
  - dang 4y ago
    Ok, we've changed to that from https://www.permissionslipcr.com/ https://www.permissionslipcr.com/ above.
- kmoser 4y ago
  For that matter, could this have been done as a website rather than a mobile app?
thrwawy74 4y ago
https://www.consumerreports.org/cro/2015/01/user-agreement/index.htm https://www.consumerreports.org/cro/2015/01/user-agreement/i... > By transmitting any Communication to the Site, you grant CR an irrevocable, non-exclusive, worldwide, perpetual, unrestricted, royalty-free license (with the right to sublicense) to use, reproduce, distribute, publicly display, publicly perform, modify, edit, create derivative works from, incorporate into one or more compilations and reproduce and distribute such compilations, and otherwise exploit such Communications, together with any personal information transmitted with your Communications (such as name, user name and photograph), in all formats and in all media now known or later developed. > You acknowledge and agree that any Communications made to or by means of any Site Tool are public and you have no expectation of privacy in any such Communication. No confidential, fiduciary, contractually implied or other relationship is created between you and CR by reason of your transmitting a Communication to any Site Tool. There has to be a narrower way to draw up this agreement.
- Terretta 4y ago
  This means (a) their comment pages can incorporate your comments and mini bio to show on their comment pages, and (b) the Internet is not private. They have bad lawyers and bad Chief Legal Officer for allowing this boilerplate in an agreement for an app like this, but these two clauses are less nefarious than they sound. Technically your writings are copyright by you, so this pairing lets them do whatever with your comments, and display them to others without you coming after them for something.
  - deleted 4y ago
    [deleted]
  - landemva 4y ago
    > Chief Legal Officer Since around 2008 I notice everyone is an officer. There was a specific meaning of officer, and now it is big-shot-ism.
    - thrwawy74 4y ago
gnad_sucks 4y ago
Here's something I never see discussed. Assessing one's credit worthiness is naturally a data business. So, unlike for ads where companies knowing more about you has no upside, when it comes to credit the situation isn't as black and white. There's an actual trade-off. I DO want companies knowing how much I make because that's beneficial for me.
- ilyt 4y ago
  In EU your rating will only get lower if you actually don't pay for loans. I don't need to use credit card and pay it off regularly to get low mortgage. Bank ask about job and income information (for bigger stuff like mortgage) when you get the mortgage, not keep a file with your entire life's of financial information.
  - gnad_sucks 4y ago
    Ok for mortgage but I had in mind getting better credit cards in order to get rewards. I do want to give these companies what they want so I can get better rewards. I'm not saying the trade-off is worth it for everyone, I'm just saying there's a trade-off, unlike in advertising.
barnbuilder 4y ago
Why is this an app? It sounds like a nice service but I don't know why I need to install software on my phone and interact with a small touch screen in order to use it.
tempodox 4y ago
> With a tap, you can tell a company to stop selling your data or to delete your data entirely. Will they listen or just laugh it off? Besides, making it the individual's job to run around and tell everyone to delete their data is the worst possible way. And who has data on you without your knowledge? How about not collecting all that data in the first place? Edit for clarification: I'm not criticizing CR, they're doing what they can under the circumstances.
- buzzerbetrayed 4y ago
  Don’t let the perfect be the event of the good. CR can’t make companies not collect data to begin with. That requires legislation. With this app, they are doing what they _can_ do.
  - tempodox 4y ago
    I agree, and I wasn't blaming CR. I thought it would be obvious that it's legislation that is lacking.
- ilyt 4y ago
  If they are under reach GDPR they have to if you tell them. No idea whether separate company pretending to be a proxy of you would be listened to
- tony101 4y ago
  From their FAQ: “Permission Slip helps you exercise your right to privacy under the California Consumer Privacy Act (CCPA) by acting as your ‘authorized agent’ and sending data requests to companies for you.” https://www.permissionslipcr.com/faq.php https://www.permissionslipcr.com/faq.php The California Attorney General is monitoring companies’ compliance with authorized agent requests: “The sweep also focuses on businesses that failed to process consumer requests submitted via an authorized agent, as required by the CCPA. Requests submitted by authorized agents include those sent by Permission Slip, a mobile application developed by Consumer Reports that allows consumers to send requests to opt-out and delete their personal information.” https://oag.ca.gov/news/press-releases/ahead-data-privacy-day-attorney-general-bonta-focuses-mobile-applications’ https://oag.ca.gov/news/press-releases/ahead-data-privacy-da...
pseufaux 4y ago
Anyone else put off by the privacy policy? It’s essentially the equivalent to what most companies do that they are “helping” with. I get that some data retention is required for offering this service, but I am not sure why they would need to retain data if my account is deleted. At least they are up front about it (assuming you are they type to read privacy policies).
joshka 4y ago
There is also simpleoptout for the more lo-fi approach. https://simpleoptout.com/ https://simpleoptout.com/

82 points by tony101 4y ago

m463 4y ago

I stopped using consumer reports online because they LOST their independence. Their website connected very intimately with the sales channels and they made their money from referrals. This reminds me of apple touting privacy, while simultaneously tracking all your activity with little or no recourse.

bigmattystyles 4y ago
It’s like how VPN providers say to use them to protect yourself from your ISP. Don’t get me wrong, Comcast has its many many issues, but I still trust them more than I would most VPNs. I guess it’s easier to create anonymity with VPNs, but still, most people just think they have a VPN so they’re good.
- bradknowles 4y ago
  In contrast, I would trust almost any VPN provider far more than I do Comcast or any other major ISP that I know of. AT&T has already had major litigation against them for their activities with deep packet inspection, injecting their own ads, and blocking or traffic shaping other sites on the Internet that compete with services that AT&T wants to sell you instead (like Netflix). And Comcast is far worse in this space than AT&T.
- kerkeslager 4y ago
  The word "trust" is pretty meaningless in a void--if you can't answer "trust to do what?" I think you're missing some nuance to the concept. For example, I trust my parents to do what they think is best for me, because I have decades of experience showing that is genuinely their goal. But would I trust my father to perform open-heart surgery on me? Absolutely not! The man doesn't have a medical degree of any kind. With corporations, my trust is largely based on their incentives. I trust Comcast not to sell my credit card data to Nigerian scammers, because they're clearly making more money by being a cable provider than they would by being a credit card data darknet wholesaler, and selling my credit card data to Nigerian scammers would put their more profitable business at risk. VPNs... might sell my credit card data to Nigerian scammers, because their profit margins aren't as high and their reputations are already not great. I don't trust Comcast not to report my metadata to the NSA or to reject MPAA requests for torrent data, because they already did both those things and have incentives to continue. I trust VPNs to request MPAA requests for torrent data, because as soon as that became known it would hurt their business model. I don't trust VPNs not to report my metadata to the NSA because acting as a honey trap for the NSA could be pretty profitable and probably wouldn't become public, so it wouldn't hurt their business model.
- KyeRussell 4y ago
  This particular situation feels sufficiently far from the original point that I’d say it isn’t that fair a comparison.
jcoq 4y ago
> connected very intimately Do you mean hyperlinks? They're not hiding anything: https://www.consumerreports.org/cro/about-us/our-partners/commercial-partners/index.htm https://www.consumerreports.org/cro/about-us/our-partners/co...
- m463 4y ago
  I used to subscribe to the physical magazine and I thought they had much higher standards. They accepted no advertising in their magazine. They bought cars independently, and tested them as customers. I think their "adaptation" to the internet might have been necessary to survive, but I believe it made them less objective.

bcherny 4y ago

Downloaded! Funny, I suggested building an app exactly like this a month ago. In unusual HN fashion, I was immediately shot down as “that would never work” [1]. I feel vindicated that Consumer Reports built this :p. [1] https://news.ycombinator.com/item?id=34194778 https://news.ycombinator.com/item?id=34194778

KyeRussell 4y ago
“YC et al would never fund this! You’d barely even become a billionaire.” Is how I read those responses when they come from Hacker News.

bradknowles 4y ago

The landing page tells me nothing useful about this app. So, I'm not inclined to trust it at all, because anyone can claim they are "Powered by Consumer Reports", and without any evidence to back that up, it's just an empty claim. Can someone please explain to me why I'm wrong?

tony101 4y ago
Refer to https://digital-lab.consumerreports.org/2022/11/16/introducing-permission-slip/ https://digital-lab.consumerreports.org/2022/11/16/introduci...
- bradknowles 4y ago
  Okay. That link explains a little bit. Enough that I'd be willing to check it out now, in comparison to other tools like DeleteMe. But it would have been nice to see that same information on the landing page for the software. Or at least have that link included in the original post here on HN.
  - bradknowles 4y ago
    Well that was a fast fail. I decided to try to have them request that Home Depot stop selling my data, and then the program seems to have hung on a blank page. I hope the problem is that their servers are overloaded due to "HN Hug-o-Death", and not something else.
- mhb 4y ago
  There are a lot more words there, but no more explanation of what it is.
- dang 4y ago
  Ok, we've changed to that from https://www.permissionslipcr.com/ https://www.permissionslipcr.com/ above.
kmoser 4y ago
For that matter, could this have been done as a website rather than a mobile app?

thrwawy74 4y ago

https://www.consumerreports.org/cro/2015/01/user-agreement/index.htm https://www.consumerreports.org/cro/2015/01/user-agreement/i... > By transmitting any Communication to the Site, you grant CR an irrevocable, non-exclusive, worldwide, perpetual, unrestricted, royalty-free license (with the right to sublicense) to use, reproduce, distribute, publicly display, publicly perform, modify, edit, create derivative works from, incorporate into one or more compilations and reproduce and distribute such compilations, and otherwise exploit such Communications, together with any personal information transmitted with your Communications (such as name, user name and photograph), in all formats and in all media now known or later developed. > You acknowledge and agree that any Communications made to or by means of any Site Tool are public and you have no expectation of privacy in any such Communication. No confidential, fiduciary, contractually implied or other relationship is created between you and CR by reason of your transmitting a Communication to any Site Tool. There has to be a narrower way to draw up this agreement.

Terretta 4y ago
This means (a) their comment pages can incorporate your comments and mini bio to show on their comment pages, and (b) the Internet is not private. They have bad lawyers and bad Chief Legal Officer for allowing this boilerplate in an agreement for an app like this, but these two clauses are less nefarious than they sound. Technically your writings are copyright by you, so this pairing lets them do whatever with your comments, and display them to others without you coming after them for something.
- deleted 4y ago
  [deleted]
- landemva 4y ago
  > Chief Legal Officer Since around 2008 I notice everyone is an officer. There was a specific meaning of officer, and now it is big-shot-ism.
  - thrwawy74 4y ago

gnad_sucks 4y ago

Here's something I never see discussed. Assessing one's credit worthiness is naturally a data business. So, unlike for ads where companies knowing more about you has no upside, when it comes to credit the situation isn't as black and white. There's an actual trade-off. I DO want companies knowing how much I make because that's beneficial for me.

ilyt 4y ago
In EU your rating will only get lower if you actually don't pay for loans. I don't need to use credit card and pay it off regularly to get low mortgage. Bank ask about job and income information (for bigger stuff like mortgage) when you get the mortgage, not keep a file with your entire life's of financial information.
- gnad_sucks 4y ago
  Ok for mortgage but I had in mind getting better credit cards in order to get rewards. I do want to give these companies what they want so I can get better rewards. I'm not saying the trade-off is worth it for everyone, I'm just saying there's a trade-off, unlike in advertising.

barnbuilder 4y ago

Why is this an app? It sounds like a nice service but I don't know why I need to install software on my phone and interact with a small touch screen in order to use it.

tempodox 4y ago

> With a tap, you can tell a company to stop selling your data or to delete your data entirely. Will they listen or just laugh it off? Besides, making it the individual's job to run around and tell everyone to delete their data is the worst possible way. And who has data on you without your knowledge? How about not collecting all that data in the first place? Edit for clarification: I'm not criticizing CR, they're doing what they can under the circumstances.

buzzerbetrayed 4y ago
Don’t let the perfect be the event of the good. CR can’t make companies not collect data to begin with. That requires legislation. With this app, they are doing what they _can_ do.
- tempodox 4y ago
  I agree, and I wasn't blaming CR. I thought it would be obvious that it's legislation that is lacking.
ilyt 4y ago
If they are under reach GDPR they have to if you tell them. No idea whether separate company pretending to be a proxy of you would be listened to
tony101 4y ago
From their FAQ: “Permission Slip helps you exercise your right to privacy under the California Consumer Privacy Act (CCPA) by acting as your ‘authorized agent’ and sending data requests to companies for you.” https://www.permissionslipcr.com/faq.php https://www.permissionslipcr.com/faq.php The California Attorney General is monitoring companies’ compliance with authorized agent requests: “The sweep also focuses on businesses that failed to process consumer requests submitted via an authorized agent, as required by the CCPA. Requests submitted by authorized agents include those sent by Permission Slip, a mobile application developed by Consumer Reports that allows consumers to send requests to opt-out and delete their personal information.” https://oag.ca.gov/news/press-releases/ahead-data-privacy-day-attorney-general-bonta-focuses-mobile-applications’ https://oag.ca.gov/news/press-releases/ahead-data-privacy-da...

pseufaux 4y ago

Anyone else put off by the privacy policy? It’s essentially the equivalent to what most companies do that they are “helping” with. I get that some data retention is required for offering this service, but I am not sure why they would need to retain data if my account is deleted. At least they are up front about it (assuming you are they type to read privacy policies).

joshka 4y ago

There is also simpleoptout for the more lo-fi approach. https://simpleoptout.com/ https://simpleoptout.com/