4 ms·

Lets take it a different way: You're knowingly sending your data to a 3rd party. You're not encrypting. It's not through the USPS (special protections). It se

by kefka 10y ago

Lets take it a different way: You're knowingly sending your data to a 3rd party. You're not encrypting. It's not through the USPS (special protections). It seems bloody evident that, of course, your email provider can read your emails! Unless you're encrypting with GPG, then they can (and they can still read the signing keys). Yahoo, Google, and friends all scan, dedup, and all sorts of tricks to determine marketing and quality content (spamming). If you're worried, run your own mailserver. It's what I do, along with using gmail. But I know that, at any time, people/scripts/ai are reading everything sent and received. edit: I'd much prefer to hear commentary/how wrong/how right/how crazy I am, rather than -1's.I'd like to hear a discussion about the "Secrecy of text written on postcards"....

peterkelly 10y ago
I've upvoted you, despite disagreeing with you, because I believe it's worth us all discussing the reasoning behind our opinions. What you've just said is the email equivalent to "she deserved to be raped, because she was dressed like a slut". Yes, we should take precautions to protect ourselves. But that in no way justifies the privacy intrusions that happened here.
- Redoubts 10y ago
  I think it's closer to "you deserved your message to be read, since you put it on the back of a postcard". But ok.
  - morganvachon 10y ago
    This. Email messages are digital postcards. When it leaves your computer (house) and goes to your ISP (local post office), anyone at that place can pick it up and read it before sending it on its way to the recipient's mail handler. While it's in transit, it's not sealed, it's not obscured or encrypted, it is plain text. Now, that doesn't change the fact that Yahoo rolled over like a puppy when the government came calling, which is reprehensible for any tech company to do. They should have fought it and asked for a warrant for the specific persons of interest, rather than happily fucking over every single Yahoo email subscriber.
    - roywiggins 10y ago
      Don't a lot of the big providers pass emails between each other encrypted with TLS? And emails internal to Yahoo's email system wouldn't be visible to your ISP or anyone outside of Yahoo. https://www.google.com/transparencyreport/saferemail/ https://www.google.com/transparencyreport/saferemail/
      - morganvachon 10y ago
        They might pass the email around via TLS but they store their copy unencrypted on their servers[1]. Even if they do one day decide to encrypt their local copy, they hold the keys, you don't. According to the Ars article on this subject[2], Google has officially said "We haven't been subpoenaed and if we were we'd say 'no'", but that stance could change in the next few years. [1] https://www.google.com/transparencyreport/saferemail/faq/#what_do_you_mean_by https://www.google.com/transparencyreport/saferemail/faq/#wh... [2] http://arstechnica.com/tech-policy/2016/10/report-fbi-andor-nsa-ordered-yahoo-to-build-secret-e-mail-search-tool/ http://arstechnica.com/tech-policy/2016/10/report-fbi-andor-...
    - dredmorbius 10y ago
      The fact that email is a digital postcard doesn't mean it must be. SMTP was designed with no privacy, security, reputation, or authentication capabilities. Even the add-ons which provide some of these (e.g., PGP -- and I'm looking for the comment on this thread mentioning that) doesn't address what's almost always more useful than full-text search: metadata. It's the systematic failure of tech industry leadership to come up with an open and viable alternative to email that's landed us in this position, and that's a lack of action that's increasingly utterly indefensible.
  - itsnotlupus 10y ago
    Or maybe "you deserved your postcard along with millions of other postcards to get systemically OCR'd and entered into a government database" ? Concepts of scale and intent are rather central to this discussion. This isn't about a postal employee glancing at your postcard and thinking you must be having a nice vacation.
- kefka 10y ago
  I don't quite follow that analogy. My underlying thoughts are as follows. Yahoo is the target in this story, so I'll use Yahoo as the placeholder for any company that deals with user data in that capacity. When you send an email, it shows up at a destination. You send it from your mail provider, "magic happens", and it shows up at the destination. By definition, the text that you send it what is received. By sending your text with who you want it to go to, you are relinquishing control over your data. Now, Yahoo can read it. And any mailserver in between. And the destination mailserver can as well. You also give up a form of copyright- because the basis of this transmission means that the same message may appear multiple places. With the USPS, we pay postage to send data and packages. And there are stringent safeguards in place for the USPS. We have no such data safeguard laws in the US. European Union is different (I don't know the laws there). But whatever data I send to some private org, can be used and reused in whatever ways that are bound by their privacy policy (which they write), and whatever contracts they abide by (PCI DSS, HIPAA, FERPA, etc). Even though this part isn't logical, whenever I don't pay for a service, I automatically assume that I'm paying with my data. I guess when you're cash-poor, it's a good trade-off.
  - matt4077 10y ago
    The "paying-with-my-data-I-am-the-product" cliche doesn't really work here because Yahoo didn't do this for money. You are also not giving up "some form of copyright" beyond the narrow definition of the license yahoo may require to show it to someone else. Otherwise there'd probably be a few bestsellers owned by google et al. – I'm sure quite a few Harry Potter manuscripts went through their network. There's a certain expectation of the relationship between a service like yahoo's and the customer. Those expectations go beyond what may be the bare minimum that is legally required. Considering that there is healthy competition even in the free tier of email services, consumers are not powerless in the "negotiation" that defines this relationship. The bare minimum of any such relationship must be a truthful and specific description of any access the provider has to my data. Indeed that is a legal requirement in many jurisdictions. But how can I trust them? It depends on the organization. I'm 100% certain that Apple doesn't sell the content of my e-mails because it'd be stupid... They'd be risking a triple-digit-revenue business on what could amount to a few million/year tops. Their and my interest are aligned. Regarding the analogy you weren't following: placing yourself in a position of vulnerability is simply never an excuse for anybody, either legally or morally, to exploit that vulnerability. If I accidentally leave my bike unlocked doesn't change the thieve's legal or moral standing at all.
- rdiddly 10y ago
  I don't see how there's anything to agree or disagree with. Nowhere is the question of "deserving" or justice raised explicitly, for example. It's just a fact: your shit is being read and analyzed at all times and at all levels. If in doubt, the safer course of action is likely to be based on assuming this rather than assuming otherwise. Encryption is a way to make sure. Though even that won't stop somebody who has already pwned your system.
rudolf0 10y ago
Yes, but there's a huge difference between a computer "seeing" your email and a human being searching for keywords within your email to decide whether or not to follow you around and/or arrest you. This report isn't complaining about unencrypted emails. It's about them giving an intelligence agency the equivalent of a `grep "terrorism" | tail -f` for all their users' email. Without a warrant. (Not that a warrant could even be granted for something so broad, anyway.)
- kefka 10y ago
  You're right, that US govt bulk-scanning is terrifying, especially without warrants. But what happens when Facebook scans your private chats and reports your illegal doings to the police? ( http://www.infowars.com/facebook-monitors-your-private-messages-and-photos-for-criminal-activity-reports-them-to-police/ http://www.infowars.com/facebook-monitors-your-private-messa... ) What data restrictions do we have that would prevent $dataCompany from sharing data with other actors? I'm sure a "privacy policy" can do something, but in the end, not really. The FTC doesn't require a privacy policy; they can only enforce one and apply lowball fines for bad behavior. For example, what laws would prevent me from running a "* As a Service", scanning everything, ranging from copyright violations, spammers, criminal enterprises, and today's bugagboo of terrorism; and forwarding each of those things to the relevant authorities? Can a law protect criminal behavior in cases it is illegal? What responsibilities do you have if you know of criminality? And specifically talking of emails, unless they are encrypted, they are akin to postcards with the content all in the clear. (And for your example, I get your sentiment, but I'm guessing they'd have a neural net that triggers on examples of terrorism discussion. And they'd run all messages through it. Not saying I agree with it without a warrant...)
  - frankydp 10y ago
    The system you are referring to is called Behavioral Retargeting, with the only difference being that retargeting is for profit not policing.
  - _audakel 10y ago
    thats why i like using google allo - end-to-end encryption and expiring chats https://allo.google.com/ https://allo.google.com/
kafkaesq 10y ago
I'd like to hear a discussion about the "Secrecy of text written on postcards".... In a nutshell, there's a near-consensus (if I'm not mistaken) among judicial experts that in fact, email has the same expectations of privacy as regular, sealed postal mail (i.e. not postcards). So that's where the postcard analogy breaks down.
mindslight 10y ago
I wholeheartedly agree with you, pragmatically. But you also have to take into account why there are special protections on the USPS. Privacy is a quality people generally expect to have. The USPS protections were created after the long social feedback cycle it took for people to realize what they were missing. We're going through another one of those cycles now, where people are finally realizing how surveilled-by-design modern technology is. I'm unsure what will be quicker - groupwise societal understanding leading to legal privacy protection, or individual adoption of specific better technology. Given that social protections only work for those in "average" society, I personally hope it's the latter. But the two viewpoints are not conflicting, and are actually complementary - privacy preserving tools educate society as to what is possible, and a person has to value privacy before they can seek out tools to preserve it,
- kefka 10y ago
  Please, I am absolutely for protections of data privacy even more stringent than what the USPS does with parcels. I would be for something akin to "Swiss Banking requirements for Data" - where companies are NOT allowed to share data unless given exception in writing/cryptographically. I'm sure we can expound on these ideas collectively. I'd also be OK with services that DO treat data as a semipermeable membrane. Think of what Google has done with all their free services. They make neural models that they (and others they choose to release) can exploit to great effect. In cases like this, there needs to be a simple chart; think of something like this https://tldrlegal.com/license/apache-license-2.0-(apache-2.0) https://tldrlegal.com/license/apache-license-2.0-(apache-2.0... . I also think of these services as bringing technology to me when I could not afford it... And yes, it has been a wonderful boon for me, and I'm sure as for Google as well. I also want to be able to request all the data on my account, sent to me in a reasonable format (multiple of: Zip, ftp, file share, mailed DVDs for reasonable price). European Union already has that law, to great effect. I should also be able to legally command a company to remove my content. If copyright is so great, I should be able to revoke their rights to it as well due to copyright. ______________________________ I get privacy. I get how networks work, and how the Internet works. I know how mailservers work, as well as file deduplication. And I see a glaring hole in the technology that allows an action, a-ethical companies that will do anything to get ahead, and a government hell-bent on dismantling privacy and data security all to stop today's big bad monster, terrorism. I'm also guaranteed on watch lists. I'm a minor Tor developer, and greatly utilizes Tor in many ways. In fact, my network resides in Tor-Space. I've figured out how to get Linux to resolve .onion addresses seamlessly, and have .onion endpoints on all my Linux machines. I also work with IPFS and Zeronet, both technologies that have some very... interesting content as well. It's my little corner of the Net... And if I help others with my tech, awesome. If enough of us do this, then we can start stemming the tide of data insecurity. But I also remember, parts of these issues are with the Political system, and not of technology. Until these older, technologically ignorant politicians die or retire, and Millenials come in, we're stuck. At least we've grown up with it.

by kefka 10y ago

peterkelly 10y ago

I've upvoted you, despite disagreeing with you, because I believe it's worth us all discussing the reasoning behind our opinions. What you've just said is the email equivalent to "she deserved to be raped, because she was dressed like a slut". Yes, we should take precautions to protect ourselves. But that in no way justifies the privacy intrusions that happened here.

Redoubts 10y ago
I think it's closer to "you deserved your message to be read, since you put it on the back of a postcard". But ok.
- morganvachon 10y ago
  This. Email messages are digital postcards. When it leaves your computer (house) and goes to your ISP (local post office), anyone at that place can pick it up and read it before sending it on its way to the recipient's mail handler. While it's in transit, it's not sealed, it's not obscured or encrypted, it is plain text. Now, that doesn't change the fact that Yahoo rolled over like a puppy when the government came calling, which is reprehensible for any tech company to do. They should have fought it and asked for a warrant for the specific persons of interest, rather than happily fucking over every single Yahoo email subscriber.
  - roywiggins 10y ago
    Don't a lot of the big providers pass emails between each other encrypted with TLS? And emails internal to Yahoo's email system wouldn't be visible to your ISP or anyone outside of Yahoo. https://www.google.com/transparencyreport/saferemail/ https://www.google.com/transparencyreport/saferemail/
    - morganvachon 10y ago
      They might pass the email around via TLS but they store their copy unencrypted on their servers[1]. Even if they do one day decide to encrypt their local copy, they hold the keys, you don't. According to the Ars article on this subject[2], Google has officially said "We haven't been subpoenaed and if we were we'd say 'no'", but that stance could change in the next few years. [1] https://www.google.com/transparencyreport/saferemail/faq/#what_do_you_mean_by https://www.google.com/transparencyreport/saferemail/faq/#wh... [2] http://arstechnica.com/tech-policy/2016/10/report-fbi-andor-nsa-ordered-yahoo-to-build-secret-e-mail-search-tool/ http://arstechnica.com/tech-policy/2016/10/report-fbi-andor-...
  - dredmorbius 10y ago
    The fact that email is a digital postcard doesn't mean it must be. SMTP was designed with no privacy, security, reputation, or authentication capabilities. Even the add-ons which provide some of these (e.g., PGP -- and I'm looking for the comment on this thread mentioning that) doesn't address what's almost always more useful than full-text search: metadata. It's the systematic failure of tech industry leadership to come up with an open and viable alternative to email that's landed us in this position, and that's a lack of action that's increasingly utterly indefensible.
- itsnotlupus 10y ago
  Or maybe "you deserved your postcard along with millions of other postcards to get systemically OCR'd and entered into a government database" ? Concepts of scale and intent are rather central to this discussion. This isn't about a postal employee glancing at your postcard and thinking you must be having a nice vacation.
kefka 10y ago
I don't quite follow that analogy. My underlying thoughts are as follows. Yahoo is the target in this story, so I'll use Yahoo as the placeholder for any company that deals with user data in that capacity. When you send an email, it shows up at a destination. You send it from your mail provider, "magic happens", and it shows up at the destination. By definition, the text that you send it what is received. By sending your text with who you want it to go to, you are relinquishing control over your data. Now, Yahoo can read it. And any mailserver in between. And the destination mailserver can as well. You also give up a form of copyright- because the basis of this transmission means that the same message may appear multiple places. With the USPS, we pay postage to send data and packages. And there are stringent safeguards in place for the USPS. We have no such data safeguard laws in the US. European Union is different (I don't know the laws there). But whatever data I send to some private org, can be used and reused in whatever ways that are bound by their privacy policy (which they write), and whatever contracts they abide by (PCI DSS, HIPAA, FERPA, etc). Even though this part isn't logical, whenever I don't pay for a service, I automatically assume that I'm paying with my data. I guess when you're cash-poor, it's a good trade-off.
- matt4077 10y ago
  The "paying-with-my-data-I-am-the-product" cliche doesn't really work here because Yahoo didn't do this for money. You are also not giving up "some form of copyright" beyond the narrow definition of the license yahoo may require to show it to someone else. Otherwise there'd probably be a few bestsellers owned by google et al. – I'm sure quite a few Harry Potter manuscripts went through their network. There's a certain expectation of the relationship between a service like yahoo's and the customer. Those expectations go beyond what may be the bare minimum that is legally required. Considering that there is healthy competition even in the free tier of email services, consumers are not powerless in the "negotiation" that defines this relationship. The bare minimum of any such relationship must be a truthful and specific description of any access the provider has to my data. Indeed that is a legal requirement in many jurisdictions. But how can I trust them? It depends on the organization. I'm 100% certain that Apple doesn't sell the content of my e-mails because it'd be stupid... They'd be risking a triple-digit-revenue business on what could amount to a few million/year tops. Their and my interest are aligned. Regarding the analogy you weren't following: placing yourself in a position of vulnerability is simply never an excuse for anybody, either legally or morally, to exploit that vulnerability. If I accidentally leave my bike unlocked doesn't change the thieve's legal or moral standing at all.
rdiddly 10y ago
I don't see how there's anything to agree or disagree with. Nowhere is the question of "deserving" or justice raised explicitly, for example. It's just a fact: your shit is being read and analyzed at all times and at all levels. If in doubt, the safer course of action is likely to be based on assuming this rather than assuming otherwise. Encryption is a way to make sure. Though even that won't stop somebody who has already pwned your system.

rudolf0 10y ago

Yes, but there's a huge difference between a computer "seeing" your email and a human being searching for keywords within your email to decide whether or not to follow you around and/or arrest you. This report isn't complaining about unencrypted emails. It's about them giving an intelligence agency the equivalent of a `grep "terrorism" | tail -f` for all their users' email. Without a warrant. (Not that a warrant could even be granted for something so broad, anyway.)

kefka 10y ago
You're right, that US govt bulk-scanning is terrifying, especially without warrants. But what happens when Facebook scans your private chats and reports your illegal doings to the police? ( http://www.infowars.com/facebook-monitors-your-private-messages-and-photos-for-criminal-activity-reports-them-to-police/ http://www.infowars.com/facebook-monitors-your-private-messa... ) What data restrictions do we have that would prevent $dataCompany from sharing data with other actors? I'm sure a "privacy policy" can do something, but in the end, not really. The FTC doesn't require a privacy policy; they can only enforce one and apply lowball fines for bad behavior. For example, what laws would prevent me from running a "* As a Service", scanning everything, ranging from copyright violations, spammers, criminal enterprises, and today's bugagboo of terrorism; and forwarding each of those things to the relevant authorities? Can a law protect criminal behavior in cases it is illegal? What responsibilities do you have if you know of criminality? And specifically talking of emails, unless they are encrypted, they are akin to postcards with the content all in the clear. (And for your example, I get your sentiment, but I'm guessing they'd have a neural net that triggers on examples of terrorism discussion. And they'd run all messages through it. Not saying I agree with it without a warrant...)
- frankydp 10y ago
  The system you are referring to is called Behavioral Retargeting, with the only difference being that retargeting is for profit not policing.
- _audakel 10y ago
  thats why i like using google allo - end-to-end encryption and expiring chats https://allo.google.com/ https://allo.google.com/

kafkaesq 10y ago

I'd like to hear a discussion about the "Secrecy of text written on postcards".... In a nutshell, there's a near-consensus (if I'm not mistaken) among judicial experts that in fact, email has the same expectations of privacy as regular, sealed postal mail (i.e. not postcards). So that's where the postcard analogy breaks down.

mindslight 10y ago

I wholeheartedly agree with you, pragmatically. But you also have to take into account why there are special protections on the USPS. Privacy is a quality people generally expect to have. The USPS protections were created after the long social feedback cycle it took for people to realize what they were missing. We're going through another one of those cycles now, where people are finally realizing how surveilled-by-design modern technology is. I'm unsure what will be quicker - groupwise societal understanding leading to legal privacy protection, or individual adoption of specific better technology. Given that social protections only work for those in "average" society, I personally hope it's the latter. But the two viewpoints are not conflicting, and are actually complementary - privacy preserving tools educate society as to what is possible, and a person has to value privacy before they can seek out tools to preserve it,

kefka 10y ago
Please, I am absolutely for protections of data privacy even more stringent than what the USPS does with parcels. I would be for something akin to "Swiss Banking requirements for Data" - where companies are NOT allowed to share data unless given exception in writing/cryptographically. I'm sure we can expound on these ideas collectively. I'd also be OK with services that DO treat data as a semipermeable membrane. Think of what Google has done with all their free services. They make neural models that they (and others they choose to release) can exploit to great effect. In cases like this, there needs to be a simple chart; think of something like this https://tldrlegal.com/license/apache-license-2.0-(apache-2.0) https://tldrlegal.com/license/apache-license-2.0-(apache-2.0... . I also think of these services as bringing technology to me when I could not afford it... And yes, it has been a wonderful boon for me, and I'm sure as for Google as well. I also want to be able to request all the data on my account, sent to me in a reasonable format (multiple of: Zip, ftp, file share, mailed DVDs for reasonable price). European Union already has that law, to great effect. I should also be able to legally command a company to remove my content. If copyright is so great, I should be able to revoke their rights to it as well due to copyright. ______________________________ I get privacy. I get how networks work, and how the Internet works. I know how mailservers work, as well as file deduplication. And I see a glaring hole in the technology that allows an action, a-ethical companies that will do anything to get ahead, and a government hell-bent on dismantling privacy and data security all to stop today's big bad monster, terrorism. I'm also guaranteed on watch lists. I'm a minor Tor developer, and greatly utilizes Tor in many ways. In fact, my network resides in Tor-Space. I've figured out how to get Linux to resolve .onion addresses seamlessly, and have .onion endpoints on all my Linux machines. I also work with IPFS and Zeronet, both technologies that have some very... interesting content as well. It's my little corner of the Net... And if I help others with my tech, awesome. If enough of us do this, then we can start stemming the tide of data insecurity. But I also remember, parts of these issues are with the Political system, and not of technology. Until these older, technologically ignorant politicians die or retire, and Millenials come in, we're stuck. At least we've grown up with it.