6 ms·

I've upvoted you, despite disagreeing with you, because I believe it's worth us all discussing the reasoning behind our opinions. What you've just said is the

I've upvoted you, despite disagreeing with you, because I believe it's worth us all discussing the reasoning behind our opinions. What you've just said is the email equivalent to "she deserved to be raped, because she was dressed like a slut". Yes, we should take precautions to protect ourselves. But that in no way justifies the privacy intrusions that happened here.

Redoubts 10y ago
I think it's closer to "you deserved your message to be read, since you put it on the back of a postcard". But ok.
- morganvachon 10y ago
  This. Email messages are digital postcards. When it leaves your computer (house) and goes to your ISP (local post office), anyone at that place can pick it up and read it before sending it on its way to the recipient's mail handler. While it's in transit, it's not sealed, it's not obscured or encrypted, it is plain text. Now, that doesn't change the fact that Yahoo rolled over like a puppy when the government came calling, which is reprehensible for any tech company to do. They should have fought it and asked for a warrant for the specific persons of interest, rather than happily fucking over every single Yahoo email subscriber.
  - roywiggins 10y ago
    Don't a lot of the big providers pass emails between each other encrypted with TLS? And emails internal to Yahoo's email system wouldn't be visible to your ISP or anyone outside of Yahoo. https://www.google.com/transparencyreport/saferemail/ https://www.google.com/transparencyreport/saferemail/
    - morganvachon 10y ago
      They might pass the email around via TLS but they store their copy unencrypted on their servers[1]. Even if they do one day decide to encrypt their local copy, they hold the keys, you don't. According to the Ars article on this subject[2], Google has officially said "We haven't been subpoenaed and if we were we'd say 'no'", but that stance could change in the next few years. [1] https://www.google.com/transparencyreport/saferemail/faq/#what_do_you_mean_by https://www.google.com/transparencyreport/saferemail/faq/#wh... [2] http://arstechnica.com/tech-policy/2016/10/report-fbi-andor-nsa-ordered-yahoo-to-build-secret-e-mail-search-tool/ http://arstechnica.com/tech-policy/2016/10/report-fbi-andor-...
  - dredmorbius 10y ago
    The fact that email is a digital postcard doesn't mean it must be. SMTP was designed with no privacy, security, reputation, or authentication capabilities. Even the add-ons which provide some of these (e.g., PGP -- and I'm looking for the comment on this thread mentioning that) doesn't address what's almost always more useful than full-text search: metadata. It's the systematic failure of tech industry leadership to come up with an open and viable alternative to email that's landed us in this position, and that's a lack of action that's increasingly utterly indefensible.
- itsnotlupus 10y ago
  Or maybe "you deserved your postcard along with millions of other postcards to get systemically OCR'd and entered into a government database" ? Concepts of scale and intent are rather central to this discussion. This isn't about a postal employee glancing at your postcard and thinking you must be having a nice vacation.
kefka 10y ago
I don't quite follow that analogy. My underlying thoughts are as follows. Yahoo is the target in this story, so I'll use Yahoo as the placeholder for any company that deals with user data in that capacity. When you send an email, it shows up at a destination. You send it from your mail provider, "magic happens", and it shows up at the destination. By definition, the text that you send it what is received. By sending your text with who you want it to go to, you are relinquishing control over your data. Now, Yahoo can read it. And any mailserver in between. And the destination mailserver can as well. You also give up a form of copyright- because the basis of this transmission means that the same message may appear multiple places. With the USPS, we pay postage to send data and packages. And there are stringent safeguards in place for the USPS. We have no such data safeguard laws in the US. European Union is different (I don't know the laws there). But whatever data I send to some private org, can be used and reused in whatever ways that are bound by their privacy policy (which they write), and whatever contracts they abide by (PCI DSS, HIPAA, FERPA, etc). Even though this part isn't logical, whenever I don't pay for a service, I automatically assume that I'm paying with my data. I guess when you're cash-poor, it's a good trade-off.
- matt4077 10y ago
  The "paying-with-my-data-I-am-the-product" cliche doesn't really work here because Yahoo didn't do this for money. You are also not giving up "some form of copyright" beyond the narrow definition of the license yahoo may require to show it to someone else. Otherwise there'd probably be a few bestsellers owned by google et al. – I'm sure quite a few Harry Potter manuscripts went through their network. There's a certain expectation of the relationship between a service like yahoo's and the customer. Those expectations go beyond what may be the bare minimum that is legally required. Considering that there is healthy competition even in the free tier of email services, consumers are not powerless in the "negotiation" that defines this relationship. The bare minimum of any such relationship must be a truthful and specific description of any access the provider has to my data. Indeed that is a legal requirement in many jurisdictions. But how can I trust them? It depends on the organization. I'm 100% certain that Apple doesn't sell the content of my e-mails because it'd be stupid... They'd be risking a triple-digit-revenue business on what could amount to a few million/year tops. Their and my interest are aligned. Regarding the analogy you weren't following: placing yourself in a position of vulnerability is simply never an excuse for anybody, either legally or morally, to exploit that vulnerability. If I accidentally leave my bike unlocked doesn't change the thieve's legal or moral standing at all.
rdiddly 10y ago
I don't see how there's anything to agree or disagree with. Nowhere is the question of "deserving" or justice raised explicitly, for example. It's just a fact: your shit is being read and analyzed at all times and at all levels. If in doubt, the safer course of action is likely to be based on assuming this rather than assuming otherwise. Encryption is a way to make sure. Though even that won't stop somebody who has already pwned your system.

Redoubts 10y ago

I think it's closer to "you deserved your message to be read, since you put it on the back of a postcard". But ok.

morganvachon 10y ago
This. Email messages are digital postcards. When it leaves your computer (house) and goes to your ISP (local post office), anyone at that place can pick it up and read it before sending it on its way to the recipient's mail handler. While it's in transit, it's not sealed, it's not obscured or encrypted, it is plain text. Now, that doesn't change the fact that Yahoo rolled over like a puppy when the government came calling, which is reprehensible for any tech company to do. They should have fought it and asked for a warrant for the specific persons of interest, rather than happily fucking over every single Yahoo email subscriber.
- roywiggins 10y ago
  Don't a lot of the big providers pass emails between each other encrypted with TLS? And emails internal to Yahoo's email system wouldn't be visible to your ISP or anyone outside of Yahoo. https://www.google.com/transparencyreport/saferemail/ https://www.google.com/transparencyreport/saferemail/
  - morganvachon 10y ago
    They might pass the email around via TLS but they store their copy unencrypted on their servers[1]. Even if they do one day decide to encrypt their local copy, they hold the keys, you don't. According to the Ars article on this subject[2], Google has officially said "We haven't been subpoenaed and if we were we'd say 'no'", but that stance could change in the next few years. [1] https://www.google.com/transparencyreport/saferemail/faq/#what_do_you_mean_by https://www.google.com/transparencyreport/saferemail/faq/#wh... [2] http://arstechnica.com/tech-policy/2016/10/report-fbi-andor-nsa-ordered-yahoo-to-build-secret-e-mail-search-tool/ http://arstechnica.com/tech-policy/2016/10/report-fbi-andor-...
- dredmorbius 10y ago
  The fact that email is a digital postcard doesn't mean it must be. SMTP was designed with no privacy, security, reputation, or authentication capabilities. Even the add-ons which provide some of these (e.g., PGP -- and I'm looking for the comment on this thread mentioning that) doesn't address what's almost always more useful than full-text search: metadata. It's the systematic failure of tech industry leadership to come up with an open and viable alternative to email that's landed us in this position, and that's a lack of action that's increasingly utterly indefensible.
itsnotlupus 10y ago
Or maybe "you deserved your postcard along with millions of other postcards to get systemically OCR'd and entered into a government database" ? Concepts of scale and intent are rather central to this discussion. This isn't about a postal employee glancing at your postcard and thinking you must be having a nice vacation.

kefka 10y ago

I don't quite follow that analogy. My underlying thoughts are as follows. Yahoo is the target in this story, so I'll use Yahoo as the placeholder for any company that deals with user data in that capacity. When you send an email, it shows up at a destination. You send it from your mail provider, "magic happens", and it shows up at the destination. By definition, the text that you send it what is received. By sending your text with who you want it to go to, you are relinquishing control over your data. Now, Yahoo can read it. And any mailserver in between. And the destination mailserver can as well. You also give up a form of copyright- because the basis of this transmission means that the same message may appear multiple places. With the USPS, we pay postage to send data and packages. And there are stringent safeguards in place for the USPS. We have no such data safeguard laws in the US. European Union is different (I don't know the laws there). But whatever data I send to some private org, can be used and reused in whatever ways that are bound by their privacy policy (which they write), and whatever contracts they abide by (PCI DSS, HIPAA, FERPA, etc). Even though this part isn't logical, whenever I don't pay for a service, I automatically assume that I'm paying with my data. I guess when you're cash-poor, it's a good trade-off.

matt4077 10y ago
The "paying-with-my-data-I-am-the-product" cliche doesn't really work here because Yahoo didn't do this for money. You are also not giving up "some form of copyright" beyond the narrow definition of the license yahoo may require to show it to someone else. Otherwise there'd probably be a few bestsellers owned by google et al. – I'm sure quite a few Harry Potter manuscripts went through their network. There's a certain expectation of the relationship between a service like yahoo's and the customer. Those expectations go beyond what may be the bare minimum that is legally required. Considering that there is healthy competition even in the free tier of email services, consumers are not powerless in the "negotiation" that defines this relationship. The bare minimum of any such relationship must be a truthful and specific description of any access the provider has to my data. Indeed that is a legal requirement in many jurisdictions. But how can I trust them? It depends on the organization. I'm 100% certain that Apple doesn't sell the content of my e-mails because it'd be stupid... They'd be risking a triple-digit-revenue business on what could amount to a few million/year tops. Their and my interest are aligned. Regarding the analogy you weren't following: placing yourself in a position of vulnerability is simply never an excuse for anybody, either legally or morally, to exploit that vulnerability. If I accidentally leave my bike unlocked doesn't change the thieve's legal or moral standing at all.

rdiddly 10y ago

I don't see how there's anything to agree or disagree with. Nowhere is the question of "deserving" or justice raised explicitly, for example. It's just a fact: your shit is being read and analyzed at all times and at all levels. If in doubt, the safer course of action is likely to be based on assuming this rather than assuming otherwise. Encryption is a way to make sure. Though even that won't stop somebody who has already pwned your system.