5 ms·

Except there is clear evidence that FastMail employees are able and willing to read through your personal emails, and they've become actively user-hostile in th

by shazow 8y ago

Except there is clear evidence that FastMail employees are able and willing to read through your personal emails, and they've become actively user-hostile in their support: https://twitter.com/shazow/status/1021570521987731458 https://twitter.com/shazow/status/1021570521987731458 Make of it what you will, but I worked at Google for a time and I came out more convinced that my data is safer there. This was 2012 so maybe things have changed since then, but we need better alternatives than things like FastMail (and I'd argue Firefox, but that's for another thread).

pacala 8y ago
Employee A reading email X does not scale. Google reading everyone's email with ever-better AI systems does scale, and is a much bigger threat to freedom, political or economical.
- yifanl 8y ago
  You don't need deep machine learning to write a simple script to fetch data from your servers. If Google can read all Gmail users' emails, Fastmail can read all their users' emails.
  - goliatone 8y ago
    I think maybe the point is that reading all your emails seems to be Google’s business model, while FastMail is a service provider that charges users for the service? Also, regarding “your data” being more secure with google... is more like Google is good at securing their main asset, which is Google’s data about you.
    - dmitrygr 8y ago
      Google no longer uses Gmail data for targeting. No person or ai is reading your email from your grandmother, florist, or then confirmation that you bought paper towels on Amazon.
- BartBoch 8y ago
  But employee A can search for a very specific thing, something that machine learning won't be able to do. So it does not need to scale if they want to target a single person.
  - pacala 8y ago
    Employee A has no clue which person to target. Nor does he know which emails to pay attention to. His search tools are primitive. His brain's processing power is limited. OTOH, Google's core business is scalable search.
    - saagarjha 8y ago
      > Employee A has no clue which person to target. Nor does he know which emails to pay attention to. Yes, he does: he looks up the people he knows about.
- mynewtb 8y ago
  A person reading your mail is a much more immediate, direct danger than your mails being slurped into the big data silo that can slowly and widely ruin society.
  - xvector 8y ago
    > that can slowly and widely ruin society. There is nothing to say these "big data silos" will run "slowly." And even if they ran slowly, the impact they could have on your life would likely be far larger than the more immediate impact of an employee reading your email.
ocdtrekkie 8y ago
It seems likely there is significant auditing at FastMail for access. For example, at one time when I asked them to check on why an email wasn't displaying correctly in their client, they asked me to create a folder with a specific name, and put it in that folder[1]. This suggests they have a process to request access to content that logs what is requested, and only displays the content requested. If you were, as in the tweet, to offer up specific subject lines, they would probably run a search that would only show the employee those subject lines, which you disclosed to them when you offered that information up to them. Not that they were logging into your account and scrolling through your inbox. I don't consider employees of my mail service accessing my mail on my direct request to help me is a hostile act. I do consider automated reading of my email to profile me[2] on a mass scale to be a hostile act. I probably would not have my email at FastMail if I believed anyone working at FastMail had a vendetta against me, I suppose, but I know for a fact that quite a few Googlers dislike me. :P [1] I will say I feel like the appropriate way to handle this, which I offered, was to forward them the email in question, since my account was not relevant to the issue. [2] Note that while Gmail "doesn't use your email for advertising", it does build a Purchases database populated with data from your email in the Account Activity panel, which has literally no justification for existing if they aren't basing ads off of that. So there's a layer of obfuscation there: https://myaccount.google.com/purchases https://myaccount.google.com/purchases
bad_user 8y ago
Not sure what FastMail has to do with anything, that wasn't the point, but ... I don't care if FastMail employees can read my email for support reasons. I actually expect FastMail employees to be able to read my email, since we aren't talking about end to end encryption. Unless end to end encryption is involved, then the stories of Google's encryption at rest are nothing more than bed time stories, since obviously their systems are not available to me for review. And that's not what my privacy concerns are about for Google. I don't care about random Google employees, because that's not the biggest threat. The biggest threat is me and my family being profiled and I've seen evidence of this time and time again. It's also a big and real threat due to Google's size and reach. FastMail is a better alternative first of all because FastMail is not Google, period. You may want security, but I want privacy and yes there's a difference. I don't need a better reason than that, but if I ever discover that FastMail is a problem (which I doubt, since they are awesome), I'll pick the next email provider in line that's not Google.
- jkaplowitz 8y ago
  At Google, the one time I'm aware of where a Gmail SRE read the mail of a woman he was interested in, he was detected, fired, and publicly called out officially by Google, which almost never happens in this industry and probably had permanent career consequences for him. They also locked things down further after this incident. I'd be surprised if FastMail has that level of ability and willingness to detect and react to a rogue employee. If the privacy threat you are concerned about is Google as a company allowing your data to be used in a way you're not happy with, such as profiling you can't sufficiently control, I can't argue with your logic beyond noting that they do offer lots of controls for most of the profiling they do. I similarly can't argue if you want to avoid providers within US jurisdiction. But if your privacy threat model includes things like "an intelligence agency wants to access your data without a legal right to demand it," "a rogue employee is hoping to access your data without an approved business need," or "foreign state-sponsored actors might want to target you," Google is one of the most private places to put your data to combat those threats. They have the resources to address those privacy attacks, and they do so. Of course your own operational security is also relevant for each of those privacy attack vectors, regardless of which third-party email provider you use. (Disclosure: I worked for Google 2011-2015. I never worked on Gmail, and neither work nor speak for them now.)

by shazow 8y ago

pacala 8y ago

Employee A reading email X does not scale. Google reading everyone's email with ever-better AI systems does scale, and is a much bigger threat to freedom, political or economical.

yifanl 8y ago
You don't need deep machine learning to write a simple script to fetch data from your servers. If Google can read all Gmail users' emails, Fastmail can read all their users' emails.
- goliatone 8y ago
  I think maybe the point is that reading all your emails seems to be Google’s business model, while FastMail is a service provider that charges users for the service? Also, regarding “your data” being more secure with google... is more like Google is good at securing their main asset, which is Google’s data about you.
  - dmitrygr 8y ago
    Google no longer uses Gmail data for targeting. No person or ai is reading your email from your grandmother, florist, or then confirmation that you bought paper towels on Amazon.
BartBoch 8y ago
But employee A can search for a very specific thing, something that machine learning won't be able to do. So it does not need to scale if they want to target a single person.
- pacala 8y ago
  Employee A has no clue which person to target. Nor does he know which emails to pay attention to. His search tools are primitive. His brain's processing power is limited. OTOH, Google's core business is scalable search.
  - saagarjha 8y ago
    > Employee A has no clue which person to target. Nor does he know which emails to pay attention to. Yes, he does: he looks up the people he knows about.
mynewtb 8y ago
A person reading your mail is a much more immediate, direct danger than your mails being slurped into the big data silo that can slowly and widely ruin society.
- xvector 8y ago
  > that can slowly and widely ruin society. There is nothing to say these "big data silos" will run "slowly." And even if they ran slowly, the impact they could have on your life would likely be far larger than the more immediate impact of an employee reading your email.

ocdtrekkie 8y ago

It seems likely there is significant auditing at FastMail for access. For example, at one time when I asked them to check on why an email wasn't displaying correctly in their client, they asked me to create a folder with a specific name, and put it in that folder[1]. This suggests they have a process to request access to content that logs what is requested, and only displays the content requested. If you were, as in the tweet, to offer up specific subject lines, they would probably run a search that would only show the employee those subject lines, which you disclosed to them when you offered that information up to them. Not that they were logging into your account and scrolling through your inbox. I don't consider employees of my mail service accessing my mail on my direct request to help me is a hostile act. I do consider automated reading of my email to profile me[2] on a mass scale to be a hostile act. I probably would not have my email at FastMail if I believed anyone working at FastMail had a vendetta against me, I suppose, but I know for a fact that quite a few Googlers dislike me. :P [1] I will say I feel like the appropriate way to handle this, which I offered, was to forward them the email in question, since my account was not relevant to the issue. [2] Note that while Gmail "doesn't use your email for advertising", it does build a Purchases database populated with data from your email in the Account Activity panel, which has literally no justification for existing if they aren't basing ads off of that. So there's a layer of obfuscation there: https://myaccount.google.com/purchases https://myaccount.google.com/purchases

bad_user 8y ago

Not sure what FastMail has to do with anything, that wasn't the point, but ... I don't care if FastMail employees can read my email for support reasons. I actually expect FastMail employees to be able to read my email, since we aren't talking about end to end encryption. Unless end to end encryption is involved, then the stories of Google's encryption at rest are nothing more than bed time stories, since obviously their systems are not available to me for review. And that's not what my privacy concerns are about for Google. I don't care about random Google employees, because that's not the biggest threat. The biggest threat is me and my family being profiled and I've seen evidence of this time and time again. It's also a big and real threat due to Google's size and reach. FastMail is a better alternative first of all because FastMail is not Google, period. You may want security, but I want privacy and yes there's a difference. I don't need a better reason than that, but if I ever discover that FastMail is a problem (which I doubt, since they are awesome), I'll pick the next email provider in line that's not Google.

jkaplowitz 8y ago
At Google, the one time I'm aware of where a Gmail SRE read the mail of a woman he was interested in, he was detected, fired, and publicly called out officially by Google, which almost never happens in this industry and probably had permanent career consequences for him. They also locked things down further after this incident. I'd be surprised if FastMail has that level of ability and willingness to detect and react to a rogue employee. If the privacy threat you are concerned about is Google as a company allowing your data to be used in a way you're not happy with, such as profiling you can't sufficiently control, I can't argue with your logic beyond noting that they do offer lots of controls for most of the profiling they do. I similarly can't argue if you want to avoid providers within US jurisdiction. But if your privacy threat model includes things like "an intelligence agency wants to access your data without a legal right to demand it," "a rogue employee is hoping to access your data without an approved business need," or "foreign state-sponsored actors might want to target you," Google is one of the most private places to put your data to combat those threats. They have the resources to address those privacy attacks, and they do so. Of course your own operational security is also relevant for each of those privacy attack vectors, regardless of which third-party email provider you use. (Disclosure: I worked for Google 2011-2015. I never worked on Gmail, and neither work nor speak for them now.)