5 ms·

Wow. “We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks.” The wording of this is really pushing the boundary of p

by ismail 8y ago

Wow. “We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks.” The wording of this is really pushing the boundary of plausibility. I fail to understand the logic of how this would protect privacy? Access logs with no profile data logged would not compromise privacy would it? Can anyone confirm the timing of the google blog post? It seems the WSJ article was posted at a similar time. This leads me to believe that the most likely reason we are hearing about this now is due to comment requests from the WSJ. WHEN Goog realised it was out they published. Goog is trying to avoid using the words Data breach as they may get into hot water in EU. Love how it is buried in the article. My guess is a similar thing has been happening with android permissions. Data has been leaking through that they have just not admitted to it.

advisedwang 8y ago
> Access logs with no profile data logged would not compromise privacy would it? True, but access logs without profile data would prevent you know _which_ profiles were accessed. This matches with the actual claim in the article that they would be "unable to determine which users were affected"
- mashlol 8y ago
  Right, but the only "profile data" they would need to add to the logs to know, would be a user ID. Not really any private info.
  - deleted 8y ago
    [deleted]
  - halflings 8y ago
    User IDs are definitely private info, since they'd allow you to follow a user's behaviour etc.
    - flukus 8y ago
      "user 1234567 viewed post 89564385943" I can see how that's private info, but would this be: "client x viewed user 1234567's profile"
      - wolco 8y ago
        Neither are private info. Private in theop law sense.
      - saagarjha 8y ago
        Sure, if user 1234567 isn’t particularly popular.
      - gdfasfklshg4 8y ago
        If the user id can be joined with other data to give a name or similar then it is considered personally identifying in terms of GDPR. I am not a lawyer. You should hire an appropriately qualified lawyer to review your data hygiene practices.
MertsA 8y ago
>Goog is trying to avoid using the words Data breach as they may get into hot water in EU. As far as GDPR goes technically this breach happened right before they would have faced large repercussions from it.
- sipos 8y ago
  It sounds like it came up as a result of their Project Strobe audit. I would guess they launched this project precisely because the penalties were about to get bigger and they knew they had skeletons.
masonic 8y ago
The wording of this is really pushing the boundary of plausibility. Maybe Google is running short of disk space.

by ismail 8y ago

advisedwang 8y ago

> Access logs with no profile data logged would not compromise privacy would it? True, but access logs without profile data would prevent you know _which_ profiles were accessed. This matches with the actual claim in the article that they would be "unable to determine which users were affected"

mashlol 8y ago
Right, but the only "profile data" they would need to add to the logs to know, would be a user ID. Not really any private info.
- deleted 8y ago
  [deleted]
- halflings 8y ago
  User IDs are definitely private info, since they'd allow you to follow a user's behaviour etc.
  - flukus 8y ago
    "user 1234567 viewed post 89564385943" I can see how that's private info, but would this be: "client x viewed user 1234567's profile"
    - wolco 8y ago
      Neither are private info. Private in theop law sense.
    - saagarjha 8y ago
      Sure, if user 1234567 isn’t particularly popular.
    - gdfasfklshg4 8y ago
      If the user id can be joined with other data to give a name or similar then it is considered personally identifying in terms of GDPR. I am not a lawyer. You should hire an appropriately qualified lawyer to review your data hygiene practices.

MertsA 8y ago

>Goog is trying to avoid using the words Data breach as they may get into hot water in EU. As far as GDPR goes technically this breach happened right before they would have faced large repercussions from it.

sipos 8y ago
It sounds like it came up as a result of their Project Strobe audit. I would guess they launched this project precisely because the penalties were about to get bigger and they knew they had skeletons.

masonic 8y ago

The wording of this is really pushing the boundary of plausibility. Maybe Google is running short of disk space.