5 ms·

Audit Cleared Google Privacy Practices Despite Security Flaw

35 points by infodocket 8y ago

Leace 8y ago
Ernst & Young also give a positive audit to Startssl/Wosign even though they had problems at the time. For that reason Mozilla "no longer accept audits carried out by Ernst & Young Hong Kong." [0]. [0]: https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ https://blog.mozilla.org/security/2016/10/24/distrusting-new...
- bsder 8y ago
  To be fair, I have never seen an external security audit do anything useful. Either they bend to the folks paying the bills, or they flag a zillion, generally known to engineers, issues. If you really want to make you security audit useless, hand the auditors C code. They will stare at you as though you just handed them the head of a small child.
  - mahemm 8y ago
    I have personally been a part of security audits that have found critical vulnerabilities in some of the best-known tech companies on the globe. Just because there exists a world of auditors who function as rubber stamps does not mean we all do.
    - cptskippy 8y ago
      I've been part to numerous audits during my career and there's always an initial findings report with the opportunity to explain away findings such that they never show up on the final report.
      - mahemm 8y ago
        If that's the case then you haven't been working with good auditors. That said, the opportunity to do this (scrub reports) is a driving decision behind many companies' choice to work with more permissive firms. If you want a rubber stamp, you can certainly get it, but if you want a true partner who will find and exploit issues you can get that too.
        Leace 8y ago
        > if you want a true partner who will find and exploit issues you can get that too. Could you name such a company? This is a perfect opportunity to get to know a good auditor, actually I can't imagine how would one look for a good auditor otherwise.
esoterae 8y ago
This is a witch-hunt by Murdoch, I'm guessing. 500,000 people's information with the potential to have leaked, and yet Facebook and Equifax fucking skate on DEMONSTRABLY having leaked well over half of America's personal information to domestic and foreign interests alike. This is sour grapes of the worst kind.
- SpicyLemonZest 8y ago
  I mean, what is it at this point, 2 days of bad press? All Murdoch properties I'm aware of covered Facebook and Equifax for a lot longer than that, and certainly didn't pretend that what they did was okay.
- partiallypro 8y ago
  ...Can you show proof that Murdoch properties didn't cover Facebook and Equifax breaches? (hint: you can't, because they covered them extensively)
- glenrivard 8y ago
  Agree. When did Murdoch start with his vendetta towards Google?
- kevingadd 8y ago
  It's only a 'potential' because they failed to keep any auditable logs of the behavior of unvetted third parties, AND failed to vet them in any meaningful fashion. The amount and type of data exposed isn't as bad but this is pretty similar to the Cambridge Analytica scandal, except in this case Google literally didn't even notice. Facebook at least noticed.
tptacek 8y ago
This story doesn't make any sense. An FTC-mandated E&Y "Privacy Audit" isn't a software security assessment and would never have been expected to either (a) uncover subtle application security flaws or (b) metabolize internal reports of subtle, fixed flaws. Nor, for that matter, is the internal discovery of a software security flaw a "breach": routine internal discovery of vulnerabilities is what good security teams do. The reporting on this G+ story has been startlingly bad. There's apparently some juice to the narrative that Google is running headlong into a collision with the Trump administration, and so reporters seem to be starting with a public policy conclusion and working their way back. Somebody needs to start informing these people how professional software security works. In any audit situation --- PCI, HITECH, SOC-2, you name it --- there is neither a norm nor a duty to notify auditors of internally discovered security problems. Nor would any such norm be productive: it would warp internal incentives, both to discover and to properly handle vulnerabilities. If the auditors discover a security problem, that problem gets documented, just like it (typically) does with external reporters (researchers, bug bounty claimants). When that happens, you have an indication that your internal software security controls failed. But when your team finds a bug in its own code? That's a sign that the team is doing things right.
- kevingadd 8y ago
  All of your characterization here is correct, but does it really make sense to classify it as an internally discovered security problem instead of a potential-or-real-breach when it was present for years, trivially exploitable by third parties, and is impossible to vet? There's no way to know whether or not it was used because there was no logging in place for third-party use of user data, and apparently no audits (manual or automated) were ever performed of these APIs. Google more or less admitted that all they had to go on here was an examination of the third parties who potentially had access to the data, because they have no way to know what they actually did with it and apparently can't contact them to find out. The reporting is definitely exaggerating the significance of the data that was exposed and making it sound like it's known that the data was collected by third parties, but it's absolutely the case that the ball was dropped here and it's inappropriate to pretend nothing happened. There's simply no way to know, which is itself a breach of user trust. It's kind of a no-win situation here given the way the media reports on these matters, but attempting to keep it quiet was incredibly foolish - everything remotely bad that happens at Google is going to get leaked by internal troublemakers now, and legal/pr should know that and should have gotten ahead of this.

35 points by infodocket 8y ago

Ernst & Young also give a positive audit to Startssl/Wosign even though they had problems at the time. For that reason Mozilla "no longer accept audits carried out by Ernst & Young Hong Kong." [0]. [0]: https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ https://blog.mozilla.org/security/2016/10/24/distrusting-new...

bsder 8y ago
To be fair, I have never seen an external security audit do anything useful. Either they bend to the folks paying the bills, or they flag a zillion, generally known to engineers, issues. If you really want to make you security audit useless, hand the auditors C code. They will stare at you as though you just handed them the head of a small child.
- mahemm 8y ago
  I have personally been a part of security audits that have found critical vulnerabilities in some of the best-known tech companies on the globe. Just because there exists a world of auditors who function as rubber stamps does not mean we all do.
  - cptskippy 8y ago
    I've been part to numerous audits during my career and there's always an initial findings report with the opportunity to explain away findings such that they never show up on the final report.
    - mahemm 8y ago
      If that's the case then you haven't been working with good auditors. That said, the opportunity to do this (scrub reports) is a driving decision behind many companies' choice to work with more permissive firms. If you want a rubber stamp, you can certainly get it, but if you want a true partner who will find and exploit issues you can get that too.
      - Leace 8y ago
        > if you want a true partner who will find and exploit issues you can get that too. Could you name such a company? This is a perfect opportunity to get to know a good auditor, actually I can't imagine how would one look for a good auditor otherwise.

esoterae 8y ago

This is a witch-hunt by Murdoch, I'm guessing. 500,000 people's information with the potential to have leaked, and yet Facebook and Equifax fucking skate on DEMONSTRABLY having leaked well over half of America's personal information to domestic and foreign interests alike. This is sour grapes of the worst kind.

SpicyLemonZest 8y ago
I mean, what is it at this point, 2 days of bad press? All Murdoch properties I'm aware of covered Facebook and Equifax for a lot longer than that, and certainly didn't pretend that what they did was okay.
partiallypro 8y ago
...Can you show proof that Murdoch properties didn't cover Facebook and Equifax breaches? (hint: you can't, because they covered them extensively)
glenrivard 8y ago
Agree. When did Murdoch start with his vendetta towards Google?
kevingadd 8y ago
It's only a 'potential' because they failed to keep any auditable logs of the behavior of unvetted third parties, AND failed to vet them in any meaningful fashion. The amount and type of data exposed isn't as bad but this is pretty similar to the Cambridge Analytica scandal, except in this case Google literally didn't even notice. Facebook at least noticed.

tptacek 8y ago

This story doesn't make any sense. An FTC-mandated E&Y "Privacy Audit" isn't a software security assessment and would never have been expected to either (a) uncover subtle application security flaws or (b) metabolize internal reports of subtle, fixed flaws. Nor, for that matter, is the internal discovery of a software security flaw a "breach": routine internal discovery of vulnerabilities is what good security teams do. The reporting on this G+ story has been startlingly bad. There's apparently some juice to the narrative that Google is running headlong into a collision with the Trump administration, and so reporters seem to be starting with a public policy conclusion and working their way back. Somebody needs to start informing these people how professional software security works. In any audit situation --- PCI, HITECH, SOC-2, you name it --- there is neither a norm nor a duty to notify auditors of internally discovered security problems. Nor would any such norm be productive: it would warp internal incentives, both to discover and to properly handle vulnerabilities. If the auditors discover a security problem, that problem gets documented, just like it (typically) does with external reporters (researchers, bug bounty claimants). When that happens, you have an indication that your internal software security controls failed. But when your team finds a bug in its own code? That's a sign that the team is doing things right.

kevingadd 8y ago
All of your characterization here is correct, but does it really make sense to classify it as an internally discovered security problem instead of a potential-or-real-breach when it was present for years, trivially exploitable by third parties, and is impossible to vet? There's no way to know whether or not it was used because there was no logging in place for third-party use of user data, and apparently no audits (manual or automated) were ever performed of these APIs. Google more or less admitted that all they had to go on here was an examination of the third parties who potentially had access to the data, because they have no way to know what they actually did with it and apparently can't contact them to find out. The reporting is definitely exaggerating the significance of the data that was exposed and making it sound like it's known that the data was collected by third parties, but it's absolutely the case that the ball was dropped here and it's inappropriate to pretend nothing happened. There's simply no way to know, which is itself a breach of user trust. It's kind of a no-win situation here given the way the media reports on these matters, but attempting to keep it quiet was incredibly foolish - everything remotely bad that happens at Google is going to get leaked by internal troublemakers now, and legal/pr should know that and should have gotten ahead of this.