11 ms·

No, Google, We Did Not Consent to This

243 points by kushti 8y ago

Meekro 8y ago
Countless companies every year hire security auditors, and get back a 100-page report in 8 point font filled with vulnerabilities, many of them marked "severe" or "critical." Forcing companies to then publicize those reports will be burdensome and counterproductive.
- tivert 8y ago
  Forcing them to publicize would also force them to spend the resources to patch them. I'm sure many companies go through those 100 pages and throw out 50 as "wontfix." Though, if you force them to publicize, you'd probably have to force them to conduct the audits, so they can't avoid the publicity/patching spend by keeping themselves in the dark.
  - matwood 8y ago
    > I'm sure many companies go through those 100 pages and throw out 50 as "wontfix." I agree in principle, but it's not always that simple. Outside of the obvious "don't make your S3 buckets public", it's usually a combination of priority, cost, and compatibility. Years ago I ran a network inside the firewall of <Insert large company here>. They did constant vulnerability testing, and I had monthly meetings explaining what I was doing to mitigate all of the vulnerabilities that came up. Mitigation for some vulnerabilities meant rewriting decades old programs to run on a new OS/platform so we would harden around it the best we could while the work was done.
- specialist 8y ago
  I'm pretty sure you're wrong here. Publicly traded companies have to declare their risks. Cue share holder lawsuits if an identified risk was ignored and caused material damage.
- s73v3r_ 8y ago
  Why do I care if something like this is "burdensome" to businesses?
  - wild_preference 8y ago
    Just because something is burdensome to a business does not mean it will have the intended, positive effect. At worst, you only make things worse for users and empower large incumbents without solving anything. So hopefully someone out there cares.
    - s73v3r_ 8y ago
      But the way it was said, it implied that I should care about the burden on business. I don't. If you're saying I should be concerned about unintended consequences, then I can agree with that. But I'm not going to be upset that businesses are "burdened" by doing what they should be doing in the first place.
  - CamperBob2 8y ago
    Because you, as a consumer, will ultimately pay for it.
amarant 8y ago
whats up with the contradictory first point the article is making? 1) This data privacy glitch is just like Facebook’s Cambridge Analytica scandal, except it isn’t. well, if its not, then why even bring it up? that part smells like sensationalism to me.. things doesn't get better when we realize there are no indications of any actual leaking of anyones anything. The bug this article refers to was pretty bad, and googles handling of it was indeed poor. but this is just bad journalism.
- 394549 8y ago
  > 1) This data privacy glitch is just like Facebook’s Cambridge Analytica scandal, except it isn’t. > well, if its not, then why even bring it up? that part smells like sensationalism to me.. It's the same type of glitch, except there's no evidence that it was exploited (which is a different statement than it wasn't exploited; it may very well have been).
  - maemilius 8y ago
    Unless I'm horribly misinformed, the Google breach is absolutely nothing like the Facebook-Cambridge Analytica deal. CA got huge amounts of information about users. The G+ breach just gave out contact information. It's similar only in that it unintentionally gave out more information than it was supposed to. Beyond that, they're not similar at all. I get that we shouldn't give Google a slap on the wrist because it's "not as bad", but we absolutely should not conflate the massive breach that was CA with this.
    - Bartweiss 8y ago
      I think the comparison is a coherent one on the security side - these were both attacks enabled by allowing apps to piggyback on the visibility settings of the app user. Further, both represent threats which can't be entirely controlled (picture a user infected with a worm that simply opened Facebook and clicked through profiles), but can be constrained by auditing API data request options. If I had a social media site with an API for user-installed apps, I'd be thinking about these attacks in the same category. But I do think the coverage here, equating the attacks on a user-impact level, is substantially unfair. The Facebook attack in some cases compromised Timeline posts and private messages from friends. What's more, Facebook initially claimed only profile data had been access, and took very little further flak when it was eventually revealed that private messages had been compromised.[1] Portraying the contents of the breach as comparable feels like it not only overstates the current exposure, but gives Facebook a pass on the broader reach of its exposure. [1] https://www.wired.com/story/cambridge-analytica-private-facebook-messages/ https://www.wired.com/story/cambridge-analytica-private-face...
pleasecalllater 8y ago
This happens again and again... a. oh no!!! b. nobody will go to prison c. a programmer will be fired d. managers will get bonuses e. nobody will change the way they write programs, process data, etc. f. go to point a
leereeves 8y ago
Can we really continue to claim that we're unaware Google, Facebook, and other web companies are monitoring everything they can and sharing the information they collect, sometimes for profit, sometimes accidentally, and sometimes compelled by legal orders? This isn't merely a legal technicality hidden in the terms of service. We know they're doing it, and by continuing to use the service we are consenting, however unhappily.
- 394549 8y ago
  > Can we really continue to claim that we're unaware Google, Facebook, and other web companies are monitoring everything they can and sharing the information they collect, sometimes for profit, sometimes accidentally, and sometimes compelled by legal orders? Yes, we can. 1. Some people (mostly technologists) are aware, but many people aren't. 2. Much of the awareness that does exist was not the result of those companies being transparent about their practices. It's the result of inferences based on scraps of information and speculation.
  - leereeves 8y ago
    Surely the author, editor, and publisher of this article, and anyone likely to read it, are aware. "We" are aware.
    - 394549 8y ago
      > Surely the author, editor, and publisher of this article, and anyone likely to read it, are aware. We are aware. That's a really weird statement. Articles are published so that readers can be informed of things that the author and editors have become aware of. Often many articles are published on the same subject because 1) many people missed previous articles, 2) there a new update that people aren't aware of, 3) people forgot and it's a good time to remind them, 4) it's not news-facts article but a persuasive piece, 5) etc. >> 2. Much of the awareness that does exist was not the result of those companies being transparent about their practices. It's the result of inferences based on scraps of information and speculation. This means that "we" aren't as aware as you make us out to be.
OnlyRepliesToBS 8y ago
OK, we'll ask you again later. OK, we'll ask you again later. OK, we'll ask you again later. OK, we'll ask you again later.
rwestergren 8y ago
Apparently unpopular opinion: an internally-discovered vulnerability with no evidence of abuse is not a breach and does not require public disclosure.
- mannykannot 8y ago
  'No evidence of abuse' is not acceptable grounds for treating it as if there were no abuse. Personally, I consider all three points as being irrelevant.
  - rwestergren 8y ago
    How is this different than any other internal/private bug found every day at orgs?
    - mannykannot 8y ago
      If it was exploitable from outside then it was not internal, by definition.
  - Kalium 8y ago
    OK. What do you find to be acceptable grounds for treating a situation as if there were no abuse? Bear in mind that proving no abuse is impossible, as it's always possible that the hypothetical abuser got one step further than your investigation and covered their tracks.
    - dleslie 8y ago
      Never not inform. When such a vulnerability is discovered the right thing to do is to inform the users of its possible severity and the duration during which it was available. Always.
      - reificator 8y ago
        So then all security audits just become you paying someone large amounts of money to get really bad press for yourself. Regardless of whether you've actually lost customer information or not. At which point why not just stop being proactive? Hardline stances sell great on forums, that doesn't make them right.
deleted 8y ago
[deleted]
deleted 8y ago
[deleted]
thelasthuman 8y ago
"There’s no quick fix here." I think people are thinking to small. Imagine if you could own your data profile and "invest" it into websites or services. Everyone builds their services to accept this same "profile" formatting and the user takes it where they pleases. This would mean small upstarts can compete with google and Facebook (who right now have a huge head start on having all this data) by having a better UX. right now, everything is trapped in all these different walled gardens. I see it like your cellphone only being able to call cell phones of the exact make and model of your own.
- pgroves 8y ago
  I've been thinking about this lately. What if the web fundamentally was data collection of what a person is doing, and then things hang off that. Right now it is a collection of information that you can 'find'. Like your photos, web history, and fitbit would be generating your profile which is the fundamental part of the web, not the 'addressable places to get javascript apps' we have now. Anyway that's as far as I got. Good luck and let me know how it goes.
- hunterjrj 8y ago
  Interesting idea. How would ownership extend to metadata derived from your profile? For example, one of the claims made during the Cambridge Analytica hearings was that the data that they had in their possession could be used to derive political leanings, sexual orientation, purchasing habits etc. I'm certain that this is where the value of the data is. No platform genuinely cares about cat pictures and birthday wishes - they care about how likely you are to purchase an advertiser's product. Or, cynically, they care about how many degrees of separation you are from a person under investigation. This is not data that you've created directly or intentionally.
outside1234 8y ago
Google is great about disclosing everyone else's zero day flaws tho!
mbostleman 8y ago
I suspect that the government will feel compelled to get involved here and I'm guessing the default ask of the public is that they do. But is a class action an option? Given that there's no evidence of a breach, does that means there's no actual damages to claim?
slenk 8y ago
Should we really be giving Bloomberg our traffic when everything points to them fabricating information in the Super Micro supply chain article?
adrianmonk 8y ago
From the article: > Google might agree to let a random online shopping company scan what I’m typing into Gmail, but I did not agree. Google might, in the sense that they could start, but Google doesn't do (and never has done) what is described. First of all, Google has never let companies scan what you type. It did let companies target based on content of messages, but that involves advertisers sharing targeting information with Google, not Google sharing email content with advertisers. Second of all, even that stopped last year. From the Google announcement: > G Suite’s Gmail is already not used as input for ads personalization, and Google has decided to follow suit later this year in our free consumer Gmail service. Consumer Gmail content will not be used or scanned for any ads personalization after this change. This decision brings Gmail ads in line with how we personalize ads for other Google products. ( https://blog.google/products/gmail/g-suite-gains-traction-in-the-enterprise-g-suites-gmail-and-consumer-gmail-to-more-closely-align/ https://blog.google/products/gmail/g-suite-gains-traction-in... )
- ucaetano 8y ago
  > Google might, in the sense that they could start, but Google doesn't do (and never has done) what is described. Yep, this is the point where it shows that the author has no idea what this is about. The entire case of the GMail-reading outrage was around the fact that the user had explicitly allowed that the 3rd party app read their emails. Sure, you can argue that you clicked by accident, or that Google shouldn't even allow it in the first place, but saying that the user did not explicitly consent, is bullshit.
  - gumby 8y ago
    How is this different from the mystery terms in the ToS or click-to-install license you clicked on without reading?
    - ucaetano 8y ago
      There was a big warning on the screen saying that you're giving access to a 3rd party all to read all your emails. This wasn't something buried deep into a long ToS, this was someone explicitly asking you for the keys to your house. Not sure what you expect when giving access to your emails...
jhabdas 8y ago
Huge ad for WhatsApp just below the fold. Not only is it ironic given the subject matter, it's not blocked by Brave. Also, this has got to stop mentality is too soft. That time passed when Uber pulled the wool over everyone's eyes while the CEO stepped down. We need more Captains, less crew.
jhabdas 8y ago
Huge ad for WhatsApp just below the fold. Not only is it ironic given the subject matter, it's not blocked by Brave.
imhelpingu 8y ago
Google is the quintessential evil tech corporation, and the federal government should prevent them from retaining the power they currently hold over the economy and society as a private autocratic monopoly.
relyio 8y ago
I wish Google would let me pay to just have 0 ads and maximum privacy. I would pay a lot for that and I would be a happier user since all my pet peeves seem to come from them dumbing down products so they can fit ads. YouTube Red is a good start, hopefully this spreads.
- izacus 8y ago
  GSuite is literally that for the core products.
  - relyio 8y ago
    Thanks for the lead, I didn't know about it!
throw2016 8y ago
This is the classic 'emperor has no clothes' moment but some 'loyal subjects' still pointing to imaginary clothes.

243 points by kushti 8y ago

Countless companies every year hire security auditors, and get back a 100-page report in 8 point font filled with vulnerabilities, many of them marked "severe" or "critical." Forcing companies to then publicize those reports will be burdensome and counterproductive.

tivert 8y ago
Forcing them to publicize would also force them to spend the resources to patch them. I'm sure many companies go through those 100 pages and throw out 50 as "wontfix." Though, if you force them to publicize, you'd probably have to force them to conduct the audits, so they can't avoid the publicity/patching spend by keeping themselves in the dark.
- matwood 8y ago
  > I'm sure many companies go through those 100 pages and throw out 50 as "wontfix." I agree in principle, but it's not always that simple. Outside of the obvious "don't make your S3 buckets public", it's usually a combination of priority, cost, and compatibility. Years ago I ran a network inside the firewall of <Insert large company here>. They did constant vulnerability testing, and I had monthly meetings explaining what I was doing to mitigate all of the vulnerabilities that came up. Mitigation for some vulnerabilities meant rewriting decades old programs to run on a new OS/platform so we would harden around it the best we could while the work was done.
specialist 8y ago
I'm pretty sure you're wrong here. Publicly traded companies have to declare their risks. Cue share holder lawsuits if an identified risk was ignored and caused material damage.
s73v3r_ 8y ago
Why do I care if something like this is "burdensome" to businesses?
- wild_preference 8y ago
  Just because something is burdensome to a business does not mean it will have the intended, positive effect. At worst, you only make things worse for users and empower large incumbents without solving anything. So hopefully someone out there cares.
  - s73v3r_ 8y ago
    But the way it was said, it implied that I should care about the burden on business. I don't. If you're saying I should be concerned about unintended consequences, then I can agree with that. But I'm not going to be upset that businesses are "burdened" by doing what they should be doing in the first place.
- CamperBob2 8y ago
  Because you, as a consumer, will ultimately pay for it.

amarant 8y ago

whats up with the contradictory first point the article is making? 1) This data privacy glitch is just like Facebook’s Cambridge Analytica scandal, except it isn’t. well, if its not, then why even bring it up? that part smells like sensationalism to me.. things doesn't get better when we realize there are no indications of any actual leaking of anyones anything. The bug this article refers to was pretty bad, and googles handling of it was indeed poor. but this is just bad journalism.

394549 8y ago
> 1) This data privacy glitch is just like Facebook’s Cambridge Analytica scandal, except it isn’t. > well, if its not, then why even bring it up? that part smells like sensationalism to me.. It's the same type of glitch, except there's no evidence that it was exploited (which is a different statement than it wasn't exploited; it may very well have been).
- maemilius 8y ago
  Unless I'm horribly misinformed, the Google breach is absolutely nothing like the Facebook-Cambridge Analytica deal. CA got huge amounts of information about users. The G+ breach just gave out contact information. It's similar only in that it unintentionally gave out more information than it was supposed to. Beyond that, they're not similar at all. I get that we shouldn't give Google a slap on the wrist because it's "not as bad", but we absolutely should not conflate the massive breach that was CA with this.
  - Bartweiss 8y ago
    I think the comparison is a coherent one on the security side - these were both attacks enabled by allowing apps to piggyback on the visibility settings of the app user. Further, both represent threats which can't be entirely controlled (picture a user infected with a worm that simply opened Facebook and clicked through profiles), but can be constrained by auditing API data request options. If I had a social media site with an API for user-installed apps, I'd be thinking about these attacks in the same category. But I do think the coverage here, equating the attacks on a user-impact level, is substantially unfair. The Facebook attack in some cases compromised Timeline posts and private messages from friends. What's more, Facebook initially claimed only profile data had been access, and took very little further flak when it was eventually revealed that private messages had been compromised.[1] Portraying the contents of the breach as comparable feels like it not only overstates the current exposure, but gives Facebook a pass on the broader reach of its exposure. [1] https://www.wired.com/story/cambridge-analytica-private-facebook-messages/ https://www.wired.com/story/cambridge-analytica-private-face...

pleasecalllater 8y ago

This happens again and again... a. oh no!!! b. nobody will go to prison c. a programmer will be fired d. managers will get bonuses e. nobody will change the way they write programs, process data, etc. f. go to point a

leereeves 8y ago

Can we really continue to claim that we're unaware Google, Facebook, and other web companies are monitoring everything they can and sharing the information they collect, sometimes for profit, sometimes accidentally, and sometimes compelled by legal orders? This isn't merely a legal technicality hidden in the terms of service. We know they're doing it, and by continuing to use the service we are consenting, however unhappily.

394549 8y ago
> Can we really continue to claim that we're unaware Google, Facebook, and other web companies are monitoring everything they can and sharing the information they collect, sometimes for profit, sometimes accidentally, and sometimes compelled by legal orders? Yes, we can. 1. Some people (mostly technologists) are aware, but many people aren't. 2. Much of the awareness that does exist was not the result of those companies being transparent about their practices. It's the result of inferences based on scraps of information and speculation.
- leereeves 8y ago
  Surely the author, editor, and publisher of this article, and anyone likely to read it, are aware. "We" are aware.
  - 394549 8y ago
    > Surely the author, editor, and publisher of this article, and anyone likely to read it, are aware. We are aware. That's a really weird statement. Articles are published so that readers can be informed of things that the author and editors have become aware of. Often many articles are published on the same subject because 1) many people missed previous articles, 2) there a new update that people aren't aware of, 3) people forgot and it's a good time to remind them, 4) it's not news-facts article but a persuasive piece, 5) etc. >> 2. Much of the awareness that does exist was not the result of those companies being transparent about their practices. It's the result of inferences based on scraps of information and speculation. This means that "we" aren't as aware as you make us out to be.

OnlyRepliesToBS 8y ago

OK, we'll ask you again later. OK, we'll ask you again later. OK, we'll ask you again later. OK, we'll ask you again later.

rwestergren 8y ago

Apparently unpopular opinion: an internally-discovered vulnerability with no evidence of abuse is not a breach and does not require public disclosure.

mannykannot 8y ago
'No evidence of abuse' is not acceptable grounds for treating it as if there were no abuse. Personally, I consider all three points as being irrelevant.
- rwestergren 8y ago
  How is this different than any other internal/private bug found every day at orgs?
  - mannykannot 8y ago
    If it was exploitable from outside then it was not internal, by definition.
- Kalium 8y ago
  OK. What do you find to be acceptable grounds for treating a situation as if there were no abuse? Bear in mind that proving no abuse is impossible, as it's always possible that the hypothetical abuser got one step further than your investigation and covered their tracks.
  - dleslie 8y ago
    Never not inform. When such a vulnerability is discovered the right thing to do is to inform the users of its possible severity and the duration during which it was available. Always.
    - reificator 8y ago
      So then all security audits just become you paying someone large amounts of money to get really bad press for yourself. Regardless of whether you've actually lost customer information or not. At which point why not just stop being proactive? Hardline stances sell great on forums, that doesn't make them right.

deleted 8y ago

[deleted]

deleted 8y ago

[deleted]

thelasthuman 8y ago

"There’s no quick fix here." I think people are thinking to small. Imagine if you could own your data profile and "invest" it into websites or services. Everyone builds their services to accept this same "profile" formatting and the user takes it where they pleases. This would mean small upstarts can compete with google and Facebook (who right now have a huge head start on having all this data) by having a better UX. right now, everything is trapped in all these different walled gardens. I see it like your cellphone only being able to call cell phones of the exact make and model of your own.

pgroves 8y ago
I've been thinking about this lately. What if the web fundamentally was data collection of what a person is doing, and then things hang off that. Right now it is a collection of information that you can 'find'. Like your photos, web history, and fitbit would be generating your profile which is the fundamental part of the web, not the 'addressable places to get javascript apps' we have now. Anyway that's as far as I got. Good luck and let me know how it goes.
hunterjrj 8y ago
Interesting idea. How would ownership extend to metadata derived from your profile? For example, one of the claims made during the Cambridge Analytica hearings was that the data that they had in their possession could be used to derive political leanings, sexual orientation, purchasing habits etc. I'm certain that this is where the value of the data is. No platform genuinely cares about cat pictures and birthday wishes - they care about how likely you are to purchase an advertiser's product. Or, cynically, they care about how many degrees of separation you are from a person under investigation. This is not data that you've created directly or intentionally.

outside1234 8y ago

Google is great about disclosing everyone else's zero day flaws tho!

mbostleman 8y ago

I suspect that the government will feel compelled to get involved here and I'm guessing the default ask of the public is that they do. But is a class action an option? Given that there's no evidence of a breach, does that means there's no actual damages to claim?

slenk 8y ago

Should we really be giving Bloomberg our traffic when everything points to them fabricating information in the Super Micro supply chain article?

adrianmonk 8y ago

From the article: > Google might agree to let a random online shopping company scan what I’m typing into Gmail, but I did not agree. Google might, in the sense that they could start, but Google doesn't do (and never has done) what is described. First of all, Google has never let companies scan what you type. It did let companies target based on content of messages, but that involves advertisers sharing targeting information with Google, not Google sharing email content with advertisers. Second of all, even that stopped last year. From the Google announcement: > G Suite’s Gmail is already not used as input for ads personalization, and Google has decided to follow suit later this year in our free consumer Gmail service. Consumer Gmail content will not be used or scanned for any ads personalization after this change. This decision brings Gmail ads in line with how we personalize ads for other Google products. ( https://blog.google/products/gmail/g-suite-gains-traction-in-the-enterprise-g-suites-gmail-and-consumer-gmail-to-more-closely-align/ https://blog.google/products/gmail/g-suite-gains-traction-in... )

ucaetano 8y ago
> Google might, in the sense that they could start, but Google doesn't do (and never has done) what is described. Yep, this is the point where it shows that the author has no idea what this is about. The entire case of the GMail-reading outrage was around the fact that the user had explicitly allowed that the 3rd party app read their emails. Sure, you can argue that you clicked by accident, or that Google shouldn't even allow it in the first place, but saying that the user did not explicitly consent, is bullshit.
- gumby 8y ago
  How is this different from the mystery terms in the ToS or click-to-install license you clicked on without reading?
  - ucaetano 8y ago
    There was a big warning on the screen saying that you're giving access to a 3rd party all to read all your emails. This wasn't something buried deep into a long ToS, this was someone explicitly asking you for the keys to your house. Not sure what you expect when giving access to your emails...

jhabdas 8y ago

Huge ad for WhatsApp just below the fold. Not only is it ironic given the subject matter, it's not blocked by Brave. Also, this has got to stop mentality is too soft. That time passed when Uber pulled the wool over everyone's eyes while the CEO stepped down. We need more Captains, less crew.

jhabdas 8y ago

Huge ad for WhatsApp just below the fold. Not only is it ironic given the subject matter, it's not blocked by Brave.

imhelpingu 8y ago

Google is the quintessential evil tech corporation, and the federal government should prevent them from retaining the power they currently hold over the economy and society as a private autocratic monopoly.

relyio 8y ago

I wish Google would let me pay to just have 0 ads and maximum privacy. I would pay a lot for that and I would be a happier user since all my pet peeves seem to come from them dumbing down products so they can fit ads. YouTube Red is a good start, hopefully this spreads.

izacus 8y ago
GSuite is literally that for the core products.
- relyio 8y ago
  Thanks for the lead, I didn't know about it!

throw2016 8y ago

This is the classic 'emperor has no clothes' moment but some 'loyal subjects' still pointing to imaginary clothes.