8 ms·

I'll go ahead and play the Devil's advocate because every constructive conversation needs one. People who signup for this already know what they are doing and

I'll go ahead and play the Devil's advocate because every constructive conversation needs one. People who signup for this already know what they are doing and the program has a privacy section[0] saying that the data is only shared with Google which is pretty much akin to having any Smart Speaker. Not only that but it also says that the data wouldn't be used to "advertise to you or sell you anything" which is not the case with Smart Speakers. In essence, from a privacy point of view, when compared to having a Smart Speaker, this is better I'd say. 0.https://support.google.com/audiencemeasurement/answer/9028740?hl=en&ref_topic=7563962 https://support.google.com/audiencemeasurement/answer/902874...

floatingatoll 8y ago
User opt-in does not excuse violating Apple’s terms of use. Google _likely_ did not get Apple’s opt-in for this approach. If they did not, they will _likely_ see their enterprise certificate terminated for precisely the same reason.
- on_and_off 8y ago
  Still playing devil's advocate : I am more perplexed by the necessity to have Apple's approval than anything else here. Sure this particular app is debatable.. but I have also worked in the music streaming industry. While being super respectful of the users, we still have sometimes had to wait for months for Apple's approval. Having a single agent being able to gatekeep what you can install on your phone at their own discretion is an issue since there will always be the temptation to prevent any competitor from getting in your space.
  - reaperducer 8y ago
    I am more perplexed by the necessity to have Apple's approval than anything else here. As I understand it, it’s because the apps were being distributed using a method that is supposed to be used only inside the company. Like for beta testing software, or for in-house applications used by employees only. Anything going to the general public is supposed to go through the App Store under Apple’s terms and conditions.
    - on_and_off 8y ago
      is there any other way to distribute an app without having to ask for apple's blessings though ?
      - mynameisvlad 8y ago
        Does it matter? It's their platform, they can choose the rules behind app distribution. They chose to allow it through methods controlled by themselves. If a third party wants to distribute apps, then they have to abide by the terms set by Apple.
      - saagarjha 8y ago
        Not really, no. You can distribute IPAs to users for them to sign locally, which Apple can't really control, but this is much more difficult.
      - peteretep 8y ago
        One reason I use an Apple device is that I like knowing every app I use has been reviewed by them
        tokyodude 8y ago
        That doesn't require Apple to lock down the platform. All it requires is for them to offer a store of Apple reviewed apps. You can choose those apps, other people can choose apps from other stores. You're basically saying you like Blockbuster video because there's no porn and they only have the "edited for the Airlines" versions of movies. Great, but other people would like to use their device for whatever they want. Yes, I know you'll say "so buy a device from someone else". I don't agree with that anymore than I think Ford should be able to make a car you're not allowed to drive anywhere Ford says your not. If Ford did that I don't think the answer should be, "if you want to drive other places buy a car from someone else". IMO the answer should be it's illegal for Ford to control my car to that level. I'm hoping Apple loses the case against their monopoly on the App store (although given the details of the case I don't think this particular case will succeed so I'll have to wait for another)
  - gilrain 8y ago
    “Still playing devil's advocate” You are not playing. You are presenting arguments and attempting to sway opinion. I’ll ask directly: do you not stand behind the arguments you’re making?
    - lovemenot 8y ago
      I didn't downvote you, but I imagine I know why others did. You seem not to understand the concept of Devil's Advocate, while the person you responded to clearly does. It's only the argument that counts. A person is thereby shielded from association with the argument and does not need to show their real intent.
  - cptskippy 8y ago
    Any time you have a human element to a process, there are bound to be unforseen consequences. For all we know, their review process could be devoid of SLAs for completing reviews and Agents could sit on reviews for months for arbitrary reasons because no one is following up on them. We're a large NFP but not a particularly large organization so I'm not sure if we get preferential treatment but our business lead has a direct point of contact with an App Store representative and has used it to get extended information about and, from our perspective, force through Apps releases stuck in review. He isn't the type of person to sit idly by when a process is taking an abnormal amount of time so part of me thinks it isn't a case of preferential treatment but rather the squeaky wheel getting the grease. I'm sure having someone he can get on a phone and hold accountable goes a long way. I'm still unclear how he managed that.
gilrain 8y ago
Real world experience indicates those assurances mean jack squat exactly as soon as the corporation needs them to. They have enough paid devil’s advocates arguing for them disingenuously; no need to spread their propaganda for free!
- dzader 8y ago
  Curious what data you have to suggest Google will (or has) broken this assurance ever?
  - falcolas 8y ago
    Does that matter? That data will be around forever (longer than Google). Do you trust every person (and lawyer) Google will ever hire from here on out, and every company who will purchase that data once Google is gone?
    - dzader 8y ago
      Actually Google anonymizes the data and deletes it after analysis (I have no idea if they do but since we're just making things up with no basis in fact my guess is just as valid if not more valid than yours)
      - abugheratwork 8y ago
        A guess that Google will delete data is just as valid as a guess that they will keep it? Or more valid? If you'd rather deal with evidence and reason than with guesses, I can understand that. But dude...c'mon.
        dzader 8y ago
        More valid - heres something that might surprise you all - my 20 year old anonymized data is as worthless to google as it is to me - so yes I don't care if someone gets a hold of it after google no longer exists
  - 8y ago
falcolas 8y ago
Not everyone who signed up, or who is signed up, is capable of giving informed consent (those under 18). There is also a lack of understanding of exactly how much information is being collected - it's one thing to say 'we will track all your traffic' and another to understand the long term implications of that action. Also, I'd just like to call out how much of an outright lie the phrase "Your [...] data will never be shared or sold to anyone outside of Google" is. If Google were to go into bankruptcy procedures at some point in the future, that data is simply another asset which will be sold off to someone else, with no respect for the privacy policy it was collected under (not to mention how privacy policies can change and retroactively cover data already collected).
- skybrian 8y ago
  Typically when children participate in a study, it's their parents that have to consent. I don't know how scientific research would work any other way? Also, what do we know about the contract they signed? It's probably not the regular privacy policy. Informed consent is kind of a grey area. How much do you normally know about the consequences of your actions? How can you prove that you know what you're doing? Should your freedom to enter an agreement be restricted if you can't prove that you know what you're doing? Legally, you prove consent by signing a contract. Sometimes people go above and beyond that to make sure people really and truly know what they're getting into, but there's a question how far you should go. I don't think we can know just from reading this article how informed the people signing up were. They didn't interview anyone to find out.
  - bunderbunder 8y ago
    Typically when children participate in a study, it's also been previously approved by an Institutional Review Board, and the IRB expects to either see that the potential harm is minimal, or that the potential benefit is easily great enough to justify the risks. It's hard for me to see either of those cases being a slam dunk here. There's at least some potential for serious harm in the event of a data breach. And the potential benefit - an already rich company getting even richer - doesn't carry a whole lot of moral weight.
basil-rash 8y ago
It has been my experience that people actually have no clue what they're signing up for. In a few reddit conversations today, I found people saying things like "sure they can see what websites I'm connected to, but my important information is encrypted, so I don't really mind". Sorry mate, they can see that too.
- deleted 8y ago
  [deleted]
- klodolph 8y ago
  Encrypted data can be read if you install a root CA, which is what the Facebook app does, but the Google version does not appear to do that. There’s an “enterprise certificate”—installing the enterprise certificate allows you to side-load applications. This is relatively benign. Both Facebook and Google do this, in both cases apparently a violation of Apple policy. There’s a “root certificate”—installing the root certificate allows you to do MitM attacks and read encrypted traffic like messages, bank passwords, etc. The Facebook app appears to do this and I would characterize this reckless, irresponsible, and unambiguously unethical.
  - the_duke 8y ago
    The Google version has a browser extension though, which is as good as a root cert.
    - muro 8y ago
      It doesn't do anything on mobile as extensions are not supported, no?
      - deleted 8y ago
        [deleted]
taneq 8y ago
> People who signup for this already know what they are doing I've seen this argument a few times recently. It's not clear to most people what they're signing up to. They've clicked through a EULA, that somewhere in thousands of lines mentions a separate Privacy Policy which they would then have had to load, in order to decipher more thousands of lines of legalese to find the few lines of 'active ingredient' which would tell them what's actually being recorded. Even when it does technically declare somewhere in there what "might be" recorded (usually in terms like "we record data such as [...]" which don't actually limit what they can record), the company itself will handwave it away as "we're just covering ourselves in case we have to write your name down if you call us for tech support" or similar inanities. The fact that so many people were surprised about the Cambridge Analytica scandal when selling such access is explicitly Facebook's business model and everyone participated voluntarily should tell you everything you need to know about how much the average user of these services "knows what they're doing". Devil's advocate is exactly the right word for defending these practices - they're like a Disney villain holding a giant contract scroll and a fountain pen dipped in blood. Don't worry about the fine print, just click ACCEPT, and I'll give you what you want, right?
jammygit 8y ago
As somebody whose read some of those privacy policies, I'm not sure I understand what I'm agreeing to. For example, in gsuite they only claim to not mine your data for advertising purposes. Does that mean 'we only use your data to provide the service', or does it mean 'we use your data for everything but advertising'? Many people I know barely even know how their data is or isn't used, and are shocked by recent news stories. That's not informed consent imo
- alanlamm 8y ago
  Based on direct involvement in the process of writing one such policy for one such big internet co., my view is that the confusion and vagueness is largely deliberate. A small part of it is the result of too many people involved pulling in different directions.
lbotos 8y ago
> it also says that the data wouldn't be used to "advertise to you or sell you anything" which is not the case with Smart Speakers 1. Google's entire business model is advertising through collecting more complete user data. 2. Why would they collect this data if not to further their advertisement business? 3. I've never heard of companies collecting data that wouldn't further their business pursuits. This data is either "digital-oil" or "digital uranium" both still extremely valuable.
- alanlamm 8y ago
  I think they mean the research data won't be used directly to target ads or try to make sales to you (standard guideline for market research), rather than the second order effect of allowing them to improve their overall ad targeting which then affects you.
  - TeMPOraL 8y ago
    Sure, data won't be used directly, it'll be laundered through ML. Doesn't change the final result - the data is used to sell you stuff. Data laundering needs to be recognized as a thing.
    - alanlamm 8y ago
      not necessarily - the data could be used to understand overall usage patterns and preferences in the target population as a whole - much in the same way as traditional surveys and focus groups. If indeed it is put into ML which then tries to match the data with the actual participants, then I agree that that is misrepresentation and probably criminal.
nomadiccoder 8y ago
so you agree that google is the devil and you thought that the devil needs an advocate..? -[0] [0] https://xkcd.com/1432/ https://xkcd.com/1432/
Buge 8y ago
Amazon Echo and Google Home only send data to the servers when they detect the wake word. That's a lot different than sending everything.
- pmontra 8y ago
  Sometimes they make mistakes (false positives for the wake word). Amazon even has a blog post about that https://developer.amazon.com/blogs/alexa/post/8a7980f4-340c-4275-9575-509255617b04/how-alexa-is-learning-to-ignore-tv-radio-and-other-media-players https://developer.amazon.com/blogs/alexa/post/8a7980f4-340c-...
tremon 8y ago
People who signup for this already know what they are doing But do the people they interact with, or invite into their home, know what they are doing? Does Google presume to have consent-by-proxy here?
- tazjin 8y ago
  Makes me wonder if "smart" speakers generally are legally dubious in two-party-consent areas ...

floatingatoll 8y ago

User opt-in does not excuse violating Apple’s terms of use. Google _likely_ did not get Apple’s opt-in for this approach. If they did not, they will _likely_ see their enterprise certificate terminated for precisely the same reason.

on_and_off 8y ago
Still playing devil's advocate : I am more perplexed by the necessity to have Apple's approval than anything else here. Sure this particular app is debatable.. but I have also worked in the music streaming industry. While being super respectful of the users, we still have sometimes had to wait for months for Apple's approval. Having a single agent being able to gatekeep what you can install on your phone at their own discretion is an issue since there will always be the temptation to prevent any competitor from getting in your space.
- reaperducer 8y ago
  I am more perplexed by the necessity to have Apple's approval than anything else here. As I understand it, it’s because the apps were being distributed using a method that is supposed to be used only inside the company. Like for beta testing software, or for in-house applications used by employees only. Anything going to the general public is supposed to go through the App Store under Apple’s terms and conditions.
  - on_and_off 8y ago
    is there any other way to distribute an app without having to ask for apple's blessings though ?
    - mynameisvlad 8y ago
      Does it matter? It's their platform, they can choose the rules behind app distribution. They chose to allow it through methods controlled by themselves. If a third party wants to distribute apps, then they have to abide by the terms set by Apple.
    - saagarjha 8y ago
      Not really, no. You can distribute IPAs to users for them to sign locally, which Apple can't really control, but this is much more difficult.
    - peteretep 8y ago
      One reason I use an Apple device is that I like knowing every app I use has been reviewed by them
      - tokyodude 8y ago
        That doesn't require Apple to lock down the platform. All it requires is for them to offer a store of Apple reviewed apps. You can choose those apps, other people can choose apps from other stores. You're basically saying you like Blockbuster video because there's no porn and they only have the "edited for the Airlines" versions of movies. Great, but other people would like to use their device for whatever they want. Yes, I know you'll say "so buy a device from someone else". I don't agree with that anymore than I think Ford should be able to make a car you're not allowed to drive anywhere Ford says your not. If Ford did that I don't think the answer should be, "if you want to drive other places buy a car from someone else". IMO the answer should be it's illegal for Ford to control my car to that level. I'm hoping Apple loses the case against their monopoly on the App store (although given the details of the case I don't think this particular case will succeed so I'll have to wait for another)
- gilrain 8y ago
  “Still playing devil's advocate” You are not playing. You are presenting arguments and attempting to sway opinion. I’ll ask directly: do you not stand behind the arguments you’re making?
  - lovemenot 8y ago
    I didn't downvote you, but I imagine I know why others did. You seem not to understand the concept of Devil's Advocate, while the person you responded to clearly does. It's only the argument that counts. A person is thereby shielded from association with the argument and does not need to show their real intent.
- cptskippy 8y ago
  Any time you have a human element to a process, there are bound to be unforseen consequences. For all we know, their review process could be devoid of SLAs for completing reviews and Agents could sit on reviews for months for arbitrary reasons because no one is following up on them. We're a large NFP but not a particularly large organization so I'm not sure if we get preferential treatment but our business lead has a direct point of contact with an App Store representative and has used it to get extended information about and, from our perspective, force through Apps releases stuck in review. He isn't the type of person to sit idly by when a process is taking an abnormal amount of time so part of me thinks it isn't a case of preferential treatment but rather the squeaky wheel getting the grease. I'm sure having someone he can get on a phone and hold accountable goes a long way. I'm still unclear how he managed that.

gilrain 8y ago

Real world experience indicates those assurances mean jack squat exactly as soon as the corporation needs them to. They have enough paid devil’s advocates arguing for them disingenuously; no need to spread their propaganda for free!

dzader 8y ago
Curious what data you have to suggest Google will (or has) broken this assurance ever?
- falcolas 8y ago
  Does that matter? That data will be around forever (longer than Google). Do you trust every person (and lawyer) Google will ever hire from here on out, and every company who will purchase that data once Google is gone?
  - dzader 8y ago
    Actually Google anonymizes the data and deletes it after analysis (I have no idea if they do but since we're just making things up with no basis in fact my guess is just as valid if not more valid than yours)
    - abugheratwork 8y ago
      A guess that Google will delete data is just as valid as a guess that they will keep it? Or more valid? If you'd rather deal with evidence and reason than with guesses, I can understand that. But dude...c'mon.
      - dzader 8y ago
        More valid - heres something that might surprise you all - my 20 year old anonymized data is as worthless to google as it is to me - so yes I don't care if someone gets a hold of it after google no longer exists
- 8y ago

falcolas 8y ago

Not everyone who signed up, or who is signed up, is capable of giving informed consent (those under 18). There is also a lack of understanding of exactly how much information is being collected - it's one thing to say 'we will track all your traffic' and another to understand the long term implications of that action. Also, I'd just like to call out how much of an outright lie the phrase "Your [...] data will never be shared or sold to anyone outside of Google" is. If Google were to go into bankruptcy procedures at some point in the future, that data is simply another asset which will be sold off to someone else, with no respect for the privacy policy it was collected under (not to mention how privacy policies can change and retroactively cover data already collected).

skybrian 8y ago
Typically when children participate in a study, it's their parents that have to consent. I don't know how scientific research would work any other way? Also, what do we know about the contract they signed? It's probably not the regular privacy policy. Informed consent is kind of a grey area. How much do you normally know about the consequences of your actions? How can you prove that you know what you're doing? Should your freedom to enter an agreement be restricted if you can't prove that you know what you're doing? Legally, you prove consent by signing a contract. Sometimes people go above and beyond that to make sure people really and truly know what they're getting into, but there's a question how far you should go. I don't think we can know just from reading this article how informed the people signing up were. They didn't interview anyone to find out.
- bunderbunder 8y ago
  Typically when children participate in a study, it's also been previously approved by an Institutional Review Board, and the IRB expects to either see that the potential harm is minimal, or that the potential benefit is easily great enough to justify the risks. It's hard for me to see either of those cases being a slam dunk here. There's at least some potential for serious harm in the event of a data breach. And the potential benefit - an already rich company getting even richer - doesn't carry a whole lot of moral weight.

basil-rash 8y ago

It has been my experience that people actually have no clue what they're signing up for. In a few reddit conversations today, I found people saying things like "sure they can see what websites I'm connected to, but my important information is encrypted, so I don't really mind". Sorry mate, they can see that too.

deleted 8y ago
[deleted]
klodolph 8y ago
Encrypted data can be read if you install a root CA, which is what the Facebook app does, but the Google version does not appear to do that. There’s an “enterprise certificate”—installing the enterprise certificate allows you to side-load applications. This is relatively benign. Both Facebook and Google do this, in both cases apparently a violation of Apple policy. There’s a “root certificate”—installing the root certificate allows you to do MitM attacks and read encrypted traffic like messages, bank passwords, etc. The Facebook app appears to do this and I would characterize this reckless, irresponsible, and unambiguously unethical.
- the_duke 8y ago
  The Google version has a browser extension though, which is as good as a root cert.
  - muro 8y ago
    It doesn't do anything on mobile as extensions are not supported, no?
    - deleted 8y ago
      [deleted]

taneq 8y ago

> People who signup for this already know what they are doing I've seen this argument a few times recently. It's not clear to most people what they're signing up to. They've clicked through a EULA, that somewhere in thousands of lines mentions a separate Privacy Policy which they would then have had to load, in order to decipher more thousands of lines of legalese to find the few lines of 'active ingredient' which would tell them what's actually being recorded. Even when it does technically declare somewhere in there what "might be" recorded (usually in terms like "we record data such as [...]" which don't actually limit what they can record), the company itself will handwave it away as "we're just covering ourselves in case we have to write your name down if you call us for tech support" or similar inanities. The fact that so many people were surprised about the Cambridge Analytica scandal when selling such access is explicitly Facebook's business model and everyone participated voluntarily should tell you everything you need to know about how much the average user of these services "knows what they're doing". Devil's advocate is exactly the right word for defending these practices - they're like a Disney villain holding a giant contract scroll and a fountain pen dipped in blood. Don't worry about the fine print, just click ACCEPT, and I'll give you what you want, right?

jammygit 8y ago

As somebody whose read some of those privacy policies, I'm not sure I understand what I'm agreeing to. For example, in gsuite they only claim to not mine your data for advertising purposes. Does that mean 'we only use your data to provide the service', or does it mean 'we use your data for everything but advertising'? Many people I know barely even know how their data is or isn't used, and are shocked by recent news stories. That's not informed consent imo

alanlamm 8y ago
Based on direct involvement in the process of writing one such policy for one such big internet co., my view is that the confusion and vagueness is largely deliberate. A small part of it is the result of too many people involved pulling in different directions.

lbotos 8y ago

> it also says that the data wouldn't be used to "advertise to you or sell you anything" which is not the case with Smart Speakers 1. Google's entire business model is advertising through collecting more complete user data. 2. Why would they collect this data if not to further their advertisement business? 3. I've never heard of companies collecting data that wouldn't further their business pursuits. This data is either "digital-oil" or "digital uranium" both still extremely valuable.

alanlamm 8y ago
I think they mean the research data won't be used directly to target ads or try to make sales to you (standard guideline for market research), rather than the second order effect of allowing them to improve their overall ad targeting which then affects you.
- TeMPOraL 8y ago
  Sure, data won't be used directly, it'll be laundered through ML. Doesn't change the final result - the data is used to sell you stuff. Data laundering needs to be recognized as a thing.
  - alanlamm 8y ago
    not necessarily - the data could be used to understand overall usage patterns and preferences in the target population as a whole - much in the same way as traditional surveys and focus groups. If indeed it is put into ML which then tries to match the data with the actual participants, then I agree that that is misrepresentation and probably criminal.

nomadiccoder 8y ago

so you agree that google is the devil and you thought that the devil needs an advocate..? -[0] [0] https://xkcd.com/1432/ https://xkcd.com/1432/

Buge 8y ago

Amazon Echo and Google Home only send data to the servers when they detect the wake word. That's a lot different than sending everything.

pmontra 8y ago
Sometimes they make mistakes (false positives for the wake word). Amazon even has a blog post about that https://developer.amazon.com/blogs/alexa/post/8a7980f4-340c-4275-9575-509255617b04/how-alexa-is-learning-to-ignore-tv-radio-and-other-media-players https://developer.amazon.com/blogs/alexa/post/8a7980f4-340c-...

tremon 8y ago

People who signup for this already know what they are doing But do the people they interact with, or invite into their home, know what they are doing? Does Google presume to have consent-by-proxy here?

tazjin 8y ago
Makes me wonder if "smart" speakers generally are legally dubious in two-party-consent areas ...