5 ms·

these are all social media companies, but what about similar abuses or security holes as such for those of us who are thinking about putting our small business

by caycep 7y ago

these are all social media companies, but what about similar abuses or security holes as such for those of us who are thinking about putting our small business data online to cloud drives/storage lockers. I.e. the google suite drive, dropbox business, backblaze backups of the world?

joshuamorton 7y ago
https://support.google.com/a/answer/9230979?hl=en https://support.google.com/a/answer/9230979?hl=en may be relevant (I work in cloud, but am not familiar with that tooling, other than knowing of it's existence). AWS might provide something similar, but I don't know what it is.
- worik 7y ago
  Not really. The problem is unauthorised access by users with sufficient privileges to do what ever they want. That would include turning off audit logs. Do you think that when Google serves your data up to the secret police that shows up in audit logs?
  - scarmig 7y ago
    It depends on your threat profile. Are the secret police more likely to target you than a vengeful ex who happens to work at Google? Obviously Google doesn't provide any real defense against court ordered snooping, but everyone (should) know that at this point. No sufficiently large company will provide any real defense, and going with no name companies doesn't help either.
  - dodobirdlord 7y ago
    Do you imagine that engineers at Google just wander around with unaudited ability to disable audit logs?
    - markholmes 7y ago
      Do you imagine this to be an impossibility? It would only take one.
      - dodobirdlord 7y ago
        I imagine that nobody has ever been deliberately given this power (why would it need to exist?), and that the auditing implementation is robust against most combinations of credentials that most engineers could put together. The number of people that could pull it off in theory is probably very small, the number that could do it in practice without leaving any trace is probably 0.
    - JetSpiegel 7y ago
      If they have legitimate access to the underlying infrastructure, they can just run cat on the physical files.
      - dodobirdlord 7y ago
        Even if you manage to end up as root in a shell on the host OS, the data you're interested in is going to be encrypted at rest, probably with keys that aren't on the same machine, and your access to the machine is going to have been logged somewhere. Access to the underlying infrastructure for the data persistence layer is also presumably granted to a tiny fraction of engineers. Only the relevant teams would need it, and even then not all of them.
  - lwhi 7y ago
    I think the problem has more to do with human nature. I've read statistics that 1 in 25 people have strong sociopathic tendencies; the percentage could arguably be higher for high-ranking jobs in media companies. There will always be people who want to make use of the power they hold for personal gain. I'd imagine this is especially true if they're unable to empathise / audit their own behavior due to their personality type. No amount of process improvement can stop this type of exploitation as far as I can imagine. If the platform is built, we should probably accept that it either has—or will—be exploited .. or put measures in place to stop that kind of power existing in the first place.
calibas 7y ago
I would say use a service you trust, and encrypt all sensitive data anyway.
acjohnson55 7y ago
I use Cryptomator to protect my documents within my Dropbox.
alexanderdmitri 7y ago
Only 2/5 of these seem to fit the "social media" category. What they all seem to have in common relevant to this thread is excessive data harvesting from their consumers.
skybrian 7y ago
The problem tends to be user interfaces built for one purpose and used for another, whether it's originally by law enforcement (due to search warrants) or by support. With something like Google Drive or Dropbox, that's where I'd look. You can say these things shouldn't exist, but then you have no support. How do you help grandpa when he has trouble with his account if you can't do anything? The end-to-end encrypted, no-support you're-on-your-own future isn't well distributed yet, and as long as there are people who can barely use a computer without a lot of hand-holding, it probably never will be. Someone has to be helping the users. They must trust someone. Such trust can be abused.
joelx 7y ago
This privacy issue is no fun, but it pales in comparison to the horrors perpetrated by the pharma industry and oil companies like this... https://www.washingtonpost.com/climate-environment/2019/06/24/fourteen-years-after-it-started-federal-government-has-studied-longest-oil-spill-history/?utm_term=.ce350f75a467 https://www.washingtonpost.com/climate-environment/2019/06/2...

by caycep 7y ago

joshuamorton 7y ago

https://support.google.com/a/answer/9230979?hl=en https://support.google.com/a/answer/9230979?hl=en may be relevant (I work in cloud, but am not familiar with that tooling, other than knowing of it's existence). AWS might provide something similar, but I don't know what it is.

worik 7y ago
Not really. The problem is unauthorised access by users with sufficient privileges to do what ever they want. That would include turning off audit logs. Do you think that when Google serves your data up to the secret police that shows up in audit logs?
- scarmig 7y ago
  It depends on your threat profile. Are the secret police more likely to target you than a vengeful ex who happens to work at Google? Obviously Google doesn't provide any real defense against court ordered snooping, but everyone (should) know that at this point. No sufficiently large company will provide any real defense, and going with no name companies doesn't help either.
- dodobirdlord 7y ago
  Do you imagine that engineers at Google just wander around with unaudited ability to disable audit logs?
  - markholmes 7y ago
    Do you imagine this to be an impossibility? It would only take one.
    - dodobirdlord 7y ago
      I imagine that nobody has ever been deliberately given this power (why would it need to exist?), and that the auditing implementation is robust against most combinations of credentials that most engineers could put together. The number of people that could pull it off in theory is probably very small, the number that could do it in practice without leaving any trace is probably 0.
  - JetSpiegel 7y ago
    If they have legitimate access to the underlying infrastructure, they can just run cat on the physical files.
    - dodobirdlord 7y ago
      Even if you manage to end up as root in a shell on the host OS, the data you're interested in is going to be encrypted at rest, probably with keys that aren't on the same machine, and your access to the machine is going to have been logged somewhere. Access to the underlying infrastructure for the data persistence layer is also presumably granted to a tiny fraction of engineers. Only the relevant teams would need it, and even then not all of them.
- lwhi 7y ago
  I think the problem has more to do with human nature. I've read statistics that 1 in 25 people have strong sociopathic tendencies; the percentage could arguably be higher for high-ranking jobs in media companies. There will always be people who want to make use of the power they hold for personal gain. I'd imagine this is especially true if they're unable to empathise / audit their own behavior due to their personality type. No amount of process improvement can stop this type of exploitation as far as I can imagine. If the platform is built, we should probably accept that it either has—or will—be exploited .. or put measures in place to stop that kind of power existing in the first place.

calibas 7y ago

I would say use a service you trust, and encrypt all sensitive data anyway.

acjohnson55 7y ago

I use Cryptomator to protect my documents within my Dropbox.

alexanderdmitri 7y ago

Only 2/5 of these seem to fit the "social media" category. What they all seem to have in common relevant to this thread is excessive data harvesting from their consumers.

skybrian 7y ago

The problem tends to be user interfaces built for one purpose and used for another, whether it's originally by law enforcement (due to search warrants) or by support. With something like Google Drive or Dropbox, that's where I'd look. You can say these things shouldn't exist, but then you have no support. How do you help grandpa when he has trouble with his account if you can't do anything? The end-to-end encrypted, no-support you're-on-your-own future isn't well distributed yet, and as long as there are people who can barely use a computer without a lot of hand-holding, it probably never will be. Someone has to be helping the users. They must trust someone. Such trust can be abused.

joelx 7y ago

This privacy issue is no fun, but it pales in comparison to the horrors perpetrated by the pharma industry and oil companies like this... https://www.washingtonpost.com/climate-environment/2019/06/24/fourteen-years-after-it-started-federal-government-has-studied-longest-oil-spill-history/?utm_term=.ce350f75a467 https://www.washingtonpost.com/climate-environment/2019/06/2...