30 ms·

I'm confused how they keep saying this is in compliance with Grpd when auto opt in is not allowed. And the idea that they force everyone in, and will add an op

I'm confused how they keep saying this is in compliance with Grpd when auto opt in is not allowed. And the idea that they force everyone in, and will add an opt out button later seems like they are gaming the system. If they don't opt everyone out they didn't ask to opt in as a default, their actions to me seem hollow.

8fingerlouie 7y ago
Most likely because as an American company they have no clue what the GDPR really does. Many European companies are still struggling to be fully compliant. Furthermore, if they transmit crash logs, and those contain partial memory contents (core dumps), chances are actual content from network packets are transmitted to UBNT as well, and those contents may contain PII (IP addresses, MAC addresses, usernames, passwords, real names, addresses, credit card information, etc.), meaning they’re most certainly violating the GDPR by making it opt out.
- secabeen 7y ago
  With a significant fraction of Internet traffic (and all eCommerce traffic) end-to-end encrypted, is it really realistic that they would have sensitive data (usernames, passwords, real names, addresses, credit card information, etc.) in memory of an AP? This is the point of Let's Encrypt, after all, to close the exposure that we give to our ISPs and our ISPs ISPs.
  - m4rtink 7y ago
    AFAIK ubiquity also does routers, those can hold quite some sensitive data in memory.
  - noja 7y ago
    Don't think sensitive data, think personal data. An IP is personal data.
  - zeeZ 7y ago
    Macs tend to use your name as their network name from what I've seen, and corporate logins usually are some variation of your first and last names. The APs absolutely know those.
  - 8fingerlouie 7y ago
    But APs are not limited to internet traffic. Maybe some company somewhere runs an internal server, and because it's internal they might think that encryption is not needed. Hell, it might even use GET arguments for username/passwords in the URL. The crash dumps would contain these data as well.
- lilyball 7y ago
  I wouldn't assume "crash logs" means "core dumps". I'd assume they mean stack traces, and perhaps register contents.
  - fhars 7y ago
    And they never hold IP addresses in registers?
    - ripdog 7y ago
      Oh come on. It's extremely unlikely, and there'd be no reliable, automated way to extract them anyway.
      - tallanvor 7y ago
        You can absolutely automate retrieving information from a core file. I'm not saying that UI is going to purposefully extract sensitive information, but of course they'll setup automated processing of the core dumps in order to categorize the types of crashes into buckets so that engineers can examine them more closely. Next time you come across a core file, use strings on it - you'll be surprised what it will find!
        ripdog 7y ago
        We were talking about registers+stack trace, not a core dump.
noja 7y ago
I hope Ubiquiti (or one of their lawyers) reads your comment.
eddyg 7y ago
Anonymous data is not subject to the the GDPR. See recital 26. [0] IANAL, but as far as I know, companies can collect anonymous data ("what versions are our customers running?") without involving the GDPR. > This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes. [0] https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/
- simpss 7y ago
  the thing is, it's pretty difficult to guarantee the data is indeed anonymous. In this specific case, as they are not willing to explain what data is actually processed and say it's somewhere in the Tos, privacy policy[1] etc... we'll take that as the gospel. ---------------- The Usage Data that we collect may include information such as your device data, including your mobile devices, sensor data, device signals, device parameters, device identifiers that may uniquely identify your devices, including your mobile device, web request, Internet Protocol address, browser type, browser language, referring/exit pages and URLs, platform type, the date and time of your request, and one or more cookies that may uniquely identify your devices or browser.[1] ---------------- This data is certainly not anonymous by GDPR standards. Identifiers that uniquely identify a device will in some cases(ex, single-user devices) also be unique identifiers to a single person. That is enough for the data to be considered Personal Data in the context of GDPR. ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person[2] [1] - https://www.ui.com/legal/privacypolicy/ https://www.ui.com/legal/privacypolicy/ [2] - https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
- tgsovlerkhgsel 7y ago
  I bet they will not actually be GDPR compliant. They will likely get away with it because enforcement is lacking, but anonymization is hard to get right and I would be surprised if they did get it right.
kasey_junk 7y ago
Opt in is only one way to justify data collection and be in compliance with GDPR. They may be basing their collection on ‘legitimate interest’ for instance. I don’t think anyone is in a position to predict these things but I’d bet they have a pretty good justification there for IP collection given the product they provide.
- simpss 7y ago
  given that there are very little references to GDPR in their ToS and privacy policy I'd say they haven't even thought of it properly. Also in the original thread someone quoted this cool tidbit from their ToS .[1] > Special Note to International Users. If You are accessing the Services from the European Union, Asia or any other region with laws or regulations governing personal data collection and disclosure that differ from United States laws, please be advised that Your continued use of the Services will be governed by United States law this makes it seem even more likely. [1] - https://www.ui.com/legal/termsofservice/ https://www.ui.com/legal/termsofservice/

8fingerlouie 7y ago

Most likely because as an American company they have no clue what the GDPR really does. Many European companies are still struggling to be fully compliant. Furthermore, if they transmit crash logs, and those contain partial memory contents (core dumps), chances are actual content from network packets are transmitted to UBNT as well, and those contents may contain PII (IP addresses, MAC addresses, usernames, passwords, real names, addresses, credit card information, etc.), meaning they’re most certainly violating the GDPR by making it opt out.

secabeen 7y ago
With a significant fraction of Internet traffic (and all eCommerce traffic) end-to-end encrypted, is it really realistic that they would have sensitive data (usernames, passwords, real names, addresses, credit card information, etc.) in memory of an AP? This is the point of Let's Encrypt, after all, to close the exposure that we give to our ISPs and our ISPs ISPs.
- m4rtink 7y ago
  AFAIK ubiquity also does routers, those can hold quite some sensitive data in memory.
- noja 7y ago
  Don't think sensitive data, think personal data. An IP is personal data.
- zeeZ 7y ago
  Macs tend to use your name as their network name from what I've seen, and corporate logins usually are some variation of your first and last names. The APs absolutely know those.
- 8fingerlouie 7y ago
  But APs are not limited to internet traffic. Maybe some company somewhere runs an internal server, and because it's internal they might think that encryption is not needed. Hell, it might even use GET arguments for username/passwords in the URL. The crash dumps would contain these data as well.
lilyball 7y ago
I wouldn't assume "crash logs" means "core dumps". I'd assume they mean stack traces, and perhaps register contents.
- fhars 7y ago
  And they never hold IP addresses in registers?
  - ripdog 7y ago
    Oh come on. It's extremely unlikely, and there'd be no reliable, automated way to extract them anyway.
    - tallanvor 7y ago
      You can absolutely automate retrieving information from a core file. I'm not saying that UI is going to purposefully extract sensitive information, but of course they'll setup automated processing of the core dumps in order to categorize the types of crashes into buckets so that engineers can examine them more closely. Next time you come across a core file, use strings on it - you'll be surprised what it will find!
      - ripdog 7y ago
        We were talking about registers+stack trace, not a core dump.

noja 7y ago

I hope Ubiquiti (or one of their lawyers) reads your comment.

eddyg 7y ago

Anonymous data is not subject to the the GDPR. See recital 26. [0] IANAL, but as far as I know, companies can collect anonymous data ("what versions are our customers running?") without involving the GDPR. > This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes. [0] https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/

simpss 7y ago
the thing is, it's pretty difficult to guarantee the data is indeed anonymous. In this specific case, as they are not willing to explain what data is actually processed and say it's somewhere in the Tos, privacy policy[1] etc... we'll take that as the gospel. ---------------- The Usage Data that we collect may include information such as your device data, including your mobile devices, sensor data, device signals, device parameters, device identifiers that may uniquely identify your devices, including your mobile device, web request, Internet Protocol address, browser type, browser language, referring/exit pages and URLs, platform type, the date and time of your request, and one or more cookies that may uniquely identify your devices or browser.[1] ---------------- This data is certainly not anonymous by GDPR standards. Identifiers that uniquely identify a device will in some cases(ex, single-user devices) also be unique identifiers to a single person. That is enough for the data to be considered Personal Data in the context of GDPR. ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person[2] [1] - https://www.ui.com/legal/privacypolicy/ https://www.ui.com/legal/privacypolicy/ [2] - https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
tgsovlerkhgsel 7y ago
I bet they will not actually be GDPR compliant. They will likely get away with it because enforcement is lacking, but anonymization is hard to get right and I would be surprised if they did get it right.

kasey_junk 7y ago

Opt in is only one way to justify data collection and be in compliance with GDPR. They may be basing their collection on ‘legitimate interest’ for instance. I don’t think anyone is in a position to predict these things but I’d bet they have a pretty good justification there for IP collection given the product they provide.

simpss 7y ago
given that there are very little references to GDPR in their ToS and privacy policy I'd say they haven't even thought of it properly. Also in the original thread someone quoted this cool tidbit from their ToS .[1] > Special Note to International Users. If You are accessing the Services from the European Union, Asia or any other region with laws or regulations governing personal data collection and disclosure that differ from United States laws, please be advised that Your continued use of the Services will be governed by United States law this makes it seem even more likely. [1] - https://www.ui.com/legal/termsofservice/ https://www.ui.com/legal/termsofservice/