9 ms·

I'm on a "low Google diet" myself as I'm not at all a fan of how my data gets scooped up and resold. That being said, while I disagree with their business prac

I'm on a "low Google diet" myself as I'm not at all a fan of how my data gets scooped up and resold. That being said, while I disagree with their business practices, I think their information security is one of the best. For contrast, imagine Equifax running your home security... :)

waihtis 6y ago
Its not an infosec problem, but a privacy problem
- antoncohen 6y ago
  In what way? What privacy breach are you worried about? For example are you worried that a real human at your home security company will be invading your privacy? When they do are you worried that real human will take personal action against you? Or are you worried about automated systems building knowledge about your life based on home security data? Or are you worried about your home security data used in aggregate? Maybe you are worried about attackers getting access? Internal infosec and privacy controls/policies are required to protect you from some of these. Some of these threats may be more likely from Google, but I'd say some of them are more likely from other home security providers (keep in mind that a lot of home security products are actually intended to have another human monitoring your home).
  - anamexis 6y ago
    I would say these are the obvious ones for Google: > Or are you worried about automated systems building knowledge about your life based on home security data? Or are you worried about your home security data used in aggregate?
  - ortvlwm8gcfpeu 6y ago
    I worry about the next disaffected Level 6 white supremacist doing a data dump out of Mountain View to dox all of “those people” he deems unworthy.
  - jcims 6y ago
    Good breakdown. For me the main issues would be around how technically capable Google is to ingest all of the content coming from ADT monitoring infrastructure, extract meaningful information and then merge that in with their existing knowledge of my life.
  - waihtis 6y ago
    There’s a number of direct answers below, so I’ll give you a more philosophical one: privacy is in direct conflict with Google’s business model and thus it is impossible for them to deliver privacy in good form without jeopardizing their business.
- kamarg 6y ago
  I'd think it's both in the age of the smart thermostat that has a camera/mic built in.
  - TedDoesntTalk 6y ago
    ... and motion sensor
stevehawk 6y ago
And every 2 years you can count on them cutting support for whatever devices you bought from them because they got bored and moved on to something else.
- lstamour 6y ago
  In their defense, OnHub routers launched late 2015 and was discontinued/rebranded Google Wifi in late 2016, but they did end up supporting the older models for approx. 4 years of updates, including phone support. That was a product that made me trust Google just as Apple was getting out of the router business. Google Home, Nest and Dropcam have all had older products remain supported, so far.
  - foepys 6y ago
    Meanwhile I'm rocking a 10 year old DSL router that is still being updated with security patches. 4 years is nothing in the consumer market with the exception of maybe smartphones. Nobody has the money to buy all electronics new every 4 years and looking at the current Android version distribution, a lot of consumers don't even buy new smartphones every 4 years.
    - 14 6y ago
      I was on an iPhone 4s up until late last year. It was a backup phone and of course I broke my newer phone and needed something quickly until I could replace it. They stopped updating it however so I really don’t like to use it.
    - sukilot 6y ago
      > 4 years is nothing in the consumer market with the exception of maybe smartphones. Smartphones that expire rapidly is a Google innovation.
      - foepys 6y ago
        6 years in Apple's case is also way too short. Home appliance lifetime is typically measured in decades.
SquareWheel 6y ago
> my data gets scooped up and resold Just to let you know, data is not resold by Google. It's used for interest-based advertising.
- sukilot 6y ago
  Potato, tomato.
  - gruez 6y ago
    Not really. If it's sold it's in the hands of god knows how many parties. If it's only used for targeting, it's still with one party. Maybe you find any sort of monetization of data icky, but the latter is definitely more preferable to the former.
    - thewebcount 6y ago
      This is something I don't get. Once I've clicked on an ad, the company has all my information to correlate with other databases they bought from someone other than Google, right? It takes me to their website, where they fingerprint my browser, drop cookies, etc. How is that materially different than Google selling them my info? If I interact with it in any way, they get all my info. (And in fact, with ads that include Javascript, do they even need me to interact with the ad?) This seems like a distinction without a difference to me.
      - d1zzy 6y ago
        That's definitely technically doable but that doesn't require Google in the mix. You clicked and went to a website that used those databases and your browser to fingerprint and identify you. Not sure how Google also having this data is somehow relevant to any of that.
        gruez 6y ago
        The parent comment's point is that you can get info for the user from google by doing this. ie. 1. google sends you a bid request, which contains the user's demographic/interest information 2. you respond to it with a bid, which has a unique tracking id 3. if your bid wins, your ad gets served. from there, you can serve a javascript payload that fingerprints the user. at this point you can create a huge database mapping of device fingerprint and ip (probably unique, but also pseudonymous) to interest/demographic data. 4. (optional) you can correlate the data you've gotten with third party databases to augment the data you already have. I'm not sure how viable this is. You can get more demographic information, but deanonymizing the pseudonymous identifiers from step 3 might be difficult to impossible. All of this only really works if you can fingerprint the user, which might be against the ToS of most ad exchanges. They're probably also on the lookout for this type of thing, because you can imagine this is pretty important business data. However, if you're big enough, you might be able to convince the ad networks to let you fingerprint for "fraud prevention" purposes.
asciident 6y ago
You know who actually sells your data? The senators and congressmen who are constantly going on about how Google and Facebook are selling your data. I've donated a small amount to many campaigns, and I always use a different email address for each one since I own my own domain with a catch-all. A few months or a year later, I get emails from groups like "stop republicans" or from local campaigns in states I don't care about to elizabethwarren@[mydomain.com]. And I only have used that email once to donate to Elizabeth. And it's not just one politician, it's all of them. Even ones we feel are so idealistic, like my Andrew Yang donation that I did based on his Reddit plea now receives emails targeted to my demographic about how it's my fault the democrats will fail to stop Trump, or lose California, or whatever. Financial companies also sell my data. I get phishing emails to turbotax2014@[mydomain.com] which is what I used to file that year's taxes. [Edit: in retrospect, this one is probably just a hack or incompetence rather than intentional selling] And which emails have never been sold or given out? The ones I use for Google or Facebook. Never in the past 15 years.
- rurp 6y ago
  This is a really good point; I have had the same experience. The fact that every political campaign is happy to sell my personal information to other groups has completely turned me off from donating. The same applies to volunteering. I made the mistake of giving my real phone number to a congressional campaign that I signed up to volunteer with. Since then I've gotten dozens of spam texts from many different organizations.
trekrich 6y ago
you have to be ever vigilant on whats happening with your data.
ed25519FUUU 6y ago
> I'm on a "low Google diet" myself as I'm not at all a fan of how my data gets scooped up and resold. Does google ever actually resell data? Or just monetize it? There’s a big difference selling the personal information on someone versus letting people buy targeted ads.
- kortilla 6y ago
  Depending on the level of targeting allowed the difference is meaningless. If you can target people based on something like sexual preference, you’ve effectively sold out everyone that clicks on that link.
deleted 6y ago
[deleted]

waihtis 6y ago

Its not an infosec problem, but a privacy problem

antoncohen 6y ago
In what way? What privacy breach are you worried about? For example are you worried that a real human at your home security company will be invading your privacy? When they do are you worried that real human will take personal action against you? Or are you worried about automated systems building knowledge about your life based on home security data? Or are you worried about your home security data used in aggregate? Maybe you are worried about attackers getting access? Internal infosec and privacy controls/policies are required to protect you from some of these. Some of these threats may be more likely from Google, but I'd say some of them are more likely from other home security providers (keep in mind that a lot of home security products are actually intended to have another human monitoring your home).
- anamexis 6y ago
  I would say these are the obvious ones for Google: > Or are you worried about automated systems building knowledge about your life based on home security data? Or are you worried about your home security data used in aggregate?
- ortvlwm8gcfpeu 6y ago
  I worry about the next disaffected Level 6 white supremacist doing a data dump out of Mountain View to dox all of “those people” he deems unworthy.
- jcims 6y ago
  Good breakdown. For me the main issues would be around how technically capable Google is to ingest all of the content coming from ADT monitoring infrastructure, extract meaningful information and then merge that in with their existing knowledge of my life.
- waihtis 6y ago
  There’s a number of direct answers below, so I’ll give you a more philosophical one: privacy is in direct conflict with Google’s business model and thus it is impossible for them to deliver privacy in good form without jeopardizing their business.
kamarg 6y ago
I'd think it's both in the age of the smart thermostat that has a camera/mic built in.
- TedDoesntTalk 6y ago
  ... and motion sensor

stevehawk 6y ago

And every 2 years you can count on them cutting support for whatever devices you bought from them because they got bored and moved on to something else.

lstamour 6y ago
In their defense, OnHub routers launched late 2015 and was discontinued/rebranded Google Wifi in late 2016, but they did end up supporting the older models for approx. 4 years of updates, including phone support. That was a product that made me trust Google just as Apple was getting out of the router business. Google Home, Nest and Dropcam have all had older products remain supported, so far.
- foepys 6y ago
  Meanwhile I'm rocking a 10 year old DSL router that is still being updated with security patches. 4 years is nothing in the consumer market with the exception of maybe smartphones. Nobody has the money to buy all electronics new every 4 years and looking at the current Android version distribution, a lot of consumers don't even buy new smartphones every 4 years.
  - 14 6y ago
    I was on an iPhone 4s up until late last year. It was a backup phone and of course I broke my newer phone and needed something quickly until I could replace it. They stopped updating it however so I really don’t like to use it.
  - sukilot 6y ago
    > 4 years is nothing in the consumer market with the exception of maybe smartphones. Smartphones that expire rapidly is a Google innovation.
    - foepys 6y ago
      6 years in Apple's case is also way too short. Home appliance lifetime is typically measured in decades.

SquareWheel 6y ago

> my data gets scooped up and resold Just to let you know, data is not resold by Google. It's used for interest-based advertising.

sukilot 6y ago
Potato, tomato.
- gruez 6y ago
  Not really. If it's sold it's in the hands of god knows how many parties. If it's only used for targeting, it's still with one party. Maybe you find any sort of monetization of data icky, but the latter is definitely more preferable to the former.
  - thewebcount 6y ago
    This is something I don't get. Once I've clicked on an ad, the company has all my information to correlate with other databases they bought from someone other than Google, right? It takes me to their website, where they fingerprint my browser, drop cookies, etc. How is that materially different than Google selling them my info? If I interact with it in any way, they get all my info. (And in fact, with ads that include Javascript, do they even need me to interact with the ad?) This seems like a distinction without a difference to me.
    - d1zzy 6y ago
      That's definitely technically doable but that doesn't require Google in the mix. You clicked and went to a website that used those databases and your browser to fingerprint and identify you. Not sure how Google also having this data is somehow relevant to any of that.
      - gruez 6y ago
        The parent comment's point is that you can get info for the user from google by doing this. ie. 1. google sends you a bid request, which contains the user's demographic/interest information 2. you respond to it with a bid, which has a unique tracking id 3. if your bid wins, your ad gets served. from there, you can serve a javascript payload that fingerprints the user. at this point you can create a huge database mapping of device fingerprint and ip (probably unique, but also pseudonymous) to interest/demographic data. 4. (optional) you can correlate the data you've gotten with third party databases to augment the data you already have. I'm not sure how viable this is. You can get more demographic information, but deanonymizing the pseudonymous identifiers from step 3 might be difficult to impossible. All of this only really works if you can fingerprint the user, which might be against the ToS of most ad exchanges. They're probably also on the lookout for this type of thing, because you can imagine this is pretty important business data. However, if you're big enough, you might be able to convince the ad networks to let you fingerprint for "fraud prevention" purposes.

asciident 6y ago

You know who actually sells your data? The senators and congressmen who are constantly going on about how Google and Facebook are selling your data. I've donated a small amount to many campaigns, and I always use a different email address for each one since I own my own domain with a catch-all. A few months or a year later, I get emails from groups like "stop republicans" or from local campaigns in states I don't care about to elizabethwarren@[mydomain.com]. And I only have used that email once to donate to Elizabeth. And it's not just one politician, it's all of them. Even ones we feel are so idealistic, like my Andrew Yang donation that I did based on his Reddit plea now receives emails targeted to my demographic about how it's my fault the democrats will fail to stop Trump, or lose California, or whatever. Financial companies also sell my data. I get phishing emails to turbotax2014@[mydomain.com] which is what I used to file that year's taxes. [Edit: in retrospect, this one is probably just a hack or incompetence rather than intentional selling] And which emails have never been sold or given out? The ones I use for Google or Facebook. Never in the past 15 years.

rurp 6y ago
This is a really good point; I have had the same experience. The fact that every political campaign is happy to sell my personal information to other groups has completely turned me off from donating. The same applies to volunteering. I made the mistake of giving my real phone number to a congressional campaign that I signed up to volunteer with. Since then I've gotten dozens of spam texts from many different organizations.

trekrich 6y ago

you have to be ever vigilant on whats happening with your data.

ed25519FUUU 6y ago

> I'm on a "low Google diet" myself as I'm not at all a fan of how my data gets scooped up and resold. Does google ever actually resell data? Or just monetize it? There’s a big difference selling the personal information on someone versus letting people buy targeted ads.

kortilla 6y ago
Depending on the level of targeting allowed the difference is meaningless. If you can target people based on something like sexual preference, you’ve effectively sold out everyone that clicks on that link.

deleted 6y ago

[deleted]