5 ms·
This is actually pretty crazy. You pay for this service, and then they share, what many consider to be pii, directly to facebook. I'm guessing if you're logged
by Zhenya 6y ago
This is actually pretty crazy. You pay for this service, and then they share, what many consider to be pii, directly to facebook.
I'm guessing if you're logged into facebook, now FB can correlate:
1) you use a backup service
2) all the metadata from the file names
Whoops.
This is why my network runs pi-hole / diversion with all tracking blocked network wide.
- tuwtuwtuwtuw 6y agoWho are the "many" that consider file name PII?
- ncallaway 6y agoI would generally consider a filename to be the kind of field that could easily contain PII. Names or identifiers are the kinds of things that very often end up in file names.
- ipnon 6y agoURLs, of which file names could be considered a subset, are definitely considered PII.[0] [0] https://cphs.berkeley.edu/hipaa/hipaa18.html https://cphs.berkeley.edu/hipaa/hipaa18.html
- Zhenya 6y agoJohn_smith_college_graduation.jpg
- KingOfCoders 6y agoJohn_smith_doctored_college_graduation.jpg
- Nadya 6y agosisters_graduation_2019.jpg Rebecca_Range_will_and_final_testament.pdf NadyaNayme - Resume - [Company Name].pdf divorce_process.pdf steps-to-take-after-a-car-accident.pdf personal_injury_michael_perez_west_coast_trial_lawyers.pdf embarassing_porno_filename.mp4 And this is a smalls subset of filenames that could not only provide PII but also potentially embarrassing or private information that isn't identifying but would be accompanied with files that are personally identifying.
- Zhenya 6y agoWell said, nadya
- thefunnyman 6y agoI’ve worked for multiple FAANGs and can assure you that all have considered file names to be PII. Pretty much anything that contains user input should be treated as PII.
- pengaru 6y agoLawfirms often utilize automatic content-derived filenames, up to the maximum OS-supported limit. As a result you'll find all sorts of private information in the filenames within their backups.
- pengaru 6y agoI should also mention, those automagic naming schemes use the beginning text in the document. So it's basically the personal details of plaintiff vs. defendant. I've also seen similar schemes used by doctor offices/hospitals, where you'll see the patient name and ailment. I once had to troubleshoot a backup problem for what turned out to obviously be an OB-GYN. Imagine my horror as I saw long filenames containing patient names and common STDs scroll by in the thousands.
- mrweasel 6y agoRead the law strictly enough and you can put health information in the file name and now you’ve forced Facebook to deal with HIPAA. That’s taking it to the extreme, but it’s technically correct.
- Arelius 6y agoNo, that’s neither true nor “technically correct”. Services that the user provides health information to for their own purposes aren’t considered covered entities or their business associates, and thus HIPAA rules don’t apply. This is why Dropbox, and GMail don’t have to be HIPAA compliant. If you say “Read the law strictly enough” please do...
- mrweasel 6y agoYou might be right, I believed I saw some definition that simply stated that "system receiving or storing PHI" would be required to be HIPAA complaint, regardless of how the data got there. I'm still wondering, because Backblaze will sign a BAA (their website says so), making them a business associate. I'm not talking about some private person uploading their own documents. My concern is that given that Backblaze will sign a BAA, then some companies must be using Backblaze and potentially storing PHI data there. Yes? Backblaze then need to follow: "§ 164.312 Technical safeguards. (e)(1) Standard: Transmission security. Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network." Facebook isn't authorized to access this data, but that might be more of a problem for Backblaze, even if Facebook could be required to delete the data.
- Arelius 6y agoYeah, that seems like it would be on Backblaze, but this might not apply here, as 164.312 only applies to PHI, and it's quite likely that Backblaze will only sign a BAA for their B2 service, and not their standard backup service.
- Simon_says 6y ago
- stordoff 6y agoJust from looking at my own documents folder, "Stephen Tordoff - ESA Appeal SSCS1.pdf". That would reveal that I have a disability, and that I am (or have) claiming benefits for it. Not everyone would be happy with that being public knowledge, and I'd be less that thrilled if things like it were shared with Facebook for no reason.
- gpm 6y agoSexual Harassment Complaints/Persons Name.doc ...