5 ms·

In my experience Google encourages good security practices. I'm interested in hearing if you have a different experience.

leephillips 6y ago
Assuming that this is a serious question and not sarcasm that has gone over my head: Terence Eden wrote this: https://shkspr.mobi/blog/2014/01/another-google-privacy-flaw/ https://shkspr.mobi/blog/2014/01/another-google-privacy-flaw... A journalist at Fast Company noticed it and wrote an article about Google's user- and privacy-hostile practices. I had written about these problems a few years before: https://lee-phillips.org/gcaldisaster/ https://lee-phillips.org/gcaldisaster/ and she interviewed me about it here: https://www.fastcompany.com/3025576/how-a-crappy-user-interface-can-create-a-privacy-nightmare https://www.fastcompany.com/3025576/how-a-crappy-user-interf... This is just one aspect of one of Google’s services. But, really, their business model is built on selling information about you to advertisers. Do you trust them to carry this out in a secure and anonymized way?
- fitblipper 6y ago
  It was a sincere question, thank you for the sincere response. When I asked my question I was narrowing thinking of account security and data leaks (which I still think Google does a decent job at) but it is clear that the issue of privacy is much broader than just that one aspect. The examples you gave are great examples of how privacy is not given the respect it deserves in these data collecting companies and design decisions can have catastrophic effects for their unsuspecting victims. > their business model is built on selling information about you to advertisers. I don't mean to be pedantic but their business model is selling your attention to advertisers not the data. Selling the actual data that they use for targeting is against their best interest since it would allow others to do what they do.
  - leephillips 6y ago
    I don’t remember hearing of any actual data breaches, so if your question was supposed to be confined to that area, point taken. “selling your attention to advertisers not the data” That’s a fair point as well. (I’m the last person to complain about being pedantic.)
    - gwerbret 6y ago
      Off topic, but the manner in which you and GP resolved your disagreement (with respect, active "listening", and acknowledgment of counterpoints) represents some of the very best of HN. It was a pleasure to see; thank you both.
- 10000truths 6y ago
  Google does not sell information about you to advertisers. They sell targeted advertisement services. It is, in fact, in Google’s best interest to make sure the information they collect on you does not ever reach the hands of advertisers, because if it does, they lose their biggest competitive advantage.
- cutemonster 6y ago
  When your reply is about privacy, not account security, and you "had to" go back 7 years in time, what you wrote instead on me makes a good impression on Google wrt account security.
mindslight 6y ago
Every time I login to my Google account, Google rejects caring about my perfectly good password, in favor of using email verification instead. Many times this occurs via a password reset link - apparently my password doesn't matter at all. So no, I don't think Google should be considered any kind of leader in security.
- cutemonster 6y ago
  Google dis-respecting one's email login settings (and abruptly eg enabling 2FA) is annoying and I'm thinking about migrating -- at the same time, what they do, makes one's account more secure (from what I've seen) but with a higher risk of locking people out permanently from their own accounts A good trade-off for Google I guess
  - mindslight 6y ago
    Sure, it's technically less secure to have a password and a password reset link, rather than just the password reset link. But you'd think a password reset link would be the thing that would result in extra scrutiny and hoops to jump through (eg captchas, rejecting from suspicious IPs, etc). That it seems to be the preferred login procedure seems to indicate that something is very odd with their security model, likely due to worrying too much about people who reuse their password of "Fluffy123!" across every site.

leephillips 6y ago

Assuming that this is a serious question and not sarcasm that has gone over my head: Terence Eden wrote this: https://shkspr.mobi/blog/2014/01/another-google-privacy-flaw/ https://shkspr.mobi/blog/2014/01/another-google-privacy-flaw... A journalist at Fast Company noticed it and wrote an article about Google's user- and privacy-hostile practices. I had written about these problems a few years before: https://lee-phillips.org/gcaldisaster/ https://lee-phillips.org/gcaldisaster/ and she interviewed me about it here: https://www.fastcompany.com/3025576/how-a-crappy-user-interface-can-create-a-privacy-nightmare https://www.fastcompany.com/3025576/how-a-crappy-user-interf... This is just one aspect of one of Google’s services. But, really, their business model is built on selling information about you to advertisers. Do you trust them to carry this out in a secure and anonymized way?

fitblipper 6y ago
It was a sincere question, thank you for the sincere response. When I asked my question I was narrowing thinking of account security and data leaks (which I still think Google does a decent job at) but it is clear that the issue of privacy is much broader than just that one aspect. The examples you gave are great examples of how privacy is not given the respect it deserves in these data collecting companies and design decisions can have catastrophic effects for their unsuspecting victims. > their business model is built on selling information about you to advertisers. I don't mean to be pedantic but their business model is selling your attention to advertisers not the data. Selling the actual data that they use for targeting is against their best interest since it would allow others to do what they do.
- leephillips 6y ago
  I don’t remember hearing of any actual data breaches, so if your question was supposed to be confined to that area, point taken. “selling your attention to advertisers not the data” That’s a fair point as well. (I’m the last person to complain about being pedantic.)
  - gwerbret 6y ago
    Off topic, but the manner in which you and GP resolved your disagreement (with respect, active "listening", and acknowledgment of counterpoints) represents some of the very best of HN. It was a pleasure to see; thank you both.
10000truths 6y ago
Google does not sell information about you to advertisers. They sell targeted advertisement services. It is, in fact, in Google’s best interest to make sure the information they collect on you does not ever reach the hands of advertisers, because if it does, they lose their biggest competitive advantage.
cutemonster 6y ago
When your reply is about privacy, not account security, and you "had to" go back 7 years in time, what you wrote instead on me makes a good impression on Google wrt account security.

mindslight 6y ago

Every time I login to my Google account, Google rejects caring about my perfectly good password, in favor of using email verification instead. Many times this occurs via a password reset link - apparently my password doesn't matter at all. So no, I don't think Google should be considered any kind of leader in security.

cutemonster 6y ago
Google dis-respecting one's email login settings (and abruptly eg enabling 2FA) is annoying and I'm thinking about migrating -- at the same time, what they do, makes one's account more secure (from what I've seen) but with a higher risk of locking people out permanently from their own accounts A good trade-off for Google I guess
- mindslight 6y ago
  Sure, it's technically less secure to have a password and a password reset link, rather than just the password reset link. But you'd think a password reset link would be the thing that would result in extra scrutiny and hoops to jump through (eg captchas, rejecting from suspicious IPs, etc). That it seems to be the preferred login procedure seems to indicate that something is very odd with their security model, likely due to worrying too much about people who reuse their password of "Fluffy123!" across every site.