4 ms·

How can we be sure that the messages are not analysed before being encrypted ? Gmail reads the emails to suggest ads and they don't have a good privacy reputati

How can we be sure that the messages are not analysed before being encrypted ? Gmail reads the emails to suggest ads and they don't have a good privacy reputation.

deadmutex 5y ago
I think you should really spell out what you mean by analysed here. E.g. does a spellchecker that doesn't leak info and is all on device count as an analyser, etc. > Gmail reads the emails to suggest ads. Is this still true? IIUC, this is no longer true, and hasn't been for years. [1] https://support.google.com/mail/answer/6603?hl=en https://support.google.com/mail/answer/6603?hl=en [2] https://www.nytimes.com/2017/06/23/technology/gmail-ads.html https://www.nytimes.com/2017/06/23/technology/gmail-ads.html Disclaimer: Work at Google, but not on ads/gmail, etc.
- Arnavion 5y ago
  >IIUC, this is no longer true, and hasn't been for years. Their privacy policy says otherwise. https://policies.google.com/privacy?hl=en#infocollect https://policies.google.com/privacy?hl=en#infocollect (This is the "Privacy" link in GMail's footer.) >We want you to understand the types of information we collect as you use our services >We collect information to provide better services to all our users — from figuring out basic stuff like which language you speak, to more complex things like which ads you’ll find most useful, the people who matter most to you online, or which YouTube videos you might like. >[...] >Things you create or provide to us >[...] >We also collect the content you create, upload, or receive from others when using our services. This includes things like email you write and receive, photos and videos you save, docs and spreadsheets you create, and comments you make on YouTube videos.
  - gizdan 5y ago
    Wow! I was under the impression they'd stopped doing that. Good to know.
  - abraham 5y ago
    > As always, we don’t sell your information to anyone, and we don’t use information in apps where you primarily store personal content—such as Gmail, Drive, Calendar and Photos—for advertising purposes, period. https://blog.google/technology/safety-security/keeping-private-information-private/ https://blog.google/technology/safety-security/keeping-priva... *I work for Google
    - speedgoose 5y ago
      Between a blog post and the privacy policy, I will go with the privacy policy. Especially when it's the worst one.
      - deadmutex 5y ago
        It might just be that email is read to create calendar invites for flights, etc. And not for ads. That would seem make both statements true. Disclaimer: views are my own, not of my employer (Google)
        speedgoose 5y ago
        True. But why is not explicitly in the privacy policy?
        deadmutex 5y ago
        I don't know since I do not work in the area, but if I had to guess -- brevity.
        Arnavion 5y ago
        I'm not sure this is a valid line of thinking. The privacy policy is a contract; there's a reason they email their users when they change it, with the expectation that users who disagree with the new policy will stop using the service. And as it stands, the current privacy policy gives them the ability to mine emails for ads. Even if they say in other non-contractual (?) channels that they don't do it right now, there would be nothing stopping them from doing it anyway. A user who has agreed to that privacy policy must conservatively assume the worst. The rest of the policy is quite verbose about what data is collected and what it's used for. It doesn't seem like brevity was the goal when creating that document, nor should it have been when the document in question is a privacy policy.
- speedgoose 5y ago
  By analysed I mean processed to transmit information. I didn't know Gmail stopped reading the emails to suggest ads. But my point is that we can't trust your work company to respect privacy.
remus 5y ago
You can't, you have to trust the platform. This is no different to any other encrypted messaging platform: you could be using a pen and paper + one time pad to encode a message but it's not secure if there's someone looking over your shoulder.
Laremere 5y ago
They stopped scanning emails for ads years ago: https://blog.google/products/gmail/g-suite-gains-traction-in-the-enterprise-g-suites-gmail-and-consumer-gmail-to-more-closely-align/#:~:text=Consumer%20Gmail%20content%20will%20not%20be%20used%20or%20scanned%20for%20any%20ads%20personalization%20after%20this%20change https://blog.google/products/gmail/g-suite-gains-traction-in... Of course, computers are very complicated and it's effectively impossible to personally verify all the software you use, but: 1. They'd be exposing themselves to large legal liability 2. to enable scanning they don't really need (they have lots of other ad targeting methods) 3. on an application likely to be examined by other security researchers to verify Google's statements 4. while also risking any employees who feel this is an ethical violation leaking this (Sure, not all employees would, but you would have to form a secret group of employees to scan, process, and utilize this data while vetting that nobody would leak this, in a company which ostensibly promotes itself externally and internally as ethical.)

How can we be sure that the messages are not analysed before being encrypted ? Gmail reads the emails to suggest ads and they don't have a good privacy reputation.

deadmutex 5y ago

I think you should really spell out what you mean by analysed here. E.g. does a spellchecker that doesn't leak info and is all on device count as an analyser, etc. > Gmail reads the emails to suggest ads. Is this still true? IIUC, this is no longer true, and hasn't been for years. [1] https://support.google.com/mail/answer/6603?hl=en https://support.google.com/mail/answer/6603?hl=en [2] https://www.nytimes.com/2017/06/23/technology/gmail-ads.html https://www.nytimes.com/2017/06/23/technology/gmail-ads.html Disclaimer: Work at Google, but not on ads/gmail, etc.

Arnavion 5y ago
>IIUC, this is no longer true, and hasn't been for years. Their privacy policy says otherwise. https://policies.google.com/privacy?hl=en#infocollect https://policies.google.com/privacy?hl=en#infocollect (This is the "Privacy" link in GMail's footer.) >We want you to understand the types of information we collect as you use our services >We collect information to provide better services to all our users — from figuring out basic stuff like which language you speak, to more complex things like which ads you’ll find most useful, the people who matter most to you online, or which YouTube videos you might like. >[...] >Things you create or provide to us >[...] >We also collect the content you create, upload, or receive from others when using our services. This includes things like email you write and receive, photos and videos you save, docs and spreadsheets you create, and comments you make on YouTube videos.
- gizdan 5y ago
  Wow! I was under the impression they'd stopped doing that. Good to know.
- abraham 5y ago
  > As always, we don’t sell your information to anyone, and we don’t use information in apps where you primarily store personal content—such as Gmail, Drive, Calendar and Photos—for advertising purposes, period. https://blog.google/technology/safety-security/keeping-private-information-private/ https://blog.google/technology/safety-security/keeping-priva... *I work for Google
  - speedgoose 5y ago
    Between a blog post and the privacy policy, I will go with the privacy policy. Especially when it's the worst one.
    - deadmutex 5y ago
      It might just be that email is read to create calendar invites for flights, etc. And not for ads. That would seem make both statements true. Disclaimer: views are my own, not of my employer (Google)
      - speedgoose 5y ago
        True. But why is not explicitly in the privacy policy?
        deadmutex 5y ago
        I don't know since I do not work in the area, but if I had to guess -- brevity.
        Arnavion 5y ago
        I'm not sure this is a valid line of thinking. The privacy policy is a contract; there's a reason they email their users when they change it, with the expectation that users who disagree with the new policy will stop using the service. And as it stands, the current privacy policy gives them the ability to mine emails for ads. Even if they say in other non-contractual (?) channels that they don't do it right now, there would be nothing stopping them from doing it anyway. A user who has agreed to that privacy policy must conservatively assume the worst. The rest of the policy is quite verbose about what data is collected and what it's used for. It doesn't seem like brevity was the goal when creating that document, nor should it have been when the document in question is a privacy policy.
speedgoose 5y ago
By analysed I mean processed to transmit information. I didn't know Gmail stopped reading the emails to suggest ads. But my point is that we can't trust your work company to respect privacy.

remus 5y ago

You can't, you have to trust the platform. This is no different to any other encrypted messaging platform: you could be using a pen and paper + one time pad to encode a message but it's not secure if there's someone looking over your shoulder.

Laremere 5y ago

They stopped scanning emails for ads years ago: https://blog.google/products/gmail/g-suite-gains-traction-in-the-enterprise-g-suites-gmail-and-consumer-gmail-to-more-closely-align/#:~:text=Consumer%20Gmail%20content%20will%20not%20be%20used%20or%20scanned%20for%20any%20ads%20personalization%20after%20this%20change https://blog.google/products/gmail/g-suite-gains-traction-in... Of course, computers are very complicated and it's effectively impossible to personally verify all the software you use, but: 1. They'd be exposing themselves to large legal liability 2. to enable scanning they don't really need (they have lots of other ad targeting methods) 3. on an application likely to be examined by other security researchers to verify Google's statements 4. while also risking any employees who feel this is an ethical violation leaking this (Sure, not all employees would, but you would have to form a secret group of employees to scan, process, and utilize this data while vetting that nobody would leak this, in a company which ostensibly promotes itself externally and internally as ethical.)