4 ms·
The real question is not whether google, dropbox or anyone else has explicit "policies" about reading content from users. They're just going to say whatever mak
by angdis 15y ago
The real question is not whether google, dropbox or anyone else has explicit "policies" about reading content from users. They're just going to say whatever makes them look good from a marketing and legal perspective. Companies lie all the time, systematically and comprehensively. They act in their own self-interest period. From their point of view it is merely a question of how much they can get away with.
The more interesting question to explore is how much we actually trust these companies with our personal information and how do we decide when we reach a limit to our trust.
Do I believe that google can read my gmail? Yes. Do I think this capability will cause harm to come to me as a result? Hell no. There's nothing "in it" for them to do so for me or millions of others. I "trust" them for this reason.
- freshhawk 15y agoUntil there is something in it for them. It's a pretty classic security question, sometimes usability means that you accept zero security and completely share your private correspondence with the world. I think trust is the wrong word, you are really just accepting the risk of sharing all your data for the benefits because the risk is low.
- angdis 15y agoYes, I agree "trust" is the wrong word. It is perhaps better to think of it as a trade-off of some risk for some convenience and that's OK. In any case, back to the OP's question, the stated "policy" about privacy means virtually nothing unless there exists a third party who can effectively verify that policy.
- freshhawk 15y agoYes, in my experience on either side of those "policies" they really do mean nothing. You just have to assume that all the data you share is no longer yours and will be used however the company sees fit. I am amazed by the number of people who assume that "that would be bad PR if they got caught" is good enough security to protect data they consider sensitive. Especially when the PR damage historically has been very low, especially if you are a sexy and loved company like facebook or google.
- jcdreads 15y agoEven if you trust a company not to do you harm with the information they store, there exist entities that can compel them to turn this information over. For example, the information can be (sometimes secretly) subpoenaed by the U.S. government. The choice between being evil and not being evil can be an easier one to make, practically speaking, than the choice between being evil and becoming the target of federal criminal prosecution.
- pyre 15y agoWhat are the chances that some random hosting company won't just do the same thing if you ran all of your services on a VPS or colo box?
- oelewapperke 15y agoActually you can prevent that using trusted computing. First the VM is started. Upon boot is asks the TPM to certify the "secure computing base", resulting in a key : a series of bytes that is the hash of all computer code that could potentially affect the execution of the program. This key is used to encrypt the real root drive, via an intermediary key. THe TPM hash reported cannot be falsified due to, well, look up why that's not possible. You select the trusted computing base the VPS provider is supposed to use, one that doesn't allow for interference except within agreed parameters, and they won't be able to interfere. If they change the key, or the kernel, they cannot get the key needed to decrypt the hard drive image, so their info is useless. (after this you obviously make sure you can't communicate with the box unencrypted) Done/done.
- necro 15y agoSpeaking of trusting google... there was a situation at a company I worked at where the management strongly was against transferring the company mail system to google apps/mail because of the concern of google may read their email. They wanted to keep their internal mail infrastructure for privacy reasons of the company. The cto at the time convinced them that there is really no point of keeping things inhouse since the majority of the management, for convenience, forwarded all their company email to their personal gmail account anyways. Funny how security is not about what you think but what you do.
- herbivore 15y agoImagine you're a startup and use gmail or Google Apps for your team communications, even customer service. One day Google decides it wants to acquire you. During negotiations, it has access to all email exchanges between you and your customers and, more importantly, you and your investors / team members. So there's definitely something "in it" for them to do so.
- wladimir 15y agoExactly. And that applies to any company not just "evil" ones. It is a bit naive to trust something as abstract as an organization. Trust applies to individual people, and a company is bound to be a very diverse group of people with different agendas. If you want your mail to be reasonably safe from third-party reading, the only solution is to encrypt it before sending, and ask people that mail you to do the same. Anything that relies on trust is a half-assed solution.
- angdis 15y agoIn theory, yes of course, you can encrypt your communications personally and "figure out" on a case by case basis how to do key exchange with the end-party. But that is a MAJOR OBSTACLE for all but the most patient and tech-savvy people and totally overkill for all but the most critical life-or-death information exchanges. In practice, unless both you and your recipient are operating your own email servers and key-exchange/encryption services, you HAVE TO "trust" a third party with your private information.
- wladimir 15y agoThe point is that if people send their mail encrypted it is encrypted both in transit and when it is stored on the mail server. So the third party can be anyone, and you don't need to specifically trust them. Also this isn't that big of an obstacle you make it to be. We're not living in 1995 anymore. A lot of mail clients have plugins or even have built-in support for encryption.