6 ms·

I was in charge of data security and privacy at Pebble among other things. I fought hard against data science teams having access to PII. It made me few friends

by lrvick 4y ago

I was in charge of data security and privacy at Pebble among other things. I fought hard against data science teams having access to PII. It made me few friends but considering the data could reveal health issues I regarded it as health data even if it technically legally is not at the moment. We were bought by Fitbit which operated with almost complete disdain for any attempt at security or privacy that could slow down operations. Anybody who wanted paintext access to user data seemed to get it without delay. Security and privacy were not among the things that created shareholder value so every issue I discovered was permanently backlogged. It was depressing seeing all the data I fought to hard to protect be absorbed into a machine that would sell it off to the highest bidder, or shrug when it got stolen by a blackhat. I quit 3 months before my golden handcuffs would have kicked in because it felt too unethical to keep working there. Then of course all the data was sold again, this time to Google. No Pebble user ever consented to their health data being sold to Google, but all of this is legal.

spaceguillotine 4y ago
My Pebble and Time are still missed, charging once a week and the e-ink screen was so damn nice to read
- hobo_mark 4y ago
  Mine still runs a week on one charge, could not find a substitute yet.
- GeneralAntilles 4y ago
  E-paper, actually, which is a fairly broad umbrella for a lot of reflective LCD displays. E-ink is specifically from E Ink and uses a different display technology (it's what's used in Kindles, etc.). This is probably a lost word-use game, as everybody just says e-ink, but it seems important given the major differences between reflective LCDs and the electrophoretic technology used in ereaders. I had a MetaWatch watch with an e-paper display with silver reflective screen backing and it was, by far, the most comment-generating thing I've ever worn. Still miss it.
- wildrhythms 4y ago
  Once a week? I easily got a month of battery out of my Pebble (whatever the base model was). It was awesome, and I'm still bitter about the sellout to Fitbit. Now I have the Amazfit Bip which gives me around 35 days of battery between charges. I can't see myself buying one of these smart watches that requires a recharge every day or two, it's already annoying enough to recharge my phone and bluetooth headphones every day.
pfortuny 4y ago
So sad. Just because… “fitness is not health, you know? there is no informed consent nor a doctor here”.
verisimi 4y ago
Yes. Once your data is out there, it will be harvested, by crook or by hook. The only way to avoid this, is to not use this (enslaving) technology. I'm genuinely wondering if the erosion of privacy, the breaking down of that wall, was the whole point of the Internet from the start.
- 2OEH8eoCRo0 4y ago
  Point of the internet from the start? I don't think so. Surveillance Capitalism didn't start with the internet, it was invented later. With that said it does seem like every single new product is built for this extractive purpose.
lrem 4y ago
You're a step too far with your assumptions. I'm a Googler. I've noped away when Pebble sold to Fitbit. But seeing from the inside how Google treats user data, I'd be 100% ok with the data going to Google instead.
- ernopp 4y ago
  Can you expand a bit on the quality of Google's internal practices with user data? eg what would an engineer on Google Photos need to do to be able to access my photos, if possible at all
  - Eridrus 4y ago
    In general, SWE/SRE do not have access to user data. SWEs just have no prod access at all, and SREs generally only have the ability to run signed binaries with code that has been code reviewed and submitted, though there are obviously break glass features with auditing. Though I am not super familiar with them. ML is where things tend to be a little bit more grey overall since being able to look at data is very useful for development, so some things are scrubbed for PII, but then accessible in some form. But for things like GMail or Photos, I would assume nobody (including ML engineers) can read your data as these are basically impossible to sanitize. Some products have systems train ML models without engineers seeing the data, e.g. spam filtering, even when the underlying data is considered sensitive.
    - hansvm 4y ago
      Basically all the data is available with no oversight if you ask permission and have some allusion to a relevant $JOB reason to need it. The fairly recent case of people's private conversations being shipped out to basically unvetted contractors for labeling and analysis (and subsequently leaked) should serve as sufficient evidence that "shit happens," and if private conversations without having even initiated an interaction with your Google devices are being tossed around and leaked, forgive me if I don't believe that when producing the tagging, timeline, and album features in Google Photos there wasn't some underpaid, unwatched contractor snooping through my photos without my permission.
moeris 4y ago
> No Pebble user ever consented to their health data being sold to Google, but all of this is legal. You're saying that Pebble users didn't sign a contract detailing use of data? That seems highly irregular.
- humanistbot 4y ago
  You know what OP means. They consented to Pebble, which is now Google.
idatum 4y ago
Is there a workout tracking, watch form factor, device that does not require "cloud" in any way? I want the convenience of a watch to track my workouts without a single thought that GOOG et al can collect. I want to download it to a local device and analyze it there. And I don't care if GOOG is "99.999999999%" better at protecting my data. The point is I do not want them to have my data.
- edmcnulty101 4y ago
  Garmin. And their products are better than Fitbit anyway.
  - hansvm 4y ago
    You mean the company that bought Navionics, blatantly ignored lifetime licenses that had been granted, force pushed broken app versions, and staffed multiple people to police the app stores and try to spin mandatory internet access and ongoing subscriptions in lieu of the aforementioned lifetime licenses as being for the users' benefit?
    - edmcnulty101 4y ago
      Sounds like you have an ax to grind! I've always really enjoyed Garmin and their products and their services. I'm sure they're not perfect but they're an alternative to the Google all seeing eye of sauron.

by lrvick 4y ago

spaceguillotine 4y ago

My Pebble and Time are still missed, charging once a week and the e-ink screen was so damn nice to read

hobo_mark 4y ago
Mine still runs a week on one charge, could not find a substitute yet.
GeneralAntilles 4y ago
E-paper, actually, which is a fairly broad umbrella for a lot of reflective LCD displays. E-ink is specifically from E Ink and uses a different display technology (it's what's used in Kindles, etc.). This is probably a lost word-use game, as everybody just says e-ink, but it seems important given the major differences between reflective LCDs and the electrophoretic technology used in ereaders. I had a MetaWatch watch with an e-paper display with silver reflective screen backing and it was, by far, the most comment-generating thing I've ever worn. Still miss it.
wildrhythms 4y ago
Once a week? I easily got a month of battery out of my Pebble (whatever the base model was). It was awesome, and I'm still bitter about the sellout to Fitbit. Now I have the Amazfit Bip which gives me around 35 days of battery between charges. I can't see myself buying one of these smart watches that requires a recharge every day or two, it's already annoying enough to recharge my phone and bluetooth headphones every day.

pfortuny 4y ago

So sad. Just because… “fitness is not health, you know? there is no informed consent nor a doctor here”.

verisimi 4y ago

Yes. Once your data is out there, it will be harvested, by crook or by hook. The only way to avoid this, is to not use this (enslaving) technology. I'm genuinely wondering if the erosion of privacy, the breaking down of that wall, was the whole point of the Internet from the start.

2OEH8eoCRo0 4y ago
Point of the internet from the start? I don't think so. Surveillance Capitalism didn't start with the internet, it was invented later. With that said it does seem like every single new product is built for this extractive purpose.

lrem 4y ago

You're a step too far with your assumptions. I'm a Googler. I've noped away when Pebble sold to Fitbit. But seeing from the inside how Google treats user data, I'd be 100% ok with the data going to Google instead.

ernopp 4y ago
Can you expand a bit on the quality of Google's internal practices with user data? eg what would an engineer on Google Photos need to do to be able to access my photos, if possible at all
- Eridrus 4y ago
  In general, SWE/SRE do not have access to user data. SWEs just have no prod access at all, and SREs generally only have the ability to run signed binaries with code that has been code reviewed and submitted, though there are obviously break glass features with auditing. Though I am not super familiar with them. ML is where things tend to be a little bit more grey overall since being able to look at data is very useful for development, so some things are scrubbed for PII, but then accessible in some form. But for things like GMail or Photos, I would assume nobody (including ML engineers) can read your data as these are basically impossible to sanitize. Some products have systems train ML models without engineers seeing the data, e.g. spam filtering, even when the underlying data is considered sensitive.
  - hansvm 4y ago
    Basically all the data is available with no oversight if you ask permission and have some allusion to a relevant $JOB reason to need it. The fairly recent case of people's private conversations being shipped out to basically unvetted contractors for labeling and analysis (and subsequently leaked) should serve as sufficient evidence that "shit happens," and if private conversations without having even initiated an interaction with your Google devices are being tossed around and leaked, forgive me if I don't believe that when producing the tagging, timeline, and album features in Google Photos there wasn't some underpaid, unwatched contractor snooping through my photos without my permission.

moeris 4y ago

> No Pebble user ever consented to their health data being sold to Google, but all of this is legal. You're saying that Pebble users didn't sign a contract detailing use of data? That seems highly irregular.

humanistbot 4y ago
You know what OP means. They consented to Pebble, which is now Google.

idatum 4y ago

Is there a workout tracking, watch form factor, device that does not require "cloud" in any way? I want the convenience of a watch to track my workouts without a single thought that GOOG et al can collect. I want to download it to a local device and analyze it there. And I don't care if GOOG is "99.999999999%" better at protecting my data. The point is I do not want them to have my data.

edmcnulty101 4y ago
Garmin. And their products are better than Fitbit anyway.
- hansvm 4y ago
  You mean the company that bought Navionics, blatantly ignored lifetime licenses that had been granted, force pushed broken app versions, and staffed multiple people to police the app stores and try to spin mandatory internet access and ongoing subscriptions in lieu of the aforementioned lifetime licenses as being for the users' benefit?
  - edmcnulty101 4y ago
    Sounds like you have an ax to grind! I've always really enjoyed Garmin and their products and their services. I'm sure they're not perfect but they're an alternative to the Google all seeing eye of sauron.