5 ms·

I know, because they tried to sell it to me when I was at a megacorp, they resell the real time location and local data correlated to user characteristics, as d

I know, because they tried to sell it to me when I was at a megacorp, they resell the real time location and local data correlated to user characteristics, as data service to large discrete customers. This includes constant real time information about where people are traveling to, businesses being frequented by demographics, with a sophisticated query interface for asking relatively complex questions of maps derived data. It has some differential privacy layers but we suspected it could be attacked to suss out individuals with sufficient care and effort. Our impression was “holy shit that’s creepy” and it convinced us to never put our sensitive workloads or data in any Google product, cloud or other.

hgsgm 3y ago
Anywhere you put your data can be read by the people that run the place, regardless of what other products they make.
- tommit 3y ago
  It seems like the person you're responding to has a problem with them selling their data in real-time to 3rd parties, rather than just any Google employee knowing where they are heading.
  - fnordpiglet 3y ago
    Yes that’s the specific issue. We didn’t fear specifically they could read our data; the key management systems available appeared sufficient at some level (although the gcp audit system had some issues, particularly access audit is available as a IAM decision log rather than point of use, so any access bypassing IAM or that failed in the service but succeeded in an IAM call would appear a positive access, etc - aws does the right thing here). More of concern is they appeared more than happy to harvest utilization information for the profit of others, and in our business that was a potentially serious side channel.
  - gardenhedge 3y ago
    surely google employees can't look up peoples locations..
    - pessimizer 3y ago
      Surely they can. Who would be locking them out? Another google employee. So the useful questions are which google employees can look up people's locations, and through what process?
      - bluGill 3y ago
        Some people need to be able to do that as part of their job. Either directly for some good reason, or indirectly (they are a DB admin). The question is what controls they have to ensure only those people can look such things up and that they don't abuse those rights.
      - AlbertCory 3y ago
        I can't speak for now, but you have to apply for access. For PII it goes to a VP. De-anonymizing a Gaia ID is about as secure as it gets. Disclosure: this is 6 year old info. YMMV.
      - gardenhedge 3y ago
        that's completely different. Can an accountant or marketing person look up a persons location vs can any developer vs can any map developer vs specific people with proper access controls
    - IX-103 3y ago
      From what I've heard that type of information is only held on a special higher-security "logs" cluster and the code accessing that data is subject to additional review by Google's privacy division before it is allowed access to the data. I think there may be special ways to manually access some of that data, but even requesting that capability would automatically trigger an audit after the fact.
- contravariant 3y ago
  I mean sure, but that doesn't mean I expect them to sell it to other people.
candiddevmike 3y ago
But the Internet told me Google doesn't sell data, they're stalwart stewards who merely review it when making ad decisions??
lotsofpulp 3y ago
> they resell the real time location and local data correlated to user characteristics, as data service to large discrete customers. I do not understand what resell means here. Who is google selling to first?
- fnordpiglet 3y ago
  Assuming here you consider the users giving up their privacy as the primary product being sold in maps.
  - lost_tourist 3y ago
    This seems wrong. I don't think the average business owner has the capability to reverse engineer the anonymous tokens that represent hash IDs. Also, it's good to go in and reset that occasionally with Google. I gave up on it and switched to apple, tho. Far as I can tell, they don't ever sell that info, even in anonymous hash # form. I'm happy to be proven wrong other than "wHy wOuLd yOu tRuSt aPPle?" .
    - fnordpiglet 3y ago
      This wasn’t a product for the average business owner, it was for megacorps to make strategic decisions with. https://en.m.wikipedia.org/wiki/Data_re-identification https://en.m.wikipedia.org/wiki/Data_re-identification That said: https://en.m.wikipedia.org/wiki/Differential_privacy https://en.m.wikipedia.org/wiki/Differential_privacy However it wasn’t clear how high quality the differential privacy algorithm was or if it was attackable. But the nefariousness of its use against groups and demographics was fairly apparent.
- hacoo 3y ago
  Technically I don’t think it’s resold, as google hasn’t bought the data from anyone. But I think what the author meant is that Google also uses the data for ads, etc and then sells it.
- wahnfrieden 3y ago
  Govts included. Govt can use the data as long as a company will sell it to them without laws considering it to be warrantless spying.
yankput 3y ago
Not directly related but last time I was this creeped out is when a antivirus company wanted to sell us crazy amount of data on our customers. Apparently AV companies lose money on the customer endpoint protection (it’s basically for free!) but make it up on selling users data. Also on the business licenses though
- wredue 3y ago
  GeForce experience tracks every single window you have open, sending the title and window information, along with every single spot that you click on your screen to Nvidia, tied to your now mandatory account. That was a couple years back. Who knows how much more invasive it’s gotten since. Oh. And this data is considered to be “valuable debugging information”, so is not prevented by opting out of analytics.
  - fnordpiglet 3y ago
    Good to know! Uninstalling when I get home. Windows has really become a big bag of certified malware and adware. I always feel a bit dirty when I play a game on my windows pc, and now I know why.
    - turkishmonky 3y ago
      I actually was racking my brain since I haven't seen any major nvidia callouts on my DNS block, but I use a 3090. Then I remembered I game in linux, on steam.
    - victor106 3y ago
      >Windows has really become a big bag of certified malware and adware. This 100%. I would include Azure too. I actively try not to use Windows every time I get a chance. I am so glad a company like Apple exists. I agree Apple might not be 100% right on privacy but they are pretty darn close that I a live with.
    - branon 3y ago
      The irony here is that you will get NVIDIA (and AMD) drivers vendored through Windows Update automatically by default. These work fine for 3D acceleration, and don't install GFE or require an account. You'll just be a few versions behind, not sure what their release cadence is for this. But as far as I know this is a net positive to the Windows PC user and potentially eliminates needing to deal with GFE/Adrenalin as long as you are satisfied with the builds Microsoft is shipping you.
AlbertCory 3y ago
I can honestly say that at the very least, I wasn't aware of that in 2012, IF it was happening. And probably it wasn't. And in the monetization meetings it was never even discussed.
- abdullahhhh 3y ago
  [dead]
- fnordpiglet 3y ago
  This was in 2019 and it was a new product.

hgsgm 3y ago

Anywhere you put your data can be read by the people that run the place, regardless of what other products they make.

tommit 3y ago
It seems like the person you're responding to has a problem with them selling their data in real-time to 3rd parties, rather than just any Google employee knowing where they are heading.
- fnordpiglet 3y ago
  Yes that’s the specific issue. We didn’t fear specifically they could read our data; the key management systems available appeared sufficient at some level (although the gcp audit system had some issues, particularly access audit is available as a IAM decision log rather than point of use, so any access bypassing IAM or that failed in the service but succeeded in an IAM call would appear a positive access, etc - aws does the right thing here). More of concern is they appeared more than happy to harvest utilization information for the profit of others, and in our business that was a potentially serious side channel.
- gardenhedge 3y ago
  surely google employees can't look up peoples locations..
  - pessimizer 3y ago
    Surely they can. Who would be locking them out? Another google employee. So the useful questions are which google employees can look up people's locations, and through what process?
    - bluGill 3y ago
      Some people need to be able to do that as part of their job. Either directly for some good reason, or indirectly (they are a DB admin). The question is what controls they have to ensure only those people can look such things up and that they don't abuse those rights.
    - AlbertCory 3y ago
      I can't speak for now, but you have to apply for access. For PII it goes to a VP. De-anonymizing a Gaia ID is about as secure as it gets. Disclosure: this is 6 year old info. YMMV.
    - gardenhedge 3y ago
      that's completely different. Can an accountant or marketing person look up a persons location vs can any developer vs can any map developer vs specific people with proper access controls
  - IX-103 3y ago
    From what I've heard that type of information is only held on a special higher-security "logs" cluster and the code accessing that data is subject to additional review by Google's privacy division before it is allowed access to the data. I think there may be special ways to manually access some of that data, but even requesting that capability would automatically trigger an audit after the fact.
contravariant 3y ago
I mean sure, but that doesn't mean I expect them to sell it to other people.

candiddevmike 3y ago

But the Internet told me Google doesn't sell data, they're stalwart stewards who merely review it when making ad decisions??

lotsofpulp 3y ago

> they resell the real time location and local data correlated to user characteristics, as data service to large discrete customers. I do not understand what resell means here. Who is google selling to first?

fnordpiglet 3y ago
Assuming here you consider the users giving up their privacy as the primary product being sold in maps.
- lost_tourist 3y ago
  This seems wrong. I don't think the average business owner has the capability to reverse engineer the anonymous tokens that represent hash IDs. Also, it's good to go in and reset that occasionally with Google. I gave up on it and switched to apple, tho. Far as I can tell, they don't ever sell that info, even in anonymous hash # form. I'm happy to be proven wrong other than "wHy wOuLd yOu tRuSt aPPle?" .
  - fnordpiglet 3y ago
    This wasn’t a product for the average business owner, it was for megacorps to make strategic decisions with. https://en.m.wikipedia.org/wiki/Data_re-identification https://en.m.wikipedia.org/wiki/Data_re-identification That said: https://en.m.wikipedia.org/wiki/Differential_privacy https://en.m.wikipedia.org/wiki/Differential_privacy However it wasn’t clear how high quality the differential privacy algorithm was or if it was attackable. But the nefariousness of its use against groups and demographics was fairly apparent.
hacoo 3y ago
Technically I don’t think it’s resold, as google hasn’t bought the data from anyone. But I think what the author meant is that Google also uses the data for ads, etc and then sells it.
wahnfrieden 3y ago
Govts included. Govt can use the data as long as a company will sell it to them without laws considering it to be warrantless spying.

yankput 3y ago

Not directly related but last time I was this creeped out is when a antivirus company wanted to sell us crazy amount of data on our customers. Apparently AV companies lose money on the customer endpoint protection (it’s basically for free!) but make it up on selling users data. Also on the business licenses though

wredue 3y ago
GeForce experience tracks every single window you have open, sending the title and window information, along with every single spot that you click on your screen to Nvidia, tied to your now mandatory account. That was a couple years back. Who knows how much more invasive it’s gotten since. Oh. And this data is considered to be “valuable debugging information”, so is not prevented by opting out of analytics.
- fnordpiglet 3y ago
  Good to know! Uninstalling when I get home. Windows has really become a big bag of certified malware and adware. I always feel a bit dirty when I play a game on my windows pc, and now I know why.
  - turkishmonky 3y ago
    I actually was racking my brain since I haven't seen any major nvidia callouts on my DNS block, but I use a 3090. Then I remembered I game in linux, on steam.
  - victor106 3y ago
    >Windows has really become a big bag of certified malware and adware. This 100%. I would include Azure too. I actively try not to use Windows every time I get a chance. I am so glad a company like Apple exists. I agree Apple might not be 100% right on privacy but they are pretty darn close that I a live with.
  - branon 3y ago
    The irony here is that you will get NVIDIA (and AMD) drivers vendored through Windows Update automatically by default. These work fine for 3D acceleration, and don't install GFE or require an account. You'll just be a few versions behind, not sure what their release cadence is for this. But as far as I know this is a net positive to the Windows PC user and potentially eliminates needing to deal with GFE/Adrenalin as long as you are satisfied with the builds Microsoft is shipping you.

AlbertCory 3y ago

I can honestly say that at the very least, I wasn't aware of that in 2012, IF it was happening. And probably it wasn't. And in the monetization meetings it was never even discussed.

abdullahhhh 3y ago
[dead]
fnordpiglet 3y ago
This was in 2019 and it was a new product.