6 ms·
Oura says it gets government demands for user data
- sz4kerto 5mo ago"In my previous blog, I revealed that Oura data is not end-to-end encrypted. That means that an Oura user's health data can be unscrambled at certain points as it travels from a person's ring, through their phone app, over the internet, and as it lands on Oura's servers." Very strange -- it seems to be conflating end-to-end encryption with encryption-in-transit.
- ggm 5mo agoIt also doesn't sound like its encrypted at rest. Perhaps each in-transit is held to be a unique e2e IP exchange?
- juggle-anyhow 5mo agoEncrypted at rest means something different. It means if you pull the hard drive out no one can decrypt it. Not that it is encrypted in the database.
- stavros 5mo agoDoes encryption at rest actually do much? The percentage of attacks that were perpetrated by people getting physical access to a drive must approach zero.
- nicce 5mo agoDepends on what kind of data is in question. Backups and old incremential data can stay encrypted while disks are otherwise in use.
- stavros 5mo agoHm yeah, I always think of encryption at rest as "the drive handles encryption itself", rather than "we encrypted these archives before we wrote them", but fair enough.
- literalAardvark 5mo agoNot necessarily the drive, but yeah, where standards mandate encryption at rest you need to have the files on the live disk encrypted. Usually it's much less of a headache to luks/bitlocker/SED the whole drive so that you don't have to worry about swap files and logs
- alternatex 5mo agoI think it's also meant to protect from potential mistakes in handling of hard disk decommissioning which presumably is a common thing with data centers.
- SoftTalker 5mo agoUsed to be, but e.g. where I work any decommissioned drive has to be DBANed (if it's spinning platters) or secure-erased (SSDs). If it can't be for some reason (e.g. it has failed) it needs to be physically destroyed. I would hope most data centers have similar policies in 2026, but that may be optimistic I guess.
- fcarraldo 5mo agoWhen the company that owns the physical hardware goes out of business, all of this stuff is moot.
- dmkolobov 5mo agoUnless the attacker is law enforcement.
- zoogeny 5mo agoIt generally has to do with risk models, especially in single tenant environments. What I mean is, say I am a b2b service provider and I have a single database for some subset of my clients. That is, multiple clients data are held in the same database. There are many ways to do this but one way I have see is BYOK (Bring Your Own Key). You can have your clients give you secure access to a public/private key pair (e.g. through AWS secrets manager). Then you encrypt anything that gets written into the database using their key. This means that if there is some security hole in your software that accidentally allows data to be exfiltrated from your servers (e.g. one malicious client sends API requests that allow for a query of data from another target client), the data the API returns will be encrypted using the target clients public/private key. My own experience with security is that nothing is perfect and good security is like an onion. Encryption at rest isn't perfect and won't handle every possible malicious attack, but it is a layer in the broader strategy. The attacker has to both find a way to exfiltrate the data and trick the server into revealing the shared key. The idea being it is harder to do both than it may be to do either individually.
- munchler 5mo agoMy understanding is that E2E encryption implies encryption in transit. The message is encrypted at the source and only decrypted at the destination, so it is encrypted everywhere in between.
- blueg3 5mo agoThe term has kind of degraded, because people started marketing that "end-to-end encryption" is the "right" answer. Encryption in transit means that network intermediates can't read the data. The two endpoints of the network communication can. E2E encryption is more context-sensitive, and its context mostly comes from messaging. It means that the data is encrypted and that operational intermediates cannot read it. So in the context of messaging, the servers that run the messaging system cannot read the messages. Or, for an email, only the sender and recipient, not any of the intermediate email servers. There's a big difference -- you can't really control or predict your network intermediates, but you can in theory know the operational intermediates. Whether something is E2E encrypted often depends on what intermediates you bring in to scope. For example: > That means that an Oura user's health data can be unscrambled at certain points as it travels from a person's ring, through their phone app, over the internet, and as it lands on Oura's servers. If the ring uses Bluetooth to sync the data to your phone and the phone syncs data to the Oura servers, but the data is in the clear on your phone, then by this definition, it is not E2E encrypted. However, that's a pretty reasonable setup, depending on how the data on the phone is stored.
- lloeki 5mo ago> If the ring uses Bluetooth to sync the data to your phone and the phone syncs data to the Oura servers, but the data is in the clear on your phone, then by this definition, it is not E2E encrypted. Yet another angle would be that both the phone and the ring are in one's material possession, whereas the cloud is someone else's computer, and to display a nice web UI it has to have the data unencrypted over there. In that case, the cloud is the potentially untrusted intermediate between the data and one's eyeballs. All of these are equally valid, it all depends on what is your threat model.
- fc417fc802 5mo ago
- iLoveOncall 5mo agoYou are conflating end-to-end encryption with encryption at rest.
- close04 5mo agoNot very strange but E2EE is thrown around a lot and everyone interprets it differently. And in some cases the expectations are unrealistic. Take a messenger app using a server as middleman. E2EE means only the 2 users get to see the content, not the middleman company server. For Oura there’s only a user and the company server and a lot of people assume Oura can’t read the data, like the Signal or WhatsApp servers can’t read the data because of E2EE. The marketing usually allows or encourages this misunderstanding. If they claim E2EE though, the interface between the user and the service (the ring or at worst the app) should mandate the encryption and the data should be decrypted only at the other end on Oura’s servers. If at any point in between these 2 ends the data is decrypted then it’s not E2EE.
- fc417fc802 5mo ago> everyone interprets it differently. No, they don't. You're spreading misinformation. If the service provider can see the data then it is not E2EE. There is no room for negotiation here. Let me be perfectly clear that any service provider that claims E2EE while having access to user data is committing blatant fraud. That said, it does not appear that Oura ever claimed E2EE. The author is merely making it clear to the reader that this is not the case.
- Chaosvex 5mo agoAgreed. Weird to see a bunch of posts trying to argue that E2E doesn't imply that provider can't see the data, at rest or in transit.
- close04 5mo ago> Weird to see a bunch of posts trying to argue that E2E doesn't imply that provider can't see the data, at rest or in transit. It's only weird for the people in that middle ground where they know "something" about it, but really not much at all. There are ways to get educated and at least acknowledge the misunderstandings but who has time for that [0]. E2E explicitly means from one end to another. Obviously when the provider is one of the ends, as sender or final recipient of the data, they can have access to the data and not violate the principle of E2EE. When the provider is just an intermediary they should not be able to decrypt the data because they are not one of the ends. Some companies slap the E2EE sticker on their product even when it's meaningless because it makes the product sound more secure. Like when they were slapping "blockchain" on everything. Or "AI" and "agentic" these days. It means nothing, it's misleading, but not factually wrong. [0] https://www.researchgate.net/publication/342621891_Improving_Non-Experts%27_Understanding_of_End-to-End_Encryption_An_Exploratory_Study https://www.researchgate.net/publication/342621891_Improving...
- fc417fc802 5mo agoI don't see the conflation? The author makes it clear that the data is not E2EE. It does sound like it's encrypted in transit (this is table stakes for the past 20 years or so). I think that saying that the data gets "unscrambled at certain points as it travels" is a perfectly reasonable way to explain the practical difference between the two approaches to a nontechnical reader.
- mystraline 5mo agoI was definitely interested in some sort of comprehensive sensor bundle for my healthcare. But every one of these devices demands some Android/Apple app, and shipping all my health data to basically non-HIPAA data brokers. Id be all over a local-only no-data-exfiltration health tracker. But the companies do NOT want to provide that. I, uh, guess, "go surveillance capitalism", for more choices?
- Aldipower 5mo agoI am using Withings in combination Tredict. Both GDPR-compliant.
- duskdozer 5mo agoIf your concern is that the government may access the data, whether it's covered by HIPAA or not is irrelevant, because HIPAA allows government access. Though yes, it would still be better than non-HIPAA in general.
- SkyPuncher 5mo agoHIPAA is completely irrelevant to any of this. Ours is technically HIPAA complaint because the data they process is not subject to HIPAA. In overly simple terms, if insurance is not involved, then it’s not subject to HIPAA.
- permutations 5mo agoI will once again proselytize for the new pebble time 2 (I am quite a fan of it). Open source and comes with standard sensors for health monitoring (6 axis imu, heart rate monitor, SpO2). Health data can be kept and analyzed on your phone and there are various apps that can do so. Suffice to say there are “surveillance-free” options out there, and if you’re not satisfied with current app options it is easy to hack your own together
- RunningDroid 5mo agoMany times GadgetBridge* can be used instead of the official app *https://codeberg.org/Freeyourgadget/Gadgetbridge https://codeberg.org/Freeyourgadget/Gadgetbridge
- basisword 5mo agoThis is why although I don't love my Apple Watch, I'm not using anything else. It's very sensitive data and Apple is the only company worth trusting with it. They're not perfect but compared to others there's no competition.
- jeroenhd 5mo agoGoogle's Health Connect system doesn't share this data either (without a consent prompt for third party apps, off course). This is to the point where I wish it would just support some kind of sync, because two devices hooked up to the same accounts need a third party app to transfer the health info. Apple is subject to the same laws Oura is. The competition is too.
- jjice 5mo agoI believe the Apple one is E2E encrypted so they physically can't give useful data. Thats the core issue with Oura here.
- jeroenhd 5mo agoApple's iCloud default is still to link the encryption key to your account password, with a bunch of extra steps if you wish to use your own key instead, just like Google does. It doesn't really matter that the data is encrypted end to end if Apple backs up the encryption key based on a factor they already know (your password).
- SoftTalker 5mo agoApple might be pretty good now. There's no assurance they always will be.
- basisword 5mo agoIf that's your policy you can't use anything ever.
- haritha-j 5mo ago
- focusgroup0 5mo ago[flagged]
- MassPikeMike 5mo agoJudging by ads for cell phone service, most people pay more than that per month to be monitored by the Feds.
- mathgeek 5mo agoJudging by various leaks over the years, you get it for free anyway.
- Cider9986 5mo agoCell phone services don't record your heart rate.
- autoexec 5mo agoI wouldn't be surprised if they could. Probably not while it's in your pocket though. They're packed with sensors that can pick up a lot. Just putting a phone on a table with a keyboard on it is enough for it to be able read your keystrokes. They can certainly tell when you're doing something that should be raising your heart rate.
- reaperducer 5mo agoCell phone services don't record your heart rate. As has been noted on HN several times, there are cars that monitor when you have sex in them. You might be surprised what is known and by whom.
- mh- 5mo agoI'm not sure what to search to find the stories you're referring to, but the obvious ones didn't cut it.. at the expense of my browser history. Can you share some links?
- ck2 5mo agoOura doesn't even have GPS does it? Government can already get ALL your celltower locations without a warrant AND read all your emails and text messages that are over 6 months old, without a warrant
- arusahni 5mo agoIn a society where women are being prosecuted for medical procedures, menstrual data becomes very risky to have handed over.
- michelb 5mo agoProbably this yeah. Your location data can be obtained from other devices than your own, but this medical data cannot.
- kevin_thibedeau 5mo agoI sat in a meeting at a data broker in 1998 where one of their product managers was strangely proud about how they could determine menstrual cycles from purchase records. It wasn't just hygiene products either. They already have that data and manipulate women with targeted ads timed for the optimal receptivity.
- speff 5mo agoFrom what I understand, they can get call records and subscription info w/ administrative subpoenas, but this is the first I've heard of them being able to get location data without a warrant. Assuming you meant directly from the telcos and not from the data broker loopholes - in which case pretty much anyone should be able to do that. Emails and texts they still need a warrant for.
- n8m8 5mo agoGreat, so they can further extrapolate what exact locations you get nervous / are more relaxed / walk more quickly… the understated problem with PII isn’t about any single data point, it’s about combining data to make probable inferences.
- ethersteeds 5mo ago
- JumpCrisscross 5mo ago> the once-responsive Oura has not yet replied to any of my inquiries, or committed to releasing the numbers Illinois has a tight biometric-privacy law [1]. I’d bet Oura isn’t particularly careful about prohibiting e.g. a Texas police department querying the protected information of Illinois residents. [1] https://en.wikipedia.org/wiki/Biometric_Information_Privacy_Act https://en.wikipedia.org/wiki/Biometric_Information_Privacy_...
- p-e-w 5mo agoWhy would they be careful, given that the chances of any serious consequences for ignoring such provisions are effectively zero?
- JumpCrisscross 5mo ago> given that the chances of any serious consequences for ignoring such provisions are effectively zero? I’m assuming that Oura are assuming that this—the Illinois BIPA is toothless—is true. It is not [1]. [1] https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20250219-year-in-review-2024-bipa-litigation-takeaways https://www.wilmerhale.com/en/insights/blogs/wilmerhale-priv...
- selectodude 5mo agoYeah I’ve probably gotten $100 in class action money from that law so far.
- reaperducer 5mo agoWhy would they be careful, given that the chances of any serious consequences for ignoring such provisions are effectively zero? Your cynicism is at odds with reality. I got a check for nearly $500 because when I was an Illinois resident, one of the SV tech companies violated that law. All it takes is one or two people to get in the ear of the right class action lawyer, and ignoring the rules quickly becomes expensive. Or you could just grouse on HN and accomplish effectively zero.
- akersten 5mo agoIPOing soon at $11B btw
- johnnyApplePRNG 5mo agoOURA is a joke. My GF bought two for us and after a week I made her return them due to non stop dark patterns coming out of that company. Everything about that company is disgusting. Such a shame, too. I was eager to learn more about my health.
- Forge36 5mo agoCan you elaborate?
- kator 5mo agoAll this said I'm more concerned about Automatic Content Recognition (ACR) on smartTV you buy in the store and never even realize it's phoning home with everything you watch...
- guilamu 5mo agoIf you're concerned about that do not give internet to your tv and use any kind of tv box instead (shield tv, apple tv, etc).
- Shadowmist 5mo agoHow long until they have built in cellular or use a mesh?
- bentcorner 5mo agoI'm certain there are a non-zero number of TVs that either attempt to auto-join popular wifi hotspots (xfinity/tmobile/starbucks/etc.) and/or have cellular connections for telemetry. Thinking more on this I think a business opportunity in the future will be companies that design hardware stacks that can go in random appliances that can gather usage information in the name of telemetry. I give it +/- 5 years before an OTS coffee maker at walmart phones home.
- iLoveOncall 5mo agoSo that TV box can phone home instead of your smart TV? What's the point?
- amarant 5mo agoWhat will the government even do with my heart rate and blood oxygen data? "Mr Smith has been running again, we better bring him in for questioning!" Edit: to be clear, the government is requesting the data, so clearly they're doing something with it... But what? I don't see it!
- deleted 5mo ago[deleted]
- AmblingAvocado 5mo agoThey used iPhone pick up and orientation data to build a narrative in the trial of Alex Murdaugh, so I imagine something similar.
- jubilanti 5mo agoTarget infamously was inferring when teenage girls were pregnant before their parents knew based on reward card data records of single merchant retail purchases.... in 2002. Tech companies when they speak to VCs: look at all the creepy things we can infer with ooodles of aggregated data and AI to maximize targeted ad revenue, we're worth 50x what an equivalent non-tech company in our sector is valued, because of all the things we can do with all that data from all those people together Tech companies when they speak to their customers: oh you're so silly to even ask about privacy, what possible utility could there be in that single isolated variable?
- nkrisc 5mo agoAccidentally inferring. They were using basic machine learning to send coupons for predicted future purchases based on past purchases and general trends. And as far as I’m aware, it only happened once (or was only publicized once).
- fc417fc802 5mo agoIt almost certainly happened regularly since the entire point of the program was to make accurate predictions about future purchases. The practical impact of acting on those predictions only caused mild controversy and became publicized the one time (at least that I'm aware of) but we have no reason to expect that the program was unsuccessful and every reason to expect that it was.
- throwawa1 5mo agoAnother reason to add to my list to justify not wearing my Apple watch and moved to a mechanical watch.
- shevy-java 5mo agoWe can not trust any government here.
- BenFranklin100 5mo agoI considered an Oura but went with an Apple watch instead. I turned on Advanced Data Protection on the paired iPhone for peace of mind. No other large data providers really provide anything equivalent to ADP’s E2EE protection with zero access encryption, especially in the consumer space for activity trackers.
- nextos 5mo agoGarmin can be used completely offline? AFAIK, they even have some watches with no radio hardware so that they can be used in sensible environments.
- allthetime 5mo agoYup. It’s a bit of a pain, but you don’t have to use the connect app. Devices and data can be accessed with direct USB connection as standard storage. You will lose some features and I think firmware updates become difficult (or impossible?)
- nextos 5mo agoI think firmware updates and even map routes can be uploaded offline by mounting the watch as a USB mass storage device? I wish Casio, Polar, Suunto and others provided this functionality. There is some community software for Polar that enables offline data exchange, but it is a bit hacky, and OFC no firmware updates. Suunto used to have a really good offline solution, but they discontinued that and moved to the cloud.
- mikestew 5mo agoGo through the Garmin Express desktop app for firmware updates. I’m probably missing something, but I can’t think of anything you lose if you don’t use the phone app.
- BenFranklin100 5mo agoI believe they can be used offline, at least the last time I used Garmin I was able to set it up such that I could sync it to Golden Cheetah. It took some jumping through hoops and an older watch version to get it work, as I recall. For serious runners and hikers, the hardware is better than Apple. I'm only a casual fitness tracker so the Apple Watch fits my needs better.
- neves 5mo ago[flagged]
- andrepd 5mo agoWhat in god's name possesses someone to buy (and pay a subscription for) a device that gathers and sells their health data in exchange for a placebo dashboard of numbers...
- reaperducer 5mo agoWhat in god's name possesses someone to buy (and pay a subscription for) a device that gathers and sells their health data in exchange for a placebo dashboard of numbers... Social media, mostly.
- myaccountonhn 5mo agoI used it to track my sleep when I had insomnia. But it has since become ewaste when they started charging for a subscription.
- einpoklum 5mo agoIt's been over a decade since the Snowden revelations. We know full well that the large tech companies collect massive amounts of your personal data and secretly share it all with the US government. Not requests, not occasionally, not some - everything. And there are even formal mechanisms for this, like National Security Letters, which essentially guarantee silence. So, why are we seeing articles like this, which raise suspcision that maybe a wearable smart-device company _might_ be sharing _some_ data, _sometimes_? Or expectations of voluntary transparency? Yes, the government spies on you. Not because you're important, but because they spy on everybody. It's cheap, convenient and has no negative political consequences (so far). References: * https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter * https://www.pcmag.com/news/the-10-most-disturbing-snowden-revelations https://www.pcmag.com/news/the-10-most-disturbing-snowden-re...
- jesterson 5mo agoIf you read comments you can see how many people are oblivious to it. And we can assume people here are fairly educated. It is incredible to read "I believe company A only!". They need to educate themselves otherwise noone would be able to stop the government machine.
- kkotak 5mo agoOh! The Audacity!
- I_am_tiberius 5mo agoWhy is it even necessary to save this data in the cloud?
- jesterson 5mo agoHow do you expect them to read it?
- I_am_tiberius 5mo agoOn my phone. I assume they get to the cloud via my phone in the first place anyway.
- j45 5mo agoThis is pretty insane. And a reminder that the cloud is someone else's computer, and your data in someone else's computer won't only be yours.
- cybercatgurrl 5mo agoreleasing a transparency report feels like an easy way to get on the administration’s shit list. i’ll be surprised if this ever happens