Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Case That Has Microsoft, Apple and Amazon Agreeing

bloomberg.com

Post reply on HN
Print view View original

31–40 of 190 posts

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#31

Post by soylentcola »

"There’s irony in any tech company confronting the government on privacy matters, considering how much heat many take for mining their own customer information and using it for advertising and other profitable purposes."

See, I don't find this very ironic. In fact, my only real issue with data mining and analysis by these sorts of companies is the way governments can demand this info without my approval.

If Microsoft or Google or Apple or Amazon offer me a service and state that "hey, we'll provide this service for no cash outlay but data you submit to our servers will be analyzed to tailor search results, advertising, and other behavior to your usage" I can opt into that knowing that I'm trading targeted ads for free email or hosting or whatever. If I don't think that's a good deal, I don't use the service. If I think "OK, ads are a fair price for this stuff" then again, I'm cool with that.

But just because I agree to let Google read my location to send me traffic warnings before heading out to work doesn't mean I want the FBI to grab that data without my knowledge so they can determine if I might be a troublemaker. Just because I agree to let Amazon use my Amazon searches to suggest other products I might want doesn't mean I want the DEA demanding that info to decide if the gardening gear I purchased was for tomatoes or growing cannabis.

I'm perfectly aware that you pay for the things you get, whether it's directly with cash or indirectly from advertisers who pay for access to your eyeballs. Those are things I can consent to or decline. But when people with guns and the ability to throw me in jail can demand access to that info without my knowledge, I'm no longer agreeing to the same thing.

It's like signing a contract where someone else has the ability to change the fine print after I've signed it.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#32

Post by idlewords »

zeveb wrote: post #12

I am not a lawyer, but it seems to me that an American court has the power to demand that an American citizen produce an item or information under his control, even if it happens to be in another country (e.g., a man getting divorced can't drive his car and all his gold and jewelry into Canada to shield them from his ex-wife). I imagine that most other countries would behave similarly: being within their borders and…

I hear you're not a lawyer.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#33

Post by throwaway7767 »

Microsoft has shown that they are quite willing to access induviduals private data if they have a financial stake in it [0]. Yes, they eventually backtracked under public pressure (after trying very hard to justify how it's totally okay because they were going to pay a lawyer to rubber-stamp things in the future), but it's rather hard to listen to their general council talking about how they value privacy on principle given their history. It's quite obvious they only care about privacy insofar as it affects their bottom line.

The article also conflates (intentionally?) this issue with the mass-surveillance issue, bringing Snowden into it and insinuating that this ruling would have an effect on that, which is just silly [1].

The whole "Company F" section is interesting (hadn't heard before that microsoft is challenging the statement that they were willingly providing user data to the NSA), but it's a bit hard to square with the leaked documents which list microsoft as the first participating partner in the PRISM program [2]

[0] http://www.geekwire.com/2014/microsoft-defends-hotmail-snoop... [1] http://www.cbsnews.com/news/patriot-act-can-obtain-data-in-e... [2] http://www.motherjones.com/politics/2013/09/nsa-timeline-sur...

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#34

Post by rayiner »

kgilpin wrote: post #4

If companies stored customer data encrypted by keys that are held by the customer, they wouldn't have this problem. Furthermore, they wouldn't have to worry about deleting customer data either. The customer would have the power to simply deny access to the keys.

What's crazy is that it often just isn't an option.

Precisely for some of the reasons outlined in the above article (third party records are subject to subpoena pretty much everywhere, not just the U.S.) it's untenable in certain fields to keep sensitive information on the cloud.

Those concerns would be dramatically mitigated if at least there was an option to do client-side encryption. That way the government has to get jurisdiction over your person to get you to turn over the encryption keys, which puts you on much stronger legal footing.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#35

Post by rayiner »

ddlatham wrote: post #23
kgilpin wrote: post #4

If companies stored customer data encrypted by keys that are held by the customer, they wouldn't have this problem. Furthermore, they wouldn't have to worry about deleting customer data either. The customer would have the power to simply deny access to the keys.

If the data is opaque to the provider, then there are many services they won't be able to provide on it (without some major advances in homomorphic encryption). For example, spam detection or search. Sharing is also made much more difficult.

There is no reason that stuff can't be done on the client side.

Outlook works just peachy searching my GB's of emails and attachments from its local replica, using the internet only to sync.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#36

Post by dpark »

zeveb wrote: post #12

I am not a lawyer, but it seems to me that an American court has the power to demand that an American citizen produce an item or information under his control, even if it happens to be in another country (e.g., a man getting divorced can't drive his car and all his gold and jewelry into Canada to shield them from his ex-wife). I imagine that most other countries would behave similarly: being within their borders and…

> it seems to me that an American court has the power to demand that an American citizen produce an item or information under his control, even if it happens to be in another country

Does the American government have the power to compel someone to violate foreign law in order to produce an item held in a foreign country? Can the American government force an American citizen to violate Greek law and take a million Euros out of Greece for that hypothetical divorce settlement?

This is the scenario in question here. It is illegal in Ireland for Microsoft to provide the requested information to the US Government. The data resides in Ireland so complying would require performing an illegal act in Ireland. Does US law for some reason override Irish law? Can the US government compel Microsoft to violate Irish law?

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#37

Post by gioele »

NoGravitas wrote: post #22
pdkl95 wrote: post #13

Earlier quoted context omitted.

> push key management to the user There is no other way. Unfortunately, there has been a serious lack of r&d in this area, so we have a lot of catching up to do. I believe it can be made to work, though, because this is not entirely a new idea for most people: they already understand physical keys and the problems associated with losing them. Moving to digital (public-)keys isn't a perfect match, but it is entirely p…

I generally agree with you, but there's one problem with the physical key analogy. The security of physical keys is weak enough that there's always a fallback if you lose all the copies of your key: you pay a locksmith to come pick the lock and rekey it. You can't do this with digital keys because a digital key that is weak enough for this strategy to be usable is also too weak to protect you from the main class of a…

> there's always a fallback if you lose all the copies of your key: you pay a locksmith to come pick the lock and rekey it.

In the digital world you have Shamir's Secret Sharing. Generate a non-encrypting, non-signing, decode-only key and give a N-th of if to N escrow services. If you lose your key you contact M of those entities and recover the data.

Plenty of tricks have been created in the last two decades to address the problems associated with key ownership, the problem is always the lack of UI and of standardization in general.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#39

Post by pdkl95 »

NoGravitas wrote: post #22
pdkl95 wrote: post #13

Earlier quoted context omitted.

> push key management to the user There is no other way. Unfortunately, there has been a serious lack of r&d in this area, so we have a lot of catching up to do. I believe it can be made to work, though, because this is not entirely a new idea for most people: they already understand physical keys and the problems associated with losing them. Moving to digital (public-)keys isn't a perfect match, but it is entirely p…

I generally agree with you, but there's one problem with the physical key analogy. The security of physical keys is weak enough that there's always a fallback if you lose all the copies of your key: you pay a locksmith to come pick the lock and rekey it. You can't do this with digital keys because a digital key that is weak enough for this strategy to be usable is also too weak to protect you from the main class of a…

Sure, as I mentioned, the physical key analogy isn't a perfect match. I'm jsut suggesting that there are some clear starting places where it should be possible to leverage existing skills, instead of starting from scratch. The details about a actually-usable product will be more complicated (and probably requires some experimentation).

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#40

Post by [deleted] »

Karunamon wrote: post #17
valarauca1 wrote: post #6

Earlier quoted context omitted.

But then you can't leverage customer data to sell to advertisers. The problem is, you are the product for most internet companies. Think of a Cow in a barn. The food/water/shelter is free, because you are what's to be sold.

If by "you", you mean aggregated data about you in lieu of cash payment. Google/Facebook/etc are not selling your data, they are not selling you , they are selling access to you via advertisers, more specifically, they are selling access to people who like certain things and who live in certain areas who have certain demographic profiles. If you're curious about this, go sign up for an Adwords account and see how the…

[deleted]
Post reply on HN