Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Forget Equifax. Facebook and Google Have the Data That Should Worry You

bloomberg.com

Post reply on HN
Print view View original

21–30 of 119 posts

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#21

Post by arkem »

lisper wrote: post #13
arkem wrote: post #11

Earlier quoted context omitted.

As someone who has worked for a five eyes intelligence agency and at Google I can tell you that Google does not share sensitive data with the Government unless compelled to do so by law.

> unless compelled to do so by law That's a pretty significant hedge. Also, how effective are Google's processes against dishonest employees? It would not be hard for, say, the Chinese government to plant a mole in Google's security team. (Actually, the real nightmare scenario is a Chinese mole in Intel or Apple's hardware team.)

Google fights against subpoenas and warrants all the time but sometimes they lose. At that point they have to comply or be held in contempt and I can't really blame Google for complying in that situation.

With many thousands of engineers it is totally possible for bad actors to have infiltrated Google. It's one of the reasons why there are such strict protocols for accessing customer data or production hardware. The idea is that by default no one has access to anything and that all accesses to data and production hardware are logged and audited.

I'm sure there're still opportunities for a rogue employee to do something bad but Google are way better at protecting access to their customer's data than many of the companies I've seen.

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#23

Post by tryingagainbro »

arkem wrote: post #8

I'm not particularly worried, Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data. The amount of convenience I get from Facebook and Google outweigh the risk I'm exposed to in my opinion. If Governments want to create data protection regulations I'll save my opinion until I see whatever regulation is proposed but I think it'll be difficult…

I'm not particularly worried, Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data.

NSA begs to differ, on both counts https://www.theguardian.com/us-news/the-nsa-files

CIA too https://wikileaks.org/ciav7p1/

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#24

Post by lisper »

saalweachter wrote: post #18
lisper wrote: post #13

Earlier quoted context omitted.

> unless compelled to do so by law That's a pretty significant hedge. Also, how effective are Google's processes against dishonest employees? It would not be hard for, say, the Chinese government to plant a mole in Google's security team. (Actually, the real nightmare scenario is a Chinese mole in Intel or Apple's hardware team.)

Honestly Google is one of the few companies I know of which really considers internal threats and has taken precautions to reduce the likelihood that internal bad actors will have access, to reduce the scope of access to any bad actors that slip through, and to ensure that illegitimate accesses will be noticed, reducing the time a bad actor will have access.

I believe you. But one still has to wonder who watches the watchmen.

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#25

Post by ams6110 »

I think what we're seeing are the same sorts of things that led to building codes, fire codes, licensing of architects and civil engineers.

After so many building collapses, bridge collapses, or disastrous fires, people finally demanded that "build whatever you want, however you want" is not OK if you are making something for use by the general public.

I think ultimately we're going to see legislation requiring licenses/certifications for software designers and software companies and software service providers. Like a civil engineer is licensed and personally liable for designs he approves.

It's coming. People will only tolerate the current shitshow that is our industry for so long.

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#26

Post by 21 »

ggggtez wrote: post #16
21 wrote: post #7

Earlier quoted context omitted.

30 mil US accounts on FB were scraped using Mechanical Turk in an ingenious way. No hacking was required. I don't think that for many it matters if their data was obtained through hacking or through legal means. https://theintercept.com/2017/03/30/facebook-failed-to-prote...

You don't have your social security number and loans on your Facebook profile (or maybe you do). However whatever you put on Facebook was your choice. Nobody "posts" to Equifax.

I agree with you, but things are changing. Facebook can create a shadow profile on you, friends can tag you into pictures without your consent, when you delete data it will still remain in Google caches and you will need to individually request removal for each URL, because it won't automatically remove them if the original page from FB is gone.

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#27

Post by arkem »

tryingagainbro wrote: post #23
arkem wrote: post #8

I'm not particularly worried, Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data. The amount of convenience I get from Facebook and Google outweigh the risk I'm exposed to in my opinion. If Governments want to create data protection regulations I'll save my opinion until I see whatever regulation is proposed but I think it'll be difficult…

I'm not particularly worried, Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data. NSA begs to differ, on both counts https://www.theguardian.com/us-news/the-nsa-files CIA too https://wikileaks.org/ciav7p1/

I've read the reporting of Snowden's leaks and I have at least as much exposure to the inner workings of the five eyes as Snowden did and I have come to a different conclusion.

I do not believe that Google is voluntarily handing over any sensitive customer data to the NSA without legal compulsion. I would not be surprised if intelligence agencies around the world including US based ones target Google's communications (probably in full accordance to each agency's authorization) but that would not be with Google's cooperation.

I believe that Google is taking steps to protect customer data from all bad actors, including Government agencies. One initiative that was underway around the time I worked at Google was to encrypt all the data-center to data-center traffic at Google in an attempt to frustrate anyone who was tapping Google's backbone links.

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#29

Post by twinkletwinkle »

hodder wrote: post #6

Yes they have immense amounts of personal data and that is worrying. It is worrying they share this data with government agencies, marketing agencies etc. BUT, unlike Equifax they haven't been completely compromised by hackers. Equifax is unique it's level of incompetence. I'm surprised the equity is holding up as well as it is. The company is grossly negligent.

To me the difference is I signed up with Facebook, even though I rarely use it any more. I created a Gmail account, and I use Google for searches. All of those were options presented to me, with alternatives - there are other ways to stay in touch with friends, to send and receive email, to search the internet.

There is no reasonable way to participate in modern society without a bank account, a cell phone, and water+electricity to my home. So I had no choice but to allow Equifax to have my data, even though if presented with any alternative I would not have.

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#30

Post by saalweachter »

lisper wrote: post #24
saalweachter wrote: post #18

Earlier quoted context omitted.

Honestly Google is one of the few companies I know of which really considers internal threats and has taken precautions to reduce the likelihood that internal bad actors will have access, to reduce the scope of access to any bad actors that slip through, and to ensure that illegitimate accesses will be noticed, reducing the time a bad actor will have access.

I believe you. But one still has to wonder who watches the watchmen.

Crazy libertarian SREs. :-P
Post reply on HN