Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Forget Equifax. Facebook and Google Have the Data That Should Worry You

bloomberg.com

Post reply on HN
Print view View original

111–119 of 119 posts

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#111

Post by alexasmyths »

shakna wrote: post #110
alexasmyths wrote: post #103

Earlier quoted context omitted.

"A) No we aren't. Unjust laws should be fought. " In the court system, not by disobeying. Your view of 'what is unjust' is likely completely different from the view of others. Particularly in this case, I don't have any problem with Google or FB handing over data for individuals under investigation, wherein a Judge had provided a warrant. This is 'legal' in every sense of the term and has been for some time. As for '…

> In the court system, not by disobeying. Which cannot be done, when any issues with these laws are discussed in "secret courts" [0], and where the individuals involved cannot reach out to experts in the field, because their hands are tied by gag orders. The strength of the warrant becomes less when you recognise that FISA approves almost every request it gets. The warrant is little more than a proforma. The structur…

The article you cited shows there is rather heavy oversight, and at a very high level.

And that only about 1500 FISA requests are granted a year, which is a very small number for 300 M people, relating to another 7 Billion.

A single case might yield 5 or 10 warrants, ergo, possibly as few as 150 serious cases.

That's small.

That 'they are almost always granted' is not so bad in and of itself. If there's a 'known process' for getting warrants, and law enforcement knows what will be approved and what won't - well - then there shouldn't be too many that are denied.

Underlying the 'warrant' is not something 'pro forma' - it's a set of expectations and requirements upon the part of the overview system in place. The 'form' requires that the applicant fulfills some very important criteria.

I do think it's fair to be suspicious and that we should be vigilant about it, but I don't think that 1500 requests a year is too out of line.

I think the big concern is the 'mass surveillance' - or when local cops are making requests to do local-yocal small cases that don't have relevance to things like actual terrorism.

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#112

Post by dsfyu404ed »

program_whiz wrote: post #60
dsfyu404ed wrote: post #31

Earlier quoted context omitted.

The danger is basically a nonrepudiation problem. Look at all the finger pointing after Trump was elected. It was Hillary's fault. It was Bernie's fault. It was the Dem's fault. Trump was what people wanted. It was the Russians. It was Facebook. It was the MSM. All this is just for an election. Assume someone does use the massive data stores of Google or FB to do something bad. How can you even identify that that hap…

That's sortof like in the old days when someone robbed the bank, you had no way to even identify them if they were masked. If they travelled far, you couldn't find them, no cross-state warrants. Also, they would rip off the traveling gold wagons and make off with untraceable gold they could melt and split for money. In those days, the idea of tracing or catching these criminals would have seemed nigh impossible. I'm…

Learn the history of the FBI.

Catching cross state criminals came with it's own set of trade-offs for society.

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#113

Post by thanksgiving »

romwell wrote: post #91
blfr wrote: post #82

Earlier quoted context omitted.

It might happen but I don't think it'll work. Codes work because they deal with known, predictable, and repeated problems. You can keep improving the fire code with each disastrous fire and fire will not actively try to outsmart you next time. Security OTOH is anti-inductive because you're dealing with intelligent attackers adjusting their methods. In this environment, security code and certifications will just becom…

I disagree. The attackers can't get the data if you don't store that data to begin with. Voila! I think there should be legislation that simply restricts who can store which data, as well as legislation that forces open-sourcing of critical infrastructure software.

We can't even agree on a very weak version: if you store personally identifiable information about me, you MUST share it with me. It does not matter if you're a local corner store or the CIA. You may not store personally identifiable information about me without telling me all about what you're storing.

I bring it up and conversation shuts down. Nobody likes it. Therefore, I submit that what you're saying won't happen either.

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#114

Post by WhiteSource1 »

ams6110 wrote: post #25

I think what we're seeing are the same sorts of things that led to building codes, fire codes, licensing of architects and civil engineers. After so many building collapses, bridge collapses, or disastrous fires, people finally demanded that "build whatever you want, however you want" is not OK if you are making something for use by the general public. I think ultimately we're going to see legislation requiring licen…

But there were always security regulations: PCI DSS, SOC 2, HIPPA, ISO 30001

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#115

Post by stuaxo »

romwell wrote: post #91
blfr wrote: post #82

Earlier quoted context omitted.

It might happen but I don't think it'll work. Codes work because they deal with known, predictable, and repeated problems. You can keep improving the fire code with each disastrous fire and fire will not actively try to outsmart you next time. Security OTOH is anti-inductive because you're dealing with intelligent attackers adjusting their methods. In this environment, security code and certifications will just becom…

I disagree. The attackers can't get the data if you don't store that data to begin with. Voila! I think there should be legislation that simply restricts who can store which data, as well as legislation that forces open-sourcing of critical infrastructure software.

I think it's predictable if certain data is stored that others will want it.

Maybe this is extreme - but the rule should be not to store it at all if possible.

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#116

Post by shakna »

alexasmyths wrote: post #111
shakna wrote: post #110

Earlier quoted context omitted.

> In the court system, not by disobeying. Which cannot be done, when any issues with these laws are discussed in "secret courts" [0], and where the individuals involved cannot reach out to experts in the field, because their hands are tied by gag orders. The strength of the warrant becomes less when you recognise that FISA approves almost every request it gets. The warrant is little more than a proforma. The structur…

The article you cited shows there is rather heavy oversight, and at a very high level. And that only about 1500 FISA requests are granted a year, which is a very small number for 300 M people, relating to another 7 Billion. A single case might yield 5 or 10 warrants, ergo, possibly as few as 150 serious cases. That's small. That 'they are almost always granted' is not so bad in and of itself. If there's a 'known proc…

> I do think it's fair to be suspicious and that we should be vigilant about it, but I don't think that 1500 requests a year is too out of line.

Those 1500 requests cover about 15 million people though, which skews the weighting. That gives me concern.

> If there's a 'known process' for getting warrants, and law enforcement knows what will be approved and what won't

Either that, or there is a culture that rejecting a warrant needs extenuating circumstances, in which case it becomes a large concern.

We can't know if the oversight is simply managerial, or actually effective. It's done with the utmost secrecy, with many punishments awaiting any who might speak out.

> I think the big concern is the 'mass surveillance' - or when local cops are making requests to do local-yocal small cases that don't have relevance to things like actual terrorism.

Unfortunately FISA enables mass surveillance. And the checks and balances seem heavily weighted against the individual, and in favour of a state they can't oppose.

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#117

Post by didibus »

The vast majority of people have nothing very precious to lose to text message leaks, or even photo leaks, but they do have a lot to lose credit wise and financially from identity theft.

Seriously, I'm open for arguments, but the data Google has on me is definitly not as risky. Maybe I'd lose some pride, but not money and financial power.

And lets be real, the problem is that government and financial institutions don't use secret passwords, but only ids to authenticate you. That's where the change need to happen.

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#118

Post by shallot_router »

tryingagainbro wrote: post #71
shallot_router wrote: post #32

Earlier quoted context omitted.

Yes, but if you reside in the US and NSA or CIA want to get your data, they are going to get it. Even if you have the best security team and program in the world.

Missed my point, maybe I didn't make that clear: if there's an org with brilliant math PHDs and security people with virtually unlimited budgets, that's NSA. Yet, their info got out. If they got hacked....

Ah sorry, I did misunderstand. Yes, no one is safe. Not Google, not Facebook, and not NSA or CIA or any agency or organization on Earth. A good defense is much harder than a good offense when it comes to infosec.

Re: Forget Equifax. Facebook and Google Have the Data That Should Worry You

#119

Post by gozur88 »

Gracana wrote: post #59
bogomipz wrote: post #55

As a natural-born American you still have the choice to not sign up for a Google account or a Facebook account. You do not however have the option of refusing to apply for a social security number when your child is born. This piece looks likes little more than propaganda from the credit reporting agencies. Shame on you Bloomberg.

> you still have the choice to not sign up for a Google account or a Facebook account Unless you're careful to guard against it, you're loading up Facebook and Google's trackers on just about every site you visit. Registering for an account is not a prerequisite for them to build a profile on you.

It's not that hard to guard against their trackers. More critical, from my point of view, is the fact that, assuming you have a normal social life, snapshots of you show up on FB. And people identify you in those snapshots. So anybody with access to that data can build a partial timeline of what you do, who your friends are, and where you've been even if you've never created an account.

It's big brother implemented through the people around you.

Post reply on HN