Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Some Google Photos videos in backups were sent to strangers in November

ww.9to5google.com

Post reply on HN
Print view View original

61–70 of 143 posts

Re: Some Google Photos videos in backups were sent to strangers in November

#61

Post by ocdtrekkie »

beckler wrote: post #48
brenden2 wrote: post #14

Earlier quoted context omitted.

I use fastmail. I'm a happy customer.

Didn't Australia like pass a bill or something that compels corporations like Fastmail to give the government any and all encrypted communications if they ask?

This is one of those stories that had no relevance in actuality, yet gets brought up in nearly every single mention of Fastmail: The bill applied to a requirement for backdoors/the ability to decrypt data. Fastmail was never E2E encrypted in the first place (like Gmail, Outlook, and most other major mail providers), and hence, Fastmail was always required to comply with lawful requests for your data.

Re: Some Google Photos videos in backups were sent to strangers in November

#62

Post by dehrmann »

drewg123 wrote: post #60
thedance wrote: post #52

Earlier quoted context omitted.

I get an absolutely endless parade of other people's data to my gmail account. Doctors send me MRI scans. Bankers send me foreclosure notices. Airlines send me tickets. Undertakers send me condolences. The preponderance of evidence suggests that relying on individual vigilance on a large scale does not work as well as relying on the vigilance of large organizations.

I assume that this not because Google is midirecting email, but rather because your email address is quite close to that of others. Mine is just my last name @gmail.com. It is a rather uncommon name, and I've met many others with that name, as I've accidentally received email intended for them.

> Mine is just my last name @gmail.com. It is a rather uncommon name

I'm in the same boat. And uncommon, but not rare. I've gotten emails intended for my brother. One time, I got a collector emailing about something with a rental car crash that I previously got confirmation email for. Recently, a Dutch woman discovered email and think she has my email address. It's amazing how many websites don't verify email addresses.

Re: Some Google Photos videos in backups were sent to strangers in November

#63

Post by Spooky23 »

darkwater wrote: post #53
thedance wrote: post #52

Earlier quoted context omitted.

I get an absolutely endless parade of other people's data to my gmail account. Doctors send me MRI scans. Bankers send me foreclosure notices. Airlines send me tickets. Undertakers send me condolences. The preponderance of evidence suggests that relying on individual vigilance on a large scale does not work as well as relying on the vigilance of large organizations.

Your comment is quite anecdotal I would dare to say, and anyway the scope of single individuals messing up is quite, quite smaller than the scope of $LARGE_COMPANY. Even if you sum all those individuals.

Lol.

The potential impact of a large company screwing up is massive. The risk is lower.

I would assert that the probability of an individual overexposing their own data in any one year period is probably close to 75%.

In my neighborhood, 5-6 cars are broken into every week, because the owners don’t lock the doors. If a process that simple isn’t handled well, folks aren’t handling more complex/abstract processes.

Re: Some Google Photos videos in backups were sent to strangers in November

#64

Post by dehrmann »

SnowingXIV wrote: post #4

How does this happen? I realize it's a small percentage, but this is one of the first tests you build. Even 1 photo (not to mention this is regarding videos) should never make it to another non-authenticated user. This is a massive mistake.

One way I've seen this happen is images have UUIDs (or just incrementing), they're base-64 encoded somewhere after security checks, and someone accidentally called `toLower()` on the id.

Re: Some Google Photos videos in backups were sent to strangers in November

#65

Post by sildur »

crazygringo wrote: post #42
brenden2 wrote: post #11

The usual argument for using "cloud" over managing your own files/data is that it's very hard to safely manage your own data without making mistakes (data loss, etc). However, this is an example of how companies like Google also make mistakes. Furthermore, when Google/FB makes a mistake (like leaking your private data) they do it at a global scale. I offboarded myself from all of Google's services a while ago, but I…

Everybody makes mistakes and nothing in the world is black and white. The only question is, is your cloud provider less likely to make mistakes with your data than you are? For most people, the answer is going to be orders of magnitude less likely.

For most people, self hosting their own data isn’t even an option. For the subset of privacy concerned people who have the technological knowledge to self host, making mistakes with their data is not “orders of magnitude less likely”.

Re: Some Google Photos videos in backups were sent to strangers in November

#66

Post by dehrmann »

friendly_fren wrote: post #7

Don't store your private information in the cloud unencrypted. Caching bugs frequently leak unintended data.

This makes sense for backups, but for something like photos, there's a lot of value-add you're missing out on. Something like sharing a photo with a friend becomes an ordeal.

Re: Some Google Photos videos in backups were sent to strangers in November

#67

Post by colejohnson66 »

Kaiyou wrote: post #54
crazygringo wrote: post #42

Earlier quoted context omitted.

Everybody makes mistakes and nothing in the world is black and white. The only question is, is your cloud provider less likely to make mistakes with your data than you are? For most people, the answer is going to be orders of magnitude less likely.

Just encrypt your data before putting it onto somebody else's computer a.k.a. the cloud.

And when the average user forgets their password?

Re: Some Google Photos videos in backups were sent to strangers in November

#68

Post by kop316 »

cyphar wrote: post #41
kop316 wrote: post #22

Earlier quoted context omitted.

I would like to say that Nextcloud, while it is not trvial to set up, is very very good at helping you set up the server securely. They additionally have a way to testing your server to make sure you did set it up, and helps you to correct issues. I would love to see Nextcloud create a "time machine" type box, where it runs both as your router and as a "home cloud" service. That way it would be much easier to configu…

The only problem is that the server is written in PHP, which has had a history of bad RCE bugs (and an RCE bug in this context means all your personal data is accessible). In addition, NextCloud has had several pretty bad bugs related to authentication (such as bypassing 2FA, by pressing "cancel"). Don't get me wrong, I still use NextCloud, but you can only access my instance through a VPN (or by being on my home net…

Do you recall which RCE bug and when?

I have been using it for 4 years, and I recall one in the past year, but Nextcloud was loud and clear on making sure you had to upgrade. It was even nicer with auto updating on Debian, I didn't have to do anything to get my server patched (I just went in to confirm it was patched).

Re: Some Google Photos videos in backups were sent to strangers in November

#69

Post by sneak »

friendly_fren wrote: post #7

Don't store your private information in the cloud unencrypted. Caching bugs frequently leak unintended data.

This is a nice platitude, but frequently most b2c client apps that use cloud storage (eg Google Photos) give no option to encrypt data clientside for storage.

Re: Some Google Photos videos in backups were sent to strangers in November

#70

Post by Macha »

I've seen services (Google Photos, Dropbox, OneDrive) try to opt in the user to having data automatically uploaded when they take a not really related action (like logging into the google account on their phone, connecting a USB device, or misclicking on an icon in their file list). I do wonder if there's any penalty that'd apply to them if they then lost data that users hadn't realised was being uploaded?
Post reply on HN