Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oura says it gets government demands for user data

this.weekinsecurity.com

Post reply on HN
Print view View original

111–120 of 168 posts

Re: Oura says it gets government demands for user data

#111

Post by wil421 »

xboxnolifes wrote: post #72
amarant wrote: post #29

What will the government even do with my heart rate and blood oxygen data? "Mr Smith has been running again, we better bring him in for questioning!" Edit: to be clear, the government is requesting the data, so clearly they're doing something with it... But what? I don't see it!

Buys your heart rate and blood oxygen data from Oura. Collects your iris data from Eyez. Purchases your fitness data from Borg. Sees your purchasing patterns through Krump. Knows everything you've said online through Gwimp. Gets your sequenced DNA from FamaTree. Tracks your location data from, well, nearly every app in existance. What could they possibly do from this single variable???

Nobody cares that’s why this stuff sells.

Re: Oura says it gets government demands for user data

#112

Post by mh- »

reaperducer wrote: post #106
Cider9986 wrote: post #39

Earlier quoted context omitted.

Cell phone services don't record your heart rate.

Cell phone services don't record your heart rate. As has been noted on HN several times, there are cars that monitor when you have sex in them. You might be surprised what is known and by whom.

I'm not sure what to search to find the stories you're referring to, but the obvious ones didn't cut it.. at the expense of my browser history.

Can you share some links?

Re: Oura says it gets government demands for user data

#113

Post by GeekyBear »

clutter55561 wrote: post #103
GeekyBear wrote: post #86

Earlier quoted context omitted.

Nope. After Apple's announcement that they would remove encryption from UK users rather than weaken it, the bad press and public pressure forced the UK government to back down.

Not exactly. Apple kept it for existing users but stopped offering it to new users. So new users are vulnerable.

Nope.

> UK backs down in Apple privacy row, US says

https://www.bbc.com/news/articles/cdj2m3rrk74o

Re: Oura says it gets government demands for user data

#114

Post by Cider9986 »

reaperducer wrote: post #106
Cider9986 wrote: post #39

Earlier quoted context omitted.

Cell phone services don't record your heart rate.

Cell phone services don't record your heart rate. As has been noted on HN several times, there are cars that monitor when you have sex in them. You might be surprised what is known and by whom.

> As has been noted on HN several times, there are cars that monitor when you have sex in them. You might be surprised what is known and by whom.

There is no proof they actually have that capability, it is just mentioned in their privacy policy.

Re: Oura says it gets government demands for user data

#115

Post by mh- »

amarant wrote: post #60
jubilanti wrote: post #49

Earlier quoted context omitted.

You're on Hacker News, think like a hacker - in both meanings of the term - for what could possibly go wrong.

I did, and came up blank... Any pointers?

I guess neither of us are hacker enough. I can't come up with anything interesting [that wouldn't be more readily available via cell networks], either.

Re: Oura says it gets government demands for user data

#116

Post by fc417fc802 »

blueg3 wrote: post #71
munchler wrote: post #31

Earlier quoted context omitted.

My understanding is that E2E encryption implies encryption in transit. The message is encrypted at the source and only decrypted at the destination, so it is encrypted everywhere in between.

The term has kind of degraded, because people started marketing that "end-to-end encryption" is the "right" answer. Encryption in transit means that network intermediates can't read the data. The two endpoints of the network communication can. E2E encryption is more context-sensitive, and its context mostly comes from messaging. It means that the data is encrypted and that operational intermediates cannot read it. So…

> The term has kind of degraded

I have to disagree. It's the same thing that happened to terms such as open source. It's perfectly clear what it means but marketers intentionally attempt to mislead people for the sake of their own bottom line.

> but the data is in the clear on your phone, then by this definition, it is not E2E encrypted.

False. E2EE is centered on a given user. So long as the phone would be viewed as "yours" (ie inside your personal security boundary) by a reasonable person then it is clear that the data is E2E encrypted.

As the sibling comment notes the common issue is providing a web interface. It isn't so simple to have a remote server dish up a nice UI with lots of convenient functions while only decrypting the data on the client side. It can certainly be done but it requires developers that know what they're doing and management willing to budget for it.

Re: Oura says it gets government demands for user data

#117

Post by anigbrowl »

amarant wrote: post #29

What will the government even do with my heart rate and blood oxygen data? "Mr Smith has been running again, we better bring him in for questioning!" Edit: to be clear, the government is requesting the data, so clearly they're doing something with it... But what? I don't see it!

Most likely biometric data on crime suspects to correlate with other forensic data. Obtaining this data on a case by case basis is expensive so it is most likely to be used in high stakes cases like murders or bank robberies where police and prosecutors need to show a win.

For example, A is known to have been an associate of B. B died violently at a certain time and date. Phone data put both of them in the same general area around that time. A seems evasive and won't talk. But A's biometric data reveals intense physical activity around the time of B's death...

Other suggestions in this thread like algorithmically making things worse for people in general are predicated on continual availability for a whole deanonymized population.

Re: Oura says it gets government demands for user data

#118

Post by al_borland »

mh- wrote: post #112
reaperducer wrote: post #106

Earlier quoted context omitted.

Cell phone services don't record your heart rate. As has been noted on HN several times, there are cars that monitor when you have sex in them. You might be surprised what is known and by whom.

I'm not sure what to search to find the stories you're referring to, but the obvious ones didn't cut it.. at the expense of my browser history. Can you share some links?

They may be referring to this.

https://news.ycombinator.com/item?id=47968252

Re: Oura says it gets government demands for user data

#119

Post by al_borland »

amarant wrote: post #29

What will the government even do with my heart rate and blood oxygen data? "Mr Smith has been running again, we better bring him in for questioning!" Edit: to be clear, the government is requesting the data, so clearly they're doing something with it... But what? I don't see it!

I’ve seen stories where fitness trackers were used to tie someone to a murder.

https://en.wikipedia.org/wiki/Murder_of_Connie_Dabate

Re: Oura says it gets government demands for user data

#120

Post by mh- »

al_borland wrote: post #118
mh- wrote: post #112

Earlier quoted context omitted.

I'm not sure what to search to find the stories you're referring to, but the obvious ones didn't cut it.. at the expense of my browser history. Can you share some links?

They may be referring to this. https://news.ycombinator.com/item?id=47968252

That sounds more like "legal asked for list of everything we collect, and anything we could collect by accident or inference" - and it leading to hilarious results - which I have seen firsthand before.

We own a Kia. I'd offer to do a GDPR data request, but my data would not give us any useful signal here lol.

Post reply on HN