Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Some Google Photos videos in backups were sent to strangers in November

ww.9to5google.com

Post reply on HN
Print view View original

131–140 of 143 posts

Re: Some Google Photos videos in backups were sent to strangers in November

#131

Post by bouke »

SnowingXIV wrote: post #4

How does this happen? I realize it's a small percentage, but this is one of the first tests you build. Even 1 photo (not to mention this is regarding videos) should never make it to another non-authenticated user. This is a massive mistake.

I once witnessed something similar. Deep down in the repository code there was a field marked `static`, which should've been an instance property. The value would be overwritten by the last user to access the repository; so this resulted in a race condition where one user might see the other's data.

Re: Some Google Photos videos in backups were sent to strangers in November

#132

Post by kerng »

dsd wrote: post #12
kerng wrote: post #5

This is big, and has GDPR fine written all over it. And I'm sure this will not be the last time we hear about this. Also, very curious to learn more of the technical details down the road?

Does gdpr forbid mistakes?

Well, at least they will have to make sure they performed due diligence with testing- because a test would reveal this pretty quickly. You know real testing, not using customers as Guinea pigs

Re: Some Google Photos videos in backups were sent to strangers in November

#133

Post by kerng »

dsd wrote: post #12
kerng wrote: post #5

This is big, and has GDPR fine written all over it. And I'm sure this will not be the last time we hear about this. Also, very curious to learn more of the technical details down the road?

Does gdpr forbid mistakes?

If you do it by accident, you pay a fine. If you do it knowingly someone should go to jail. It's time to hold those tech companies to a higher standard.

Re: Some Google Photos videos in backups were sent to strangers in November

#134

Post by PeterisP »

londons_explore wrote: post #90

Considering this is 4 months later... This can't have been very widespread. If I saw someone else's video in my takeout archive, I'd have totally contacted the tech media...

Honestly, I would not have noticed if a bunch of someone else's videos were on my takeout archive - I've downloaded that takeout archive multiple times as a backup, and I've browsed some stuff there (a fraction of the total) once to see if the things I care about are there, and that's it.

For all I know, your videos might be in a zip file on my external HDD I use for backups, and I'll never know unless I need to restore data after some disaster and that's the latest takeout that I have.

Re: Some Google Photos videos in backups were sent to strangers in November

#135

Post by jayFu »

gregsadetsky wrote: post #113

Does anyone have suggestions for a self hosted photo service with - importantly - a solid iOS companion app to do photo sync and possibly browse photos? I would prefer using a simple S3 backend. It seems that finding a reliable photo sync'ing app for iOS (outside of Google Photos or Dropbox) is difficult. I've been manually using Image Capture and uploading to S3 but that's quite inefficient. Thanks!

Check https://lomorage.com, you can host in your home network using raspberry pi.

Re: Some Google Photos videos in backups were sent to strangers in November

#136

Post by jliptzin »

colejohnson66 wrote: post #103
jliptzin wrote: post #72

Earlier quoted context omitted.

Don’t be the average user.

That’s a very dismissive attitude. If you want to make the world a better place, you have to accommodate the average user; One can’t say, “you’re not smart enough for our service.”

If you’re serious about the security of your data, you need to know how to pick a password you will remember. There are things in this world that we ask of average people that are far more difficult. In 2020, picking and remembering a password should be table stakes at this point. It’s not 1997 anymore.

Re: Some Google Photos videos in backups were sent to strangers in November

#137

Post by johntash »

mceachen wrote: post #74
sildur wrote: post #65

Earlier quoted context omitted.

For most people, self hosting their own data isn’t even an option. For the subset of privacy concerned people who have the technological knowledge to self host, making mistakes with their data is not “orders of magnitude less likely”.

> For most people, self hosting their own data isn’t even an option. I'm trying hard to invalidate this with PhotoStructure. My goal is to be installable and usable by even my least-computer-savvy family members. Although there are desktop installers, users can move their library to a NAS, rPI, oDroid, NUC or a VM in the cloud--anything that can host 64-bit docker images--but only if they want to. Everything in your…

Is PhotoStructure a web app, or something else? I looked through the website and signed up for the beta, it seems interesting and is going on my list of possible Google Photos replacements.

Re: Some Google Photos videos in backups were sent to strangers in November

#138

Post by mceachen »

johntash wrote: post #137
mceachen wrote: post #74

Earlier quoted context omitted.

> For most people, self hosting their own data isn’t even an option. I'm trying hard to invalidate this with PhotoStructure. My goal is to be installable and usable by even my least-computer-savvy family members. Although there are desktop installers, users can move their library to a NAS, rPI, oDroid, NUC or a VM in the cloud--anything that can host 64-bit docker images--but only if they want to. Everything in your…

Is PhotoStructure a web app, or something else? I looked through the website and signed up for the beta, it seems interesting and is going on my list of possible Google Photos replacements.

It's a web app. I've packaged it up with Electron, but you can also run it via docker or even directly if you've got node installed.

I'll be sending out instructions to my next wave of beta users soon.

Re: Some Google Photos videos in backups were sent to strangers in November

#139

Post by boring_twenties »

dehrmann wrote: post #62
drewg123 wrote: post #60

Earlier quoted context omitted.

I assume that this not because Google is midirecting email, but rather because your email address is quite close to that of others. Mine is just my last name @gmail.com. It is a rather uncommon name, and I've met many others with that name, as I've accidentally received email intended for them.

> Mine is just my last name @gmail.com. It is a rather uncommon name I'm in the same boat. And uncommon, but not rare. I've gotten emails intended for my brother. One time, I got a collector emailing about something with a rental car crash that I previously got confirmation email for. Recently, a Dutch woman discovered email and think she has my email address. It's amazing how many websites don't verify email address…

Some asshole bought a Lexus and entered my email address. I now get his loan statements and service reminders, on top of the advertising. They are all from noreply@, of course, and I would need to know the password to the account to unsubscribe. Sure I could reset it, but I'm not actually sure if it's legal?

Re: Some Google Photos videos in backups were sent to strangers in November

#140

Post by colejohnson66 »

jliptzin wrote: post #136
colejohnson66 wrote: post #103

Earlier quoted context omitted.

That’s a very dismissive attitude. If you want to make the world a better place, you have to accommodate the average user; One can’t say, “you’re not smart enough for our service.”

If you’re serious about the security of your data, you need to know how to pick a password you will remember. There are things in this world that we ask of average people that are far more difficult. In 2020, picking and remembering a password should be table stakes at this point. It’s not 1997 anymore.

The key word there is “if.” Most people don’t care about the security because they’re unaware of the risks involved. Stories like this blow over in a week or two.

Most people don’t want to lose their stuff because they forget a password. That’s why unencrypted data and password resets are a thing.

What we as tech people should be doing is educating and helping those people. Set your family up with a NAS for local backup and have it mirror to, say, Backblaze. Set your parents/grandparents up with a password manager. Etc.

Post reply on HN