Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Case That Has Microsoft, Apple and Amazon Agreeing

bloomberg.com

Post reply on HN
Print view View original

41–50 of 190 posts

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#41

Post by jo909 »

kgilpin wrote: post #4

If companies stored customer data encrypted by keys that are held by the customer, they wouldn't have this problem. Furthermore, they wouldn't have to worry about deleting customer data either. The customer would have the power to simply deny access to the keys.

That works for file and message/mail contents, and there already are functional external solutions for that (f.e. GPG). I agree that needs to be better integrated and supported.

But Google needs to know my search query to be able to serve me a results page. Google will know my phones location if I use their WiFi-positioning-system. Google needs to know my address and payment information to have me buy apps.

Encryption can not help me here. I need to be able to trust Google not to collect that data without my consent, that they do not store that data longer than needed to provide me the service and that they do not share that data with anybody that has no right to it. That can only be guaranteed by laws.

This is about laws, and the need for such laws will not go away by encryption alone.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#42

Post by Tactic »

soylentcola wrote: post #31

"There’s irony in any tech company confronting the government on privacy matters, considering how much heat many take for mining their own customer information and using it for advertising and other profitable purposes." See, I don't find this very ironic. In fact, my only real issue with data mining and analysis by these sorts of companies is the way governments can demand this info without my approval. If Microsoft…

The government has this ability with near all other relationships you have. So much so that they have codified the few that it doesn't apply to. We put lawyers, doctors, clergy and spouses in a special category but others can be required to divulge any information they have on you with the appropriate order. (What's appropriate is another discussion)

Ultimately, realize that any dealing you have is open to the government if they so desire and make that part of your decision making process.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#43

Post by whopa »

gioele wrote: post #37
NoGravitas wrote: post #22

Earlier quoted context omitted.

I generally agree with you, but there's one problem with the physical key analogy. The security of physical keys is weak enough that there's always a fallback if you lose all the copies of your key: you pay a locksmith to come pick the lock and rekey it. You can't do this with digital keys because a digital key that is weak enough for this strategy to be usable is also too weak to protect you from the main class of a…

> there's always a fallback if you lose all the copies of your key: you pay a locksmith to come pick the lock and rekey it. In the digital world you have Shamir's Secret Sharing. Generate a non-encrypting, non-signing, decode-only key and give a N-th of if to N escrow services. If you lose your key you contact M of those entities and recover the data. Plenty of tricks have been created in the last two decades to addr…

These escrow services would be centralized targets too just like Microsoft, Google, Amazon, etc.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#44

Post by Karunamon »

[deleted] wrote: post #40
Karunamon wrote: post #17

Earlier quoted context omitted.

If by "you", you mean aggregated data about you in lieu of cash payment. Google/Facebook/etc are not selling your data, they are not selling you , they are selling access to you via advertisers, more specifically, they are selling access to people who like certain things and who live in certain areas who have certain demographic profiles. If you're curious about this, go sign up for an Adwords account and see how the…

[deleted]

Any inferring is being done by the ad company, not the advertiser.

And framing this as discrimination (a loaded term nowadays) is just more hyperbole, IMO. People of different races, orientations, religions etc are very likely to view different things as relevant, and at the end of the day, relevance is what any advertising company's mission in life is.

Best of all, it's all supposed to be data driven, so those nasty human biases don't even creep in. If demographic X clicks on a thing more than demographic Y, at the end of the day, that is what matters, and we can sidestep any discussions of bias, regardless if the demographic under consideration is young/old, black/white, atheist/religious, rich/poor, male/female.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#45

Post by deelowe »

soylentcola wrote: post #31

"There’s irony in any tech company confronting the government on privacy matters, considering how much heat many take for mining their own customer information and using it for advertising and other profitable purposes." See, I don't find this very ironic. In fact, my only real issue with data mining and analysis by these sorts of companies is the way governments can demand this info without my approval. If Microsoft…

Agreed. It's not ironic at all. If you are in the business of data mining and some competitor comes along screwing up the data mining business for you (the government's actions and it's impact on PR), you'd be very interested fixing this problem as well.

Most generally didn't care about this until they became aware of the government's activities.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#46

Post by dogma1138 »

rayiner wrote: post #35
ddlatham wrote: post #23

Earlier quoted context omitted.

If the data is opaque to the provider, then there are many services they won't be able to provide on it (without some major advances in homomorphic encryption). For example, spam detection or search. Sharing is also made much more difficult.

There is no reason that stuff can't be done on the client side. Outlook works just peachy searching my GB's of emails and attachments from its local replica, using the internet only to sync.

Outlook also downloads and stores the emails locally, if the emails isn't in the PST the search takes ages and if you don't use recent versions of Exchange with all their bells and whistles and full indexing then finding anything is near impossible (e.g. searching within attachments).

No one will use Gmail if they need to download GB's of Junk they haven't cleared in 10 years to find an email for 2 months ago, not to mention that any type of sharing will force major duplication as well as require you to download and generate new copies with each person you want to share it with.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#48

Post by jfindley »

bertomartin wrote: post #20
protomyth wrote: post #10

Earlier quoted context omitted.

Tarsnap (a service that acts like your description) is quite nice, but the problem of "customer lost the keys" is a very real one. I love the idea, but someone really needs to come up with some decent key management (and offline backup and key migration) to make this consumer friendly.

Then, we need a good service to store keys, with a key to get to your key

I wrote a PoC app [0] a while ago to do just this - allow storing and sharing of keys, with the server holding the encrypted keys never seeing the decryption key.

Sharing a key involves downloading it from the server, asymetrically encrypting it with the public key of the reciever, and uploading to the server again. It also allowed sharing with groups via intermediate keys decrypt-able by multiple users.

Obviously it's just a PoC - noone should use it for actually important data, and I certainly don't promise that it's actually secure - but it does (more or less) work. As it requires client-side crypto, it's not an ideal candidate for a web-service either (although one could potentially use browser extensions to make that more reasonable).

0: https://github.com/jfindley/skds

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#49

Post by MichaelGG »

throwaway7767 wrote: post #33

Microsoft has shown that they are quite willing to access induviduals private data if they have a financial stake in it [0]. Yes, they eventually backtracked under public pressure (after trying very hard to justify how it's totally okay because they were going to pay a lawyer to rubber-stamp things in the future), but it's rather hard to listen to their general council talking about how they value privacy on principl…

Is there any evidence that any companies were willingly going along with PRISM? Seems like they were under gag orders and potential fines (Yahoo said $250K a day). Not sure what choice they had.

Though MS accessing user's data via Hotmail for internal review really does scuttle their credibility.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#50

Post by 317070 »

Tactic wrote: post #42
soylentcola wrote: post #31

"There’s irony in any tech company confronting the government on privacy matters, considering how much heat many take for mining their own customer information and using it for advertising and other profitable purposes." See, I don't find this very ironic. In fact, my only real issue with data mining and analysis by these sorts of companies is the way governments can demand this info without my approval. If Microsoft…

The government has this ability with near all other relationships you have. So much so that they have codified the few that it doesn't apply to. We put lawyers, doctors, clergy and spouses in a special category but others can be required to divulge any information they have on you with the appropriate order. (What's appropriate is another discussion) Ultimately, realize that any dealing you have is open to the govern…

As a European citizen, I have a different view on this issue. While I do trust Google/Microsoft with some of my data, and I kind of trust my own government with my data, I don't trust the U.S. government for one bit, especially its judicial system.

Luckily, I don't normally need to account for that, and I'd rather keep it like that. But this is like somebody at the other end of the planet changing the small letters of my contract which I made with a local subsidiary of the American giant. The contract was between me and a local vendor, and suddenly we have the American government intervening?

Post reply on HN