Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google says e-mail users should have no legitimate expectation of privacy

scribd.com

Post reply on HN
Print view View original

41–45 of 45 posts

Re: Google says e-mail users should have no legitimate expectation of privacy

#41

Post by antr »

simonw wrote: post #11

The "a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties" quote has been massively taken out of context by everyone who is covering this story. The overall case appears to be about people complaining that Google scanning their emails and showing contextual ads is a privacy violation. Most of this document is an explanation of why that shouldn't hold (Gmail users…

I see your point, it's clear and has plenty of logic to it. Then I guess that the same argument will apply to my medical records, tax returns, GPS coordinates of my car, GPS coordinates of phone, my pay-per-view TV consumption, the who/when/where of the phone calls I make, etc.

Trust is vital in any economy that wants to function. This Google argument will make me trust no one.

Re: Google says e-mail users should have no legitimate expectation of privacy

#42

Post by toyg »

codeka wrote: post #35
toyg wrote: post #17

Earlier quoted context omitted.

They could still do that in a secure way, client-side, if they wanted: when content is displayed in-browser, javascript could parse it, send home relevant words (on an encrypted channel), and receive relevant ads. The server would have to ensure that data is not saved, or it's anonymously aggregated right away -- you'll have to trust their word on that, but that'll always be the case. Computationally expensive, maybe…

They'd also have to do spam filtering client side, parsing the MIME to extract inline images, attachments and so on, sanitize the HTML to protected against XSS attacks, process it for full-text search, filtering into labels, auto-forwarding and really absolutely everything that happens to an email. They all involve "reading" the email.

To be fair, that's all stuff that "real" email clients already do.

Re: Google says e-mail users should have no legitimate expectation of privacy

#43

Post by dredmorbius »

venomsnake wrote: post #34
dredmorbius wrote: post #23

Earlier quoted context omitted.

PKI specifically means you don't have to rely on secure key transfer. Encrypt everything, and post your public key on any keyserver you choose. There is very little sensitive information in a public key (though it can tie you socially to another party, in a cryptographically strong manner, for those who are concerned about such things). But the point is that an out-of-band and secure key transfer isn't required.

And what happens when your keyserver gets hit with NSL to impersonate another party? Is there something to prevent it there as infrastructure or legal?

Please read a fundamental PKI text or FAQ. That isn't a viable threat model.

On the other hand, anyone at any time can create a key with any given name on it. Under PGP, trust is generally imbued through keysigning and trust metrics.

Keys are also cheap: two (or more) parties could create keys (or subkeys) they used exclusively for communications between themselves, if they so chose.

Re: Google says e-mail users should have no legitimate expectation of privacy

#44

Post by dredmorbius »

amboar wrote: post #25
dredmorbius wrote: post #23

Earlier quoted context omitted.

PKI specifically means you don't have to rely on secure key transfer. Encrypt everything, and post your public key on any keyserver you choose. There is very little sensitive information in a public key (though it can tie you socially to another party, in a cryptographically strong manner, for those who are concerned about such things). But the point is that an out-of-band and secure key transfer isn't required.

However, each party needs to be sure that the identity of the other is who they expect, I.e. that a MitM is not occurring. Sometimes the best way to achieve that is an out-of-band key exchange

Correct.

An out-of-band key exchange, or OOB verification of messages, would work. You'd start with messages of low criticality.

In Snowden's case, he didn't even identify himself to Poitras until they'd been communicating for some months.

Re: Google says e-mail users should have no legitimate expectation of privacy

#45

Post by txutxu »

jkl32 wrote: post #37
txutxu wrote: post #20

Earlier quoted context omitted.

I still use google services. I'm conscious of what happens, much before the NSA revelations this year. I use 8.8.8.8 for DNS on some networks (for external resolution and for nagios) knowing perfectly that each request is registered and extrapolated. I use an apple macbook air for some tasks, even if I know I've no control over many privacy issues in such machine. On the other side, I've had offline networks for some…

Yes. It's worse that you don't even have ignorance as an excuse.

I don't seek any excuse.

I don't like cars, but I need to use one. I don't like the effects of our civilization in the nature, but at the end I'm part of it to cover my basic needs. And the same happens with internet and widely known services.

I don't approve unconstitutional surveillance, but I, from Europe, can't change such _facts_

You may think I'm an idiot because I don't have ignorance as an excuse for use certain services. I may think I'm not, because I don't need the media and news to know what is going really.

You may feel superior just by calling people idiot. I respect your though level, it's your life.

We think in different ways.

Post reply on HN