Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oura says it gets government demands for user data

this.weekinsecurity.com

Post reply on HN
Print view View original

81–90 of 168 posts

Re: Oura says it gets government demands for user data

#81

Post by allthetime »

nextos wrote: post #73
BenFranklin100 wrote: post #59

I considered an Oura but went with an Apple watch instead. I turned on Advanced Data Protection on the paired iPhone for peace of mind. No other large data providers really provide anything equivalent to ADP’s E2EE protection with zero access encryption, especially in the consumer space for activity trackers.

Garmin can be used completely offline? AFAIK, they even have some watches with no radio hardware so that they can be used in sensible environments.

Yup. It’s a bit of a pain, but you don’t have to use the connect app. Devices and data can be accessed with direct USB connection as standard storage. You will lose some features and I think firmware updates become difficult (or impossible?)

Re: Oura says it gets government demands for user data

#82

Post by BenFranklin100 »

nextos wrote: post #73
BenFranklin100 wrote: post #59

I considered an Oura but went with an Apple watch instead. I turned on Advanced Data Protection on the paired iPhone for peace of mind. No other large data providers really provide anything equivalent to ADP’s E2EE protection with zero access encryption, especially in the consumer space for activity trackers.

Garmin can be used completely offline? AFAIK, they even have some watches with no radio hardware so that they can be used in sensible environments.

I believe they can be used offline, at least the last time I used Garmin I was able to set it up such that I could sync it to Golden Cheetah. It took some jumping through hoops and an older watch version to get it work, as I recall. For serious runners and hikers, the hardware is better than Apple.

I'm only a casual fitness tracker so the Apple Watch fits my needs better.

Re: Oura says it gets government demands for user data

#84

Post by dmkolobov »

stavros wrote: post #61
juggle-anyhow wrote: post #8

Earlier quoted context omitted.

Encrypted at rest means something different. It means if you pull the hard drive out no one can decrypt it. Not that it is encrypted in the database.

Does encryption at rest actually do much? The percentage of attacks that were perpetrated by people getting physical access to a drive must approach zero.

Unless the attacker is law enforcement.

Re: Oura says it gets government demands for user data

#85

Post by treesknees »

BenFranklin100 wrote: post #59

I considered an Oura but went with an Apple watch instead. I turned on Advanced Data Protection on the paired iPhone for peace of mind. No other large data providers really provide anything equivalent to ADP’s E2EE protection with zero access encryption, especially in the consumer space for activity trackers.

I was stuck between the two, Oura won for its better sleep tracking and battery life.

I suppose one option would be to enable data syncing to Apple Health, and periodically delete/create new Oura accounts to purge historical health data. Not a great workflow, but would let you benefit from E2EE with Apple Health while using Oura (assuming Oura’s “delete account and all data” does what it claims)

Re: Oura says it gets government demands for user data

#86

Post by GeekyBear »

pepperoni_pizza wrote: post #79
GeekyBear wrote: post #26

Earlier quoted context omitted.

Apple literally removed encrypted file storage as a feature in the UK rather than comply with demands for access to encrypted customer data from the UK government. Previously, they refused US government demands for a backdoor that would allow them to unlock locked devices.

> Apple literally removed encrypted file storage as a feature in the UK rather than comply with demands for access to encrypted customer data from the UK government. Does that mean that instead of UK government accessing the data (through a backdoor), UK government can now access to data (because it's not encrypted at all)?

Nope.

After Apple's announcement that they would remove encryption from UK users rather than weaken it, the bad press and public pressure forced the UK government to back down.

Re: Oura says it gets government demands for user data

#88

Post by stavros »

dmkolobov wrote: post #84
stavros wrote: post #61

Earlier quoted context omitted.

Does encryption at rest actually do much? The percentage of attacks that were perpetrated by people getting physical access to a drive must approach zero.

Unless the attacker is law enforcement.

Law enforcement will just get you to give them the keys.

Re: Oura says it gets government demands for user data

#89

Post by mathgladiator »

xboxnolifes wrote: post #72
amarant wrote: post #29

What will the government even do with my heart rate and blood oxygen data? "Mr Smith has been running again, we better bring him in for questioning!" Edit: to be clear, the government is requesting the data, so clearly they're doing something with it... But what? I don't see it!

Buys your heart rate and blood oxygen data from Oura. Collects your iris data from Eyez. Purchases your fitness data from Borg. Sees your purchasing patterns through Krump. Knows everything you've said online through Gwimp. Gets your sequenced DNA from FamaTree. Tracks your location data from, well, nearly every app in existance. What could they possibly do from this single variable???

Sell me things that I might want... i did buy the Gibson slack board... hrmmm

Re: Oura says it gets government demands for user data

#90

Post by autoexec »

Cider9986 wrote: post #39
MassPikeMike wrote: post #18

Earlier quoted context omitted.

Judging by ads for cell phone service, most people pay more than that per month to be monitored by the Feds.

Cell phone services don't record your heart rate.

I wouldn't be surprised if they could. Probably not while it's in your pocket though. They're packed with sensors that can pick up a lot. Just putting a phone on a table with a keyboard on it is enough for it to be able read your keystrokes. They can certainly tell when you're doing something that should be raising your heart rate.
Post reply on HN