Hacker News Reader

Comment by tptacek | Hacker News Reader

In what sense?

My understanding is that Outlook for iOS uses a cloud service that talks to the Exchange server and stores your credentials/data: https://blog.winkelmeyer.com/2015/01/warning-microsofts-outl.... So logging in involves giving Microsoft (and indirectly Amazon, since it runs on AWS), clear-text access to your information.

Your credentials aren't stored in clear text. They are encrypted with a key only your device has.

So how do these creds get to the exchange server from the cloud?

So? You have no expectation of privacy in email anyway, right?

My Exchange server is 15 feet down the hall. When I use a normal Exchange client, the only people who can see my data in clear-text are myself and my employer (who owns the Exchange server). Anyone in-between just sees an encrypted stream. But when I use Outlook for iOS, people I've never met at Amazon and Microsoft can see my email.

I think the former situation creates a legitimate expectation of privacy. I think the latter situation does not. Which is why I use Apple Mail instead of Outlook for iOS.

Something visible to anyone in your employer's management -- hence work email in general -- doesn't have an expectation of privacy.

The company has an expectation of privacy with respect to those emails. Its employees aren't third parties with respect to it.

Okay, but if you're going to accept that kind of situation as creating an expectation of privacy across several parties, then you can just as well say that Google + me have an expectation of privacy with respect to my Gmail communications.

And yet somehow there's always someone saying, "well, you let Gmail employees run programs that aggregate data over its contents, therefore it's not really violating your privacy when a government investigator looks at them without a warrant". Which is it?

The difference is ownership and control. The company owns its exchange server. It allows employees access under controlled conditions, for the employer's purposes. It's like leaving stuff in your garage that your lawn guy might have access to. But the company doesn't own Google's server. It has little control over how Google accesses that data. And Google accesses that data for its own purposes. That's more like leaving your stuff in someone else's garage.

Now, Google has a 4th amendment right with respect to "your" mail sitting on its servers, even though its employees have access to it. Because it's really "Google's mail," stored on Google's property, under Google's control.

Reply on news.ycombinator.com