Hacker News Reader

Comment by angdis | Hacker News Reader

The real question is not whether google, dropbox or anyone else has explicit "policies" about reading content from users. They're just going to say whatever makes them look good from a marketing and legal perspective. Companies lie all the time, systematically and comprehensively. They act in their own self-interest period. From their point of view it is merely a question of how much they can get away with.

The more interesting question to explore is how much we actually trust these companies with our personal information and how do we decide when we reach a limit to our trust.

Do I believe that google can read my gmail? Yes. Do I think this capability will cause harm to come to me as a result? Hell no. There's nothing "in it" for them to do so for me or millions of others. I "trust" them for this reason.

View on HN

Speaking of trusting google... there was a situation at a company I worked at where the management strongly was against transferring the company mail system to google apps/mail because of the concern of google may read their email. They wanted to keep their internal mail infrastructure for privacy reasons of the company.

The cto at the time convinced them that there is really no point of keeping things inhouse since the majority of the management, for convenience, forwarded all their company email to their personal gmail account anyways. Funny how security is not about what you think but what you do.

Until there is something in it for them.

It's a pretty classic security question, sometimes usability means that you accept zero security and completely share your private correspondence with the world.

I think trust is the wrong word, you are really just accepting the risk of sharing all your data for the benefits because the risk is low.

Yes, I agree "trust" is the wrong word. It is perhaps better to think of it as a trade-off of some risk for some convenience and that's OK.

In any case, back to the OP's question, the stated "policy" about privacy means virtually nothing unless there exists a third party who can effectively verify that policy.

Yes, in my experience on either side of those "policies" they really do mean nothing.

You just have to assume that all the data you share is no longer yours and will be used however the company sees fit.

I am amazed by the number of people who assume that "that would be bad PR if they got caught" is good enough security to protect data they consider sensitive. Especially when the PR damage historically has been very low, especially if you are a sexy and loved company like facebook or google.

Imagine you're a startup and use gmail or Google Apps for your team communications, even customer service. One day Google decides it wants to acquire you. During negotiations, it has access to all email exchanges between you and your customers and, more importantly, you and your investors / team members. So there's definitely something "in it" for them to do so.

If you had strong evidence that Google was spying on you (especially for such anti-competitive reasons), you'd have them over a barrel a lot more than vice-versa.

Well, I don't. That's how convenient this arrangement is :)

Even if you trust a company not to do you harm with the information they store, there exist entities that can compel them to turn this information over. For example, the information can be (sometimes secretly) subpoenaed by the U.S. government.

The choice between being evil and not being evil can be an easier one to make, practically speaking, than the choice between being evil and becoming the target of federal criminal prosecution.

What are the chances that some random hosting company won't just do the same thing if you ran all of your services on a VPS or colo box?

Exactly. And that applies to any company not just "evil" ones. It is a bit naive to trust something as abstract as an organization. Trust applies to individual people, and a company is bound to be a very diverse group of people with different agendas.

If you want your mail to be reasonably safe from third-party reading, the only solution is to encrypt it before sending, and ask people that mail you to do the same. Anything that relies on trust is a half-assed solution.

In theory, yes of course, you can encrypt your communications personally and "figure out" on a case by case basis how to do key exchange with the end-party. But that is a MAJOR OBSTACLE for all but the most patient and tech-savvy people and totally overkill for all but the most critical life-or-death information exchanges.

In practice, unless both you and your recipient are operating your own email servers and key-exchange/encryption services, you HAVE TO "trust" a third party with your private information.

The point is that if people send their mail encrypted it is encrypted both in transit and when it is stored on the mail server. So the third party can be anyone, and you don't need to specifically trust them.

Also this isn't that big of an obstacle you make it to be. We're not living in 1995 anymore. A lot of mail clients have plugins or even have built-in support for encryption.

Reply on news.ycombinator.com