Hacker News Reader

Comment by bipson | Hacker News Reader

I think this is a little far fetched as a scenario.

Under which assumptions should Google be forced to "peer into accounts a user has with other services"?

This is not only not enforceable, it would be illegal.

Companies can not be enlisted to do such things governmental agencies are doing. How should a company decide what to look for? Google is not the police and can not be made an investigator just-for-fun. FBI's search engine?!

Also, you need the first factor. Do you expect Google would also send the "password reset"-request, reset the password, use your 2nd factor... Just to be nice to the authorities?

Wild theory if you ask me...

View on HN

Legality doesn't matter when the authorities pull out the magic National Security Letter, slap you with a gag order, and fine you an amount doubling from $50,000 per day until you comply.

Wow.

Fine for what?

Gag order? Does not help them.

Legality? That would count, if it was something I could order them to do, but again, what do you think would happen there?

"Dear Google, we know you have user TechBro8615@gmail.com, could you please:

- Go through all your data, and gather which Accounts for which services TechBro8615 has

- Go through all these accounts TechBro8615 has with every possible service and reset all his passwords with these accounts (without him noticing)

- And use the second factor TechBro8615 has to login

- Make a user data takeout for all the data TechBro8615 has with all these services

- Create an index of this data, because, well we ask you to, although we can't make you do that

- Tell us if TechBro8615 likes Cranberry juice???

Legality does matter, if you request something from third parties. Why on earth should Google ever cooperate beyond step 1? Would you do that?!

My comment is referencing what was documented to happen during 2013: the NSA compelled tech companies to turn over user data under threat of jailing the executives and fining the company huge amounts.

They don't need to ask Google for data from other companies. They can compel them to provide the passwords or authentication codes which are stored on Google's servers. Or they could just ask for a list of which accounts have a saved password, so they know who to target next with an NSL.

Dude. Everything you said is correct, but:

I responded to

> Google could be requested to peer not just into the user's google account, but into accounts they have with other companies/organisations too

Your response to my response should somehow relate to that.

Well in that case, after rereading your comment I guess I agree with you. I don't think the government would deputize Google to effectively hack into other companies on their behalf. I wouldn't put it past them to ask for a backdoor into a user's device, but I doubt Google would comply with that (although there is precedent for Google remotely installing Covid tracking apps on devices in Massachusetts).

Reply on news.ycombinator.com