Hacker News Reader

Hacker News

Comment by pas | Hacker News Reader

Full thread

pas

> " They are willing to give up privacy for free email. "

How exactly does Google/GMail violate the users' privacy with email?

They process the messages, show hyper-targeted ads. End of story.

But is there a Cambridge Analytica for GMail? Can some "app" exfiltrate the emails? Or the contacts of users?

View on HN

What you describe sounds exactly like giving up privacy to me, even if it doesn't sound like giving up privacy to you.

And then when you add in all the other tracking that Google does of your web history, search history, location data, that is pretty much all your privacy gone.

Let's say I pay an assistant to help with my email. Even though they are in my employ, I'm still giving up my privacy for the service. Google gives us email service in exchange for that peek in to our private lives.

"An assistant to help with my X" is a pretty solid, concise description of Google's service suite, complete with the observation about privacy.

Ok so then you need to invent a new word for what is lost when companies further cross the line from [using your data in a totally internal and in fact internal to just your account]. Because it seems like a big step from treating your data as a tool to affect your experience to selling it to other companies to do whatever they want with. What is the primary word associated with that step if not "privacy"?

I never understood how scanning emails to show ads is a privacy violation? No information about you is leaking to anyone.

I think it's the whole _scanning emails_. The information is already leaked at that point.

Leaked to whom though? That's what I don't get. No human is involved in the process and your information is in the hands of the same company as before.

That's a lot of trust in a black box coded by humans. What's going on under the hood with their Smart Compose? Smart Reply? Smart Labels? It all requires processing very very personal information, and you simply can't vet whether it's all handled securely.

Sure, you're trusting their code is bug free. That's just (lack of) faith on your end. The fact that you decide not to trust their competence certainly does not logically imply that they are invading your privacy. It just means you need to trust their competence or take your business to some company you deem more competent. (Though exactly which company would be more competent in infosec is quite the question, but I digress.)

No, it's a lot more than just trusting that their code is bug-free. It's trusting that they're actually only doing what they claim to be doing with your data.

The only solution is to have the code open sourced with reproducible builds and a checksum to verify it against. Pretty much every GApp has a free, libre, open-source alternative that respects your privacy in this way.

Even that: if you lack trust on your part, that does not imply what someone else is doing is an invasion of your privacy. If you claim someone is invading your privacy, that is an accusation... a serious one at that. To support it you need to actually describe how that is happening, not merely how you have problems trusting people who deal with your information. I don't see how this is not obvious.

It's why GDPR came into being, and California's recent data privacy law. We have no reason to have faith in these companies to keep our data safe, or to use it properly. After 10+ years of having our credit card numbers, social security numbers, emails, passwords, and so on leaked again and again, I fail to see how one wouldn't have trust issues at this point.

I never said you can't have trust issues or that GDPR isn't necessary, I'm saying neither of those implies they are invading your privacy when they show you ads based on your emails. This should be pretty clear?

The root of the issue is that if they _are_ invading your privacy, you wouldn't be able to tell.

https://en.wikipedia.org/wiki/Black_box

Yes, and if they aren't, you wouldn't be able to tell either, so all that means is you're willing to recklessly make unjustified accusations to defame a company without actual evidence.

Well, we already know they require reading your emails to power their Smart features. That's enough of an invasion of my privacy to use a FOSS alternative, and I'll always be an advocate for this.

Which makes sense, but reading emails to provide smart features is not an automatic loss of privacy.

Google runs the SmartBot2000 software for you. If you use FOSS but run it on AWS EC2, you still need to trust the software, manage the upgrades (or trust the auto upgrade feature, trust the maintainers), and trust AWS for not fucking with your VM.

We have a few physical servers. And probably always will. We run our own email, but also use gmail too. Because sometimes our email breaks, sometimes [understandably fewer times] gmail breaks (or is not available, such as in China). And we will probably always run our email, but it's a lot of work, and it's not for everybody. And even though postfix, dovecot and K9/thunderbird/roundcube are all fine, they are not as smart as gmail. (but usually snappier)

You need decades of experience to set up a secure email host. GMail does it for people in exchange for showing them ads. (uBlock FTW, BTW)

NSA/Prism is a valid reason to use your own mailserver, but then again, keeping up with TLS/OpenSSL issues is a valid reason to use a non-self-hosted solution (as they do it for you, though gmail accepts unencrypted SMTP :/).

And of course, at the end of the day, there's ProtonMail!

Very true! I personally use both ProtonMail and Tutanota, and give my thanks to Proton for opening their OpenPGP library. I don't think the source to their servers is open, but that's not necessary since:

1) you can't verify they're actually running that code anyway

2) it's end-to-end encrypted so as long as the client-side code is indeed doing its part, your message could be sent to everyone on the planet without any fear of anyone figuring out its plaintext.

In essence, yes. Except the human assistant could technically be coerced to spill the beans on you. Via bribes or blackmail, etc.

Gmail dosen't. The ads you see have nothing to do with your mail activity. They haven't for a while now. Not saying Google is a paragon of privacy, mind you.

https://support.google.com/mail/answer/6603?hl=en

Yes, developers can request permission to access your inbox "offline" (i.e. at any time, with a long-term access token). The scope is clearly identified in the OAuth authentication process, and the consent screen clearly asks for permission to (IIRC) "read, write, and delete emails." There are a few well-known applications (Earny and Unroll.me come to mind, off the top of my head) that are known to work with consumer research operations with the resulting data.

I am so far willing to give up some small amount of privacy for free email, though I'd also pay Google for it because it is simply the best email hosting I could find. I don't want to host my own email, hosting email sucks. I've tried other email hosters and they just weren't as good. They also have security in place that takes care of all the big things in my threat model.

So when it comes to email... yeah, it's not as private as it could be, but it's about the best I can find for everything else. It ain't perfect, but it's the best option for me right now. Maybe it won't be in a year or two?

That hasn't been the case for nearly five years... Gmail messages are NOT used for any ad targeting.

They process the messages

That's SVspeak for

they read your emails

Yes, yes. I know it's a machine.

Any email host reads you emails. And not everyone is up to the task of hosting their own emails.

Reply on news.ycombinator.com