Hacker News Reader

Comment by TZubiri | Hacker News Reader

Only by a very wide definition of "having" your email. Having data in one of your servers means not much if it's not usable or findable.

Can a government submit a subpoena to Gmail asking for your emails? Unlikely, they would just answer that you are not a client of theirs and as such they don't have your emails.

Can they submit a subpoena asking Google to hand over all of the emails that your clients sent or received from your address? Sure they can. It's going to be a way harder sell to the judge and the reason and burden of proof will be that much higher, as it would essentially be closer to fishing or mass surveillance. But it's something that I can see passing for cases of national security or child abuse. Nothing I would personally worry about, but I understand if you want to wear a tinfoil hat.

Semantics and nuance matter.

View on HN

What a blissfully-naive take. You're more than a decade behind the times.

https://en.m.wikipedia.org/wiki/PRISM

In 2023, Google received requests for user information for about 900,000 accounts, and complied with ~80% of them, and both numbers are on the rise.

https://transparencyreport.google.com/user-data/overview

Am I the one that is a decade behind the times? You are the one citing a case from 15 years ago, lol.

Also, I'm not sure what seems to be contradicting here. The exception that you are brining up proves the rule. If I say that humans have five fingers in each hand, will bringing up the famous case of the sixed fingered lady be relevant at all to the discussion? Especially if I worded it specifically saying that "most" humans have 5 fingers? Check my wording, I said unlikely.

The fact is, most government agencies do not have access to your emails, let's say that the NSA does, which is debatable, great, that is 0.01% of the government, and probably 0% of companies (that are not Google), unless they submitted a subpoena as part of some litigation.

Feel free to obsess about the one or two agencies that have access to emails for national security reasons, and feel free to lump it into "THE government". But I don't think you'll ever make any important nuanced cybersecurity trade offs with that attitude, you'll just want to encrypt everything until none of your users can do shit (if you have users at all, you may not even be able to get a job because you are doubtful of sending your resume to anyone, and you might be too busy configuring your own email server instead of just using gmail and doing other productive stuff.)

>Google received requests for user information for about 900,000 accounts

I'm responsible for a few of those btw. All for e-mails clearly related to malware operations, to help with the investigation. It's not like anyone cares what John Doe talks about with his grandma and Netflix support. Well, maybe some do, but that's probably 1% of that 900k.

This is the inescepable tradeoff. You either have a system for investigating abuse (and in this case it's tech abuse, there's also physical crime), or you have a system that protects the privacy of everyone.

I sleep like a baby knowing a state can submit subpoenas for my information. And I wouldn't sleep like a baby using a system that not only irreversibly encrypts contents, but neuters the admin capabilities such that it's not even possible to know the headers of messages sent, like telegram or protonmail, knowing that I would give plausible deniability by pooling with cyber and non cybercriminals.

Reply on news.ycombinator.com