Hacker News new | ask | show | jobs
by homebrewer 531 days ago
You're fine with Google seeing complete information about your income and spending? I'm not one of those truly paranoid, but this seems like a bit too much.
5 comments

What’s your risk model here? Google are not manually or automatically inspecting the contents of your spreadsheets in order to profile you and show you better-personalised ads. Not enough people have such a spreadsheet for it to be worth it for them, I’m sure - and they also probably already know approximately how wealthy you are. Unless you’re under investigation for fraud or something, I doubt the government could get much use out of being able to access your financial spreadsheets via Google compared to the information they already get directly from banks etc. So that only really leaves criminals (for whom I still can’t see a great incentive to read your spreadsheets), and I also don’t really think your Google account is much less secure than your computer’s local storage (if that’s the other place you would keep it)
We’ve learned over and over that tech companies do things which seemingly make no sense to us, but do to them. Not being able to imagine it is not sufficient. Nothing is deleted anymore as well, in hopes it will be useful later.

That said I don’t see a huge risk here, unless combined with lots of other data. Would probably avoid though.

I simply want minimal exposure of my personal data since I don't want to go through life thinking about risk models. Not only is it time consuming, but my creative juices simply don't flow when it comes down to exploiting people (nor do I want them to flow in that direction).
I only care about humans seeing my data.

Most big tech companies very rarely/never let a human review private customer data. Therefore I'm fine handing all the data over to big tech companies.

I don't really understand any other point of view - if you're worried about a machine seeing your private stuff, why did you type it into a keyboard in the first place?

> if you're worried about a machine seeing your private stuff, why did you type it into a keyboard in the first place?

Who owns that machine is important though. I don't mind putting my card details in via my phone to buy something because there's a level of trust in the whole system (it's my phone, I have a level of trust that google is not going to steal my card details via android, and a level of trust that the shop is legit and will process my order.)

If some random person off the street asked me to type my card details into their phone that's a very different ball game as I don't inherently trust them.

I don’t care that much about card details. If I see a fraudulent transaction, I dispute it and it’s done. But my personal financial details/etc — that’s much different than a payment mechanism.
> Most big tech companies very rarely/never let a human review private customer data. Therefore I'm fine handing all the data over to big tech companies.

This isn't true. Google and Apple and others turn over user data to human analysts at NSA and FBI and others without search warrants all of the time, on hundreds of thousands of user accounts per year.

To be fine handing all the data over to big tech companies, you have to be fine handing all of the data over to US federal cops and intelligence services, too, because that's what giving the data (in non-e2ee form) to big tech means.

Actually I have heard the exact opposite of what you are stating is true. Both Google and Apple fight very hard to avoid handing data to authorities. They don't want to be seen as some sort of easy conduit to government surveillance or shill. How does that benefit their reputation? I know of one case where Google spent millions on lawyers fighting government wanting access to an activist's email. Their FAQ here makes their policy pretty clear. https://support.google.com/transparencyreport/answer/9713961...
Apple’s own transparency report indicates they turn over data to the USG for over 100,000 different apple IDs each year in the no-warrant-or-probable-cause (FISA orders and NSLs) category.

(Mind you; this includes device location histories due to geoip logs, unique identifiers, iMessage histories, photos, documents, everything.)

The cases they are allowed to tell you about aren’t in this category. They aren’t even allowed to say exactly how many of the secret warrantless orders they received, or exactly how many users were affectee, only 500-count ranges.

For just Apple, for just January 2023 to June 2023 (six months):

National Security - FISA Non-Content Requests

Table for National Security - FISA Non-Content Requests Data

Requests Received 0 - 499

Users/Accounts 40,500 - 40,999

National Security - FISA Content Requests

Table displaying National Security - FISA Content Requests

Requests Received 500 - 999

Users/Accounts 50,500 - 50,999

National Security Letter Requests

Table for National Security Letter Requests data

Requests Received 0 - 499

Users/Accounts 1,000 - 1,499

National Security Letters where Non-disclosure Order Lifted

0

I encourage you to read it for yourself:

https://www.apple.com/legal/transparency/us.html

> ...no-warrant-or-probable-cause (FISA orders and NSLs)...

These are not equivalents, nor are they similar. FISA = Foreign Intelligence Surveillance Court / NSL = National Security Letter.

If a person is the target of the FISA system, there most certainly is probable cause.

National Security Letter is a gag order, given by the intelligence community, in order to protect national security.

Again, if you or your organization receives one of these, there most certainly is probable cause.

These systems may be detestable, but there's no need to make things up.

There is no probable cause required for FISA orders. They are routinely used illegally against americans.

This has been well documented in the press following the Snowden disclosures. It’s called FAA702 or PRISM.

> Apple’s own transparency report indicates they turn over data to the USG for over 100,000 different apple IDs each year in the no-warrant-or-probable-cause (FISA orders and NSLs) category.

FISA “orders” are warrants and have the same requirement for probable cause as any search or seizure warrant (they aren't criminal warrants so the probable cause is not of there being evidence of a crime, but of the target being an agent of a foreign power.)

NSLs are administrative subpoenas accompanied with gag orders, not warrants, and correspondingly do not have a probable cause requirement; unlike warrants (and like other subpoenas), they are subject to precompliance challenge (and the associated gag order is challengable separately.)

> FISA “orders” are warrants and have the same requirement for probable cause as any search or seizure warrant (they aren't criminal warrants so the probable cause is not of there being evidence of a crime, but of the target being an agent of a foreign power.)

You put orders in quotes, but that’s what they are called, because it is illegal and inaccurate to call them warrants, because warrants per 4A are issued only upon probable cause. FISA orders are warrantless and do not require probable cause.

Snowden was very clear when he released the data on FAA702. No probable cause is required. They are not warrants. There is nobody in the room except a government petitioner and a government judge who rubber stamps them.

They are the #1 most used source in the US IC, and they make it possible for the FBI and DHS et al to read all of your gmail, all of your google docs, and all of your iMessages and phone photos without so much as a shred of criminal wrongdoing.

The idea that they are used only for foreign surveillance is patently false. There is ample hard documentation (again, thanks to Snowden) that they routinely use these to spy on americans. Their twisted logic is that if the data is replicated outside of the US (to say, a datacenter in Europe) then they are legally permitted to access it under the way the unconstitutional FISA Amendments Act (Section 702) is written.

FISA warrants do not have the check and balance safeguards that other warrants have, and the system for getting FISA warrants has been extensively and egregiously abused

>they are subject to precompliance challenge

and it's weird you go to the trouble to mention this but slough over the problems with FISA warrants. You are not arguing honestly here.

That seems like the least "compromising" data, compared to other things we let them get.

Imagine there are whole countries out there where income is public and accessible to anyone ;)

I put recipes in google sheets. I hope that Google gets the ratios right on some killer ragù.
I hope you don't use Gmail if that's your attitude lol.