Google asks journalists to tone down story of "massive" Google Play security flaw

17891113

Comments

  • Reply 201 of 257

    Quote:

    Originally Posted by MacRulez View Post


    Thanks for clarifying that for us, but for whom was that intended?  I don't recall anyone here claiming that OS X is a cloud OS.



     


     


    Quote:


    Quote:

    Originally Posted by TBell View Post


    I have Little Snitch installed on my Mac and I stopped using Chrome. It calls home repeatedly every session. Firefox and Safari call home maybe one a week to check for updates. Other than to check for updates, a browser has no reason to call home. You are right it is spyware. 



    It's a cloud OS - how else would you expect it to work?


     


    And since you used Little Snitch, can you tell us specifically what unauthorized sensitive data it was transmitting?



     


    I know it's hard to keep track when you just make stuff up to respond to people, but at least try, a little bit.


     


     


    Quote:


    Is that the data you've seen with Little Snitch yourself? And what do you imagine is done with that data, and where did you find any proof to support such imaginings?


     


    I think this is the point where Tallest Skil would write, "Citation needed."




     


    I think I must have imagined it when Mountain Lion asked me if I wanted to allow Chrome to have my contacts.


     


    Again, if you don't know what you are talking about, don't post your garbage here.

  • Reply 202 of 257


     


    And not just Chrome. All Google software is spyware, every last bit of it. It's all about collecting information about users to sell and give to advertisers. That's their business model, so it shouldn't be a shock to anyone.

  • Reply 203 of 257


     


    wtfQuote:


    Originally Posted by MacRulez View Post


    For most people making claims that might seem potentially libelous, providing supporting details for those claims would indeed matter.


     


    When you use any browser on any OS, data is being sent to the server.  When you have an OS which is essentially a browser, we would expect this to be no different.


     


    So unless you believe that all use of the Internet, characterized as it is by two-way communications between a client and a server, somehow satisfies the definition of "spyware", one may reasonably expect TBell to take an interest in his own words at least sufficient to explain his claims.



     


    WTF are you talking about? Of course this is how browsers work. If I ask to view xyz.com there's going to be traffic between my computer and xyz.com. If there's other content displayed then my browser might connect to other servers as well (like images.xyz.com, forums.xyz.com or adcompany.com). All these server references would be contained within the web page itself, and this is normal.


     


    What's being talked about is a browser that's connecting regularly to servers that have nothing to do with the web page I'm trying to view. There's no reason for a browser to do this. It should only be connecting to the web page server itself (and affiliates).


     


    Not sure why you can't seem to comprehend this and use the asinine argument that "when you use any browser on any OS data is being sent to the server" as if all browsers are behaving the same as Chrome. They're not.


     


    I suppose you're still one of those that thinks Google bypassing Safari was OK too.

  • Reply 204 of 257

    Quote:

    Originally Posted by muppetry View Post




    Quote:

    Originally Posted by Taniwha View Post




    Quote:

    Originally Posted by Tallest Skil View Post





    Originally Posted by Suddenly Newton View Post

    Most Google/Samsung defenders in the forums tend to argue something like "see, Apple does it too!" using spurious examples. They never actually deny that Google/Samsung did whatever they were accused of doing.


     


    Exactly. And to top it off, Apple's NOT doing what Google, et. al. do! There's no "too"! In Apple's list of "Apple affiliated companies"… it's all Apple! Just under different names! It's to be understood that Apple shares the personal information you give them… with Apple! It's them! And then they go on to say that non-personal information is shared with true third-parties, and they state what that non-personal information is. 



    Ah TS, are you being willfully ignorant ? The Apple definition of non-personal information is, to put it mildly, defective, as I pointed out earlier in this thread. It is really quite asinine in this context to ignore the fact that the Apple definition is absolutely contrived and not in any way compatible with internationally accepted definitions of personal information:  Restricting the definition of "personal information" to only cover DIRECTLY IDENTIFIABLE information about persons is simply a trick to deceive the uninformed.


     


     


     


    If the definition had been invented by some idiot with no professional experience in privacy law it might be excusable, but that's not the case. It was defined by professionals who are familiar with privacy laws and regulations worldwide. But when it comes from a professional then it must be assumed that it is intentional.


     


    The point is that it is trivial to link various pieces of "apple-defined" non-personal information to identify people. This is why the laws are formulated to include "identifiable" personal information. So please, give it a rest. Nobody can be so stupid as not to see through that. But since we don't have any insight into what apple is really doing it is a bit difficult to say more than it looks like a ruse which will create the illusion that they are not processing personal information while at the same time opening a back door to permit it.  To me it seems quite obvious that the specific inclusion of "direct" in the definition, is something that requires closer examination.


     


    And before you start arguing that this is a US Company and subject only to US laws, you may wish to wise up on definitions of personal information in various state laws and federal regulations (HIPAA for example). In any case, there is not a shadow of doubt that the Apple definition is incompatible with privacy law in the majority of countries which have any such laws at all. 



     


    What kinds of non-personal information do you think could reasonably be combined to permit identification of a customer?



    Well this is not a hard question to answer: Let's take 2 examples.


     


    1. you buy something on the internet, and supply your credit card, email address and login-name.


    2. you buy something in a shop, pay in cash and supply your home address for the delivery, your email address in case there's some problem with the order, and your telephone number so that the delivery man  can call you to arrange a time to take the delivery.


     


    In this case you have two datasets. The internet supplier doesn't have your home address and telephone, but the brick and mortar shop does.


     


    Now an indexer can link the two datasets based on your email address. That, incidentally, is how many internet data aggregators function ... building links by indexing on seemingly disconnected information sub-sets. If you*re interested PM me and I'll send you an article about data leakage on the internet. It's quite revealing.


     


    But my main point is another one:


     


    Apples "Privacy" policy does not give you ANYTHING LIKE A USEFUL GUARANTEE. Most people probably wouldn't notice the fine distinction that Apple makes and the fact that they classify information as personal only if it is directly attributable to a person. Anything that is not DIRECTLY attributable, is "free-to-use-in-any-way-we like". So the unwary reader, and intellectually challenged AI moderators, don't understand that the definition that Apple invented is not a protection of personal information and not a guarantee at all. In fact it's a blank check as long as the data set doesn't contain your NAME.


     


    The other point I made was that the Apple definition is in contradiction to the most widely accepted international definition of "personal information" in the laws of many countries, whicht is "any information relating to identified or identfiable natural persons"


     


    By using this transparent trick, many people will be mislead into believing that the Apple privacy policy gives them some protective guarantees that it does NOT in fact provide. I don't think it is accidental and I certainly don't think that is acceptable or praisworthy. Seems to me it's a calculated gamble that uninformed people will be mislead to believe that they are getting something more than they are actually getting by way of guarantees.


     


    Actually I just did a quick check in a couple of international privacy law resources (Baker & McKenzie, Linklaters). About 40 countries, including the entire EU, but also Russia, India, Argentina, Chile, Columbia, Kazakhstan, Azerbaijan, Indonesia, Philippines, Turkey, and Vietnam (among others) ALL use the "identified or identifiable" definition. So Apple is WAY off target.


     


    And here's the Killer :-). EVEN GOOGLE defines personal information more broadly than apple's limited definition. I find that is simply hilarious.


     


     


    "Personal information:


     


    This is information which you provide to us which personally identifies you, such as your name, email address or billing information, or other data which can be reasonably linked to such information by Google."


     


    For the intellectually challenged, the last sentence is the key. (Hi TS).


     


    So, what I am saying is that the Apple definition is self-serving and deceptive and clearly in violation of the law in at least 40 countries outside of the US of A.


     


    Self-serving: Because the main thing that US companies are afraid of in respect of privacy violations are class-actions and the FTC enforcement of privacy policies. For those who may not know, the FTC regards deviations from published privacy policies as misleading advertising, so they use that angle to make sure that companies stick to what they say they will do. The FTC does NOT have a mandate to enforce privacy law per se except where sector-specific federal laws make this possible.  So the Apple Privacy Policy can be seen more as a means to avoid both of these risks in the US. This however serves Apple's interests but goes no way to ACTUALLY PROTECTING their USER and CUSTOMER personal information.


     


    Apart from the simple comparison to the google privacy definition, as a privacy professional I am by no means defending Google in any shape or form. But there have been enough contributions to this thread that draw attention to the shit that Google is propagating. I don't think I need to add to that.


     


    Hope that helps to clarify the issues.

  • Reply 205 of 257

    Quote:

    Originally Posted by Tallest Skil View Post





    Originally Posted by Taniwha View Post

    Restricting the definition of "personal information" to only cover DIRECTLY IDENTIFIABLE information about persons is simply a trick to deceive the uninformed.


     


    So you object to the idea of Apple stating that their customers have eyes of a certain color. You'd prefer third-parties not even know that Apple's customers have eyes at all. Got it. 






    Originally Posted by Euphonious View Post

    135 posts bickering about whether Google is more evil than Apple, or vice versa.


     


    Plenty of us really need to go outside more.




     


    I ask because I genuinely don't think you know: you do realize this is a discussion forum, right?





    TS, with all DUE respect. Those comments are at best not constructive, and at worst simply childish. I will not engage with you at that level. Forget it.

  • Reply 206 of 257
    macrulezmacrulez Posts: 2,455member


    deleted

  • Reply 207 of 257
    macrulezmacrulez Posts: 2,455member


    deleted

  • Reply 208 of 257
    macrulezmacrulez Posts: 2,455member


    deleted

  • Reply 209 of 257

    Quote:

    Originally Posted by MacRulez View Post


    Do they actually give identify information about individuals to advertisers, or do they merely use that information to provide options for demographically relevant ad placement as Apple's iAd does?


     


    I can't claim to know with certainty, and look forward to your proving a URL to the page where Googgle offers specific identifying information about users as a product for sale to advertisers.



     


    You clearly haven't been reading the news, come back when you have a clue, which should be never.

  • Reply 210 of 257

    Quote:

    Originally Posted by MacRulez View Post


    Ah, so a software asked your permissions for a synching activity.  Did you grant those permissions? 



     


    Of course, the part you are conveniently ignoring is that, prior to Mountain Lion, Chrome was simply able to grab that information.


     


    You know, most of the rest of the Z collective of trolls has left us, why are you still here?

  • Reply 211 of 257

    Quote:

    Originally Posted by MacRulez View Post


    You're off to a good start, but then:


     


    Let's take a look at the page we're on now:  in addition to AppleInsider.com, NoScript shows JS requests for quanserve.com, viglink.com, scorecardresearch.com, facebook.com, googleadservices.com, and google-analytics.com, with cookie requests from apple.com and yahooapis.com.


     


    I trust AI's dependence on googleadsevices.com and google-analytics.com will prompt you to close your account here, no?


     


    And can you kindly tell us what specific requests you've seen from the Chrome browser so we can better understand how you define "spyware"?


     


    The astute reader will note that you suppose many things no one actually said.



     


    "The astute reader will note that you suppose many things no one actually said". Oh the irony.


     


    I never made the claim that I personally saw Chrome requests nor did I claim that Chrome was "spyware". Do you even keep track of who you're replying to?


     


    My comment was regarding your over-generalization about browsers connecting to servers. Are you going to claim that Chrome ONLY contacts servers listed in their web pages and never makes calls to servers that aren't related to the website, Google Analytics or Google Ads?


     


    I use Google Analytics myself, so why would I stop visiting AI (or any site) that uses them? In fact, it's Google Analytics that allows me to call BS on the articles you previously always liked to link that try to refute claims that iOS devices comprise the majority of web traffic. Google Analytics is smart enough to tell me how many iPhone, iPad, Nexus or Nokia phones visit my site. Which is why I use it.


     


     


    The astute reader would realize you're a troll who thinly disguises their posts as legitimate "concerns" or "issues". You're not fooling anyone, so why do you still keep trying?

  • Reply 212 of 257


    Originally Posted by Taniwha View Post

    Well this is not a hard question to answer: Let's take 2 examples.


     


    1. you buy something on the internet, and supply your credit card, email address and login-name.


    2. you buy something in a shop, pay in cash and supply your home address for the delivery, your email address in case there's some problem with the order, and your telephone number so that the delivery man can call you to arrange a time to take the delivery.


     


    In this case you have two datasets. The internet supplier doesn't have your home address and telephone, but the brick and mortar shop does.


     


    Now an indexer can link the two datasets based on your email address.



     


    Is this supposed to answer the question? Home address is personally identifying information, as is the phone number and e-mail address.





    Apples "Privacy" policy does not give you ANYTHING LIKE A USEFUL GUARANTEE. 



     


    What would be a "useful guarantee" if not:






    Personal information will only be shared by Apple to provide or improve our products, services and advertising; it will not be shared with third parties for their marketing purposes.


     


    If we do combine non-personal information with personal information the combined information will be treated as personal information for as long as it remains combined.



     


    Do "will not", "will be", and "will only" not mean anything?






    Most people probably wouldn't notice the fine distinction that Apple makes and the fact that they classify information as personal only if it is directly attributable to a person. Anything that is not DIRECTLY attributable, is "free-to-use-in-any-way-we like".




     


    Yes, that's known as the law, as well as the choice of the company. Don't like it, don't use the company. Both Apple and Google do this, as do tens of thousands of other companies. Personal information is protected, non-personal can be shared.






    …the definition that Apple invented…




     


    They invented no definition. You keep saying this.






    …is not a protection of personal information and not a guarantee at all. In fact it's a blank check as long as the data set doesn't contain your NAME.




     


    No. Read the laws again.


     


    US:




    Information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.



    EU*:




    Article 2a: 'personal data' shall mean any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity



     


     Read the privacy policy again.



    What personal information we collect



    • When you create an Apple ID, register your products, apply for commercial credit, purchase a product, download a software update, register for a class at an Apple Retail Store, or participate in an online survey, we may collect a variety of information, including your name, mailing address, phone number, email address, contact preferences, and credit card information.



     


    So I'm confused. Either you didn't read the privacy policy or you don't care what it says. Personal information extends far beyond "name" to Apple. Would you prefer a "but not limited to" after the "including" there, even though everything is already covered?





    The other point I made was that the Apple definition is in contradiction to the most widely accepted international definition of "personal information" in the laws of many countries, which is "any information relating to identified or identfiable natural persons"



     


    *I can't seem to find an itemized list of the EU's definition of items of personal information. All the laws I'm finding pertain exclusively to the use thereof. Could you list them, with a source? What is "identifiable natural persons" supposed to entail? Note that it's singular, not plural. Your original claim is this:






    You note that Apple defines "non personal information" only as information that does not permit association with any specific individual.


     


    In the entire EU this may, and in many cases would, nevertheless qualify as personal information.




     


    Emphasis yours. Your implication is that while Apple obviously cannot release data pertaining to a person, they also cannot release data that could pertain to more than one person. Except the law says:





    Personal data are defined as "any information relating to an identified or identifiable natural person ("data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;"


     


    Singular. And yet you go on to claim:






    which makes it an undisputable fact that Apple's privacy policy does NOT in fact give the assurances that its users may indeed expect, simply by the trick of defining personal information in a manner that is less broad than the legal definition



     


    So what was less broad? You haven't explained that.


     




    So the unwary reader, and intellectually challenged AI moderators…






    For the intellectually challenged, the last sentence is the key. (Hi TS).



     


    Hey, you realize that doing this invalidates everything you've said, even if it any of it is redeemable, right?

  • Reply 213 of 257
    macrulezmacrulez Posts: 2,455member


    deleted

  • Reply 214 of 257
    macrulezmacrulez Posts: 2,455member


    deleted

  • Reply 215 of 257
    jragostajragosta Posts: 10,473member
    macrulez wrote: »
    First, since the best you could find was two random and rather minor blogs, I'm not sure they meet the AnkleSkater Standard of "an authoritative source".  Were you really completely unable to find any reports from any of the well-known security sites?

    Still, random rants on the web can be fun, so let's enjoy them:

    Did you read the titles of either article?  Interestingly, both are worded as questions, rather like the "Did Glenn Beck...?" meme from a few year back, second only in popularity to the "some people say..." technique that's a mainstay of Fox News and similar reporting.

    True. But, then, I was able to read past the title - where they answered their own question in the affirmative. Reading past the title is fun - you should try it some time.
  • Reply 216 of 257
    macrulezmacrulez Posts: 2,455member


    deleted

  • Reply 217 of 257
    macrulezmacrulez Posts: 2,455member


    deleted

  • Reply 218 of 257
    kdarlingkdarling Posts: 1,640member

    Quote:

    Originally Posted by MacRulez View Post


    Do they actually give identify information about individuals to advertisers, or do they merely use that information to provide options for demographically relevant ad placement as Apple's iAd does?



     


    Neither Apple nor Google sells personal information to third parties.  That would be like giving away the goose that lays the golden eggs.


     


    Both companies only sell anonymous ad placements based on the info they have.


     


    For example, Apple sells iAds based on knowledge they have about us from our iTunes registration info, our media purchases, and our device location (see graphic from Apple below):


     


    image


     


    Whenever an app requests an iAd, Apple's server looks at our profile to see what target audience we match. It also checks to see which ads we've already seen in the past month.  The server then sends back an ad to fit our profile.  The requesting company pays Apple about 10 cents for each ad view, and the app developer gets a 70% cut of that. 


     


    Google's ads are done in a similar manner.  One difference is that anyone can go to their Google Dashboard and see (and even edit) major pieces of their profile.  I don't know of any way to do that with Apple's version of our profile.


     


     

  • Reply 219 of 257
    habihabi Posts: 317member
    kdarling wrote: »
    <p id="user_yui_3_7_3_1_1361210848065_637" style="color:rgb(24,24,24);font-family:arial, helvetica, sans-serif;line-height:18.1875px;">Neither Apple nor Google sells personal information to third parties.  That would be like giving away the goose that lays the golden eggs.</p>


    What th e hell do you mean? This article says Google said it was a feature that google sends private information to 3rd parties ( developers) without consent nor mention in the privacy policy about what exactly happens!!! Your point is then fully wrong and proved wrong!!!!
  • Reply 220 of 257
    maestro64maestro64 Posts: 5,043member


    Honestly, anyone who is upset of crying over this revelation deserves what you get here. What hell did you thing was going to happen when you take something for free. 


     


    I do not feel sorry for anyone who had their personal information share with whom every wanted it. If it was that important you should have never agreed to use google stuff, Maybe the DoJ will go after them for this one as well, But if I was google i would stay what did all these sheep think would happen when they got a free OS with free email, free web searched, and cheap and useless apps with lots of advertising and so on. If you going to be cheap an not pay then we get to whore their information to the highest bidder.


     


    The DoJ should just stay out of it and let buyer or in this case the begger beware. If you do not want you inform whore around then you should pay. As people already pointed out, Apple is making far more money selling you a product then selling your personal information.

Sign In or Register to comment.