Slashdot Mirror
Google Building Privacy Red Team
Trailrunner7 writes "Google, which has come under fire for years for its privacy practices and recently settled a privacy related case with the Federal Trade Commission that resulted in a $22.5 million fine, is building out a privacy 'red team,' a group of people charged with finding and resolving privacy risks in the company's products. The concept of a red team is one that's been used in security for decades, with small teams of experts trying to break a given software application, get into a network or circumvent a security system as part of a penetration test or a similar engagement. The idea is sometimes applied in the real world as well, in the form of people attempting to gain entry to a secure facility or other restricted area."
It's a good idea too. Deliberately cause mayhem to encourage and test true redundancy.
Help stamp out iliturcy.
...the concerns about Google and privacy have next to nothing to do with what hackers might do with the data Google collects on you, rather than what Google will do with it.
This space available.
And here I thought, silly me, that it was the massive fines by the EU and Canadian regulators as to their practices that caused this change.
Never mind.
I'm sure they're doing it for the reason you say.
-- Tigger warning: This post may contain tiggers! --
There is, you just have to take steps to preserve yours, which most people don't do.
And the rampant privacy violations that happen by default exist because people don't care about their privacy. If they did, engaging in such practices would put companies out of business. But people actively support this world, where everything they do is tracked. Such drastic measures to preserve privacy would not be necessary if more people cared about not living in a Panopticon.
The fine referenced in the summary was an intentional violation of privacy, at least from what I understand. It sounds like the point of the red team is to find unintentional security flaws that may cause privacy risks. That's good and all, but it really doesn't address the issue that the article and summary are pretending to address.
...a grizzled old Google veteran, brought out of retirement. He has a rag-tag team consisting of an arrogant young prodigy, a burnt out developer with a death wish, a hard-as-nails female programmer and a sassy ex-con who learned all his coding on the street.
They are PRIVACY RED TEAM!
I agree, and think Google is on the right track here.
I suspect they are starting to see the backlash against easily broken security, and are starting to do something about it.
This is really amazing when you stop and think that they have most to gain by learning all your habits (or at least the "Hate Google First" rabble would have you believe.
The iCloud meltdown preceded by the never ending follies of facebook probably told Google it was time to test their own stuff rather than wait for the storm to hit home. They are well ahead of the game with two factor authentication. Now if they could just add Zero Knowledge encryption techniques to their Google Drive they could be giving even more assurance they weren't out to market anything more about you than what is already public record.
I would love to have stuff backed up in the cloud, but as it is, the only cloud I trust is SpiderOak.
Passive-aggressive?
He did, but the continuum set it right again. He's currently being punished by having his powers suspended, and being forced to work at the DMV.
(It was the less horrible punishment they offered. The other was signing autographs at a startrek convention.)
Back in the days when ActiveX was first created, I mean. But simply having a team doesn't mean that team will be allowed by the powers-that-be to make any meaningful difference.
Here, for example - according to the linked article, this team is all about external penetration and threat testing. I don't know anyone whose primary concern regarding Google's data collection is about what an external attacker could do with that information. And the $22.5 million fine was about Google's own internal decisions and behavior, not about what some hacker pulled off because of poor security on Google's part.
This just smells like theater. Much like Microsoft's statements about security a decade or so ago.
#DeleteChrome
I think the ridiculous thing is that my email and phone account is orders of magnitude safer than my bank account.
Google's security is already miles beyond the average website, it's banks I want to see get into the 21st century. I should be able to use top-notch encryption techniques if I so desired, instead of an 8-character password coupled with questions for which anybody could find answers if they even vaguely knew me.
My US bank gave me my Internet banking password, from a VoIP call from overseas, knowing nothing more than my name, address, and date of birth. Apparently this is roughly the same set of security as iCloud.
I am TheRaven on Soylent News
Yes, because it is much worse for Google to know I prefer a BMW to a Toyota and serve me ads appropriately, vs. having someone use the same information to steal my identity, take out a second mortgage on my home, and leave me destitute.
You can take my house, but PLEASE don't ask me what my car preference is!
Can we tone down the hyperbole please? Comparing using personal data for marketing vs. using it to steal from innocents is just stupid.