To: rocksolid.shared.security
Google what?

https://sputniknews.com/science/201810091068712194-google-plus-data-leak/?utm_source=https://t.co/f87GYA9eyy&utm_medium=short_url&utm_content=jH2Y&utm_campaign=URL_shortening

Google will shut down its social network after a massive security hole for
years allowed user profile data to be accessed.

Turns out, Facebook is not the only tech giant to suffer a heavy body blow
over user data security. This time, it is the almighty Google, or, more
precisely, its not-so-popular social network called Google+.

Those who used the product have had personal data exposed to malefactors
since 2015, according to a Wall Street Journal report cited by TechCrunch.
When a user allowed an app access to their public profile data, the bug
allowed the app to also grab non-public profile fields, including full
names, email addresses, birth dates, gender, profile photos, places lived,
occupation and relationship status.

The total amount of users endangered by the bug is reported to be 496,951.

Google headquarters in Mountain View, Calif. 2013
© AP PHOTO / MARCIO JOSE SANCHEZ
UK Court Dismisses Case Against Google Over Harvesting of iPhone User Data
The security hole was only discovered and plugged by Google this March,
the report reads, but the company decided not to go public with the
breach, as it was exactly same time as the notorious Facebook/Cambridge
Analytica scandal was unraveling.
Going public with a bug finding would have led to Google "coming into the
spotlight alongside or even instead of Facebook despite having stayed
under the radar throughout the Cambridge Analytica scandal," an internal
memo cited by TechCrunch read.

Curiously, mere minutes after WSJ published their report on the data
leakage, Google made an announcement that they would close Google+ in the
next 10 months, allowing users to export their data, and then switch G+ to
an enterprise product. This is one of a series of measures taken following
the Project Strobe security audit. Besides closing their social network,
Google will rework security rules, including restricting third-party
developers from accessing phone SMS data, call logs and some contact info.

Project Strobe provides eyebrow-raising statistics, including that 90
percent of Google+ interactions took less than five seconds. Apparently,
the only interaction the vast majority of users ever had with the social
network is pushing a button to close login dialog windows.

"This review crystallized what we've known for a while: that while our
engineering teams have put a lot of effort and dedication into building
Google+ over the years, it has not achieved broad consumer or developer
adoption, and has seen limited user interaction with apps," the Project
Strobe report reads.

Google
© AFP 2018 / PHILIPPE HUGUEN
Google CEO Secretly Met Pentagon Leaders to Ease Tensions Over AI Project
Withdrawal - Reports
In an attempt to control the damage, Google specifically stated that the
bug did not allow perpetrators access to messages or posts made by users.
The company also claimed that they "found no evidence that any developer
was aware of this bug, or abusing the API" and that they "found no
evidence that any Profile data was misused," writing "no evidence" in
bold, twice.
According to TechCrunch, Google is likely to avoid the 2 percent of global
annual revenue fine for failing to disclose the issue within 72 hours.
However, the website reads, the company might still face lawsuits and
public backlash.

Google stayed above much of the Facebook- and Twitter-centered scandals of
recent months, partially by claiming that G+ is "not really a social
network," TechCrunch reads. Although this time the company might end up
testifying before Congress, just like Facebook's Mark Zuckerberg.

--
Posted on RetroBBS
--- Synchronet 3.17a-Linux NewsLink 1.108
Posted on RetroBBS

99% of Google employees don't know how to use gpg. Microsoft is no better.
Posted on: def3.i2p

>99% of Google employees don't know how to use gpg. Microsoft is no better.

why would they ? mother google will keep them safe from all harm plus help them protecting their privacy, as it does with its customers.

the problem for all these poor victims is that they are so entangled in the net of apps, services, os and so on that they cannot even imagine to live outside of the google/microsoft/apple universe. the second they disconnect only one of their devices from it their life starts to malfunction.

i see this in the company i work for: they have bought the microsoft ticket a long time ago, and stayed on it ever since. 30 years later everything from calendars, emails, office applications to printing, domain controlling, web applications and bookkeeping is depending on some component from the microsoft universe.
to even think about any change is seen as ridiculous because everything is interlinked and depending on each other as well (like the webapp that lets you access web sharepoints (running with silverlight, if you can believe it), and that only works correctly with the internet explorer).
for each of the single tasks there would be something better and more secure from the open source universe, but you cannot replace one part without replacing all the others at the same time. so you are caught...and realizing that, you just continue to use the shitware, hoping that the big data meltdown catastrophee that is bound to happen one day will happen only after you have changed your position or employer...of course, should you still be in charge at that time, you can always play the card with the russian/chinese/korean hackers, that could not be stopped because they opened the boxes with their evil hacking power, so no system can resist...
in a way, the philosophy of the tech giants is exactly the opposite of linux:
with linux, you have one tool to solve one task, you need to put the whole thing together yourself, and in the end, it does what you want and nothing that you don't want.
with m$, you have a universe of tools for a mulitude of things, everything is preassembled, and in the end, it does some of the things you want, and a shitload a things you don't want, and in fact did not even think about when switching the damn thing on.

Posted on def4.i2p

anon wrote:

> i see this in the company i work for: they have bought the microsoft ticket
a long time ago, and stayed on it ever since. 30 years later everything from
calendars, emails, office applications to printing, domain controlling, web
applications and bookkeeping is depending on some component from the microsoft
universe.
> to even think about any change is seen as ridiculous because everything is
interlinked and depending on each other as well (like the webapp that lets you
access web sharepoints (running with silverlight, if you can believe it), and
that only works correctly with the internet explorer).

It's exactly the same where I work. 100% Microsoft and no one there seems
to think there is any other way to do things. I haven't used Outlook in
many years, now I must use it all day every day and it's a bloated
nightmare.

Every program is tied to every other program. Every server accessed
(internally, and there are a lot) is tied to every other. It gives the
appearance of great security, but it's incredibly frustrating using the
additional security programs (apps) and verifications and all else just to
get something done.

If it were really secure, they wouldn't want me using the exact same
password with every different thing I need to access, but they require
that.

> with m$, you have a universe of tools for a mulitude of things, everything
is preassembled, and in the end, it does some of the things you want, and a
shitload a things you don't want, and in fact did not even think about when
switching the damn thing on.

As you said people are so dependent on this structure they don't seem to
comprehend (really, don't care) that there are other ways to get things
done.

--
Posted on RetroBBS

>(really, don't care) that there are other ways to get things done.

i would assume that there is no one really brave or foolhardy enough to break out from a complex it-structure (i mean among the people that have a strong enough influence in companies). from their point of view the reward is too little, and should the need arise they can always minimize their personal risk by proving that they where acting compliant to $some_company_standard

Posted on def4.i2p