Oura says it gets government demands for user data(this.weekinsecurity.com) |
Oura says it gets government demands for user data(this.weekinsecurity.com) |
Illinois has a tight biometric-privacy law [1]. I’d bet Oura isn’t particularly careful about prohibiting e.g. a Texas police department querying the protected information of Illinois residents.
[1] https://en.wikipedia.org/wiki/Biometric_Information_Privacy_...
I’m assuming that Oura are assuming that this—the Illinois BIPA is toothless—is true. It is not [1].
[1] https://www.wilmerhale.com/en/insights/blogs/wilmerhale-priv...
Very strange -- it seems to be conflating end-to-end encryption with encryption-in-transit.
Encryption in transit means that network intermediates can't read the data. The two endpoints of the network communication can.
E2E encryption is more context-sensitive, and its context mostly comes from messaging. It means that the data is encrypted and that operational intermediates cannot read it. So in the context of messaging, the servers that run the messaging system cannot read the messages. Or, for an email, only the sender and recipient, not any of the intermediate email servers.
There's a big difference -- you can't really control or predict your network intermediates, but you can in theory know the operational intermediates. Whether something is E2E encrypted often depends on what intermediates you bring in to scope.
For example:
> That means that an Oura user's health data can be unscrambled at certain points as it travels from a person's ring, through their phone app, over the internet, and as it lands on Oura's servers.
If the ring uses Bluetooth to sync the data to your phone and the phone syncs data to the Oura servers, but the data is in the clear on your phone, then by this definition, it is not E2E encrypted. However, that's a pretty reasonable setup, depending on how the data on the phone is stored.
You’re more concerned about privacy when it comes to TV viewing than medical data? What a strange hijacking of a serious thread…
"Mr Smith has been running again, we better bring him in for questioning!"
Edit: to be clear, the government is requesting the data, so clearly they're doing something with it... But what? I don't see it!
Government can already get ALL your celltower locations without a warrant
AND read all your emails and text messages that are over 6 months old, without a warrant
Assuming you meant directly from the telcos and not from the data broker loopholes - in which case pretty much anyone should be able to do that. Emails and texts they still need a warrant for.
But every one of these devices demands some Android/Apple app, and shipping all my health data to basically non-HIPAA data brokers.
Id be all over a local-only no-data-exfiltration health tracker. But the companies do NOT want to provide that.
I, uh, guess, "go surveillance capitalism", for more choices?
In overly simple terms, if insurance is not involved, then it’s not subject to HIPAA.
Everything about that company is disgusting.
Such a shame, too. I was eager to learn more about my health.
Tech companies when they speak to VCs: look at all the creepy things we can infer with ooodles of aggregated data and AI to maximize targeted ad revenue, we're worth 50x what an equivalent non-tech company in our sector is valued, because of all the things we can do with all that data from all those people together
Tech companies when they speak to their customers: oh you're so silly to even ask about privacy, what possible utility could there be in that single isolated variable?
What could they possibly do from this single variable???
Bad health? Raise the insurance premiums? Or anything more evil I can't think of.
edit: grammar
(Note 1:"Dr. Bootlicker, the defendant wants the court to believe that she calmly placed herself between the agent and the minor he was trying to apprehend, and asserts that the agent's claim, that the defendant's actions constitute assault, is, in her words, 'ridiculous'. But am I correct in understanding that you view minutes 8 and 9 of the biometric data submitted to the court as characteristic of significant physical exertion that might be similar to that undergone by an assailant while commiting an assault?")
The best way to prevent the Feds from getting access to customer data is to not collect it in the first place.
Apple is subject to the same laws Oura is. The competition is too.
Apple has a great PR (propaganda) department that has convinced many people they respect your privacy. In truth, they do not. They're "better" than Google, but only slightly. And only so slightly that realistically it doesn't matter.
"Apple is taking the unprecedented step of removing its highest level data security tool from customers in the UK, after the government demanded access to user data."
https://www.bbc.com/news/articles/cgj54eq4vejo
It happened in the UK; it will not be long before it happens in the US.
--
Also, USA: https://www.bbc.com/news/technology-36084244
--
Also, France, Germany, Australia, Brazil, Japan: https://www.apple.com/legal/transparency/pdf/requests-2024-H...
--
Also, Russia: https://www.bloomberg.com/news/articles/2019-02-04/apple-fil...
--
Also, China: https://www.article19.org/resources/apple-cares-about-digita...
--
Also in general: https://proton.me/blog/iphone-privacy
All it takes is a political sea change for E2EE to go away.
Apple already has to hand over a wealth of information when asked by the feds.
Previously, they refused US government demands for a backdoor that would allow them to unlock locked devices.
That makes it very nearly meaningless.
We've never had so many threats to our privacy and liberties heaved upon us, and the rate is accelerating.
Thinking more on this I think a business opportunity in the future will be companies that design hardware stacks that can go in random appliances that can gather usage information in the name of telemetry.
I give it +/- 5 years before an OTS coffee maker at walmart phones home.