Misfired e-mail was never viewed by Gmail user

http://news.cnet.com/8301-27080_3-10363663-245.html

by designtofly • 17 years ago

25 30 17 years ago

news.cnet.com

jcromartie• 17 years ago

Shouldn't it be possible, with what we know about cryptography available today, for banks and other companies to do business without having to regularly pass around files containing thousands of their customers' most personal identification credentials like names, addresses, SSNs and account numbers?

DannoHung• 17 years ago

Not on the approved list of corporate software, requisition for the approved software that can do the same thing was denied due to budgetary reasoning.

callahad2• 17 years ago

How do you combat this sort of thing? My employer is set to impose a software registry upon its employees -- any open source tool, at all, has to be registered. Proprietary but free packages, like Adobe Reader or Opera, do not need to be reported.

I've yet to find a compelling argument against this. Or at least one that's persuasive to our legal department.

_dan• 17 years ago

Heh. You'd be surprised at how blasé a lot of companies are about people's personal information. The vast majority of the corporate world still thinks it's perfectly reasonable to do their work by emailing excel files of personal data around.

ams6110• 17 years ago

And this is the real problem. This will happen again. That email should have been sent with something like PGP encryption to ensure that only the intended recipient could open it.

no customer data of any sort has been viewed or used by any inappropriate user during this data lapse

Since the email was apparently sent "in the clear" they cannot say this with certainty. A copy could have been siphoned off any intermediate network or smtp server.

tomjen2• 17 years ago

That would require the banks to have a brain. That isn't necessary when you have friends in Washington.

macragge• 17 years ago

I work for a very large bank, we secure our sensitive communications with PGP. Part of my job involves communicating sensitive information with other very large banks which also take encryption seriously. I suspect that the bank in the article is the exception, rather than the rule.

tlb• 17 years ago

Instructive to read the original outrage here: http://news.ycombinator.com/item?id=844228

But in the end, they did the reasonable thing: delete the email and move on.

sfphotoarts• 17 years ago

"permanently destroyed by Google's system" - I find that hard to believe with all there duplication of data across locations and hardware.

naveensundar• 17 years ago

The interesting thing is that Google can easily read data in Gmail. I would have been happier if it was actually encrypted using the user's password or a one way hash of the user's password.

jonah• 17 years ago

I like that idea, but what do you do when someone changes their password? Decrypt/Reencrypt all their messages?

jpwagner• 17 years ago

store the password change history...

dchest• 17 years ago

Easy: encrypt a random encryption key with password (I mean, with a key derived from password). Then encrypt content with this random key. When user changes password, re-encrypt the same key using a new password. No need to re-encrypt contents, because it's still encrypted with the same key.

This is how it's done in most disk encryption software, for example, FileVault.

dtf3• 17 years ago

Although a core part of Gmail's business case is the context-sensitive ads - they really do read every mail you receive and send.

Mankhool• 17 years ago

Using unecrypted emails and web based email services for corporate communication is really bad judgement. In Canada one of our banks used to fax confidential documents to a scrapyard operator in West Virginia - for years. http://tinyurl.com/ycdeqm8

nixme• 17 years ago

Please don't use URL shorteners on HN. It masks the domain making it difficult to gauge the context of a link (in this case theglobeandmail.com).

idm• 17 years ago

Check out this URL unshortener extension for Firefox:

https://addons.mozilla.org/en-US/firefox/addon/9549

Also posted to HN here (upvote if you want others to know about it):

http://news.ycombinator.com/item?id=853586

chanux• 17 years ago

You send me an email by mistake. And you want my email provider to delete my account.

I love this world.

dschobel2• 17 years ago

"Rocky Mountain Bank, working with Google (through court order), confirmed on Thursday of last week that the e-mail containing client information was never opened and has now been permanently destroyed by Google's system," Tina Martinez, general counsel for Rocky Mountain Capital, wrote in an e-mail response to questions. "As a result, no customer data of any sort has been viewed or used by any inappropriate user during this data lapse," Martinez wrote

So basically they got unbelievably lucky. It doesn't change the fact that Google was prepared to bust down this guy's virtual door because someone said they accidentally slipped some data in his mail-slot.

It's still all very troubling.

dtf3• 17 years ago

To be fair to Google, they did nothing until ordered by a US court. Is there any more you can ask?

dschobel2• 17 years ago

I think what's troubling is really a combination of two independent circumstances.

First, one company has access to tons of my personal data. I trust this company, they seem well intentioned and they have a very reasonable privacy policy. It's also extremely useful to me to have all of my data (email, personal contacts, calendar) in one place and accessible via a web-interface.

However, when you throw in the second variable, namely, the mixed-bag which is the US judicial system it can all be torpedoed with the flick of a wrist.

I really would have preferred to have seen the judge tell the bank "tough shit" and have someone (either the email recipient or EFF) put up more of a legal resistance to this court order.

Misfired e-mail was never viewed by Gmail user

Related Stories