Pages

2014-04-21

Google misappropriating use of social security numbers

Google does many good things for privacy of its customers, including leading a fight against the US government to disclose its gag-order-suppressed subpoenas and auditing security of its networks to fight against US government hackers gaining unauthorized access to exfiltrate client data.

One flaw in privacy is shown below.


Here, personally-identifiable information is collected from users including social security numbers and government-issued identification under the pretense that it will be used exclusively to "confirm your identity". However another page also notes that this will be used to "verify the identity of the individual" but also adds an extended scope of "We may also use this stored information for security purposes, for example, to ensure that someone trying to access the service is really the registered user."

A cynical person would read the literal meaning of that sentence as "We may also use this stored information for [any] security purposes."

Always beware of scope creep for the intended uses of private information you are giving out to companies.