undefined | Better HN

0 pointsrandomdata1y ago0 comments

Right, expectation is the standard. The standard is that anyone who is an agent of the entity you have entrusted is also considered trustworthy. After all, giving full trust to an entity you only trust partially is nonsensical.

However, you make a fair point that it is reasonable to assume that entities you trust are willing to go above and beyond, for various reasons.

0 comments

ImPostingOnHN1y ago

> Right, expectation is the standard. The standard is that anyone who is an agent of the entity you have entrusted is also considered trustworthy.

To clarify, I am the second person here telling you that that is not the expectation. The expectation, and/or the right thing to do, and/or "the standard we expect them to meet", is that Google follows the standard security principle of least privileged access, meaning each employee can only access data they need to see, with proper permission acquired beforehand, auditing during, and abuse-detection & alerting afterwards.

Unfortunately, they don't meet this expectation that we have of them. Your own expectations and/or standards might be lower, like you described.

randomdataOP1y ago

The expectation is placed on the entity the trust is given to. Unless you go to individuals directly, there can be so such expectation on individuals. There may be an assumption that the entity you have given trust to do will "do the right thing" with individual agents, but it there is no such expectation as you have already trusted the entity, meaning that you have already trusted its agents. What have you gained by keeping information away from people you have already entrusted with the information? If you cannot find the trust to give them, why are you giving it?

ImPostingOnHN1y ago

Your own expectation is covered in the second paragraph of my previous post, I am describing the expectation, which is what I and the other poster have described. You speak of this as an assumption, but you have it backwards: given google's history of failing to meet our expectations, we assume they will continue to fail to do so.

Your question of "why" boils down to asking, What is to be gained by employing the principles of least privileged access, as well as proper authorization, auditing, and alerting? The answer to that question is beyond the scope of this post, but I trust that you understand or can understand the benefits of these principles.

1 more reply

j / k navigate · click thread line to collapse

0 comments

ImPostingOnHN1y ago

> Right, expectation is the standard. The standard is that anyone who is an agent of the entity you have entrusted is also considered trustworthy.

Unfortunately, they don't meet this expectation that we have of them. Your own expectations and/or standards might be lower, like you described.

randomdataOP1y ago

ImPostingOnHN1y ago

1 more reply

j / k navigate · click thread line to collapse