The Problem With Glow
Feb. 8th, 2018 06:48 am![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
osewalrus Consumer Reports developed a standard set of tests for privacy and cybersecurity and started testing products. Glow is a product that helps women track their fertility. As a consequence, it contains highly sensitive personal information.
CR's tests revealed a lot of vulnerabilities.
https://www.consumerreports.org/mobile-security-software/glow-pregnancy-app-exposed-women-to-privacy-threats/?loginMethod=auto
Now, to its credit, Glow took immediate steps to remedy the problems. This is why CR notifies the companies privately of the results and gives them time to fix the issue before publishing the results.
But this is a lot like saying "to its credit, X restaurant stopped leaving food out on the counter and addressed other public health concerns once alerted. Happily, no food-related illnesses can be directly traced to their practices."
It's not that Glow, or these other ap developers, are bad. But that is not any consolation when products with severe security and privacy bugs are released. Glow has 4 million users, btw.
From a public policy perspective, this is what we call market failure. In theory, there are market incentives for companies to build privacy secure and cybersecure products. But these incentives are cancelled out by other, stronger incentives. Additionally, because consumers lack the capacity to determine which products are more or less secure for themselves, they are required to act as if all products are insecure -- which creates a further disincentive for developers to focus on security or privacy. (The "Market for Lemons" problem.)
Additionally, as we have seen in other cases, insecure devices can create negative externalities for non-users. Same situation for privacy, especially in a world where data brokers suck up all available data and correlate it to build information profiles on average people (because it has become dirt cheap to do so and the profit per person is fairly high).
CR's tests revealed a lot of vulnerabilities.
https://www.consumerreports.org/mobile-security-software/glow-pregnancy-app-exposed-women-to-privacy-threats/?loginMethod=auto
Now, to its credit, Glow took immediate steps to remedy the problems. This is why CR notifies the companies privately of the results and gives them time to fix the issue before publishing the results.
But this is a lot like saying "to its credit, X restaurant stopped leaving food out on the counter and addressed other public health concerns once alerted. Happily, no food-related illnesses can be directly traced to their practices."
It's not that Glow, or these other ap developers, are bad. But that is not any consolation when products with severe security and privacy bugs are released. Glow has 4 million users, btw.
From a public policy perspective, this is what we call market failure. In theory, there are market incentives for companies to build privacy secure and cybersecure products. But these incentives are cancelled out by other, stronger incentives. Additionally, because consumers lack the capacity to determine which products are more or less secure for themselves, they are required to act as if all products are insecure -- which creates a further disincentive for developers to focus on security or privacy. (The "Market for Lemons" problem.)
Additionally, as we have seen in other cases, insecure devices can create negative externalities for non-users. Same situation for privacy, especially in a world where data brokers suck up all available data and correlate it to build information profiles on average people (because it has become dirt cheap to do so and the profit per person is fairly high).
