Security quote of the week
I began my investigation with a strong presumption of chicanery. I was
unable to imagine the project kickoff meeting in which Wacom decided to
bundle Google Analytics with their device, which - remember - is
essentially a mouse, but managed to restrain themselves from also grabbing
some deliciously intrusive information while they were at it. I Googled
“wacom google analytics”. There were a couple of Tweets and Reddit posts
made by people who had also read Wacom’s privacy policy and been unhappy
about its contents, but no one had yet tried to find out exactly what data
Wacom were grabbing. No one had investigated Wacom’s understanding of the
phrase “aggregate usage data” or whether it was anywhere near that of a
reasonable person.
— Robert Heaton (worth reading in full)[...]
Some of the events that Wacom were recording were arguably within their purview, such as “driver started” and “driver shutdown”. I still don’t want them to take this information because there’s nothing in it for me, but their attempt to do so feels broadly justifiable. What requires more explanation is why Wacom think it’s acceptable to record every time I open a new application, including the time, a string that presumably uniquely identifies me, and the application’s name.