5 ms·
Just curious, in what way does Google docs not have "end to end" encryption?
by radium3d 10y ago
Just curious, in what way does Google docs not have "end to end" encryption?
- pmarreck 10y agoIt's HTTPS to them, then it's "inside their systems in some unknown form", then it's HTTPS to whoever else looks at it. Basically, there's nothing preventing Google themselves from looking at your Docs data in cleartext. And that's bad for corps who want total privacy.
- brown9-2 10y agoI think it is worth pointing out that 1) you have no idea what Quip does with the data once it gets past their web server 2) there is no mention of "end to end" in Quip's security document https://quip.com/ABbYAZsD8nbt https://quip.com/ABbYAZsD8nbt
- X86BSD 10y agoYeah I didn't get his comment either. I read their security document. They use SSL to encrypt traffic in transit. That is all. It's not encrypted at rest or in any other fashion. Big deal almost everything is SSL these days during transit the big sales point that catches MY eye are products that encrypt your data at rest like tarsnap, where no one, including the state can access it. THAT is the only products I will use or trust. These guys mine your data just like Google. Don't kid yourself.
- jsmthrowaway 10y agoWhile you're right to be suspicious — of any hosted product, really, especially biz intel things like this and Slack — I think you got ahead of yourself in the last couple of sentences. A does not necessarily imply B there. (I'm not kidding myself.)
- pmarreck 10y agoAnswered here https://news.ycombinator.com/item?id=12207328 https://news.ycombinator.com/item?id=12207328 but in short, you're correct, I made a bad assumption.
- jsmthrowaway 10y agoYou can run Quip on premises, and it's functional without an Internet connection. So if the security picture matters that much there is an option (priced rather well, too). There are a number of "shadow IT" single-admin Quip instances popping up both in systems I'm aware of and those I hear about from other folks, so I'm guessing it's easy to administer. I know it works without Internet connectivity because I saw someone install it in an environment that intentionally has no access. I've always wanted Google Docs on prem so if Quip is it, that's interesting in itself especially for the security reasons. But, Google has incredibly stringent controls around user data after a particular press-involved incident involving an SRE, so while the paranoia of possibilities is well-founded, in practice they'd need a damned good reason (like a critical failure in the product) to even look. They can, and do, walk employees for getting this stuff wrong. So theoretically, yes (good security mind), practically, not likely.
- X86BSD 10y agoThanks for pointing out it can be run locally. That's a win IMO.
- voltagex_ 10y agoWhat was the Google incident?
- jsmthrowaway 10y agoDavid Barksdale. To be clear, though, if one squints he did leave a positive legacy in many more forms and technical barriers on the way to a log entry. Not all him, but a lot. Good lesson to learn for all of us with administrator access, too, about not even trusting inside folks. The DBIR is compelling here.
- pmarreck 10y agoYou're right. I read too much into the "Security/Privacy" section of their website. So what's the real selling point, then? Like I said it seems like a hybrid of Google Docs and Google Wave.
- richman777 10y agoThat's essentially exactly what it is. Our team got a demo from them trying to determine the best tool for our use-case and we simply couldn't justify it over google docs for how we do things, especially since we were already setup on the google apps platform for our domain.
- shawn-butler 10y agoData at rest is not guaranteed to be encrypted.
- hyperbovine 10y agoThe documents are still human readable when I edit them. I am left to assume that in quip, you edit the raw ciphertext manually.