4 ms·
> I don't think you can accuse Google of not taking security seriously. I don't think they take my security, and the security of my data, seriously. They seem
by zeveb 10y ago
> I don't think you can accuse Google of not taking security seriously.
I don't think they take my security, and the security of my data, seriously. They seem to care very much about their security.
> They are making a security tradeoff that allows governments and insiders access to private data. This is a legitimate tradeoff to make
No, at this point I don't believe that it is legitimate, any more than it's legitimate to sell an oven which will explode if the temperature dial is set above 600° ('just don't set it that high!').
Yes, there are people at Google who work very hard to secure Google's data; there are people at Google (e.g. Adam Langley) who care a lot about users' data. There may even be people at Google who are working very hard to change its course on user privacy.
But Google, the company, does not take the security of user data against privacy threats seriously: if it did, it would use a better architecture (note that Apple doesn't take user-data security seriously, either, since they can MITM any time they want; nor does Mozilla, nor does Microsoft: no organization's hands are clean, so far as I can tell).
- idlewords 10y agoGoogle's business is based on destroying what you and I consider to be privacy, so I don't see how you could expect them to change their minds about that. Google and similar companies have a coherent worldview in which they collect user data, protect it from outsiders and inside threats, and do benign and wonderful things for users in return. Within that worldview, they do an excellent and commendable job. Calling their beliefs on data collection a security issue muddies the debate. I'm curious about your comments on Apple. If I back up my phone to iCloud, how can Apple "MITM any time they want"?
- zeveb 10y ago> I'm curious about your comments on Apple. If I back up my phone to iCloud, how can Apple "MITM any time they want"? I was referring to iMessage: my understanding is that it Apple is the CA for all iMessage keys, and thus they can issue a certificate to anyone, if they wish to or are compelled to.
- giovannibajo1 10y agoTheoretically, just like they could prepare a broken version of iOS that disables security and push it to targeted users. In reality, such a software/infrastructure does not exist today, and we've been shown what happens when Apple is asked to write it.
- tptacek 10y agoExactly how does almost singlehandedly transitioning the global Internet to forward-secure curve-based TLS help their security and not yours? All I can see in that work is cost for them.
- kryptiskt 10y agoThat's easy, TLS is great for Google as ISPs and wifi providers can't replace ads with their own in transit.
- tptacek 10y agoThat is some Alex Jones level reasoning. There's no end-user security you can provide that can't be reframed that way.
- DiabloD3 10y agoWhat he said isn't even entirely wrong... both adware and shitty ISPs do this, mostly as a vector for malware. Google has admitted as such, and migrating their ad platform to https and teaching Chrome and Firefox to refuse mixed content was part of not allowing their service to be abused for this. Just because Google sells something we don't like doesn't mean they're evil, but it means they have a responsibility to limit the attack surface outside attackers use. There is no way to eliminate all attack surface while still allowing third party admins or closed source code (technically, its impossible period, but w/e).
- kryptiskt 10y agoBelatedly seen this. For the record I just want to note that I claimed that Google have sound business reasons to promote TLS, i.e. that their ads can't be MITMed. I have no clue why tptacek would go ballistic at that suggestion.
- CaptSpify 10y agoAdditionally: The google of tomorrow != the google of today. Even if you assume that google currently has the best security/privacy setup in place, they could suddenly turn around tomorrow and hand that to whoever they wanted.