4 ms·

> "Google employees with privileged access to Gmail are conspiring to be after me, personally" I thought employees do not have access to user data. Can anyone

> "Google employees with privileged access to Gmail are conspiring to be after me, personally" I thought employees do not have access to user data. Can anyone comment on this?

cisanti 9y ago
If there is a will, there is a way. It's all about trust, but I'm sure st least publicly they have stated employees do not have that access.
zabuni 9y ago
It's happened before: https://techcrunch.com/2010/09/14/google-engineer-spying-fired/ https://techcrunch.com/2010/09/14/google-engineer-spying-fir... If a person has enough access, and they have to, given that someone has to have admin access.
- joshuamorton 9y ago
  Worth noting that this occurred in 2009 (ie when gmail looked like this: https://1.bp.blogspot.com/_ZaGO7GjCqAI/SYD3g8LflXI/AAAAAAAAO4I/tH0-Ftb5P2o/s640/gmail-outbox.png https://1.bp.blogspot.com/_ZaGO7GjCqAI/SYD3g8LflXI/AAAAAAAAO...).
- londons_explore 9y ago
  Around 100 people have root @ Google. They get a tshirt with it on. With months of effort researching tripwires and auditing systems, any of them could read your mail. There's a pretty good chance they'd get caught by some auditing or alerting system they were unaware of though. Many of those systems are kept secret from employees for obvious reasons. Any two employees collude to much more easily read your mail. There's probably ~1000 people in that position (not only the gmail team, but anyone who writes any kind of library code used by any of the databases, datastores, or application servers). They would leave audit records though, although they might go unnoticed.
  - DINKDINK 9y ago
    >100 people have root @ Google. They get a tshirt with it on. A convenient way to put a target on your back. What benefit does this have to their security? Accountability?
    - md_ 9y ago
      The t-shirts are a bit of jokey swag, not an access control mechanism. ;)
      - DINKDINK 9y ago
        Yes, it’s a “hey everyone this person has the keys to the kingdom, target them” indicator.
  - technofiend 9y ago
    That's cool in that it's such a small number. Netflix shared how they do ephemeral access by publishing bless *[1]. It would be cool to see how Google does it as well. Googling for the usual terms doesn't return anything. [1]https://github.com/Netflix/bless https://github.com/Netflix/bless
  - singron 9y ago
    It's likely that reading Gmail data and other sensitive actions require significantly less privilege than some Google-wide "root".
    - londons_explore 9y ago
      Access controls are actually fairly locked down. I would guess the access control list for Gmail data is only ~10 people. If any of them were to make use of their access permissions, it would automatically trigger a review of their actions.
geofft 9y ago
I don't know anything about Google's internals, but, like, there's some data. It gets to your screen. There's code written by Google employees that makes that happen. That code gets modified on a regular basis by Google employees. If enough Google employees get together, they can modify that code to do whatever they want. I expect that any single Google employee does not have access, in the sense that they've locked themselves out of making changes to their systems without a computer seeing multiple human approvals. But there is a point at which someone can fix that computer. But yes, my point was that the threat model here isn't "one Google employee goes rogue," it's "multiple Google employees with extremely privileged access to Gmail and/or their code deployment servers all decide that they want to read your email without telling you, and nobody blows any whistles," which seems much more far-fetched.

> "Google employees with privileged access to Gmail are conspiring to be after me, personally" I thought employees do not have access to user data. Can anyone comment on this?

cisanti 9y ago

If there is a will, there is a way. It's all about trust, but I'm sure st least publicly they have stated employees do not have that access.

zabuni 9y ago

It's happened before: https://techcrunch.com/2010/09/14/google-engineer-spying-fired/ https://techcrunch.com/2010/09/14/google-engineer-spying-fir... If a person has enough access, and they have to, given that someone has to have admin access.

joshuamorton 9y ago
Worth noting that this occurred in 2009 (ie when gmail looked like this: https://1.bp.blogspot.com/_ZaGO7GjCqAI/SYD3g8LflXI/AAAAAAAAO4I/tH0-Ftb5P2o/s640/gmail-outbox.png https://1.bp.blogspot.com/_ZaGO7GjCqAI/SYD3g8LflXI/AAAAAAAAO...).
londons_explore 9y ago
Around 100 people have root @ Google. They get a tshirt with it on. With months of effort researching tripwires and auditing systems, any of them could read your mail. There's a pretty good chance they'd get caught by some auditing or alerting system they were unaware of though. Many of those systems are kept secret from employees for obvious reasons. Any two employees collude to much more easily read your mail. There's probably ~1000 people in that position (not only the gmail team, but anyone who writes any kind of library code used by any of the databases, datastores, or application servers). They would leave audit records though, although they might go unnoticed.
- DINKDINK 9y ago
  >100 people have root @ Google. They get a tshirt with it on. A convenient way to put a target on your back. What benefit does this have to their security? Accountability?
  - md_ 9y ago
    The t-shirts are a bit of jokey swag, not an access control mechanism. ;)
    - DINKDINK 9y ago
      Yes, it’s a “hey everyone this person has the keys to the kingdom, target them” indicator.
- technofiend 9y ago
  That's cool in that it's such a small number. Netflix shared how they do ephemeral access by publishing bless *[1]. It would be cool to see how Google does it as well. Googling for the usual terms doesn't return anything. [1]https://github.com/Netflix/bless https://github.com/Netflix/bless
- singron 9y ago
  It's likely that reading Gmail data and other sensitive actions require significantly less privilege than some Google-wide "root".
  - londons_explore 9y ago
    Access controls are actually fairly locked down. I would guess the access control list for Gmail data is only ~10 people. If any of them were to make use of their access permissions, it would automatically trigger a review of their actions.

geofft 9y ago

I don't know anything about Google's internals, but, like, there's some data. It gets to your screen. There's code written by Google employees that makes that happen. That code gets modified on a regular basis by Google employees. If enough Google employees get together, they can modify that code to do whatever they want. I expect that any single Google employee does not have access, in the sense that they've locked themselves out of making changes to their systems without a computer seeing multiple human approvals. But there is a point at which someone can fix that computer. But yes, my point was that the threat model here isn't "one Google employee goes rogue," it's "multiple Google employees with extremely privileged access to Gmail and/or their code deployment servers all decide that they want to read your email without telling you, and nobody blows any whistles," which seems much more far-fetched.