4 ms·

I'm a little surprised google does not use the user's password for encryption. Seems like they are inviting a very bad data breach in the future.

• tyingq 8y ago
  I imagine it's encrypted over the wire, but since the model is "processed in the cloud", it has to be decrypted to do anything useful with it. I suppose they could not log anything that could allow correlation to a user/ip, but that creates a different security problem. I don't see a real technical solution here other than doing all the processing locally.
• QuercusMax 8y ago
  So if you forget your password, your data is just gone? That doesn't seem like a good solution. I worked on a system in a previous life that encrypted data based on user passwords, and we had to add a backup encryption key (tied to security questions) because we had so many issues with people forgetting their password and losing their data. Google does now allow you to supply your own encryption keys for some offerings: https://cloud.google.com/compute/docs/disks/customer-supplied-encryption https://cloud.google.com/compute/docs/disks/customer-supplie.... This is probably a better option for those who are clueful enough. (Disclaimer: I work for an Alphabet company.)
• Johnny555 8y ago
  If this surprises you, you must not understand Google's business model at all. They give you services for "free" (or cheap) so they can use your data for marketing analysis. The thermostat tells Google when you're home and when you're not, tells them when you go to bed and when you wake up. Tells them when you go on vacation, and with the Nest Mobile App, where you went for vacation. Tells them how frugal you are with energy. This is a lot of valuable data to a marketing company, so of course they aren't going to lock themselves out of it.