4 ms·

And why is it that we all trust Google is unhackable? I won't be shocked if someday a torrent turns up with billions of private Gmail messages and user search h

And why is it that we all trust Google is unhackable? I won't be shocked if someday a torrent turns up with billions of private Gmail messages and user search history records.

debatem1 7y ago
Perhaps because such a torrent has not shown up in the last 20 years?
- charlesism 7y ago
  "Equifax was founded by Cator and Guy Woolford in Atlanta, Georgia, as Retail Credit Company in 1899" And the thing is that most people would never knowingly make the privacy vs utility trade-off. The risk (that the entire world gain access to one's search history) is not in the best interest of most users. Personalized search does not provide that much added value.
  - debatem1 7y ago
    Ironic that you should bring Equifax up since they would literally sell everything they had on you to anyone who could pay until Congress stomped on them with the FCRA. If you thought they were ever a good steward of your data you weren't paying attention.
    - charlesism 7y ago
      Equifax is in the business of selling data. I will grant you that's a good point. I suppose the issue now boils down to whether 20 years is a long time or not. I don't think it is, but I don't see a conclusive way to argue either side of that. I'm not sure how to continue at this point :)
      - debatem1 7y ago
        I guess all I can do is say that 20 years of good behavior is enough to convince the state to release you for first degree murder, and most people seem to feel ok about that. I'd suggest that most people probably don't know their spouses or best friends for 20 years before trusting them, either. And you could declare bankruptcy twice in that time and still have pretty good credit. So as a society we seem to have accepted that 20 years is actually a pretty long track record. Not sure why our standards for infosec should be higher than any of those things.
dredmorbius 7y ago
Google's been hacked, individually, to major geopolitical significance, and at scale. John Podesta: http://www.thesmokinggun.com/documents/crime/how-john-podesta-got-hacked-839125 http://www.thesmokinggun.com/documents/crime/how-john-podest... Colin Powell, and others: https://www.theguardian.com/commentisfree/2016/sep/15/colin-powell-hacked-emails-analysis-gift-voters-presidential-election-sarah-now https://www.theguardian.com/commentisfree/2016/sep/15/colin-... https://www.nytimes.com/2016/09/16/us/politics/email-hacking-colin-powell-congress.html https://www.nytimes.com/2016/09/16/us/politics/email-hacking... Tibetan activists, broadly: https://www.sfgate.com/business/article/Tibet-activist-s-e-mail-attacked-from-China-3203678.php https://www.sfgate.com/business/article/Tibet-activist-s-e-m... NSA and other surveillance operations claim access to Google, and other online service providers: https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data https://www.theguardian.com/world/2013/jun/06/us-tech-giants... There's been no widescale mass comprehensive breach of Google yet, that we are aware of. But that may simply be a matter of luck and time. Google have said Gmail users should not expect privacy: People sending email to any of Google's 425 million Gmail users have no "reasonable expectation" that their communications are confidential, the internet giant has said in a court filing. https://www.theguardian.com/technology/2013/aug/14/google-gmail-users-privacy-email-lawsuit https://www.theguardian.com/technology/2013/aug/14/google-gm... And, though I cannot find a link presently, in the wake of the Snowden revelations, Google employees told the Guardian that integrity of Gmail and associated Google accounts (and they are all associated) could not be assured. Probably 2013-2014 timeframe.
- sonnyblarney 7y ago
  People using social engineering to hack into gmail is not really 'google getting hacked'. That's individuals getting hacked. And Google allowing the NSA access is not them getting hacked either. Google reading your mail is not hacking either. We're talking someone hacking into G and grabbing millions of emails or passwords, I don't think that has happened.
  - dredmorbius 7y ago
    At Google scale, and given the proved consequences, that's really not the case. There was plenty in, e.g., the Podesta, Powell, and related hacks, to suggest at the least suspicion. The fact that single-password hacking is a keys-to-the-kingdom event is itself a major flaw. And it's not as if phishing is a new attack vector, the concept dates to at least the 1980s. And also, Google have changed internal proceses in consequence. But a massive blame component absolutely falls squarely on Google. There were and are mechanisms Google could implement (and to some extent has) to reduce the attack surface further. Encrypting contents and doing so independently of access is probably the most significant. Google does not do this, and in fairness, no other major player, not even Protonmail, does this, at least not by default. The problem is hard, it intoduces inconveniences. It is not impossible. Lack of the feature has cost Google users, a small but aware and technical cohort, myself included. (Protonmail's encryption prevents static-storage-on-disk attacks, including subpoena and insider access, but password compromise remains an extant risk. bI no principally use Protonmail.) Patterns-of-use fingerprinting (which Google does), app-specific passwords for non-Web access (ditto), special attention to politically exposed persons (PEPs), and exceptional internal access and process controls, yes. But the mass-sweep attack appears still viable through multiple potental vectors, stream, static, and dynamic (programmatic).

And why is it that we all trust Google is unhackable? I won't be shocked if someday a torrent turns up with billions of private Gmail messages and user search history records.

debatem1 7y ago

Perhaps because such a torrent has not shown up in the last 20 years?

charlesism 7y ago
"Equifax was founded by Cator and Guy Woolford in Atlanta, Georgia, as Retail Credit Company in 1899" And the thing is that most people would never knowingly make the privacy vs utility trade-off. The risk (that the entire world gain access to one's search history) is not in the best interest of most users. Personalized search does not provide that much added value.
- debatem1 7y ago
  Ironic that you should bring Equifax up since they would literally sell everything they had on you to anyone who could pay until Congress stomped on them with the FCRA. If you thought they were ever a good steward of your data you weren't paying attention.
  - charlesism 7y ago
    Equifax is in the business of selling data. I will grant you that's a good point. I suppose the issue now boils down to whether 20 years is a long time or not. I don't think it is, but I don't see a conclusive way to argue either side of that. I'm not sure how to continue at this point :)
    - debatem1 7y ago
      I guess all I can do is say that 20 years of good behavior is enough to convince the state to release you for first degree murder, and most people seem to feel ok about that. I'd suggest that most people probably don't know their spouses or best friends for 20 years before trusting them, either. And you could declare bankruptcy twice in that time and still have pretty good credit. So as a society we seem to have accepted that 20 years is actually a pretty long track record. Not sure why our standards for infosec should be higher than any of those things.

dredmorbius 7y ago

Google's been hacked, individually, to major geopolitical significance, and at scale. John Podesta: http://www.thesmokinggun.com/documents/crime/how-john-podesta-got-hacked-839125 http://www.thesmokinggun.com/documents/crime/how-john-podest... Colin Powell, and others: https://www.theguardian.com/commentisfree/2016/sep/15/colin-powell-hacked-emails-analysis-gift-voters-presidential-election-sarah-now https://www.theguardian.com/commentisfree/2016/sep/15/colin-... https://www.nytimes.com/2016/09/16/us/politics/email-hacking-colin-powell-congress.html https://www.nytimes.com/2016/09/16/us/politics/email-hacking... Tibetan activists, broadly: https://www.sfgate.com/business/article/Tibet-activist-s-e-mail-attacked-from-China-3203678.php https://www.sfgate.com/business/article/Tibet-activist-s-e-m... NSA and other surveillance operations claim access to Google, and other online service providers: https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data https://www.theguardian.com/world/2013/jun/06/us-tech-giants... There's been no widescale mass comprehensive breach of Google yet, that we are aware of. But that may simply be a matter of luck and time. Google have said Gmail users should not expect privacy: People sending email to any of Google's 425 million Gmail users have no "reasonable expectation" that their communications are confidential, the internet giant has said in a court filing. https://www.theguardian.com/technology/2013/aug/14/google-gmail-users-privacy-email-lawsuit https://www.theguardian.com/technology/2013/aug/14/google-gm... And, though I cannot find a link presently, in the wake of the Snowden revelations, Google employees told the Guardian that integrity of Gmail and associated Google accounts (and they are all associated) could not be assured. Probably 2013-2014 timeframe.

sonnyblarney 7y ago
People using social engineering to hack into gmail is not really 'google getting hacked'. That's individuals getting hacked. And Google allowing the NSA access is not them getting hacked either. Google reading your mail is not hacking either. We're talking someone hacking into G and grabbing millions of emails or passwords, I don't think that has happened.
- dredmorbius 7y ago
  At Google scale, and given the proved consequences, that's really not the case. There was plenty in, e.g., the Podesta, Powell, and related hacks, to suggest at the least suspicion. The fact that single-password hacking is a keys-to-the-kingdom event is itself a major flaw. And it's not as if phishing is a new attack vector, the concept dates to at least the 1980s. And also, Google have changed internal proceses in consequence. But a massive blame component absolutely falls squarely on Google. There were and are mechanisms Google could implement (and to some extent has) to reduce the attack surface further. Encrypting contents and doing so independently of access is probably the most significant. Google does not do this, and in fairness, no other major player, not even Protonmail, does this, at least not by default. The problem is hard, it intoduces inconveniences. It is not impossible. Lack of the feature has cost Google users, a small but aware and technical cohort, myself included. (Protonmail's encryption prevents static-storage-on-disk attacks, including subpoena and insider access, but password compromise remains an extant risk. bI no principally use Protonmail.) Patterns-of-use fingerprinting (which Google does), app-specific passwords for non-Web access (ditto), special attention to politically exposed persons (PEPs), and exceptional internal access and process controls, yes. But the mass-sweep attack appears still viable through multiple potental vectors, stream, static, and dynamic (programmatic).