4 ms·

People using social engineering to hack into gmail is not really 'google getting hacked'. That's individuals getting hacked. And Google allowing the NSA access

People using social engineering to hack into gmail is not really 'google getting hacked'. That's individuals getting hacked. And Google allowing the NSA access is not them getting hacked either. Google reading your mail is not hacking either. We're talking someone hacking into G and grabbing millions of emails or passwords, I don't think that has happened.

dredmorbius 7y ago
At Google scale, and given the proved consequences, that's really not the case. There was plenty in, e.g., the Podesta, Powell, and related hacks, to suggest at the least suspicion. The fact that single-password hacking is a keys-to-the-kingdom event is itself a major flaw. And it's not as if phishing is a new attack vector, the concept dates to at least the 1980s. And also, Google have changed internal proceses in consequence. But a massive blame component absolutely falls squarely on Google. There were and are mechanisms Google could implement (and to some extent has) to reduce the attack surface further. Encrypting contents and doing so independently of access is probably the most significant. Google does not do this, and in fairness, no other major player, not even Protonmail, does this, at least not by default. The problem is hard, it intoduces inconveniences. It is not impossible. Lack of the feature has cost Google users, a small but aware and technical cohort, myself included. (Protonmail's encryption prevents static-storage-on-disk attacks, including subpoena and insider access, but password compromise remains an extant risk. bI no principally use Protonmail.) Patterns-of-use fingerprinting (which Google does), app-specific passwords for non-Web access (ditto), special attention to politically exposed persons (PEPs), and exceptional internal access and process controls, yes. But the mass-sweep attack appears still viable through multiple potental vectors, stream, static, and dynamic (programmatic).

dredmorbius 7y ago

At Google scale, and given the proved consequences, that's really not the case. There was plenty in, e.g., the Podesta, Powell, and related hacks, to suggest at the least suspicion. The fact that single-password hacking is a keys-to-the-kingdom event is itself a major flaw. And it's not as if phishing is a new attack vector, the concept dates to at least the 1980s. And also, Google have changed internal proceses in consequence. But a massive blame component absolutely falls squarely on Google. There were and are mechanisms Google could implement (and to some extent has) to reduce the attack surface further. Encrypting contents and doing so independently of access is probably the most significant. Google does not do this, and in fairness, no other major player, not even Protonmail, does this, at least not by default. The problem is hard, it intoduces inconveniences. It is not impossible. Lack of the feature has cost Google users, a small but aware and technical cohort, myself included. (Protonmail's encryption prevents static-storage-on-disk attacks, including subpoena and insider access, but password compromise remains an extant risk. bI no principally use Protonmail.) Patterns-of-use fingerprinting (which Google does), app-specific passwords for non-Web access (ditto), special attention to politically exposed persons (PEPs), and exceptional internal access and process controls, yes. But the mass-sweep attack appears still viable through multiple potental vectors, stream, static, and dynamic (programmatic).