8 ms·

[I'm a googler, who works in Apps, but not directly on anything relevant here]. This article mentions Access Transparency > By default, G Suite Enterprise ena

[I'm a googler, who works in Apps, but not directly on anything relevant here]. This article mentions Access Transparency > By default, G Suite Enterprise enables a feature called Access Transparency, which allows administrators to see who has looked at each document within the organization. But gets it a bit wrong. Access Transparency is a log of any Google employees who have looked at stuff in your domain. From the official site "Access Transparency logs provide information about actions of Google staff when they access your data."[1]. Which is a nice way of knowing that Google employees aren't randomly snooping on your files. [1]: https://support.google.com/a/answer/9230979?hl=en https://support.google.com/a/answer/9230979?hl=en

judge2020 7y ago
Only downside over a self-hosted solution is that legal requests won't always create an entry in access transparency. https://support.google.com/a/answer/9230474?hl=en https://support.google.com/a/answer/9230474?hl=en
- dmix 7y ago
  The point of eavesdropping would largely be defeated if the person can find out, so I get why it's a part of law. The thing about NSLs is the target often never finds out because there was no public investigations or courts involved. I remember reading a particular drug investigation had over 50 wiretaps including the mother's and sister's (of the targets) smartphones because they sometimes used their phones for business, which is pretty common in poorer households. I've always been curious if they found out afterwards. In The Wire they had a scene where they would pause the audio if it's only someone else talking after x amount of time. But I highly doubt every single text, picture, and message sent to the person isn't being seen by at least one person.
  - kuschku 7y ago
    If you selfhost, you'll definitely find out if you get a NSL. That's the advantage.
    - lazide 7y ago
      Only if you 100% completely selfhost (machine running in the basement?). Otherwise they could compromise your hosting provider at various different levels of the stack. Come to think of it though, even if you put your own machine in your own basement, they could just come in when you're not home and rootkit your box in numerous ways, and you'd probably never know barring some pretty heavy security. State level actors are very hard to defend against, especially when it's your own state.
      - angry_octet 7y ago
        It's a matter of scale. How many experience covert ops / TAO teams do you think the FBI has? Are they going to do a covert entry to your basement, deploy a custom software or hardware implant, watch you, retrieve their implant, etc? They would have to have probably cause, and in any case they don't have the budget or people to do many. And you can actually make it incredibly hard quite easily -- do everything on an ipad with a strong passphrase and no network connection (except occasionally to get software updates from Apple), keep it in a decent tamper evident safe (not a money safe), a painfully loud alarm with PIRs, in a location where people are around. Contrast that with surveillance via grep.
      - upofadown 7y ago
        There is a lot of law associated with residences, often constitutional, that does not protect you when the access is to a provider. The mere existence of a local alarm can greatly increase the risk of getting caught when going into a residence. State level actors really hate getting caught. They tend to be the sort of people who do not deal very well with uncertainty.
ohithereyou 7y ago
>Which is a nice way of knowing that Google employees aren't randomly snooping on your files. Why would I, as a end user, be given to trust this if I think Google employees are snooping in my files? I have no way to audit how this is kept, so I'd have to assume that any Googler snooping these files is either doing so using a backchannel that is not audited or the log is a no-op.
- joshuamorton 7y ago
  What's your threat model? If your worry is Google, as an organization, is actively trying to steal your stuff, that's one thing. If your worry is a rogue google employee is doing some unsanctioned thing, that's another. This (imo) mostly helps with the second, unless you also assume that Google as an organization is fairly inept and so can't log things reliably.
  - otakucode 7y ago
    I'd like to add an additional possible threat model that gets ignored pretty comprehensively and, in some cases, intentionally: Your data being fed to automated systems that provide summaries or derivative information based upon your data. People ignoring this is behind much of the NSAs snooping. They believe that until a HUMAN operator views the cleartext of some communication, the communication can not legally be said to have been 'intercepted' at all. And if you look up any statement ever made about reforms done at the NSA after Snowden's revelations, you will find that all of them, every single one, spoke exclusively about human analysts reading communications directly. They avoided addressing analysis, profiling, ML training, summarization, and other automated things very intentionally. The government has dropped a good many cases, serious cases involving child pornography even, to avoid ever testing this idea of theirs in court. We learned about this particular legal opinion of theirs (which would almost certainly never survive any court challenge at all) before Snowden even, back when the AT&T whistleblower came forward. The likelihood a company like Google is reading your emails directly and trying to scoop your business on a product idea or something like that is slim. The likelihood they are profiling your communications in aggregate and producing derivative information like "how many companies in the space are considering hiring" or "do the employees at this company talk about Chipotle" and using that for advertising or data products is, I would guess, pretty high.
dwighttk 7y ago
"Which is a nice way of knowing that Google employees aren't randomly snooping on your files." does it do that? Or does it just show you times that Google is willing to tell you Google employees snooped on your files?
- tylerl 7y ago
  "Google is willing"? You make it sound like there's a person making a decision. The system is automated, there's no mechanism for employees to be unwilling. A lot of effort goes in to ensuring that audit trails are non-optional.
- bhhaskin 7y ago
  Right. As an end user how can I actually verify that instead of just taking Google's word.
  - debatem1 7y ago
    This is a difficult argument to counter; for instance, are you sure that signal can't decrypt your messages? If so, do you remain sure knowing that they can update the app? As a security person I really can't think of any service (or piece of hardware) which I think satisfies the threat model where the provider is both clever and truly hostile.
    - tptacek 7y ago
      Yes, you're pretty sure about Signal, because it's end-to-end encrypted; you can verify what the binary you're running is actually doing (you have to have the expertise to do so, but then, even if Signal was written entirely in browser Javascript, you'd still need the cryptography expertise to verify it). By design, Signal doesn't depend on its serverside deployment for cryptographic security. That's not true of G Suite.
      - stubish 7y ago
        You can verify what the binary did while you were watching. You can't verify what it did before, or what it will do next. OP said hostile and clever, and part of clever is only being hostile when nobody is watching. Apps that don't snoop constantly, delay transmissions, and hide transmissions in existing and expected communication channels are much harder to catch.
paxys 7y ago
While they may not have used the correct terminology, the issue itself is correct. You can, by default, see who all in the org have viewed a document.
- joshuamorton 7y ago
  Oh absolutely, but that's a different feature that they also mention (and imo a less interesting one).
samstave 7y ago
I want a list of any google employees who have looked at my Gsuites How do I get that list
- joshuamorton 7y ago
  Read the docs for access transparency and follow the instructions. I don't admin a gsuite domain so I don't actually know the sequence of buttons to click to view AT logs.

judge2020 7y ago

Only downside over a self-hosted solution is that legal requests won't always create an entry in access transparency. https://support.google.com/a/answer/9230474?hl=en https://support.google.com/a/answer/9230474?hl=en

dmix 7y ago
The point of eavesdropping would largely be defeated if the person can find out, so I get why it's a part of law. The thing about NSLs is the target often never finds out because there was no public investigations or courts involved. I remember reading a particular drug investigation had over 50 wiretaps including the mother's and sister's (of the targets) smartphones because they sometimes used their phones for business, which is pretty common in poorer households. I've always been curious if they found out afterwards. In The Wire they had a scene where they would pause the audio if it's only someone else talking after x amount of time. But I highly doubt every single text, picture, and message sent to the person isn't being seen by at least one person.
- kuschku 7y ago
  If you selfhost, you'll definitely find out if you get a NSL. That's the advantage.
  - lazide 7y ago
    Only if you 100% completely selfhost (machine running in the basement?). Otherwise they could compromise your hosting provider at various different levels of the stack. Come to think of it though, even if you put your own machine in your own basement, they could just come in when you're not home and rootkit your box in numerous ways, and you'd probably never know barring some pretty heavy security. State level actors are very hard to defend against, especially when it's your own state.
    - angry_octet 7y ago
      It's a matter of scale. How many experience covert ops / TAO teams do you think the FBI has? Are they going to do a covert entry to your basement, deploy a custom software or hardware implant, watch you, retrieve their implant, etc? They would have to have probably cause, and in any case they don't have the budget or people to do many. And you can actually make it incredibly hard quite easily -- do everything on an ipad with a strong passphrase and no network connection (except occasionally to get software updates from Apple), keep it in a decent tamper evident safe (not a money safe), a painfully loud alarm with PIRs, in a location where people are around. Contrast that with surveillance via grep.
    - upofadown 7y ago
      There is a lot of law associated with residences, often constitutional, that does not protect you when the access is to a provider. The mere existence of a local alarm can greatly increase the risk of getting caught when going into a residence. State level actors really hate getting caught. They tend to be the sort of people who do not deal very well with uncertainty.

ohithereyou 7y ago

>Which is a nice way of knowing that Google employees aren't randomly snooping on your files. Why would I, as a end user, be given to trust this if I think Google employees are snooping in my files? I have no way to audit how this is kept, so I'd have to assume that any Googler snooping these files is either doing so using a backchannel that is not audited or the log is a no-op.

joshuamorton 7y ago
What's your threat model? If your worry is Google, as an organization, is actively trying to steal your stuff, that's one thing. If your worry is a rogue google employee is doing some unsanctioned thing, that's another. This (imo) mostly helps with the second, unless you also assume that Google as an organization is fairly inept and so can't log things reliably.
- otakucode 7y ago
  I'd like to add an additional possible threat model that gets ignored pretty comprehensively and, in some cases, intentionally: Your data being fed to automated systems that provide summaries or derivative information based upon your data. People ignoring this is behind much of the NSAs snooping. They believe that until a HUMAN operator views the cleartext of some communication, the communication can not legally be said to have been 'intercepted' at all. And if you look up any statement ever made about reforms done at the NSA after Snowden's revelations, you will find that all of them, every single one, spoke exclusively about human analysts reading communications directly. They avoided addressing analysis, profiling, ML training, summarization, and other automated things very intentionally. The government has dropped a good many cases, serious cases involving child pornography even, to avoid ever testing this idea of theirs in court. We learned about this particular legal opinion of theirs (which would almost certainly never survive any court challenge at all) before Snowden even, back when the AT&T whistleblower came forward. The likelihood a company like Google is reading your emails directly and trying to scoop your business on a product idea or something like that is slim. The likelihood they are profiling your communications in aggregate and producing derivative information like "how many companies in the space are considering hiring" or "do the employees at this company talk about Chipotle" and using that for advertising or data products is, I would guess, pretty high.

dwighttk 7y ago

"Which is a nice way of knowing that Google employees aren't randomly snooping on your files." does it do that? Or does it just show you times that Google is willing to tell you Google employees snooped on your files?

tylerl 7y ago
"Google is willing"? You make it sound like there's a person making a decision. The system is automated, there's no mechanism for employees to be unwilling. A lot of effort goes in to ensuring that audit trails are non-optional.
bhhaskin 7y ago
Right. As an end user how can I actually verify that instead of just taking Google's word.
- debatem1 7y ago
  This is a difficult argument to counter; for instance, are you sure that signal can't decrypt your messages? If so, do you remain sure knowing that they can update the app? As a security person I really can't think of any service (or piece of hardware) which I think satisfies the threat model where the provider is both clever and truly hostile.
  - tptacek 7y ago
    Yes, you're pretty sure about Signal, because it's end-to-end encrypted; you can verify what the binary you're running is actually doing (you have to have the expertise to do so, but then, even if Signal was written entirely in browser Javascript, you'd still need the cryptography expertise to verify it). By design, Signal doesn't depend on its serverside deployment for cryptographic security. That's not true of G Suite.
    - stubish 7y ago
      You can verify what the binary did while you were watching. You can't verify what it did before, or what it will do next. OP said hostile and clever, and part of clever is only being hostile when nobody is watching. Apps that don't snoop constantly, delay transmissions, and hide transmissions in existing and expected communication channels are much harder to catch.

paxys 7y ago

While they may not have used the correct terminology, the issue itself is correct. You can, by default, see who all in the org have viewed a document.

joshuamorton 7y ago
Oh absolutely, but that's a different feature that they also mention (and imo a less interesting one).

samstave 7y ago

I want a list of any google employees who have looked at my Gsuites How do I get that list

joshuamorton 7y ago
Read the docs for access transparency and follow the instructions. I don't admin a gsuite domain so I don't actually know the sequence of buttons to click to view AT logs.