10 ms·

Genuinely curious: What secure and reliable systems has Google built? Nothing really springs to mind. Android, their most popular end-user product, is a securi

Genuinely curious: What secure and reliable systems has Google built? Nothing really springs to mind. Android, their most popular end-user product, is a security disaster [1]. Chrome, "the most secure browser in the world", has a huge list of serious vulnerabilities [2]. [1] https://www.cl.cam.ac.uk/~drt24/papers/spsm-scoring.pdf https://www.cl.cam.ac.uk/~drt24/papers/spsm-scoring.pdf [2] https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/opec-1/Google-Chrome.html https://www.cvedetails.com/vulnerability-list/vendor_id-1224...

danso 7y ago
You believe that Google Accounts, GMail, and GDrive are fundamentally insecure and unreliable? Compared to what?
- armitron 7y ago
  You mean the same Google services running on top of data centers that the NSA had infiltrated and was monitoring for years?
  - tekno45 7y ago
    if it's so secure that only state sponsored actors can force their way in, thats pretty damn secure.
  - danso 7y ago
    You mean the same program that also "infiltrated" (I guess you take those companies at their word that they weren't cooperating) every other tech giant? Again, that's why I asked "Compared to what?" What is your favorite tech company, uninfiltrated by the NSA while also serving billions of users, whose SRE books would be more worthwhile?
    - armitron 7y ago
      Assuming that an answer to your question is even quantifiable (it isn't since you're asking me to prove nonexistence), how is it relevant to my original question? The security failures that allowed the NSA to come in were comical. Deliberate choices that Google made are for the most part responsible for the Android fiasco. In fact, Google is one of the behemoths that put us all at -ever increasing- risk in the name of profit and so far have done precious little to reverse course [1]. [1] https://seclists.org/dailydave/2020/q2/1 https://seclists.org/dailydave/2020/q2/1
      - buttersbrian 7y ago
        Can you suggest another company with the experience and expertise at this scale to go with the unbesmirched reputation needed to write an information and helpful book on this topic?
- alexeldeib 7y ago
  Has anyone ever compromised search?
  - slivanes 7y ago
    Do SEO abusers count?
    - speedgoose 7y ago
      Yes. Google search is broken.
- deleted 7y ago
  [deleted]
NOGDP 7y ago
Google search, gmail, maps, their ad systems...?
- kerng 7y ago
  Weren't they all compromised by NSA, as well as China. And those are the issues that became public. Look up Operation Aurora for instance, or the famous slide deck that highlighted lack of encryption inside Google's network - and security intelligence even put a smile face there!
  - joshuamorton 7y ago
    If your best examples of security failings from Google are from 7 and 10 years ago suggests a fairly robust security track record, does it not? And Aurora "became public" when Google announced it, it was the other 30+ companies affected by it that kept silent on the issue (some to this day).
  - dodobirdlord 7y ago
    > Weren't they all compromised by NSA, as well as China. And those are the issues that became public. Look up Operation Aurora for instance They caught the Chinese trying to compromise their systems, and stopped them before they got very far. In the process of investigating it was discovered that the Chinese had totally compromised a ton of other companies in the same operation. Sounds like top-tier security by Google. Nobody's perfect, and defending is so much harder than attacking that they're not even really the same industry. > the famous slide deck that highlighted lack of encryption inside Google's network - and security intelligence even put a smile face there! They hadn't reckoned on their own government physically tapping the network cables inside of their datacenters. And it's hard to blame them. Snowden's leaks wouldn't have been so shocking if they weren't, y'know, shocking. Once they added this to their threat model, they went and encrypted all internal traffic.
joshuamorton 7y ago
Can you name a more secure OS or browser?
- pjmlp 7y ago
  Unisys ClearPath MCP or Green Hills INTEGRITY OS, for example.
  - joshuamorton 7y ago
    So no general purpose OS or browser then? It's also not obvious to me that clearpath is more secure than android, mostly because I can't actually find any information about what it is, there's only marketing jargon :/
    - pjmlp 7y ago
      It is quite obvious from how many CVE entries you can find for each one.
      - joshuamorton 7y ago
        That doesn't obviously follow. CVE entries are both a function of security and interest. My github projects don't have any CVEs, not because they aren't woefully insecure to anyone who bothers to investigate deeply, but because no one cares. "Android" is installed on more devices than any other OS in the world. So it stands to reason that there would be more interest in finding exploits in android than in OS's that are often airgapped or locked away behind firewalls.
        pjmlp 7y ago
        It is also very seldom updated, my dummy GitHub projects have more updates than many common Android brands, so whatever security Pixel devices sell, it is hardly a reflection of what most consumers outside North America get to use.

danso 7y ago

You believe that Google Accounts, GMail, and GDrive are fundamentally insecure and unreliable? Compared to what?

armitron 7y ago
You mean the same Google services running on top of data centers that the NSA had infiltrated and was monitoring for years?
- tekno45 7y ago
  if it's so secure that only state sponsored actors can force their way in, thats pretty damn secure.
- danso 7y ago
  You mean the same program that also "infiltrated" (I guess you take those companies at their word that they weren't cooperating) every other tech giant? Again, that's why I asked "Compared to what?" What is your favorite tech company, uninfiltrated by the NSA while also serving billions of users, whose SRE books would be more worthwhile?
  - armitron 7y ago
    Assuming that an answer to your question is even quantifiable (it isn't since you're asking me to prove nonexistence), how is it relevant to my original question? The security failures that allowed the NSA to come in were comical. Deliberate choices that Google made are for the most part responsible for the Android fiasco. In fact, Google is one of the behemoths that put us all at -ever increasing- risk in the name of profit and so far have done precious little to reverse course [1]. [1] https://seclists.org/dailydave/2020/q2/1 https://seclists.org/dailydave/2020/q2/1
    - buttersbrian 7y ago
      Can you suggest another company with the experience and expertise at this scale to go with the unbesmirched reputation needed to write an information and helpful book on this topic?
alexeldeib 7y ago
Has anyone ever compromised search?
- slivanes 7y ago
  Do SEO abusers count?
  - speedgoose 7y ago
    Yes. Google search is broken.
deleted 7y ago
[deleted]

NOGDP 7y ago

Google search, gmail, maps, their ad systems...?

kerng 7y ago
Weren't they all compromised by NSA, as well as China. And those are the issues that became public. Look up Operation Aurora for instance, or the famous slide deck that highlighted lack of encryption inside Google's network - and security intelligence even put a smile face there!
- joshuamorton 7y ago
  If your best examples of security failings from Google are from 7 and 10 years ago suggests a fairly robust security track record, does it not? And Aurora "became public" when Google announced it, it was the other 30+ companies affected by it that kept silent on the issue (some to this day).
- dodobirdlord 7y ago
  > Weren't they all compromised by NSA, as well as China. And those are the issues that became public. Look up Operation Aurora for instance They caught the Chinese trying to compromise their systems, and stopped them before they got very far. In the process of investigating it was discovered that the Chinese had totally compromised a ton of other companies in the same operation. Sounds like top-tier security by Google. Nobody's perfect, and defending is so much harder than attacking that they're not even really the same industry. > the famous slide deck that highlighted lack of encryption inside Google's network - and security intelligence even put a smile face there! They hadn't reckoned on their own government physically tapping the network cables inside of their datacenters. And it's hard to blame them. Snowden's leaks wouldn't have been so shocking if they weren't, y'know, shocking. Once they added this to their threat model, they went and encrypted all internal traffic.

joshuamorton 7y ago

Can you name a more secure OS or browser?

pjmlp 7y ago
Unisys ClearPath MCP or Green Hills INTEGRITY OS, for example.
- joshuamorton 7y ago
  So no general purpose OS or browser then? It's also not obvious to me that clearpath is more secure than android, mostly because I can't actually find any information about what it is, there's only marketing jargon :/
  - pjmlp 7y ago
    It is quite obvious from how many CVE entries you can find for each one.
    - joshuamorton 7y ago
      That doesn't obviously follow. CVE entries are both a function of security and interest. My github projects don't have any CVEs, not because they aren't woefully insecure to anyone who bothers to investigate deeply, but because no one cares. "Android" is installed on more devices than any other OS in the world. So it stands to reason that there would be more interest in finding exploits in android than in OS's that are often airgapped or locked away behind firewalls.
      - pjmlp 7y ago
        It is also very seldom updated, my dummy GitHub projects have more updates than many common Android brands, so whatever security Pixel devices sell, it is hardly a reflection of what most consumers outside North America get to use.