3 ms·

> they still won't tell him the password The Google support people should have mentioned it, but hopefully, they wouldn't be able to tell him the password with

by KMag 6y ago

> they still won't tell him the password The Google support people should have mentioned it, but hopefully, they wouldn't be able to tell him the password without investing tens to hundreds of thousands of dollars in cracking the hash. https://plaintextoffenders.com/ https://plaintextoffenders.com/

charliebrownau 6y ago
If it was important People would WRITE IT DOWN People would RECORD IT People would BACK IT UP Its not the job of companies, corporations or tech repair stuff to remember stuff for you
superkuh 6y ago
Is google really encrypting each individuals email based on a password they have no knowledge of? I know privacy oriented email hosts have tried to achieve this, but google? I'd hope the phone tech support understand the goal was to regain access to the account, through a reset or whatever mechanism, and not to just know the password. But maybe if my dad worded it like I did the same confusion could've happened.
- KMag 6y ago
  > Is google really encrypting each individuals email based on a password they have no knowledge of? We're talking about giving out a forgotten password, not getting access to email contents. I used to work on the indexing system, not GMail, but my vague recollection is there are some master private keys (necessary for lawful intercept, etc.) locked in hardware modules for email storage, where very few binaries are able to get the hardware modules to perform public key decryptions. There are strong safeguards on humans using some of the binaries that do have access. Access to these encryption keys is orthogonal to access to the account password. My recollection of the Aurora attacks is that the intruders got access to some systems that were able to decrypt/display senders and subjects, but we believed they were unable to get at the email bodies.
- Closi 6y ago
  They mean google does not have access to the password, as that is done via a one-way hash. They can do a password reset, however would need sufficient proof of account ownership. Having access to the account is unfortunately not enough proof to show ownership, as that could be achieved with access to someone else’s device.

by KMag 6y ago

charliebrownau 6y ago

If it was important People would WRITE IT DOWN People would RECORD IT People would BACK IT UP Its not the job of companies, corporations or tech repair stuff to remember stuff for you

superkuh 6y ago

Is google really encrypting each individuals email based on a password they have no knowledge of? I know privacy oriented email hosts have tried to achieve this, but google? I'd hope the phone tech support understand the goal was to regain access to the account, through a reset or whatever mechanism, and not to just know the password. But maybe if my dad worded it like I did the same confusion could've happened.

KMag 6y ago
> Is google really encrypting each individuals email based on a password they have no knowledge of? We're talking about giving out a forgotten password, not getting access to email contents. I used to work on the indexing system, not GMail, but my vague recollection is there are some master private keys (necessary for lawful intercept, etc.) locked in hardware modules for email storage, where very few binaries are able to get the hardware modules to perform public key decryptions. There are strong safeguards on humans using some of the binaries that do have access. Access to these encryption keys is orthogonal to access to the account password. My recollection of the Aurora attacks is that the intruders got access to some systems that were able to decrypt/display senders and subjects, but we believed they were unable to get at the email bodies.
Closi 6y ago
They mean google does not have access to the password, as that is done via a one-way hash. They can do a password reset, however would need sufficient proof of account ownership. Having access to the account is unfortunately not enough proof to show ownership, as that could be achieved with access to someone else’s device.