7 ms·
All the data is encrypted so it doesn’t matter where they are storing it. Using multiple service providers (Google, Amazon, their own servers, etc) might actual
by cadence- 5y ago
All the data is encrypted so it doesn’t matter where they are storing it. Using multiple service providers (Google, Amazon, their own servers, etc) might actually be beneficial because it eliminates one point of failure, especially if they replicate data in a smart way to take advantage of it. It might also speed up access to data.
- deleted 5y ago[deleted]
- suifbwish 5y agoUnless you have encryption that is guaranteed to never be obsolete it ALWAYS matters where you store the data.
- peter422 5y agoIt does seem likely that Google will pay to store every bit of encrypted customer data that is currently stored forever because potentially decades from now it could be cracked and they could access all that amazing ancient private information.
- erhk 5y agoGoogle spends way too much money building consumer and corporate trust to attempt to cash it in for data they already have the majority of.
- exitheone 5y agoThis sentiment seems so weird to me. Can you point to a single enterprise offering where Google is collecting data and using it themselves? Or where it would even make sense to do so? Corporate customers pay a lot more per byte than the fleeting value of private data so Google has a strong incentive to never ever touch that data.
- Closi 5y agoI don’t agree with the original point, but there is no doubt lots of telemetry in the cloud.
- nl 5y agoTelemetry (ie usage data) is very very different the data being stored itself.
- SilverRed 5y agoPeter's comment comes off as satire to me. A joke about how absurd it would be for google to store 8 exabytes of data for decades because it might one day be useful.
- usrusr 5y agoBecause it might one day be useful for.. targeting ads? I can almost see the abuse potential, the ads "I know what you did the summer of 1997" will turn us all into mind controlled consumer drones. (those of us who are old enough)
- hulitu 5y agoFor them, maybe not. But maybe you heard that there are some agencies which are interested.
- mda 5y agoI think it was a satirical comment.
- spookthesunset 5y agoWhen it comes to posts about Google, Poe’s law operates in full force.
- remus 5y agoI don't think that is really the point that was being made. As you say the practical chances of google storing this data for x years, then committing corporate suicide by decrypting it is are miniscule (and presumably apple agrees). The point is that there are layers of security, and by moving the data outside of their physical control apple has given up one of those layers of security.
- VortexDream 5y agoI'm not sure why people are are thinking in such a limited fashion. Google is effectively holding onto the data for the US government or whoever else has the capability to access all that data in the future. This is the kind of stuff authoritarian governments dream about. And I'm not saying Google is doing it intentionally, just that they're holding onto the data at all and at some point there will be somebody who will make use of that data.
- remus 5y agoIf that is the argument, does it matter whether it is Apple or Google who is holding the physical data? Apple and Google are both based in the US and beholden to the US government, so from the government's perspective it's just a change of address when they send out a warrant.
- paganel 5y ago> does it matter whether it is Apple or Google who is holding the physical data? It might matter, yes. A company run by a guy like Eric Schmidt is a lot more likely to play nice with the US government when it comes to privacy compared to a company run by a guy like Cook, who from the outside seems obsessed with user-privacy (as long as China isn't directly involved).
- ahmedfromtunis 5y agoDidn't Schmidt retire as CEO 10 years ago (and 3 years ago as chairman)? Isn't now a Pichai-run company?
- helsinkiandrew 5y agoIt still puzzles me that people just can't understand the the huge chasm between storing and using peoples data from their own products and stealing data from other companies thats stored on your systems in the hope that one day it can be decrypted and used to improve ads. Google is a huge company, the idea that it would set out to do something that everyone involved in would know is directly breaking the law (rather than doing something thats a grey area, or they know is legal but 'unethical' or could become a PR issue, or destroy trust in them and destroy their product) is fairly unbelievable. This comes up again and again with stories about Google and (particularly) AWS cloud computing. I hope for better on HN!
- fshbbdssbbgdd 5y agoI mean, there’s these posts on Hacker News claiming to be from former AWS employees saying they stole customer data to launch competing services: https://news.ycombinator.com/item?id=23929959 https://news.ycombinator.com/item?id=23929959 There’s also mainstream reporting that Amazon employees used retail sales data to launch competing products: https://www.wsj.com/articles/amazon-scooped-up-data-from-its-own-sellers-to-launch-competing-products-11587650015 https://www.wsj.com/articles/amazon-scooped-up-data-from-its... Maybe the first story is fake and the second is real… but they both point to a “win at all costs” company culture where policies might be violated, even if it threatens trust in the platform and a PR problem when exposed.
- helsinkiandrew 5y agoBut those cases are very different too (I’m not trying to defend what they did). Talking to a startup then copying their product is douchy but not illegal. Using Amazon.com sales data is like looking at the public “top products in electronics” and selling your own version of the top sellers - I imagine all large retailers do something similar when deciding what products to make own versions of. Hacking computers, networks, or services of your competitors, even when running in you data center is just bad business.
- deleted 5y ago[deleted]
- mackrevinack 5y agoits it really going to be 'amazing' if the information is a decade or more old?
- spookthesunset 5y agoI mean google is full of employees who threatened to walk out when their employer wanted government defense contracts. Pretty sure google would get a ton of internal pushback if a team wanted to do what you describe. Google employs the same standard issue tech person you see here on HN.
- deleted 5y ago[deleted]
- fouc 5y agoAre you saying there is no encryption guaranteed to be good for the next 50 years ?
- brutus1213 5y agoAgainst a state-actor, perhaps not. Check out quantum cryptography. It is a serious business.
- pseudo0 5y agoThe current academic consensus is that AES-256 is quantum resistant, as even with Grover's algorithm the attack would still require 2^128 bits of work. Generally symmetric encryption schemes are impacted to a much lesser extent than public key cryptosystems, with larger key sizes sufficing to ensure quantum resistance. I'd be quite surprised if Apple weren't using AES-256 already.
- eurasiantiger 5y agoThey are using AES-128. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- pseudo0 5y agoA minimum of AES-128, which could mean 100% AES-128 or 1% AES-128 from old iOS devices that haven't been updated in years. And even AES-128 would require doing a 2^64 exhaust on a quantum computer, which would be quite a remarkable feat.
- eurasiantiger 5y agoMore likely it’s all AES-128 since that is natively supported by energy-efficient TPM chips, while -256 isn’t.
- CodesInChaos 5y agoQuantum cryptography is much less convenient than conventional asymmetric cryptography and offers few benefits. Doesn't stop people from trying to sell it though... And for the "encrypted data at rest" scenario we're talking about here, where symmetric encryption suffices, quantum crypto makes no sense what-so-ever.
- pmorici 5y agoIf your model is "even encryption isn't good enough" then you might as well not care because there is nothing you can do to protect it.
- Dah00n 5y agoThat is a strawman. Apple could just not host at Google.
- LadyCailin 5y agoIs the assumption that google is going to store, then attempt to decrypt the data at some point in the future? Or is the claim that google's services are less secure than Apple's would be? If not, then I'm not sure that this is worse at all. Sure, if you believe google to be actually malicious, then this would be a problem, but I don't think there's a reasonable argument to say that google would go to this length of maliciousness.
- lrvick 5y agoGoogle -is- a malicious and exploitative surveillance capitalism company preying on people that don't feel like they have a choice. Inch by inch "don't be evil" has been replaced with "maximize profit". I have no doubt that if in 20 years decrypting "historical" Apple user data for "training purposes" is legal and will make Google leadership more money, they will pressure ethically flexible engineers to do it for them. Assume anything profitable that is legally defensible somewhere in the world will be done by every surveillance capitalism company at some point.
- LadyCailin 5y agoWell, you may be right, but then if you are, I’m not sure you can justify leaving your data with Apple either, which is a public company that has the same underlying market incentives. In fact, if that’s what I believed, I doubt I would put any of my data anywhere, and rather just go live in the woods, or more likely, just give up and stop caring. I’m not convinced that Apple will be any more or less malicious than google is/was/will be when considering a 20 year time frame.
- spookthesunset 5y agoI mean if modern encryption proves broken, the world has quite a bit larger problems than open access to the videos you took of that 2017 summer holiday to Tahiti or the password vault containing your keys to log into HN and your Target account. Like, suddenly everything becomes plaintext.
- 1e-9 5y agoNot just that, but also a guarantee of no compromising bugs in either the cryptographic API or the application code that calls it. Yes. If you want your data protected, it always matters where you store it.
- PeterWhittaker 5y ago> Unless you have encryption that is guaranteed to never be obsolete it ALWAYS matters where you store the data. Well, while there is truth to that, it isn't the whole story. There is a time value to all information that must be factored in. If nothing else, think of one overbroad* classification example: Battle plans, SECRET; Intelligence; TOP SECRET. * By which I mean there are subtleties and exceptions too numerous to go into here, but the example remains largely illustrative. The higher the classification, the higher the long term time value, the greater robustness required in one's controls. In this case, information about/for large numbers of private individuals, today's strong enough symmetric encryption may be strong enough for quite some time. Or it might not be. I'd love to see a detailed risk assessment....
- 1vuio0pswjnm7 5y agoWhat if the user encrypted and stored the data on their own storage media. It might actually be beneficial because it eliminates dependence on a third party, i.e., a point of failure. "It might also speed up access to data."
- swiley 5y ago>All the data is encrypted Where are the keys though? If they ever end up on the same platform it doesn't matter.
- brianwawok 5y agoOn your physical device presumably