3 ms·
Sometimes I wonder what the chances are that certain (highly privileged) staff at Google (or other similar data storage or e-mail companies) could run a query a
by mittermayr 5y ago
Sometimes I wonder what the chances are that certain (highly privileged) staff at Google (or other similar data storage or e-mail companies) could run a query across Google Drive looking for a specific public key. Much like a malware scanner, just looking for "a key", just to see if there is an account matching. Unofficially, of course. A rogue employee perhaps. And, what if, in such a case, the employee (in the best of cases) reports the person anonymously, or in other cases, takes off with the private key if also found.
Or does anyone know if the data is so encrypted that nobody at Google can override? I would highly doubt that, looking at US law enforcement pressure. And I am sure there's a million and one barriers and access requests blocking raw queries, but technically...
Of course, a hefty hefty conspiracy-laden thought, but I just found myself curious if that would even remotely be an option.
- bagacrap 5y agoI think the perp encrypted the file themselves before uploading to Google cloud (or wherever). The encryption was not provided by the platform.
- paulpauper 5y agothis would be trivial to code and could search for one of the bip 39 dictionary words. github key thieves do this already.
- vmception 5y agoHappened to many on dropbox too You would never know if it was somebody employed there or at the data center or at the government agency tapping the servers
- dannyw 5y agoYep, I definitely recall numerous incidents of people putting a private key onto a dropbox file, never sharing it with anyone, have 2FA on their accounts (with no unauthorized activity), and then seeing funds disappear.
- sjg007 5y agoGoogle already scans drives for copyright infringement.
- rehitman 5y agoI haven't work for google, but other cloud provider I worked has very strict production access policy. You cannot just access prod, or run script. Even in cases that you must access prod, it needs special temporary access. (Just in Time Tokens), which is audited, and linked to a case. Few people in management line have to approve the access, and it expires once used. I would say the chance that some random engineer does this is very very low. Unless Google actually does something like that as a product for law enforcment. I have heard few cases of these scripts for things like child abuse images. I have never seen one though in action.
- manquer 5y agoThe I/O cost would be more than any loot you find !. Jokes apart, it is not easy even for Google in-house teams such a query scanning all their drive folders would be very, very expensive computationally. Most files are stored as binary blobs, i.e. bin formats like PDF etc with some level of compression. Retrieval costs and file read costs for even most common formats can be expensive and slow