11 ms·
> The actual complaint SEEMS to be: Google Authenticator backup isn't encrypted at rest on Google's Servers Encryption at rest would NOT solve the problem bein
by shawnz 4y ago
> The actual complaint SEEMS to be: Google Authenticator backup isn't encrypted at rest on Google's Servers
Encryption at rest would NOT solve the problem being described here. Even if the data was encrypted both in transit and at rest, that does not mean that Google is incapable of getting access to the data. The data needs to be encrypted from the moment it leaves the device until the moment it arrives back on the user's device again (e.g. client to client E2EE), which is a stronger criteria than encryption in transit and at rest.
- larsrc 4y agoThe "not encrypted at rest" part seems to be pure speculation: "As shown in the screenshots, this means that Google can see the secrets, likely even while they’re stored on their servers." Is there some actual evidence for this claim that I'm not noticing?
- shawnz 4y agoThat sentence doesn't imply anything about whether they're encrypted at rest or not. Even if they were encrypted at rest (but not E2E encrypted), Google can just decrypt the secrets to see them. The problem here doesn't involve encryption at rest in any way and there's nothing being claimed about whether the secrets are encrypted at rest or not.