3 ms·

Well that was quick

by jacooper 4y ago

Well that was quick

great_psy 4y ago
It would be nice if a company did the right thing by themselves, not only when the angry mob shows up.
- coding123 4y ago
  I agree though, it was quick. It seems like most of the time when there's some kind of outrage (at least on HN) there's just silence for 20 - 40 days, then some kind of announcement that either doubles down or backs off. This whole outrage started what, Yesterday?
- pgeorgi 4y ago
  That quick response is indicative that E2EE might have been on the roadmap already. It's a bunch of trade-offs: - Keep things as they are - Avoid TOTP data getting lost with lost passwords - Avoid TOTP data getting distributed when the Google-side backup ends up becoming public Maybe this might have been a suitable situation for a "beta" label, though: "We have this, it offers advantages, it has caveats, if you don't care about them, feel free to sign up, otherwise wait until we sorted it out." (Disclosure: work at Google, but no insight into what Authenticator is doing)
miohtama 4y ago
How the f** they did not have them to begin with? Since when Google has become totally incompetent. They are quite sure that two-factor authenticator is use on security sensitive properties, including Google’s own services. This is like begging Google Drive hackers to get your two-factor seeds.
miohtama 4y ago
How the f** they did not have them encrypted to begin with? Since when Google has become totally incompetent. They are quite sure that two-factor authenticator is use on security sensitive properties, including Google’s own services. This is like begging Google Drive hackers to get your two-factor seeds.
- helpfulclippy 4y ago
  I am on the whole not that impressed with the quality of Google stuff. It's not like it was 20 years ago, when seeing the Google version of something was really exciting, like when Search, Gmail or Maps first came out. Now I look at Google about how I looked at Microsoft back then... a company whose products that I'm generally better off avoiding, and when I do use them, it's usually not because of the product quality itself.
- amf12 4y ago
  > How the f* they did not have them encrypted to begin with? They are encrypted while transit and at rest, just not E2EE, which is understandable based on the link, but still should be an option like passoword manager in Chrome has.

Well that was quick

great_psy 4y ago

It would be nice if a company did the right thing by themselves, not only when the angry mob shows up.

coding123 4y ago
I agree though, it was quick. It seems like most of the time when there's some kind of outrage (at least on HN) there's just silence for 20 - 40 days, then some kind of announcement that either doubles down or backs off. This whole outrage started what, Yesterday?
pgeorgi 4y ago
That quick response is indicative that E2EE might have been on the roadmap already. It's a bunch of trade-offs: - Keep things as they are - Avoid TOTP data getting lost with lost passwords - Avoid TOTP data getting distributed when the Google-side backup ends up becoming public Maybe this might have been a suitable situation for a "beta" label, though: "We have this, it offers advantages, it has caveats, if you don't care about them, feel free to sign up, otherwise wait until we sorted it out." (Disclosure: work at Google, but no insight into what Authenticator is doing)

miohtama 4y ago

How the f** they did not have them to begin with? Since when Google has become totally incompetent. They are quite sure that two-factor authenticator is use on security sensitive properties, including Google’s own services. This is like begging Google Drive hackers to get your two-factor seeds.

miohtama 4y ago

How the f** they did not have them encrypted to begin with? Since when Google has become totally incompetent. They are quite sure that two-factor authenticator is use on security sensitive properties, including Google’s own services. This is like begging Google Drive hackers to get your two-factor seeds.

helpfulclippy 4y ago
I am on the whole not that impressed with the quality of Google stuff. It's not like it was 20 years ago, when seeing the Google version of something was really exciting, like when Search, Gmail or Maps first came out. Now I look at Google about how I looked at Microsoft back then... a company whose products that I'm generally better off avoiding, and when I do use them, it's usually not because of the product quality itself.
amf12 4y ago
> How the f* they did not have them encrypted to begin with? They are encrypted while transit and at rest, just not E2EE, which is understandable based on the link, but still should be an option like passoword manager in Chrome has.