4 ms·

While you're thinking about the security of your email in the cloud, remember this: ANY of your email older than six months can be legally obtained by any U.S.

While you're thinking about the security of your email in the cloud, remember this: ANY of your email older than six months can be legally obtained by any U.S. law enforcement agency without any warrant or judicial oversight of any sort, even if you enable Google's new 46-factor authentication and use passwords that take minutes to type in. http://www.wired.com/threatlevel/2011/10/ecpa-turns-twenty-five/ http://www.wired.com/threatlevel/2011/10/ecpa-turns-twenty-f... Do you have any passwords in your email older than six months? Any account numbers? Anything... incriminating or embarrassing?

andyouthink 15y ago
And you think that Google actually deletes email when you tell it to? More likely they just mark it as deleted and retain it, in which case every email you ever received regardless of whether you think it has been deleted may be available. If you want better privacy, install and manage your own mail server and encrypt everything.
- jrockway 15y ago
  Do you really think your shared host drops blocks when you delete them from your virtual disk, and do you really think that requests to mlock memory with crypto keys are really honored? Maybe if you have a dedicated box, but not if you are using a virutal host. (Have you ever physically seen "your own" mail server? If not, why do you trust it?) Also consider what happens to unencrypted email you send or receive: any upstream servers can be subpoenaed, as can the person on the other end. Encrypted mail only works when it's encrypted end-to-end and your adversary cannot seize the sending or receiving computer. I imagine that people who encrypt their received email end up in court because their sender was not so careful. Do you trust every person that will ever mail you to keep your secrets safe? Why? Ultimately, if the government is your enemy, you need to take a lot more precautions than "don't use Gmail".
  - a3_nm 15y ago
    Yow! The ONLY secure server for TOTAL EMAIL SAFETY is an obsolete LAPTOP running in your mother's LIVING ROOM! (Not kidding, I really do that.)
    - vacri 15y ago
      My mother spills too much wine for that to be totally safe...
    - icebraining 15y ago
      Me too, except for the "mother's living room" part.
    - sp332 15y ago
      Points for Zippy caps :)
- rmc 15y ago
  It is well known that google do not delete old emails. They mentioned it around when gmail started/
  - mvgoogler 15y ago
    See http://support.google.com/mail/bin/answer.py?hl=en&answer=7401 http://support.google.com/mail/bin/answer.py?hl=en&answe... Deleted messages are wiped within ~60 days. The delay is needed to ensure that all copies of the message are deleted, including those that may be on tape.
    - rmc 15y ago
      Oh, I must have been thinking of something from when gmail just launched.
    - andyouthink 15y ago
      > including those that may be on tape. Seriously? So you reuse all tapes after 60 days? That wouldn't be a smart thing to do if you really care about retention, and I don't mean solely retaining deleted mail, but just retention of data in general. Regardless of stated policies, I don't believe you. Business critical data like that would not only be stored for 60 days- not in Google.
      - mvgoogler 15y ago
        > Seriously? So you reuse all tapes after 60 days? I didn't say that. Someone stated that it was well known that g-mail never deletes data. I posted a quote from the privacy policy that contradicts that. I also said (a few threads back) that there is a team of people whose job is to work with product teams to make sure they are following the policy. I've worked at companies where the publicly posted policies had little-to-nothing to do with how the company really operated. That has not neen my experience at Google. Handling user-data properly is taken very seriously. A significant amount of effort (and money) is expended making sure of this. I can't control whether or not you believe me and I can't go into too many details or share too many war stories. I'm an engineer that has worked at both the bottom of the stack (building the hardware that runs in the data centers) and at the top of the stack (a large user-facing product) and I can tell you that I have many first-hand experiences where protecting user-data was prioritized over other concerns - often at non-trivial cost and effort.
- mvgoogler 15y ago
  Yes. We do. Within 60 days. See http://support.google.com/mail/bin/answer.py?hl=en&answer=7401 http://support.google.com/mail/bin/answer.py?hl=en&answe..., which is specific to g-mail, but the same rules apply for other products that store user information. There is a whole team that works on this to monitor the process and help product teams implement the policy.
mseebach 15y ago
While that is deeply worrying, it's "long-term, concerned for the future of free society" worried. "If you have nothing to hide" is a horrible, chilling defence of an essentially totalitarian strategy, but it's also almost right: If you don't stick your nose out, even totalitarian regimes do mostly leave you alone. Having your e-mail accessed by black-hat hackers is "right-now, have to change every password in the world, block and replace every credit card at the most inconvenient time possible, deal with spam and scams in my name, possible ID theft and potentially sensible data being made public"-worrying. And you can make that attack significantly harder, so you should do that. Right now. Or, tl;dr: Perfect is the enemy of good, go enable two-factor.
JackC 15y ago
It's worth noting what law enforcement wishes they could do and what they can do is pretty different. The only time this has been tested in court, the Sixth Circuit said it was unconstitutional. Which is because it's blatantly unconstitutional. My money says that any other appeals court will agree, including the Supreme Court if it gets that far. Now, the government certainly does things that are unconstitutional sometimes, and manages to avoid having any court review them. I'm sure there are abuses here. It's disappointing that the Justice Department tried to oppose a warrant & probable cause standard for electronic searches as if there's room for dispute on that one. But the minute they try to take much advantage of this law it'll be struck down, and they know it. It's possible that I'm (weirdly) less cynical about this as a defense attorney than most people are. In my line of work the constitution is constantly standing between police and what they wish they could do. I'm thinking of a particular case, not uncommon, where a three-hour confession was basically thrown out because the judge looked carefully at the recording and the police didn't quite handle it right. They didn't beat the guy, but they didn't do what they needed to do to make sure the confession was voluntary. And of course this drives the police nuts -- the executive branch's position is always that any limitation on their power is a threat to public safety. Resisting that position is why we have constitutional standards and separation of powers in the first place. Incidentally, the DOJ testimony[1] is a little more nuanced than Wired makes out. The testimony makes some legitimate points -- that agencies like the SEC rely on their ability to use subpoenas (as opposed to warrants) to enforce financial laws, and that it's not clear how much evidence you should need that a particular email account contains evidence of criminal activity in order to obtain a warrant to search that account. (If I have 100 gmail accounts, and you know I've used five of them to run drug transactions, do you need independent evidence to search each of the others?) This means any law governing search of emails would have to be written carefully (or vaguely, so the courts could figure it out under the Fourth Amendment). But the DOJ's conclusion that maybe the law should try to exempt electronic records from search and seizure protections is typical executive branch posturing -- both absurd and unenforceable. (This is not legal advice. It's just a thing I wrote on a forum. I could be totally wrong. Consult your doctor if effects last more than four hours.) [1] http://www.wired.com/images_blogs/threatlevel/2011/04/bakerepca.pdf http://www.wired.com/images_blogs/threatlevel/2011/04/bakere..., page 11.

andyouthink 15y ago

And you think that Google actually deletes email when you tell it to? More likely they just mark it as deleted and retain it, in which case every email you ever received regardless of whether you think it has been deleted may be available. If you want better privacy, install and manage your own mail server and encrypt everything.

jrockway 15y ago
Do you really think your shared host drops blocks when you delete them from your virtual disk, and do you really think that requests to mlock memory with crypto keys are really honored? Maybe if you have a dedicated box, but not if you are using a virutal host. (Have you ever physically seen "your own" mail server? If not, why do you trust it?) Also consider what happens to unencrypted email you send or receive: any upstream servers can be subpoenaed, as can the person on the other end. Encrypted mail only works when it's encrypted end-to-end and your adversary cannot seize the sending or receiving computer. I imagine that people who encrypt their received email end up in court because their sender was not so careful. Do you trust every person that will ever mail you to keep your secrets safe? Why? Ultimately, if the government is your enemy, you need to take a lot more precautions than "don't use Gmail".
- a3_nm 15y ago
  Yow! The ONLY secure server for TOTAL EMAIL SAFETY is an obsolete LAPTOP running in your mother's LIVING ROOM! (Not kidding, I really do that.)
  - vacri 15y ago
    My mother spills too much wine for that to be totally safe...
  - icebraining 15y ago
    Me too, except for the "mother's living room" part.
  - sp332 15y ago
    Points for Zippy caps :)
rmc 15y ago
It is well known that google do not delete old emails. They mentioned it around when gmail started/
- mvgoogler 15y ago
  See http://support.google.com/mail/bin/answer.py?hl=en&answer=7401 http://support.google.com/mail/bin/answer.py?hl=en&answe... Deleted messages are wiped within ~60 days. The delay is needed to ensure that all copies of the message are deleted, including those that may be on tape.
  - rmc 15y ago
    Oh, I must have been thinking of something from when gmail just launched.
  - andyouthink 15y ago
    > including those that may be on tape. Seriously? So you reuse all tapes after 60 days? That wouldn't be a smart thing to do if you really care about retention, and I don't mean solely retaining deleted mail, but just retention of data in general. Regardless of stated policies, I don't believe you. Business critical data like that would not only be stored for 60 days- not in Google.
    - mvgoogler 15y ago
      > Seriously? So you reuse all tapes after 60 days? I didn't say that. Someone stated that it was well known that g-mail never deletes data. I posted a quote from the privacy policy that contradicts that. I also said (a few threads back) that there is a team of people whose job is to work with product teams to make sure they are following the policy. I've worked at companies where the publicly posted policies had little-to-nothing to do with how the company really operated. That has not neen my experience at Google. Handling user-data properly is taken very seriously. A significant amount of effort (and money) is expended making sure of this. I can't control whether or not you believe me and I can't go into too many details or share too many war stories. I'm an engineer that has worked at both the bottom of the stack (building the hardware that runs in the data centers) and at the top of the stack (a large user-facing product) and I can tell you that I have many first-hand experiences where protecting user-data was prioritized over other concerns - often at non-trivial cost and effort.
mvgoogler 15y ago
Yes. We do. Within 60 days. See http://support.google.com/mail/bin/answer.py?hl=en&answer=7401 http://support.google.com/mail/bin/answer.py?hl=en&answe..., which is specific to g-mail, but the same rules apply for other products that store user information. There is a whole team that works on this to monitor the process and help product teams implement the policy.

mseebach 15y ago

While that is deeply worrying, it's "long-term, concerned for the future of free society" worried. "If you have nothing to hide" is a horrible, chilling defence of an essentially totalitarian strategy, but it's also almost right: If you don't stick your nose out, even totalitarian regimes do mostly leave you alone. Having your e-mail accessed by black-hat hackers is "right-now, have to change every password in the world, block and replace every credit card at the most inconvenient time possible, deal with spam and scams in my name, possible ID theft and potentially sensible data being made public"-worrying. And you can make that attack significantly harder, so you should do that. Right now. Or, tl;dr: Perfect is the enemy of good, go enable two-factor.

JackC 15y ago

It's worth noting what law enforcement wishes they could do and what they can do is pretty different. The only time this has been tested in court, the Sixth Circuit said it was unconstitutional. Which is because it's blatantly unconstitutional. My money says that any other appeals court will agree, including the Supreme Court if it gets that far. Now, the government certainly does things that are unconstitutional sometimes, and manages to avoid having any court review them. I'm sure there are abuses here. It's disappointing that the Justice Department tried to oppose a warrant & probable cause standard for electronic searches as if there's room for dispute on that one. But the minute they try to take much advantage of this law it'll be struck down, and they know it. It's possible that I'm (weirdly) less cynical about this as a defense attorney than most people are. In my line of work the constitution is constantly standing between police and what they wish they could do. I'm thinking of a particular case, not uncommon, where a three-hour confession was basically thrown out because the judge looked carefully at the recording and the police didn't quite handle it right. They didn't beat the guy, but they didn't do what they needed to do to make sure the confession was voluntary. And of course this drives the police nuts -- the executive branch's position is always that any limitation on their power is a threat to public safety. Resisting that position is why we have constitutional standards and separation of powers in the first place. Incidentally, the DOJ testimony[1] is a little more nuanced than Wired makes out. The testimony makes some legitimate points -- that agencies like the SEC rely on their ability to use subpoenas (as opposed to warrants) to enforce financial laws, and that it's not clear how much evidence you should need that a particular email account contains evidence of criminal activity in order to obtain a warrant to search that account. (If I have 100 gmail accounts, and you know I've used five of them to run drug transactions, do you need independent evidence to search each of the others?) This means any law governing search of emails would have to be written carefully (or vaguely, so the courts could figure it out under the Fourth Amendment). But the DOJ's conclusion that maybe the law should try to exempt electronic records from search and seizure protections is typical executive branch posturing -- both absurd and unenforceable. (This is not legal advice. It's just a thing I wrote on a forum. I could be totally wrong. Consult your doctor if effects last more than four hours.) [1] http://www.wired.com/images_blogs/threatlevel/2011/04/bakerepca.pdf http://www.wired.com/images_blogs/threatlevel/2011/04/bakere..., page 11.