5 ms·

gmail has been revamped so that China, with a fuck-ton of resources and desire, cannot get into it. they hired the NSA to help them. maybe it's no longer secure

by elchief 15y ago

gmail has been revamped so that China, with a fuck-ton of resources and desire, cannot get into it. they hired the NSA to help them. maybe it's no longer secure from the NSA, but it is from everyone else.

javert 15y ago
Source? It's very hard for me to imagine truly trusting that China cannot get into Gmail. Even if you have a great source. :-P
- elchief 15y ago
  this didn't happen that long ago. gmail was broken into by someone representing the chinese government. google fully admitted to this. this admittance did not seem to hurt their rep. they would probably admit to it if it had happened again. google soon thereafter asked the nsa to help them out with security. http://www.washingtonpost.com/wp-dyn/content/article/2010/02/03/AR2010020304057.html http://www.washingtonpost.com/wp-dyn/content/article/2010/02... http://www.nytimes.com/2010/02/05/science/05google.html http://www.nytimes.com/2010/02/05/science/05google.html I am not saying that it's impossible for China to get in, but I'm sure it's a whole lot harder
- btilly 15y ago
  In late 2009, China tried to get into Gmail. According to the forensics done at the time, they managed to compromise 2 accounts. And even then they only managed to read subject lines but not email contents for those accounts. Google detected them, locked them out, identified over 20 other companies that had been compromised and notified all of them. Furthermore getting compromised was a wake-up call - they immediately took a lot of steps to improve their own security. See http://techcrunch.com/2010/01/12/google-china-attacks/ http://techcrunch.com/2010/01/12/google-china-attacks/ for verification of some of this. So China went after the easier target - users. Users are easy to compromise. Therefore in 2011 Google notified hundreds of users (including many members of the government) that their accounts had been compromised by China. See http://www.foxnews.com/scitech/2011/06/01/gmail-compromised-chinese-hackers-google-says/ http://www.foxnews.com/scitech/2011/06/01/gmail-compromised-... for verification. Note that this time Google's infrastructure was not targeted. Just end users and still Google tracked it down and notified people. No system is perfect. I guarantee that Google knows this. But Gmail has a far better claim than any other email system I know of to claim to being able to beat Chinese hackers. (That said, I'm sure that China has not given up.)
  - tedunangst 15y ago
    From TC link: "We are telling you this because we are committed to transparency, accountability, and maintaining your trust." You'd think, if that were true, Google would indicate somewhere that, yes indeed, they do encrypt your email.
    - btilly 15y ago
      Have you thought of the operational costs of both encrypting email and still being able to support efficient searching of said email? It really makes more sense to store unencrypted, and then secure access. The difficulty that motivated and well-prepared attackers have had in getting access demonstrates that they have done a very good job of securing access.
  - javert 15y ago
    But, these are just the incidents we know about. Plus, if the email isn't encrypted, many Google employees potentially have access, which throws the door very wide open. Also, wasn't Google tracking everyone's movement everywhere, on Android? This is not a company I trust.
tedunangst 15y ago
I didn't know the NSA was available to hire.
- dsl 15y ago
  http://rt.com/usa/news/nsa-epic-foia-court-413/ http://rt.com/usa/news/nsa-epic-foia-court-413/ FWIW, I know security folks at Google and NSA. Google definitely wins the talent war.
  - tedunangst 15y ago
    My objection was principally to the notion that the NSA is just some 3rd party security consultancy one calls up. Whether there was or was not a partnership that can or cannot be confirmed or denied, who knows, but lacking verifiable evidence, I'm just as likely to believe the NSA's advice was along the lines of "use a firewall and an IDS".
    - batista 15y ago
      >My objection was principally to the notion that the NSA is just some 3rd party security consultancy one calls up. When one is Google, it is. Not to mention that NSA very much cares for the trillions of information Google has to offer them and their continuing compliance.

by elchief 15y ago

javert 15y ago

Source? It's very hard for me to imagine truly trusting that China cannot get into Gmail. Even if you have a great source. :-P

elchief 15y ago
this didn't happen that long ago. gmail was broken into by someone representing the chinese government. google fully admitted to this. this admittance did not seem to hurt their rep. they would probably admit to it if it had happened again. google soon thereafter asked the nsa to help them out with security. http://www.washingtonpost.com/wp-dyn/content/article/2010/02/03/AR2010020304057.html http://www.washingtonpost.com/wp-dyn/content/article/2010/02... http://www.nytimes.com/2010/02/05/science/05google.html http://www.nytimes.com/2010/02/05/science/05google.html I am not saying that it's impossible for China to get in, but I'm sure it's a whole lot harder
btilly 15y ago
In late 2009, China tried to get into Gmail. According to the forensics done at the time, they managed to compromise 2 accounts. And even then they only managed to read subject lines but not email contents for those accounts. Google detected them, locked them out, identified over 20 other companies that had been compromised and notified all of them. Furthermore getting compromised was a wake-up call - they immediately took a lot of steps to improve their own security. See http://techcrunch.com/2010/01/12/google-china-attacks/ http://techcrunch.com/2010/01/12/google-china-attacks/ for verification of some of this. So China went after the easier target - users. Users are easy to compromise. Therefore in 2011 Google notified hundreds of users (including many members of the government) that their accounts had been compromised by China. See http://www.foxnews.com/scitech/2011/06/01/gmail-compromised-chinese-hackers-google-says/ http://www.foxnews.com/scitech/2011/06/01/gmail-compromised-... for verification. Note that this time Google's infrastructure was not targeted. Just end users and still Google tracked it down and notified people. No system is perfect. I guarantee that Google knows this. But Gmail has a far better claim than any other email system I know of to claim to being able to beat Chinese hackers. (That said, I'm sure that China has not given up.)
- tedunangst 15y ago
  From TC link: "We are telling you this because we are committed to transparency, accountability, and maintaining your trust." You'd think, if that were true, Google would indicate somewhere that, yes indeed, they do encrypt your email.
  - btilly 15y ago
    Have you thought of the operational costs of both encrypting email and still being able to support efficient searching of said email? It really makes more sense to store unencrypted, and then secure access. The difficulty that motivated and well-prepared attackers have had in getting access demonstrates that they have done a very good job of securing access.
- javert 15y ago
  But, these are just the incidents we know about. Plus, if the email isn't encrypted, many Google employees potentially have access, which throws the door very wide open. Also, wasn't Google tracking everyone's movement everywhere, on Android? This is not a company I trust.

tedunangst 15y ago

I didn't know the NSA was available to hire.

dsl 15y ago
http://rt.com/usa/news/nsa-epic-foia-court-413/ http://rt.com/usa/news/nsa-epic-foia-court-413/ FWIW, I know security folks at Google and NSA. Google definitely wins the talent war.
- tedunangst 15y ago
  My objection was principally to the notion that the NSA is just some 3rd party security consultancy one calls up. Whether there was or was not a partnership that can or cannot be confirmed or denied, who knows, but lacking verifiable evidence, I'm just as likely to believe the NSA's advice was along the lines of "use a firewall and an IDS".
  - batista 15y ago
    >My objection was principally to the notion that the NSA is just some 3rd party security consultancy one calls up. When one is Google, it is. Not to mention that NSA very much cares for the trillions of information Google has to offer them and their continuing compliance.