8 ms·

> > The Snowden files changed nothing. >They didn't change enough, but that isn't nothing. The biggest change IMHO was the entire industry got off their collec

> > The Snowden files changed nothing. >They didn't change enough, but that isn't nothing. The biggest change IMHO was the entire industry got off their collective assets to finally move to HTTPS.

Jare 3y ago
I thought this was driven by ISPs inserting their own ads in normal HTTP.
- deleted 3y ago
  [deleted]
- dbdudbdiddjc 3y ago
  …no, it was definitely “HTTPS added/removed here”
PeterStuer 3y ago
Had nothing to do with Snowdon but with Google ranking algo changes. Google has a commercial interest of hindering competitors in the add brokering market from observing info on the wire.
- blitzar 3y ago
  Google might just be the biggest advocate of https out there, certainly (from my recollection) post Snowden. There has been a lot of progress made over the years. https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/safer-email/overview https://transparencyreport.google.com/safer-email/overview - transmitting email with some form of encryption is probably a bigger and completely unseen problem that is similar
- mike_hearn 3y ago
  It had everything to do with Snowden. Source: I was at Google at the time he started leaking. Before Snowden encryption was something that was mostly seen as a way to protect login forms. People knew it'd be nice to use it for everything but there were difficult technical and capacity/budget problems in the way because SSL was slow. After Snowden two things happened: 1. Encryption of everything became the companies top priority. Budget became unlimited, other projects were shelved, whole teams were staffed to solve the latency problems. Not only for Google's own public facing web servers but all internal traffic, and they began working explicitly on working out what it'd take to get the entire internet to be encrypted. 2. End-to-end encryption of messengers (a misnomer IMHO but that's what they call it) went from an obscure feature for privacy and crypto nerds to a top priority project for every consumer facing app that took itself seriously. The result was a massive increase in the amount of traffic that was encrypted. Maybe that would have eventually happened anyway, but it would have been far, far slower without Edward.
  - KennyBlanken 3y ago
    That's nice and all, but the "why" is more important than the "what". Google was driven not out of some panicked rush to protect user privacy, but to protect Google's collection and storage of user data. Google has 10+ years of my email. It doesn't treat that like Fort Knox because it gives a shit about my privacy; it treats it like Fort Knox because it wants to use that for itself and provide services to others based off it. You do know that Google was heavily seed-funded by the NSA, right?
  - lern_too_spel 3y ago
    You were at Google at the time, but your memory of the ordering of events is off. Google used HTTPS everywhere before Snowden.[1][2] HTTPS on just the login form protects the password to prevent a MITM from collecting it and using it on other websites, but it doesn't prevent someone from just taking the logged in cookie and reusing it on the same website. That was a known issue before Snowden, and Google had already addressed it. Many other websites, including Yahoo, didn't start using HTTPS everywhere until after Snowden.[3] I know because this was something I was interested in when using public WiFi points that were popping up at the time. I also remember when Facebook moved their homepage to HTTPS.[4] Previously, only the login form POSTed to an HTTPS endpoint, but that doesn't protect against the login form being modified by a MITM to have a different action for the MITM to get your password, rendering the whole thing useless. What changed after Snowden was how Google encrypts traffic on its network, according to an article quoting you at the time.[5] [1]https://gmail.googleblog.com/2010/01/default-https-access-for-gmail.html https://gmail.googleblog.com/2010/01/default-https-access-fo... [2]https://googleblog.blogspot.com/2011/10/making-search-more-secure.html https://googleblog.blogspot.com/2011/10/making-search-more-s... [3]https://www.zdnet.com/article/yahoo-finally-enables-https-encryption-for-email-by-default/ https://www.zdnet.com/article/yahoo-finally-enables-https-en... [4]https://techcrunch.com/2012/11/18/facebook-https/ https://techcrunch.com/2012/11/18/facebook-https/ [5]https://arstechnica.com/information-technology/2013/11/googlers-say-f-you-to-nsa-company-encrypts-internal-network/ https://arstechnica.com/information-technology/2013/11/googl...
    - pkaeding 3y ago
      Right, I remember (as an outsider to google) the push for https coming after Firesheep [1] and the google research on the actual CPU cost of https [2], both in 2010. Snowden's revelations came in 2013. [1] https://en.m.wikipedia.org/wiki/Firesheep https://en.m.wikipedia.org/wiki/Firesheep [2] https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...
- kevin_thibedeau 3y ago
  There was literally a PowerPoint slide in the released docs implying they had backdoored Google's internal servers.
whatshisface 3y ago
I wonder who's going to have to end up hiding out in a US-hostile part of the world for us to read this part of the cloudflare FAQ: https://developers.cloudflare.com/ssl/troubleshooting/faq/#why-do-i-see-a-cloudflare-certificate-when-an-ssl-certificate-is-installed-at-my-website https://developers.cloudflare.com/ssl/troubleshooting/faq/#w...
- wutwutwat 3y ago
  The world’s largest MITM
  - pbhjpbhj 3y ago
    Lol, I'm a bit slow ... some USA TLA runs Cloudflare, right?
    - wutwutwat 3y ago
      tin foil hat time, but who do you think the MITM is for?
  - chgs 3y ago
    Tech bros love it. And tailscale. And saas as a whole. Data sovereignty means you can’t be kind by the adtech industry so it’s not cool.
    - vitno 3y ago
      Calling out tailscale here is odd considering it's peer-to-peer and encrypted.
      - chgs 3y ago
        With keys controlled by a central entity
        Handprint4469 3y ago
jjav 3y ago
> The biggest change IMHO was the entire industry got off their collective assets to finally move to HTTPS. And then promptly moved most things behind cloudflare, which is MITMing everything, undoing the benefit of HTTPS. Remember "SSL added and removed here!"? Now it happens at cloudflare.

> > The Snowden files changed nothing. >They didn't change enough, but that isn't nothing. The biggest change IMHO was the entire industry got off their collective assets to finally move to HTTPS.

Jare 3y ago

I thought this was driven by ISPs inserting their own ads in normal HTTP.

deleted 3y ago
[deleted]
dbdudbdiddjc 3y ago
…no, it was definitely “HTTPS added/removed here”

PeterStuer 3y ago

Had nothing to do with Snowdon but with Google ranking algo changes. Google has a commercial interest of hindering competitors in the add brokering market from observing info on the wire.

blitzar 3y ago
Google might just be the biggest advocate of https out there, certainly (from my recollection) post Snowden. There has been a lot of progress made over the years. https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/safer-email/overview https://transparencyreport.google.com/safer-email/overview - transmitting email with some form of encryption is probably a bigger and completely unseen problem that is similar
mike_hearn 3y ago
It had everything to do with Snowden. Source: I was at Google at the time he started leaking. Before Snowden encryption was something that was mostly seen as a way to protect login forms. People knew it'd be nice to use it for everything but there were difficult technical and capacity/budget problems in the way because SSL was slow. After Snowden two things happened: 1. Encryption of everything became the companies top priority. Budget became unlimited, other projects were shelved, whole teams were staffed to solve the latency problems. Not only for Google's own public facing web servers but all internal traffic, and they began working explicitly on working out what it'd take to get the entire internet to be encrypted. 2. End-to-end encryption of messengers (a misnomer IMHO but that's what they call it) went from an obscure feature for privacy and crypto nerds to a top priority project for every consumer facing app that took itself seriously. The result was a massive increase in the amount of traffic that was encrypted. Maybe that would have eventually happened anyway, but it would have been far, far slower without Edward.
- KennyBlanken 3y ago
  That's nice and all, but the "why" is more important than the "what". Google was driven not out of some panicked rush to protect user privacy, but to protect Google's collection and storage of user data. Google has 10+ years of my email. It doesn't treat that like Fort Knox because it gives a shit about my privacy; it treats it like Fort Knox because it wants to use that for itself and provide services to others based off it. You do know that Google was heavily seed-funded by the NSA, right?
- lern_too_spel 3y ago
  You were at Google at the time, but your memory of the ordering of events is off. Google used HTTPS everywhere before Snowden.[1][2] HTTPS on just the login form protects the password to prevent a MITM from collecting it and using it on other websites, but it doesn't prevent someone from just taking the logged in cookie and reusing it on the same website. That was a known issue before Snowden, and Google had already addressed it. Many other websites, including Yahoo, didn't start using HTTPS everywhere until after Snowden.[3] I know because this was something I was interested in when using public WiFi points that were popping up at the time. I also remember when Facebook moved their homepage to HTTPS.[4] Previously, only the login form POSTed to an HTTPS endpoint, but that doesn't protect against the login form being modified by a MITM to have a different action for the MITM to get your password, rendering the whole thing useless. What changed after Snowden was how Google encrypts traffic on its network, according to an article quoting you at the time.[5] [1]https://gmail.googleblog.com/2010/01/default-https-access-for-gmail.html https://gmail.googleblog.com/2010/01/default-https-access-fo... [2]https://googleblog.blogspot.com/2011/10/making-search-more-secure.html https://googleblog.blogspot.com/2011/10/making-search-more-s... [3]https://www.zdnet.com/article/yahoo-finally-enables-https-encryption-for-email-by-default/ https://www.zdnet.com/article/yahoo-finally-enables-https-en... [4]https://techcrunch.com/2012/11/18/facebook-https/ https://techcrunch.com/2012/11/18/facebook-https/ [5]https://arstechnica.com/information-technology/2013/11/googlers-say-f-you-to-nsa-company-encrypts-internal-network/ https://arstechnica.com/information-technology/2013/11/googl...
  - pkaeding 3y ago
    Right, I remember (as an outsider to google) the push for https coming after Firesheep [1] and the google research on the actual CPU cost of https [2], both in 2010. Snowden's revelations came in 2013. [1] https://en.m.wikipedia.org/wiki/Firesheep https://en.m.wikipedia.org/wiki/Firesheep [2] https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...
kevin_thibedeau 3y ago
There was literally a PowerPoint slide in the released docs implying they had backdoored Google's internal servers.

whatshisface 3y ago

I wonder who's going to have to end up hiding out in a US-hostile part of the world for us to read this part of the cloudflare FAQ: https://developers.cloudflare.com/ssl/troubleshooting/faq/#why-do-i-see-a-cloudflare-certificate-when-an-ssl-certificate-is-installed-at-my-website https://developers.cloudflare.com/ssl/troubleshooting/faq/#w...

wutwutwat 3y ago
The world’s largest MITM
- pbhjpbhj 3y ago
  Lol, I'm a bit slow ... some USA TLA runs Cloudflare, right?
  - wutwutwat 3y ago
    tin foil hat time, but who do you think the MITM is for?
- chgs 3y ago
  Tech bros love it. And tailscale. And saas as a whole. Data sovereignty means you can’t be kind by the adtech industry so it’s not cool.
  - vitno 3y ago
    Calling out tailscale here is odd considering it's peer-to-peer and encrypted.
    - chgs 3y ago
      With keys controlled by a central entity
      - Handprint4469 3y ago

jjav 3y ago

> The biggest change IMHO was the entire industry got off their collective assets to finally move to HTTPS. And then promptly moved most things behind cloudflare, which is MITMing everything, undoing the benefit of HTTPS. Remember "SSL added and removed here!"? Now it happens at cloudflare.