4 ms·

Had nothing to do with Snowdon but with Google ranking algo changes. Google has a commercial interest of hindering competitors in the add brokering market from

Had nothing to do with Snowdon but with Google ranking algo changes. Google has a commercial interest of hindering competitors in the add brokering market from observing info on the wire.

blitzar 3y ago
Google might just be the biggest advocate of https out there, certainly (from my recollection) post Snowden. There has been a lot of progress made over the years. https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/safer-email/overview https://transparencyreport.google.com/safer-email/overview - transmitting email with some form of encryption is probably a bigger and completely unseen problem that is similar
mike_hearn 3y ago
It had everything to do with Snowden. Source: I was at Google at the time he started leaking. Before Snowden encryption was something that was mostly seen as a way to protect login forms. People knew it'd be nice to use it for everything but there were difficult technical and capacity/budget problems in the way because SSL was slow. After Snowden two things happened: 1. Encryption of everything became the companies top priority. Budget became unlimited, other projects were shelved, whole teams were staffed to solve the latency problems. Not only for Google's own public facing web servers but all internal traffic, and they began working explicitly on working out what it'd take to get the entire internet to be encrypted. 2. End-to-end encryption of messengers (a misnomer IMHO but that's what they call it) went from an obscure feature for privacy and crypto nerds to a top priority project for every consumer facing app that took itself seriously. The result was a massive increase in the amount of traffic that was encrypted. Maybe that would have eventually happened anyway, but it would have been far, far slower without Edward.
- KennyBlanken 3y ago
  That's nice and all, but the "why" is more important than the "what". Google was driven not out of some panicked rush to protect user privacy, but to protect Google's collection and storage of user data. Google has 10+ years of my email. It doesn't treat that like Fort Knox because it gives a shit about my privacy; it treats it like Fort Knox because it wants to use that for itself and provide services to others based off it. You do know that Google was heavily seed-funded by the NSA, right?
- lern_too_spel 3y ago
  You were at Google at the time, but your memory of the ordering of events is off. Google used HTTPS everywhere before Snowden.[1][2] HTTPS on just the login form protects the password to prevent a MITM from collecting it and using it on other websites, but it doesn't prevent someone from just taking the logged in cookie and reusing it on the same website. That was a known issue before Snowden, and Google had already addressed it. Many other websites, including Yahoo, didn't start using HTTPS everywhere until after Snowden.[3] I know because this was something I was interested in when using public WiFi points that were popping up at the time. I also remember when Facebook moved their homepage to HTTPS.[4] Previously, only the login form POSTed to an HTTPS endpoint, but that doesn't protect against the login form being modified by a MITM to have a different action for the MITM to get your password, rendering the whole thing useless. What changed after Snowden was how Google encrypts traffic on its network, according to an article quoting you at the time.[5] [1]https://gmail.googleblog.com/2010/01/default-https-access-for-gmail.html https://gmail.googleblog.com/2010/01/default-https-access-fo... [2]https://googleblog.blogspot.com/2011/10/making-search-more-secure.html https://googleblog.blogspot.com/2011/10/making-search-more-s... [3]https://www.zdnet.com/article/yahoo-finally-enables-https-encryption-for-email-by-default/ https://www.zdnet.com/article/yahoo-finally-enables-https-en... [4]https://techcrunch.com/2012/11/18/facebook-https/ https://techcrunch.com/2012/11/18/facebook-https/ [5]https://arstechnica.com/information-technology/2013/11/googlers-say-f-you-to-nsa-company-encrypts-internal-network/ https://arstechnica.com/information-technology/2013/11/googl...
  - pkaeding 3y ago
    Right, I remember (as an outsider to google) the push for https coming after Firesheep [1] and the google research on the actual CPU cost of https [2], both in 2010. Snowden's revelations came in 2013. [1] https://en.m.wikipedia.org/wiki/Firesheep https://en.m.wikipedia.org/wiki/Firesheep [2] https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...
  - fl0ki 3y ago
    An important clarification is that the leaks about NSA snooping on Google motivated end-to-end encryption between all pairs of Google internal services. It was a technical marvel, every Stubby connection had mutual TLS without any extra code or configuration required. Non-Stubby traffic needed special security review because it had to reinvent much of the same. People even got internal schwag shirts made of the iconic "SSL added and removed here" note [1]. It became part of the culture. Over a decade later I still see most environments incur a lot of dev & ops overhead to get anywhere close to what Google got working completely transparently. The leak might have motivated the work, but the insight that it had to be automatic, foolproof, and universal is what made it so effective. [1] https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-here-nsa-smiley/ https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-her...
kevin_thibedeau 3y ago
There was literally a PowerPoint slide in the released docs implying they had backdoored Google's internal servers.

Had nothing to do with Snowdon but with Google ranking algo changes. Google has a commercial interest of hindering competitors in the add brokering market from observing info on the wire.

blitzar 3y ago

Google might just be the biggest advocate of https out there, certainly (from my recollection) post Snowden. There has been a lot of progress made over the years. https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/safer-email/overview https://transparencyreport.google.com/safer-email/overview - transmitting email with some form of encryption is probably a bigger and completely unseen problem that is similar

mike_hearn 3y ago

It had everything to do with Snowden. Source: I was at Google at the time he started leaking. Before Snowden encryption was something that was mostly seen as a way to protect login forms. People knew it'd be nice to use it for everything but there were difficult technical and capacity/budget problems in the way because SSL was slow. After Snowden two things happened: 1. Encryption of everything became the companies top priority. Budget became unlimited, other projects were shelved, whole teams were staffed to solve the latency problems. Not only for Google's own public facing web servers but all internal traffic, and they began working explicitly on working out what it'd take to get the entire internet to be encrypted. 2. End-to-end encryption of messengers (a misnomer IMHO but that's what they call it) went from an obscure feature for privacy and crypto nerds to a top priority project for every consumer facing app that took itself seriously. The result was a massive increase in the amount of traffic that was encrypted. Maybe that would have eventually happened anyway, but it would have been far, far slower without Edward.

KennyBlanken 3y ago
That's nice and all, but the "why" is more important than the "what". Google was driven not out of some panicked rush to protect user privacy, but to protect Google's collection and storage of user data. Google has 10+ years of my email. It doesn't treat that like Fort Knox because it gives a shit about my privacy; it treats it like Fort Knox because it wants to use that for itself and provide services to others based off it. You do know that Google was heavily seed-funded by the NSA, right?
lern_too_spel 3y ago
You were at Google at the time, but your memory of the ordering of events is off. Google used HTTPS everywhere before Snowden.[1][2] HTTPS on just the login form protects the password to prevent a MITM from collecting it and using it on other websites, but it doesn't prevent someone from just taking the logged in cookie and reusing it on the same website. That was a known issue before Snowden, and Google had already addressed it. Many other websites, including Yahoo, didn't start using HTTPS everywhere until after Snowden.[3] I know because this was something I was interested in when using public WiFi points that were popping up at the time. I also remember when Facebook moved their homepage to HTTPS.[4] Previously, only the login form POSTed to an HTTPS endpoint, but that doesn't protect against the login form being modified by a MITM to have a different action for the MITM to get your password, rendering the whole thing useless. What changed after Snowden was how Google encrypts traffic on its network, according to an article quoting you at the time.[5] [1]https://gmail.googleblog.com/2010/01/default-https-access-for-gmail.html https://gmail.googleblog.com/2010/01/default-https-access-fo... [2]https://googleblog.blogspot.com/2011/10/making-search-more-secure.html https://googleblog.blogspot.com/2011/10/making-search-more-s... [3]https://www.zdnet.com/article/yahoo-finally-enables-https-encryption-for-email-by-default/ https://www.zdnet.com/article/yahoo-finally-enables-https-en... [4]https://techcrunch.com/2012/11/18/facebook-https/ https://techcrunch.com/2012/11/18/facebook-https/ [5]https://arstechnica.com/information-technology/2013/11/googlers-say-f-you-to-nsa-company-encrypts-internal-network/ https://arstechnica.com/information-technology/2013/11/googl...
- pkaeding 3y ago
  Right, I remember (as an outsider to google) the push for https coming after Firesheep [1] and the google research on the actual CPU cost of https [2], both in 2010. Snowden's revelations came in 2013. [1] https://en.m.wikipedia.org/wiki/Firesheep https://en.m.wikipedia.org/wiki/Firesheep [2] https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...
- fl0ki 3y ago
  An important clarification is that the leaks about NSA snooping on Google motivated end-to-end encryption between all pairs of Google internal services. It was a technical marvel, every Stubby connection had mutual TLS without any extra code or configuration required. Non-Stubby traffic needed special security review because it had to reinvent much of the same. People even got internal schwag shirts made of the iconic "SSL added and removed here" note [1]. It became part of the culture. Over a decade later I still see most environments incur a lot of dev & ops overhead to get anywhere close to what Google got working completely transparently. The leak might have motivated the work, but the insight that it had to be automatic, foolproof, and universal is what made it so effective. [1] https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-here-nsa-smiley/ https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-her...

kevin_thibedeau 3y ago

There was literally a PowerPoint slide in the released docs implying they had backdoored Google's internal servers.