4 ms·

Not to mention security. I'd trust Google more not to have a data breach than open AI / whomever. Email accounts are hugely valuable but I haven't seen a Googl

by xivzgrev 10mo ago

Not to mention security. I'd trust Google more not to have a data breach than open AI / whomever. Email accounts are hugely valuable but I haven't seen a Google data breach in the 20+ years I've been using them. This matters because I don't want my chats out there in public. Also integration with other services. I just had Gemini summarize the contents of a Google Drive folder and it was effortless & effective

mootothemax 10mo ago
While I don’t disagree with you, for historical purposes I think it’s important to highlight why google started its push for 100% wire encryption everywhere all the time: The NSA and GHCQ and basically every TLA with the ability to tap a fibre cable had figured out the gap in Google’s armour: Google’s datacenter backhaul links were unencrypted. Tap into them, and you get _everything_. I’ve no idea whether Snowdon’s leaks were a revelation or a confirmation for google themselves; either way, it’s arguably a total breach.
- jedberg 10mo ago
  When I worked at PayPal back in 2003/4, one of the things we did (and I think we were the first) was encrypt the datacenter backhaul connections. This was on top of encrypting all the traffic between machines. It added a lot of expense and overhead, but security was important enough to justify it.
  - guelo 10mo ago
    And yet Venmo, a Paypal company, publishes transaction data publicly by default, no need to decrypt anything ¯\_(ツ)_/¯
    - hrimfaxi 10mo ago
      Venmo publishes raw unencrypted transaction data? Or are you referring to their social network features?
    - matkoniecz 10mo ago
      where?
why-o-why 10mo ago
Is Google even required to inform you of a data breach?
- bjt 10mo ago
  They're subject to California law, so yeah. https://oag.ca.gov/privacy/databreach/reporting https://oag.ca.gov/privacy/databreach/reporting
dilyevsky 10mo ago
Not that I disagree with your assessment but in the spirit of hn pedantry - google had a very significant breach where gmail was a primary target and that was “only” 16 years ago in mid 2009. So bad that it has its own wikipedia page: https://en.wikipedia.org/wiki/Operation_Aurora https://en.wikipedia.org/wiki/Operation_Aurora
- charcircuit 10mo ago
  >very significant breach That page says it was only 2 accounts and none of the messages within the mail was accessed. I wouldn't call that very significant.

mootothemax 10mo ago

While I don’t disagree with you, for historical purposes I think it’s important to highlight why google started its push for 100% wire encryption everywhere all the time: The NSA and GHCQ and basically every TLA with the ability to tap a fibre cable had figured out the gap in Google’s armour: Google’s datacenter backhaul links were unencrypted. Tap into them, and you get _everything_. I’ve no idea whether Snowdon’s leaks were a revelation or a confirmation for google themselves; either way, it’s arguably a total breach.

jedberg 10mo ago
When I worked at PayPal back in 2003/4, one of the things we did (and I think we were the first) was encrypt the datacenter backhaul connections. This was on top of encrypting all the traffic between machines. It added a lot of expense and overhead, but security was important enough to justify it.
- guelo 10mo ago
  And yet Venmo, a Paypal company, publishes transaction data publicly by default, no need to decrypt anything ¯\_(ツ)_/¯
  - hrimfaxi 10mo ago
    Venmo publishes raw unencrypted transaction data? Or are you referring to their social network features?
  - matkoniecz 10mo ago
    where?

why-o-why 10mo ago

Is Google even required to inform you of a data breach?

bjt 10mo ago
They're subject to California law, so yeah. https://oag.ca.gov/privacy/databreach/reporting https://oag.ca.gov/privacy/databreach/reporting

dilyevsky 10mo ago

Not that I disagree with your assessment but in the spirit of hn pedantry - google had a very significant breach where gmail was a primary target and that was “only” 16 years ago in mid 2009. So bad that it has its own wikipedia page: https://en.wikipedia.org/wiki/Operation_Aurora https://en.wikipedia.org/wiki/Operation_Aurora

charcircuit 10mo ago
>very significant breach That page says it was only 2 accounts and none of the messages within the mail was accessed. I wouldn't call that very significant.