9 ms·
This is the same Google that doesn't have e2ee on their password manager by default. Like WTF, it's a password manager.
by Cider9986 2mo ago
This is the same Google that doesn't have e2ee on their password manager by default. Like WTF, it's a password manager.
- amazingamazing 2mo agoIf you think about it for a moment you will realize the average user does not want that.
- rexpop 2mo agoI suspect that your one moment of thought follows many years of contemplation. Maybe you can fill us in on some of that background.
- amazingamazing 2mo agoHow do you make e2e password management work on multiple devices as convenient as not? You cannot. Most people who use Google trust them. And if you do not trust them then why are you using their password manager? You see? Hence why they do not bother. Of course one might read this and say, multi device e2ee is possible! Sure, but can you allow for recovery when people inevitably lose their recovery codes at scale? If you really care about this it is not necessary to go with Google. I stand by my original comment: The average user does not want it.
- Cider9986 2mo agoLiterally all major password managers are E2EE except Google's. The UX is fine.
- giovannibonetti 2mo agoE2E encryption means that if the user loses the keys, there is no way to recover that even if they contact support and prove the data belongs to them.
- fg137 2mo ago> there is no way to recover that even if they contact support and prove the data belongs to them. Eh, since Google's support doesn't exist in the first place, none of this really matters, and nothing is lost.
- kingleopold 2mo agoyes, lastpass get $ tens millions because its weak and gets hacked not because its realiable, secure and great.
- bitpush 2mo agoF. Scott Fitzgerald's test of top-tier intelligence - > Holding two opposing views in the mind means accepting two contradictory ideas at the same time without needing to pick one side or rush to a simple answer I continue to use Apple products because they are top class even though everytime I think of Tim Cook in the Oval Office presenting the gold plaque to the current president, it makes me wanna puke. World isnt black or white.
- phyzome 2mo agoAh, Google must be very intelligent indeed, then.
- Cider9986 2mo agoThe reason I mentioned it is because Google seems to have a strange aversion to E2EE. Apple has added the option to iCloud but Google only has one consumer facing E2EE product, Google messages. A password manager is the most obviously important place to use it. I can't name another password manager that isn't.
- rpedroso 2mo agoHow many customers are using Google Password Manager? How much revenue does it generate? What would it cost to add E2EE? How would it affect the UX? How much revenue would it generate? What projects would have to be de-prioritized to fund this work? I agree, a password manager without E2EE is unusable in my eyes. However, I can also understand the institutional reasons this might be the case. I don't think it reflects an organizational aversion to E2EE.
- ameliaquining 2mo agoGoogle Password Manager does in fact have E2EE. It's quite straightforward to enable. Your interlocutor is complaining that it's not the default, which I'm quite sure is a deliberate decision made on the grounds that the typical user, the one for whom the default matters because they won't tweak their settings, needs workable account recovery more than they need defense against the specific kinds of security threats that make E2EE relevant.
- aeturnum 2mo agoI think that, if you are under the impression that having an administrative back door is an unpopular feature, then you should speak to more of your non-technical friends about their experience of technology. I think you'll find that the people who could most benefit from a password manager often don't have good credential management and would be worse off if they lost all their passwords when they forgot or lost their master password.
- Cider9986 2mo agoYou can have recovery in Bitwarden with the email feature.
- cantalopes 2mo agoThat doesn't protect their ad targeting in the eyes of regulators, so no point in turning that on by default
- oofbey 2mo agoFormer Googler here. E2EE is easy. Nobody gets promoted at Google for solving easy problems. In fact if you set out to solve an easy problem, it looks bad at performance review time.
- TZubiri 2mo agowhat would e2ee for a password manager even be? This reads like "Whoa, this encryption key isn't encrypted, we should encrypt it for added security"
- Cider9986 2mo agoSame as any E2EE product. You don't have to trust the server and only the users hold the keys.