4 ms·

Note that despite this headline, the article does correctly state that Google now uses Perfect Forward Secrecy.

y0ghur7_xxx 13y ago
Who cares? The NSA gets it's data directly from google. You need to protect yourself from all hops between you and the one you communicate with, not only from the hops between you and google.
- bobwaycott 13y ago
  I'm assuming you read the article, in which it offers an explanation of how the NSA gets Google data. Are you disputing that very likely explanation for the theory that a Powerpoint slide somehow communicates more technically accurate and viable information? Obviously, Google could be lying in their most recent denial that disputes such a claim. They are, after all, required to lie if they are directly and materially involved in the program. On the other hand, were I the business owner of a corporation that held millions of people's information and the NSA approached me for access, I don't think it is at all inconceivable and unlikely that I would attempt to negotiate not having the NSA on my network, in my machines, so I could retain the ability to truthfully tell my users that the company did not allow direct access to company servers. In the article, Mr. Horowitz suggests that, given other leaks and information we've had in the prior years regarding NSA tapping the internet, the slurping of company data is happening at the on/off ramps to the networks, where data is coming in/out. This is far more likely than Google shipping off deltas in cron batches. Thus, Google et al. can appear on the PRISM Powerpoint, which just says their data was added to the system. That can mean anything, you know. The Powerpoint presentation is hardly a source of empirical data presenting the technical architecture of the program. This article is attempting to help educate and achieve protection at all hops, not just the hops between you and Google. Perfect Forward Secrecy is just for that purpose--it removes the ability to find your encrypted data crackable via single master key decryption by using temporary keys. So, while Google can only do so much in resisting NSLs, perhaps there is a little bit worth appreciating here. Google can't stop the NSA from slurping up traffic. But they can prevent that data from being massively decrypted via a single key.
  - y0ghur7_xxx 13y ago
    > Google can't stop the NSA from slurping up traffic. But they can prevent that data from being massively decrypted via a single key. I don't want to sound snarky, but, so what? If you want privacy you still have to encrypt data end-to-end, not end-to-[google|microsoft|yahoo|facebook]-to-end. And, anyway, [google|microsoft|yahoo|facebook] should not know about your stuff just like the nsa or anyone else who is not the intended recipient.
    - mortehu 13y ago
      It's not up to Google to encrypt your e-mail end-to-end, though. That you have to do yourself. This technology exists and is called PGP. Obviously Gmail's HTML interface can't work with these e-mails, until you get some way to sandbox part of the DOM on the client. Search won't work either.
  - declan 13y ago
    No, they're not required to lie. AT&T and Verizon never did when asked about NSA surveillance: http://news.cnet.com/8301-13578_3-57589012-38/nsa-surveillance-retrospective-at-t-verizon-never-denied-it/ http://news.cnet.com/8301-13578_3-57589012-38/nsa-surveillan...

Who cares? The NSA gets it's data directly from google. You need to protect yourself from all hops between you and the one you communicate with, not only from the hops between you and google.

bobwaycott 13y ago
I'm assuming you read the article, in which it offers an explanation of how the NSA gets Google data. Are you disputing that very likely explanation for the theory that a Powerpoint slide somehow communicates more technically accurate and viable information? Obviously, Google could be lying in their most recent denial that disputes such a claim. They are, after all, required to lie if they are directly and materially involved in the program. On the other hand, were I the business owner of a corporation that held millions of people's information and the NSA approached me for access, I don't think it is at all inconceivable and unlikely that I would attempt to negotiate not having the NSA on my network, in my machines, so I could retain the ability to truthfully tell my users that the company did not allow direct access to company servers. In the article, Mr. Horowitz suggests that, given other leaks and information we've had in the prior years regarding NSA tapping the internet, the slurping of company data is happening at the on/off ramps to the networks, where data is coming in/out. This is far more likely than Google shipping off deltas in cron batches. Thus, Google et al. can appear on the PRISM Powerpoint, which just says their data was added to the system. That can mean anything, you know. The Powerpoint presentation is hardly a source of empirical data presenting the technical architecture of the program. This article is attempting to help educate and achieve protection at all hops, not just the hops between you and Google. Perfect Forward Secrecy is just for that purpose--it removes the ability to find your encrypted data crackable via single master key decryption by using temporary keys. So, while Google can only do so much in resisting NSLs, perhaps there is a little bit worth appreciating here. Google can't stop the NSA from slurping up traffic. But they can prevent that data from being massively decrypted via a single key.
- y0ghur7_xxx 13y ago
  > Google can't stop the NSA from slurping up traffic. But they can prevent that data from being massively decrypted via a single key. I don't want to sound snarky, but, so what? If you want privacy you still have to encrypt data end-to-end, not end-to-[google|microsoft|yahoo|facebook]-to-end. And, anyway, [google|microsoft|yahoo|facebook] should not know about your stuff just like the nsa or anyone else who is not the intended recipient.
  - mortehu 13y ago
    It's not up to Google to encrypt your e-mail end-to-end, though. That you have to do yourself. This technology exists and is called PGP. Obviously Gmail's HTML interface can't work with these e-mails, until you get some way to sandbox part of the DOM on the client. Search won't work either.
- declan 13y ago
  No, they're not required to lie. AT&T and Verizon never did when asked about NSA surveillance: http://news.cnet.com/8301-13578_3-57589012-38/nsa-surveillance-retrospective-at-t-verizon-never-denied-it/ http://news.cnet.com/8301-13578_3-57589012-38/nsa-surveillan...