11 ms·

Google tests encryption to protect users' Drive files against government demands

57 points by declan 13y ago

hannibal5 13y ago
This would mean that Google would not be able to data main user data for relevant ads. If Google wants to take small free from the encryption, I would be OK with that. It would be also nice to have option where my data is begin stored (again for a fee if necessary). I would like mine in their Finnish data center.
- Kapura 13y ago
  > If Google wants to take small free from the encryption, I would be OK with that. You shouldn't have to pay a company to make sure they don't share your data. That is, in essence, what you're suggesting: you pay google, they encrypt your data and when the government comes a-knocking, it's safe. It's like a hack in a broken system
  - kyzyl 13y ago
    That may be true, but the broken system is the government, not Google. Google appears (being the operative word...) to simply be doing what they can in the current system. However, I think you somewhat sidestepped hannibal's point. My impression was that he was saying that just by putting your files in drive for google to mine, you are effectively paying google. If they encrypt your files, it's akin to them discontinuing their monthly fee (or whatever) for the service. So sure, if you're already paying a fee for a service then maybe you shouldn't need to pay extra for the luxury of privacy (make no mistake, privacy is a luxury these days), but Google encrypting their revenue stream means you are substituting the ad fee for the encryption fee. Seems fair to me.
  - hannibal5 13y ago
    As long as I use Gmail and Google drive for free (and I'm using Adblock), they have to monetize the service they provide to me somehow. I would like to have clear option of being fed advertisements and being profiled for profits and paying for service.
- psbp 13y ago
  Does google data mine Drive? I always thought the monetary incentive was through the cloud storage tiers.
- kyboren 13y ago
  Putting your data on Google's servers in Finland won't save it from the NSA. Google's headquarters are in the US, and so Google complies with "legal" US Government data requests. Your data is subject to US Government subpoena, FISA warrant, etc. if it's stored on Google's property--wherever that property happens to be.
  - hannibal5 13y ago
    That's incorrect. Companies must follow laws of each country. Chinese companies can't follow orders from Chinese courts if they break US laws when they operate in US. Besides, Google has local company in each country that runs business there.
webwanderings 13y ago
Last time I was using Drive, I ran into a trouble of re-synching my files with Drive after a crash. I had copy of my files on a hard drive which I was able to bring back in. I reinstalled Google Drive to learn that Google has no way to avoid the resync (ultimately making duplicates). So I gave up on Drive altogether. Their encryption efforts won't be winning me back.
cliveowen 13y ago
When I first set up my Drive account it wasn't the U.S. government I was worried about, it was Google itself. That's why I put all of the files I wanted to sync in an encrypted image (which you can create with Disk Utility on Mac OS X) and then uploaded the image. Also, to avoid re-uploading the whole shebang (which is more than a GB) I use a sparse bundle disk image which means that if I modify a single file only a small portion of the image will be re-synced with Drive.
- toomuchtodo 13y ago
  I do the same thing, but with Truecrypt and Dropbox.
  - guiambros 13y ago
    Hmm, does sparse bundle work well with TrueCrypt? Any consistency issues when sync'ing with Dropbox?
    - toomuchtodo 13y ago
      I didn't use a sparse bundle, just a TrueCrypt container. It uses the full space allocated on disk, and I've rarely had an issue (1-2 times over 4 months) with Dropbox syncing.
      - guiambros 13y ago
        Thanks. I research more, and seems that TrueCrypt still does not support sparse bundle, so that's still a no go. The only option is to do what you did, sharing a full container. But if you have a big container (say, 1GB or so), it has the drawback of re-syncing the file back-and-forth. And if you have multiple devices (including mobile, etc), this would easily became a nightmare. That's a bummer. I love TrueCrypt for local encryption of filesystems and containers, but I wish I could use as a lightweight, on-the-fly, encryption of files. Particularly dropbox and other cloud-based storage.
- hannibal5 13y ago
pppp 13y ago
If it's not client-side encryption (where only you know the password and the stuff is encrypted on your machine before it is sent), then it's a non-starter. The government can just order Google to bypass the protections for their suspect.
- foobarqux 13y ago
  If they control the code they can bypass the protections for their suspect as well.
- ef4 13y ago
  And even if it's client-side encrypted, unless the client is open source there's no practical way to know whether there are backdoors, or whether a future update adds backdoors.
- declan 13y ago
  I understand that's your legal theory. The article says, however, that remains an "unanswered legal question" in the United States, according to Jennifer Granick at Stanford's CIS.
decryptthis_NSA 13y ago
This sounds like an ad for Google, including the Microsoft and Verizon bashing. The truth is that Google 'needs' to see the messages, all you other info and documents in clear text to serve ads and mine them. That's their business model and they aren't about to change it. Oh and as other said, NSA can force them to do what Microsoft did.
- ok_craig 13y ago
  There are no ads in Drive. You pay for storage, that's how it makes money.
  - decryptthis_NSA 13y ago
    Drive /documents are one aspect of what is stored in Google, Microsoft+++. The point I was trying to make is to be careful, even if they secure Drive, don't assume that other services and data are NSA proof. The companies are all in PR mode, trying to reverse the damage done. The stuff on drive and Azure it's easy, I can encrypt it yourself. Email location data, call logs, videos watches, pages visited etc are the real problem.
jlgreco 13y ago
Does anyone know of a good way to use Google Drive from Linux securely? I'm currently sitting on a 1TB Drive account with nothing really to do with it. I tried fuse-google-drive and it was so broken it was unusable.
- jpalomaki 13y ago
  At least BoxCryptor[1] is available for Linux. I've been using the classic version on Windows for a while. Maybe there are also similar open source solutions available for Linux. On Windows BoxCryptor classic creates a virtual drive which you use to access the files. The actual files are stored as encrypted in Dropbox/GDrive folder. BoxCryptor can also encrypt file names. Benefit from this approach compared to for example TrueCrypt is that works really nicely with the syncing features of these cloud storage systems as the files are still stored as individual files. [1] https://www.boxcryptor.com/en/download https://www.boxcryptor.com/en/download
- mateuszf 13y ago
  I'm not sure how Google Drive works for synchronization, but if it does like for Dropbox (automatic filesystem sync) than you could use EncFs or git-annex with encryption enabled.
  - jlgreco 13y ago
    Ah, I should be more specific: My issue is with accessing Google Drive on Linux at all, let alone with my data encrypted. An encrypted rsync-style remote with git-annex would be ideal of course. I'm going to give insync a look, though I'm not thrilled about paying for something to access cloud storage that I'm not paying for.
- plouc 13y ago
  I am using https://www.insynchq.com https://www.insynchq.com and it works really well.
FellowTraveler 13y ago
I've already lost all faith in Google. I recommend Spider Oak as a replacement for Google Drive. Also, don't forget Bittorrent Sync.
- fear91 13y ago
  Yep, no matter how much PR bullshit they spew out, no one resonable is going to trust them with sensitive data.
- UVB-76 13y ago
  I want to like SpiderOak, but transfers are painfully slow, and their OS X interface is horrible.
  - FellowTraveler 13y ago
    Do you ever notice that your Mac's camera and microphone do not have a physical off-switch? Just like 1984.
    - harrytuttle 13y ago
      Neither does my Sony all in one, my ThinkPad or my three Nokia phones and you're singling out the mac?
      - FellowTraveler 13y ago
        You're right: Sony, ThinkPad, and Nokia are therefore also systems of slavery. How hard can it be to manufacture a product with an off-switch?
        superuser2 13y ago
        I'm guessing you never supported an environment where laptops had hardware switches for the WiFi card. I can't even begin to quantify the amount of support time that wastes. If a users asks for something to happen (like a Skype call) it should just happen. To end-users, having multiple points at which the functionality they want can be switched off is just frustrating, and it costs manufacturers call center time and customer satisfaction. The paranoid can tape over cameras and cut mic cables if they feel it's really necessary. You really might want to consider whether "slavery" is the appropriate word for switches implemented in software.
dmix 13y ago
The same Google whose new strategy - only two months ago -involved disabling the ability to use off-the-record on Gtalk by default in chat? Or using third-party OTR plugins (with real encryption) by replacing gtalk XMPP with Google Hangout? http://news.en.softonic.com/google-chat-history-can-no-longer-be-turned-off-by-default http://news.en.softonic.com/google-chat-history-can-no-longe... > One of the features of Hangouts that was really emphasized at I/O, was that you will no longer have to worry about losing anything. Chats are kept, and everything you share, like photos, is put in folders and stored.
- superuser2 13y ago
  Google Hangout is substantially more functional than gtalk. For example, my Class of 2017 group does 10-way hangouts most weeks to get to know each other, something which really wasn't possible with gtalk, which facilitates one-way calls between contacts. Hangouts provides a semi-private room that more people can join, and all sorts of silly things to like watching YouTube together. It's not a conspiracy to prevent you from using encryption. That's just absurd. If you need XMPP and OTR, run Openfire on a VM. I just deployed this internally at work and we love it.
- ineedtosleep 13y ago
  FWIW, the Google Hangout(Talk) has an option to "Turn history off". Whether or not you trust that is a different story.
  - jmillikin 13y ago
    The complaint is that there used to be an option to make history off by default, which no longer exists. Every chat must have its history manually disabled.
- jmillikin 13y ago
  > Or using third-party OTR plugins (with real encryption) > by replacing gtalk XMPP with Google Hangout? Has this actually stopped working for you? On my account, Gtalk still works fine with XMPP, including OTR chats in Pidgin.
newsign 13y ago
SpiderOak is the best solution ... client side encryption and fully secured with zero-knowledge policy ....Bye Bye Drive, Skydrive & DropBox :)
thret 13y ago
"PRISM. The utility collates data that the companies are required to provide under the Foreign Intelligence Surveillance Act -- unless, crucially, it's encrypted and the government doesn't possess the key." Couldn't they just use a hand-wavy encryption like a caesar cipher that meets the legal requirements without actually making storage any harder?
RachelF 13y ago
We use an app called Syncdocs to encrypt everything locally with AES256 before uploading it encrypted to Google Drive. It is simple to setup and seems to work well. http://www.syncdocs.com/how-to-set-up-google-drive-encryption/ http://www.syncdocs.com/how-to-set-up-google-drive-encryptio...
- LeeLorean 13y ago
  Syncdocs and Boxcryptor are quite similar. What I like about Syncdocs is it enables EncFS for the folders selected to be encrypted, too.
tracker1 13y ago
If google handles the communications channel, and the "encryption" software, they still have access to everything.

57 points by declan 13y ago

This would mean that Google would not be able to data main user data for relevant ads. If Google wants to take small free from the encryption, I would be OK with that. It would be also nice to have option where my data is begin stored (again for a fee if necessary). I would like mine in their Finnish data center.

Kapura 13y ago
> If Google wants to take small free from the encryption, I would be OK with that. You shouldn't have to pay a company to make sure they don't share your data. That is, in essence, what you're suggesting: you pay google, they encrypt your data and when the government comes a-knocking, it's safe. It's like a hack in a broken system
- kyzyl 13y ago
  That may be true, but the broken system is the government, not Google. Google appears (being the operative word...) to simply be doing what they can in the current system. However, I think you somewhat sidestepped hannibal's point. My impression was that he was saying that just by putting your files in drive for google to mine, you are effectively paying google. If they encrypt your files, it's akin to them discontinuing their monthly fee (or whatever) for the service. So sure, if you're already paying a fee for a service then maybe you shouldn't need to pay extra for the luxury of privacy (make no mistake, privacy is a luxury these days), but Google encrypting their revenue stream means you are substituting the ad fee for the encryption fee. Seems fair to me.
- hannibal5 13y ago
  As long as I use Gmail and Google drive for free (and I'm using Adblock), they have to monetize the service they provide to me somehow. I would like to have clear option of being fed advertisements and being profiled for profits and paying for service.
psbp 13y ago
Does google data mine Drive? I always thought the monetary incentive was through the cloud storage tiers.
kyboren 13y ago
Putting your data on Google's servers in Finland won't save it from the NSA. Google's headquarters are in the US, and so Google complies with "legal" US Government data requests. Your data is subject to US Government subpoena, FISA warrant, etc. if it's stored on Google's property--wherever that property happens to be.
- hannibal5 13y ago
  That's incorrect. Companies must follow laws of each country. Chinese companies can't follow orders from Chinese courts if they break US laws when they operate in US. Besides, Google has local company in each country that runs business there.

webwanderings 13y ago

Last time I was using Drive, I ran into a trouble of re-synching my files with Drive after a crash. I had copy of my files on a hard drive which I was able to bring back in. I reinstalled Google Drive to learn that Google has no way to avoid the resync (ultimately making duplicates). So I gave up on Drive altogether. Their encryption efforts won't be winning me back.

cliveowen 13y ago

When I first set up my Drive account it wasn't the U.S. government I was worried about, it was Google itself. That's why I put all of the files I wanted to sync in an encrypted image (which you can create with Disk Utility on Mac OS X) and then uploaded the image. Also, to avoid re-uploading the whole shebang (which is more than a GB) I use a sparse bundle disk image which means that if I modify a single file only a small portion of the image will be re-synced with Drive.

toomuchtodo 13y ago
I do the same thing, but with Truecrypt and Dropbox.
- guiambros 13y ago
  Hmm, does sparse bundle work well with TrueCrypt? Any consistency issues when sync'ing with Dropbox?
  - toomuchtodo 13y ago
    I didn't use a sparse bundle, just a TrueCrypt container. It uses the full space allocated on disk, and I've rarely had an issue (1-2 times over 4 months) with Dropbox syncing.
    - guiambros 13y ago
      Thanks. I research more, and seems that TrueCrypt still does not support sparse bundle, so that's still a no go. The only option is to do what you did, sharing a full container. But if you have a big container (say, 1GB or so), it has the drawback of re-syncing the file back-and-forth. And if you have multiple devices (including mobile, etc), this would easily became a nightmare. That's a bummer. I love TrueCrypt for local encryption of filesystems and containers, but I wish I could use as a lightweight, on-the-fly, encryption of files. Particularly dropbox and other cloud-based storage.
hannibal5 13y ago

pppp 13y ago

If it's not client-side encryption (where only you know the password and the stuff is encrypted on your machine before it is sent), then it's a non-starter. The government can just order Google to bypass the protections for their suspect.

foobarqux 13y ago
If they control the code they can bypass the protections for their suspect as well.
ef4 13y ago
And even if it's client-side encrypted, unless the client is open source there's no practical way to know whether there are backdoors, or whether a future update adds backdoors.
declan 13y ago
I understand that's your legal theory. The article says, however, that remains an "unanswered legal question" in the United States, according to Jennifer Granick at Stanford's CIS.

decryptthis_NSA 13y ago

This sounds like an ad for Google, including the Microsoft and Verizon bashing. The truth is that Google 'needs' to see the messages, all you other info and documents in clear text to serve ads and mine them. That's their business model and they aren't about to change it. Oh and as other said, NSA can force them to do what Microsoft did.

ok_craig 13y ago
There are no ads in Drive. You pay for storage, that's how it makes money.
- decryptthis_NSA 13y ago
  Drive /documents are one aspect of what is stored in Google, Microsoft+++. The point I was trying to make is to be careful, even if they secure Drive, don't assume that other services and data are NSA proof. The companies are all in PR mode, trying to reverse the damage done. The stuff on drive and Azure it's easy, I can encrypt it yourself. Email location data, call logs, videos watches, pages visited etc are the real problem.

jlgreco 13y ago

Does anyone know of a good way to use Google Drive from Linux securely? I'm currently sitting on a 1TB Drive account with nothing really to do with it. I tried fuse-google-drive and it was so broken it was unusable.

jpalomaki 13y ago
At least BoxCryptor[1] is available for Linux. I've been using the classic version on Windows for a while. Maybe there are also similar open source solutions available for Linux. On Windows BoxCryptor classic creates a virtual drive which you use to access the files. The actual files are stored as encrypted in Dropbox/GDrive folder. BoxCryptor can also encrypt file names. Benefit from this approach compared to for example TrueCrypt is that works really nicely with the syncing features of these cloud storage systems as the files are still stored as individual files. [1] https://www.boxcryptor.com/en/download https://www.boxcryptor.com/en/download
mateuszf 13y ago
I'm not sure how Google Drive works for synchronization, but if it does like for Dropbox (automatic filesystem sync) than you could use EncFs or git-annex with encryption enabled.
- jlgreco 13y ago
  Ah, I should be more specific: My issue is with accessing Google Drive on Linux at all, let alone with my data encrypted. An encrypted rsync-style remote with git-annex would be ideal of course. I'm going to give insync a look, though I'm not thrilled about paying for something to access cloud storage that I'm not paying for.
plouc 13y ago
I am using https://www.insynchq.com https://www.insynchq.com and it works really well.

FellowTraveler 13y ago

I've already lost all faith in Google. I recommend Spider Oak as a replacement for Google Drive. Also, don't forget Bittorrent Sync.

fear91 13y ago
Yep, no matter how much PR bullshit they spew out, no one resonable is going to trust them with sensitive data.
UVB-76 13y ago
I want to like SpiderOak, but transfers are painfully slow, and their OS X interface is horrible.
- FellowTraveler 13y ago
  Do you ever notice that your Mac's camera and microphone do not have a physical off-switch? Just like 1984.
  - harrytuttle 13y ago
    Neither does my Sony all in one, my ThinkPad or my three Nokia phones and you're singling out the mac?
    - FellowTraveler 13y ago
      You're right: Sony, ThinkPad, and Nokia are therefore also systems of slavery. How hard can it be to manufacture a product with an off-switch?
      - superuser2 13y ago
        I'm guessing you never supported an environment where laptops had hardware switches for the WiFi card. I can't even begin to quantify the amount of support time that wastes. If a users asks for something to happen (like a Skype call) it should just happen. To end-users, having multiple points at which the functionality they want can be switched off is just frustrating, and it costs manufacturers call center time and customer satisfaction. The paranoid can tape over cameras and cut mic cables if they feel it's really necessary. You really might want to consider whether "slavery" is the appropriate word for switches implemented in software.

dmix 13y ago

The same Google whose new strategy - only two months ago -involved disabling the ability to use off-the-record on Gtalk by default in chat? Or using third-party OTR plugins (with real encryption) by replacing gtalk XMPP with Google Hangout? http://news.en.softonic.com/google-chat-history-can-no-longer-be-turned-off-by-default http://news.en.softonic.com/google-chat-history-can-no-longe... > One of the features of Hangouts that was really emphasized at I/O, was that you will no longer have to worry about losing anything. Chats are kept, and everything you share, like photos, is put in folders and stored.

superuser2 13y ago
Google Hangout is substantially more functional than gtalk. For example, my Class of 2017 group does 10-way hangouts most weeks to get to know each other, something which really wasn't possible with gtalk, which facilitates one-way calls between contacts. Hangouts provides a semi-private room that more people can join, and all sorts of silly things to like watching YouTube together. It's not a conspiracy to prevent you from using encryption. That's just absurd. If you need XMPP and OTR, run Openfire on a VM. I just deployed this internally at work and we love it.
ineedtosleep 13y ago
FWIW, the Google Hangout(Talk) has an option to "Turn history off". Whether or not you trust that is a different story.
- jmillikin 13y ago
  The complaint is that there used to be an option to make history off by default, which no longer exists. Every chat must have its history manually disabled.
jmillikin 13y ago
> Or using third-party OTR plugins (with real encryption) > by replacing gtalk XMPP with Google Hangout? Has this actually stopped working for you? On my account, Gtalk still works fine with XMPP, including OTR chats in Pidgin.

newsign 13y ago

SpiderOak is the best solution ... client side encryption and fully secured with zero-knowledge policy ....Bye Bye Drive, Skydrive & DropBox :)

thret 13y ago

"PRISM. The utility collates data that the companies are required to provide under the Foreign Intelligence Surveillance Act -- unless, crucially, it's encrypted and the government doesn't possess the key." Couldn't they just use a hand-wavy encryption like a caesar cipher that meets the legal requirements without actually making storage any harder?

RachelF 13y ago

We use an app called Syncdocs to encrypt everything locally with AES256 before uploading it encrypted to Google Drive. It is simple to setup and seems to work well. http://www.syncdocs.com/how-to-set-up-google-drive-encryption/ http://www.syncdocs.com/how-to-set-up-google-drive-encryptio...

LeeLorean 13y ago
Syncdocs and Boxcryptor are quite similar. What I like about Syncdocs is it enables EncFS for the folders selected to be encrypted, too.

tracker1 13y ago

If google handles the communications channel, and the "encryption" software, they still have access to everything.