3 ms·

I don't agree. Google may have spent a lot of money, but that hasn't kept them off of the PRISM list and so far I've not read any really convincing explanation

by motters 13y ago

I don't agree. Google may have spent a lot of money, but that hasn't kept them off of the PRISM list and so far I've not read any really convincing explanation from anyone at Google about why they're on that list. I think in the post-Snowden world it's game over for the idea of expecting reasonable privacy or data security from the likes of Gmail. Once someone can routinely exfiltrate 100% of your data without a warrant - particularly if you are a "non US person reasonably believed to be outside the US" then the security model is not just a bit wonky, it's utterly destroyed.

tptacek 13y ago
You haven't managed to disagree with me here, because my point accommodates the fact that Google might cooperate with the USG.
- tghw 13y ago
  Google cooperating with the USG is a much larger risk factor for being surveilled. Currently, the USG does not need to exploit server vulnerability to access Google messages, but for a foreign-owned ISP, they don't have this back door, at least not as readily. That means a targeted attack, which is inherently more expensive.
  - tptacek 13y ago
    Vulnerabilities in your mail provider present a superset of the problems of Google Mail.
    - tghw 13y ago
      Not really. They're more of intersecting sets. Is a foreign mail provider as likely to succumb to PRISM? No. Is it possible for GMail to have vulnerabilities unique to GMail and not to a more standard mail setup? Of course.
      - tptacek 13y ago
        I think the issue is that we disagree, probably very very strongly, about the relative likelihood of vulnerabilities in Google Mail versus vulnerabilities in any other mail service provider. It's O.K. to disagree! We don't have to agree on anything, let alone this. Just know that my opinion is a professional one in this specific case. There are extremely smart people working on Google Mail's security, and on the security of every component in the stack that Google Mail depends on, and that is an arrangement (in both degree and kind) that is pretty much unique to Google Mail.
        tghw 13y ago
        I'm just pointing out that asking for data from a database is always going to be easier than exploiting a system, no matter whose it is. From what we know, it seems that the USG has the ability to do surveillance on Google Mail by querying a database, but likely does not have that same ability on a foreign mail service. Therefore, it is likely that it is easier for the USG to read mail from a Google user. As you know, security is not about making things impossible but making them more difficult and resource-intensive. So far, we have little evidence that Google has been making anything difficult for the USG.

by motters 13y ago

tptacek 13y ago

You haven't managed to disagree with me here, because my point accommodates the fact that Google might cooperate with the USG.

tghw 13y ago
Google cooperating with the USG is a much larger risk factor for being surveilled. Currently, the USG does not need to exploit server vulnerability to access Google messages, but for a foreign-owned ISP, they don't have this back door, at least not as readily. That means a targeted attack, which is inherently more expensive.
- tptacek 13y ago
  Vulnerabilities in your mail provider present a superset of the problems of Google Mail.
  - tghw 13y ago
    Not really. They're more of intersecting sets. Is a foreign mail provider as likely to succumb to PRISM? No. Is it possible for GMail to have vulnerabilities unique to GMail and not to a more standard mail setup? Of course.
    - tptacek 13y ago
      I think the issue is that we disagree, probably very very strongly, about the relative likelihood of vulnerabilities in Google Mail versus vulnerabilities in any other mail service provider. It's O.K. to disagree! We don't have to agree on anything, let alone this. Just know that my opinion is a professional one in this specific case. There are extremely smart people working on Google Mail's security, and on the security of every component in the stack that Google Mail depends on, and that is an arrangement (in both degree and kind) that is pretty much unique to Google Mail.
      - tghw 13y ago
        I'm just pointing out that asking for data from a database is always going to be easier than exploiting a system, no matter whose it is. From what we know, it seems that the USG has the ability to do surveillance on Google Mail by querying a database, but likely does not have that same ability on a foreign mail service. Therefore, it is likely that it is easier for the USG to read mail from a Google user. As you know, security is not about making things impossible but making them more difficult and resource-intensive. So far, we have little evidence that Google has been making anything difficult for the USG.