3 ms·

Google Cloud Storage now provides server-side encryption

3 points by Sami_Lehtinen 13y ago

erkose 13y ago
Server side encryption? We want client side encryption and the server doesn't get to know the key.
hannibal5 13y ago
> To help, Google Cloud Storage now automatically encrypts all data before it is written to disk, at no additional charge. There is no setup or configuration required, no need to modify the way you access the service and no visible performance impact. The data is automatically and transparently decrypted when read by an authorized user. In other words, if someone is able to gain remote access to Google Cloud data, Google handles the decryption for them automatically. Google data centres have damn good physical security, so getting access by other means is not big concern. While this improves security marginally. This is just Google PR move trying to distract users from the fact that they have the keys and they give those keys to NSA when they ask for them. ps. If they would allow users to set and manage the keys as they please, they would make NSA snooping little more difficult. Instead of having instant bulk access to everything, they would need to investigate the apps running and that would involve humans.
- anxiousest 13y ago
  Not every feature is about the NSA nor every upgrade is a "PR move", this is a standard feature that Amazon also offers, and keeping law enforcement out isn't its main objective although it would make things a bit difficult for them since a warrant would be necessary to get the keys as a court order won't do, but if you are so inclined no one is preventing you from encrypting your stuff before uploading.
  - hannibal5 13y ago
    My understanding is that google cloud storage is not offering disc space. Data goes always trough their interfaces and databases. That would make difference to Amazon's offerings.
lsdkfj 13y ago
No doubt this is 90%+ a PR move, it also provides some real benefits: * Customers bound by HIPAA or other data privacy regulations may require encryption at rest, so this opens up a new market. * Assuming Google didn't warranty-return failed disks with cleartext on them, Disks may be returned under warranty instead of held/destroyed which may partially or completely offset the additional cost of the encryption. This definitely would not provide any additional barrier to a legitimate subpoena or the NSA/secret police -- only the customer controlling their own keys and encrypting the data before transit to Google could do that. Even then, there is no way to know if the NSA has a backdoor baked into the encryption anyway... Big brother is watching, and this will have zero impact on that.

3 points by Sami_Lehtinen 13y ago

Server side encryption? We want client side encryption and the server doesn't get to know the key.

> To help, Google Cloud Storage now automatically encrypts all data before it is written to disk, at no additional charge. There is no setup or configuration required, no need to modify the way you access the service and no visible performance impact. The data is automatically and transparently decrypted when read by an authorized user. In other words, if someone is able to gain remote access to Google Cloud data, Google handles the decryption for them automatically. Google data centres have damn good physical security, so getting access by other means is not big concern. While this improves security marginally. This is just Google PR move trying to distract users from the fact that they have the keys and they give those keys to NSA when they ask for them. ps. If they would allow users to set and manage the keys as they please, they would make NSA snooping little more difficult. Instead of having instant bulk access to everything, they would need to investigate the apps running and that would involve humans.

anxiousest 13y ago
Not every feature is about the NSA nor every upgrade is a "PR move", this is a standard feature that Amazon also offers, and keeping law enforcement out isn't its main objective although it would make things a bit difficult for them since a warrant would be necessary to get the keys as a court order won't do, but if you are so inclined no one is preventing you from encrypting your stuff before uploading.
- hannibal5 13y ago
  My understanding is that google cloud storage is not offering disc space. Data goes always trough their interfaces and databases. That would make difference to Amazon's offerings.

lsdkfj 13y ago

No doubt this is 90%+ a PR move, it also provides some real benefits: * Customers bound by HIPAA or other data privacy regulations may require encryption at rest, so this opens up a new market. * Assuming Google didn't warranty-return failed disks with cleartext on them, Disks may be returned under warranty instead of held/destroyed which may partially or completely offset the additional cost of the encryption. This definitely would not provide any additional barrier to a legitimate subpoena or the NSA/secret police -- only the customer controlling their own keys and encrypting the data before transit to Google could do that. Even then, there is no way to know if the NSA has a backdoor baked into the encryption anyway... Big brother is watching, and this will have zero impact on that.