4 ms·

Since Google is able (and willing, when asked by the government) to decrypt everybody's email at will, and continues to build software that maintains their abso

by drcode 13y ago

Since Google is able (and willing, when asked by the government) to decrypt everybody's email at will, and continues to build software that maintains their absolute power to do this, I really don't give a f@#k whether they promise to use 256 bit encryption, 512 bit encryption or 23439287239 bit encryption.

crazygringo 13y ago
There's still a gigantic difference between the government being able to "vacuum up" everything (weak/no encryption) from everyone, versus the government having to ask for communications from specific users.
- quantumpotato_ 13y ago
  You can split up the USA into a few queries and then just filter for a specific email. Semantics.
- drcode 13y ago
  Yes, but (as others have already pointed out) the takeaway point from this press release shouldn't be "Google is doing great things to prevent spying" and should instead be "Google admits they have been sending sensitive customer data between data centers in plaintext."
  - randomfool 13y ago
    When email passes between providers, 90% of the time it's plaintext. How many here encrypt replication data between data centers?
- lambda 13y ago
  Yes. If you are actually trying to hide something from a targeted government attack, you certainly don't want to use any hosted services like Google's. If, however, you are merely trying to avoid the government passively sweeping up all of your data, searching through it, and maybe subjecting it to further scrutiny due to it containing the wrong keyword, it helps to know that it's encrypted in transit, and that in order to decrypt it, someone has to actually present a warrant to Google. Of course, there's the additional problem of National Security Letters, as they aren't really real warrants and they have the secrecy around them. These problems can be attacked on multiple fronts. We can improve cryptographic security, and work on more decentralized approaches to online services, and reign in the NSA's power at a legal level, and so on.
- megantic 13y ago
  For sure, but in the case of google this probably doesn't apply. From what was published recently we know NSA has proven methods for bypassing encryption, namely getting the keys used for encryption (so they can decrypt everything) or getting access to the content before encryption or after decryption. To me this last move by google is a PR attempt at regaining people's trust
  - hugofirth 13y ago
    I'm so bored of hearing the accusations of PR stunts. They crop up in every submission detailing an action taken by Google with regards to the Snowden/Prism/NSA revelations. Is it so ridiculous that a large corporation should seek to ameliorate its image in the eyes of users and shareholders? PR has become such a dirty word. Of course it would be best if all these actions were taken earlier, purely as the result of a strongly held principle. However, when presented with the realities of public businesses operating on a global scale - I am glad that such steps as those detailed above are taken: at whatever stage, and for whatever reason. The tinfoil hat brigade needs to, as the old saying goes, "stop seeing reds under the beds" and occasionally ... just occasionally ... take the facts presented to them. In times when misinformation and confusion is so wont to proliferate, attempting to discern true motive is almost ridiculous - condemnation on the basis of any such discernment doubly so.
    - mike-cardwell 13y ago
      When Google does something that makes it impossible for them to hand over certain types of data to the NSA, either by not collecting it, or making it so that only the user is able to decrypt it, wake me up. Until then, it's a PR stunt.
      - hugofirth 13y ago
        I am not disputing the fact that a major motivation for their actions is PR. I am suggesting that action as a result of PR pressure is still action - vastly preferable to meek acceptance of the status quo. That being so - dismissing something as "just PR" misrepresents the actual benefits something like this may confer.

by drcode 13y ago

crazygringo 13y ago

There's still a gigantic difference between the government being able to "vacuum up" everything (weak/no encryption) from everyone, versus the government having to ask for communications from specific users.

quantumpotato_ 13y ago
You can split up the USA into a few queries and then just filter for a specific email. Semantics.
drcode 13y ago
Yes, but (as others have already pointed out) the takeaway point from this press release shouldn't be "Google is doing great things to prevent spying" and should instead be "Google admits they have been sending sensitive customer data between data centers in plaintext."
- randomfool 13y ago
  When email passes between providers, 90% of the time it's plaintext. How many here encrypt replication data between data centers?
lambda 13y ago
Yes. If you are actually trying to hide something from a targeted government attack, you certainly don't want to use any hosted services like Google's. If, however, you are merely trying to avoid the government passively sweeping up all of your data, searching through it, and maybe subjecting it to further scrutiny due to it containing the wrong keyword, it helps to know that it's encrypted in transit, and that in order to decrypt it, someone has to actually present a warrant to Google. Of course, there's the additional problem of National Security Letters, as they aren't really real warrants and they have the secrecy around them. These problems can be attacked on multiple fronts. We can improve cryptographic security, and work on more decentralized approaches to online services, and reign in the NSA's power at a legal level, and so on.
megantic 13y ago
For sure, but in the case of google this probably doesn't apply. From what was published recently we know NSA has proven methods for bypassing encryption, namely getting the keys used for encryption (so they can decrypt everything) or getting access to the content before encryption or after decryption. To me this last move by google is a PR attempt at regaining people's trust
- hugofirth 13y ago
  I'm so bored of hearing the accusations of PR stunts. They crop up in every submission detailing an action taken by Google with regards to the Snowden/Prism/NSA revelations. Is it so ridiculous that a large corporation should seek to ameliorate its image in the eyes of users and shareholders? PR has become such a dirty word. Of course it would be best if all these actions were taken earlier, purely as the result of a strongly held principle. However, when presented with the realities of public businesses operating on a global scale - I am glad that such steps as those detailed above are taken: at whatever stage, and for whatever reason. The tinfoil hat brigade needs to, as the old saying goes, "stop seeing reds under the beds" and occasionally ... just occasionally ... take the facts presented to them. In times when misinformation and confusion is so wont to proliferate, attempting to discern true motive is almost ridiculous - condemnation on the basis of any such discernment doubly so.
  - mike-cardwell 13y ago
    When Google does something that makes it impossible for them to hand over certain types of data to the NSA, either by not collecting it, or making it so that only the user is able to decrypt it, wake me up. Until then, it's a PR stunt.
    - hugofirth 13y ago
      I am not disputing the fact that a major motivation for their actions is PR. I am suggesting that action as a result of PR pressure is still action - vastly preferable to meek acceptance of the status quo. That being so - dismissing something as "just PR" misrepresents the actual benefits something like this may confer.