41 ms·

Google knows nearly every Wi-Fi password in the world

• Qantourisc 13y ago
  Scarry
• tiernano 13y ago
  when i read the title, i though "really?! how?" then i read the article and realized any time i have restored my android phone, then entered my Google account, it automagically connects to all access points i usually use (home, work, other office, etc)...
  • rcthompson 13y ago
    But they didn't have to design it in such a way as to share the passwords with google. All your data could be encrypted with your google account's password (or some other secret derived from it) on the device and backed up encrypted. When you enter your account password on a new device, it then downloads the encrypted data and decrypts and restores it. Same user experience without exposing private data.
    • codeka 13y ago
      Do we know that's not happening? The article says "they can decrypt them, given only a Gmail address and password" which implies that it would be encrypted with your password.
      • mhaymo 13y ago
        The article states that Google has refused to comment on whether the data is encrypted on their servers. So it seems fair to assume it isn't.
        • DominikR 13y ago
          No, it is fair to assume nothing without any information.
    • acqq 13y ago
      It's shared with Google as long as Google stores your Google account password as the actual sequence of characters and not as the result of bcrypt processing and as long as the data copied to Google aren't encrypted locally. Local encryption has the effect that as soon as you forget your password, the data stored as the backup are unusable, even you can make Google reset your Google account password. Security is always a trade-off.
    • deong 13y ago
      > Same user experience without exposing private data. Google also knows your Google account password. If you can decrypt the data using any deterministic function of your Google password, then so can Google, so there's no additional security gained. They probably already store your wifi password encrypted -- it's just when the device asks for it, Google decrypts it and sends it back to you. So in all likelihood, they're already doing what you want. They could have done it by asking the user to provide a new unique password that would have to be entered on each new device. That would provide additional security as only the device could decrypt the password. However, (a) because such a password would only be used once or twice a year at most, no one would remember it and the whole feature would be useless, and (b) you still have to trust Google to not send the password after the device decrypts it, and if you trust the OS vendor to not backdoor the OS, you might as well trust them to not backdoor their own servers to access the same data.
      • DougWebb 13y ago
        Google also knows your Google account password. If you can decrypt the data using any deterministic function of your Google password, then so can Google, so there's no additional security gained. Probably, but not necessarily. All they need to know is the hash of your password. When you set up a new device, it can call out to Google to authenticate without sending a cleartext password (similar to HTTP's Digest auth). Once you've authenticated and retrieved your encrypted settings, the password can be used locally to decrypt the settings. The password never has to leave the device. If they haven't done it this way (and unless the article's author knows something, I don't think you can tell if they're doing it this way or not from observed behavior) they're either (a) lazy or (b) nefarious. I'm guessing lazy, since that's the reason for most developers who implement poor security... they just don't spend enough time thinking about security of the features they're working on.
        • CJefferson 13y ago
          With your design, a user with a lost password also loses all their data. While that might be better from a security perspective, I can't remember the last time I used a system that did not keep all my data when I set a new password, without having the old one. Such a thing would annoy many users.
• anxiousest 13y ago
  Not sure what the author is after here. I mean he's not breaking any news, he admits as much, he also links to some of the articles that were published weeks ago that do a better job of discussing the security/convenience trade offs. Seems like he missed the furore at the the time and decided to compensate with a woefully inaccurate and baiting headline.
  • zobzu 13y ago
    yes, but to be fair, this issue deserves to be more well known. it wont be fixed if google isn't blamed and shamed for it repeatedly.
    • anxiousest 13y ago
      'Blamed and shamed'?! I don't even think it's an issue, your wifi password isn't that of your bank account. They store your emails unencrypted for crying out loud, wifi passwords pale in comparison. It's a non issue.
      • nekopa 13y ago
        My gmail is my personal email choice. I know the risks associated with that and accept them in return for the convenience of google email. On the other hand, my employer may not like that google has the password to our company's internal wifi. That's why I think there may be a bit of an issue here.
      • tripzilch 13y ago
        You are in no position to decide whether it's okay for your phone to share my WiFi password with a third party. It's not your choice to make.
      • zobzu 13y ago
        Note that I can probably get your bank account password with your wifi password, when you'll be annoyed and hit that "ignore warning for invalid SSL certificate" ;-)
    • 13y ago
• nodata 13y ago
  Oh god not this again.
• crb 13y ago
  Google also knows all the secrets of General David Petraeus, or anyone else that uses Gmail. And everything you've (secretly) searched for. Google's business model is based on aggregating that information and gaining value out of the data, mostly in the form of advertising. As soon as it lets a major secret out, even just once, it's game over, and no-one will ever trust a secret to Google again. This is why they publish videos saying that no-one can ever walk out of a Google data centre with a hard drive. I continue to use the services I use because I find the benefit I gain from them, more useful than the potential risk of exposure. Should these secrets be encrypted? If they were, it would be possible for Google to steal your key if they wanted to. This is the same kind of perception problem that led to the Chrome team being hauled over the coals in public for not encrypting saved passwords. They have to be available to be useful, but people would rather perceive they weren't available.
  • batemanesque 13y ago
    I agree that it's unlikely Google as a whole would decide to read/use confidential data. on the other hand, the idea that someone w/in Google might abuse their position is completely plausible. if we know that people at the NSA were passing around phone sex calls by US troops, do you really want to keep trusting that no-one at Google will ever do anything problematic w/ yr data? edit: to be clear, I use Google services all the time & store a lot of confidential data w/ them. but there need to be institutional (whether at Google or outside it) safeguards that go beyond trusting a company as a whole to always behave in a way compatible w/ its own rational self-interest.
    • Amadou 13y ago
      Given that Google has a VC arm, I am stunned every time I run into a VC who uses gmail and other google-hosted services as part of their business. They are handing their competition an enormous chunk of their business proprietary information and trusting them not to peek at it without even a contract. To me, that level of naivety with respect to operational security is just baffling. All it takes is one unscrupulous person in the right place at Google and those convenient, "free" services could end up costing millions. It isn't like the people in the finance industry have a reputation for being upstandingly moral either.
• prab97 13y ago
  For convenience, most people won't opt out of it. Most people won't bother at all. Google employees(or even NSA if you don't do anything illegal) coming to your home/office to use your WiFi is a joke! Only the paranoid ones are perturbed by these kinds of revelations, and they are ready to face the inconvenience caused. I didn't use last pass until recently when keeping a difficult password on every site became a major pain given that countless numbers of password enforcing rules are there on the web some requiring at least one caps, some enforcing using at least one symbol but not using a ~ or a # yeda yeda. I gave up on it. Every damn time I had to reset password on services I use less frequently. But now I don't. Although LastPass claims that they keep the passwords encrypted and they themselves can not read them. But I don't believe them. Login to lastpass.com. Click your vault on top right corner. Click the pencil against any site in the list. Click the 'show' link in front of password field. And your password is staring at you in plain text. And it has been accessed at lastpass.com. Once they start storing master passwords, or once someone cracks their hash you are done with. But there is no simple and easy alternative. To get the job done we need to make these sacrifices.
  • aestra 13y ago
    The encryption/decryption is done client side. This is a simple version of how it works, your master password isn't sent to lastpass, just an encryption key which is created with your email address and master password. On the website this is done client side with javascript. When you click on the pencil icon, you are reading the decrypted file, which you have decrypted on your own computer, with javascript.
    • jmillikin 13y ago
      Client-side decoding in a web app is not secure against the host of the web app, because the decryption code can be changed at any time to contain arbitrary backdoors. Lastpass stores the encrypted secret, and they serve the Javascript that decrypts the secret, so they should be assumed to have access to the secret.
  • bloodorange 13y ago
    People tend to reuse passwords across multiple services and devices. Stealing their WiFi password is not something they will be comfortable with.
• deleted 13y ago
  [deleted]
  • demallien 13y ago
    That's not the problem - choosing to give up your own secrets is fine, but giving up the wifi password of your friend's router because they kindly let you use the network whilst visiting is not cool at all. I personally refuse to allow access by friends with Android devices, and they are shocked to learn what Google does when I explain why...
    • marcuspovey 13y ago
      At home, and everywhere I've had a say on how the network is laid out during working hours, I treat wifi as external. They get internet access, and there's a password to prevent the neighbours kids downloading GBs of pr0n, access to internal resources require connection over the vpn. This has the side benefit that all my devices can connect securely to home resources wherever I am in the world.
• DanBC 13y ago
  > And, although they have never said so directly, it is obvious that Google can read the passwords. Frustrating then that it's so hard for users to reveal the password being used by their phone to connect to a WIFI hotspot.
• 0x006A 13y ago
  And in addition to that they have the audacity to not make them accessible to the user! No way to look up your own wireless password in your phone, i.e. to tell a guest, thats just ridiculous.
  • wingerlang 13y ago
    On (jailbroken) iOS there is an app which displays all saved WIFI passwords. I am sure there are something similar to Androids.
    • 0x006A 13y ago
      Yes if you jailbreak you can do many things. That it requires a jailbreak is the insult.
      • iwasakabukiman 13y ago
        That has nothing to do with this conversation. And don't you think that the fact that iOs doesn't allow you to do this without a jailbreak is a good thing?
    • andrewaylett 13y ago
      Yes, and they too require root. Plenty of choices found by searching the Play store.
    • vikas0380 13y ago
      On Android(rooted) we can see all the saved WIFI passwords in /data/misc/wifi/wpa_supplicant.conf file.
  • josteink 13y ago
    I you root your Android phone, there are apps to do that for you. But I do agree that it's a form of UI-fail that there is no legitimate way for a user to recover his own passwords.
• runn1ng 13y ago
  I am not sure why is this such a problem. OK, when NSA goes physically near my home, they can connect to my WiFi and secretly use my internet connection. That's not really what I am concerned about.
  • sudomal 13y ago
    People secure their Wi-Fi for more than just their connection. There is likely to be file servers, media centres, printers, scanners, radios, TVs, tablets, phones, computers with shared folders, security cameras etc all connected to the local network.
    • VMG 13y ago
      They should be protected by additional means anyway.
      • outworlder 13y ago
        Disregarding the fact that this would completely bypass the border routers. Devices in an internal network maybe protected, but they are never as protected as they are from requests coming from the internet.
  • cowls 13y ago
    Agreed, Google already have all our info anyway so not sure why they would send someone round to connect up to our Wireless networks..
• cowls 13y ago
  "On an HTC device, the option that gives Google your Wi-Fi password is "Back up my settings" Evil Google, disguising the 'Can we steal your password button'
• Kiro 13y ago
  I don't mind.
• kedar5 13y ago
  What's wrong in it.It's not a bank account rite.
  • siddhartpai 13y ago
    It could be like leaving your bank account password in the open. Your bank account password could be sniffed probably very easily by someone who is connected to your network. Now imagine somebody exposes some way to get the password of your home network from the google servers.
    • siddhartpai 13y ago
      With all these NSA revelations and Richard Stallman being right all along. there is no such thing as being secure or encrypted unless you have encrypted it yourself.
      • rimantas 13y ago
        And built your own hardware and installed your own cell towers. And control all the servers, because even if they are made with 100% open-source code, someone could just modify it. Also you must be sure nobody else has read access to it, because being 100% open source does not mean "no-one can read it". I don't see how trusted networking can be possible in stallmanic world.
    • phaer 13y ago
      If a random attacker in your local network can do that easily you should talk to your bank about SSL or change to one that actually knows basic internet technology. SSL should be assumed as broken for defence against government surveillance but it still keeps the most common attackers out.
      • joe_the_user 13y ago
        SSL depends on dns and so is broken when someone has compromised your local router. Yeah, that's a pretty bad weakness but it's just sitting there and indeed that's what the NSA supposedly used against Petrobras.
• jfasi 13y ago
  This very same point could be made against Apple, for instance, but there hasn't been a single comment to that effect in any discussion of this article. I wonder if all of this recent Google-bashing is really just a symptom of something larger. People are suddenly waking up to the obvious-in-hindsight realization that simply giving their data to a third party involves a certain amount of trust. The reason people don't seem to be ganging up on Facebook, Apple, etc. in a similar way is because they never really earned that faith. Take Facebook: from the very start their founder was known to consider their users "dumb fucks" for entrusting him with their privacy. In my opinion, the fact that Google went out of their to, and generally succeeded at earning that trust is a good sign. It shows they take the matter seriously. All American companies operate under the same rules. If you've taken the position that all American companies are not to be trusted, fine. But if you haven't, wouldn't Google's history make them one of the more trustworthy ones?
  • garethadams 13y ago
    > This very same point could be made against Apple, for instance, but there hasn't been a single comment to that effect in any discussion of this article. See a couple of months ago (the context is iMessages but the level of implicit trust is the same): https://news.ycombinator.com/item?id=5943778 https://news.ycombinator.com/item?id=5943778
    • jfasi 13y ago
      Acknowledged. I still argue that Google's getting more than its fair share of abuse, though.
      • revscat 13y ago
        Fair share? Abuse? It is a criticism made against a corporation. It deserves scrutiny and a critical eye whenever it fails, regardless of what it's competitors do. I hate to say it because I abhor the word, but this reeks of fanboyism.
        • deleted 13y ago
• aestra 13y ago
  Google is going to have thousands of different passwords mapped to the SSID "linksys."
  • juhanima 13y ago
    Coupled with the rest of the backed up data, it doesn't really matter if the SSID were not unique.
  • slig 13y ago
    I think the MAC Address of the router is known too, so there's no duplicates.
    • aestra 13y ago
      That comment was meant to be humorous, not serious.
    • voltagex_ 13y ago
      I have to wonder whether the MACs are "globally" unique - what's stopping an OEM using the same MAC? Also, I've seen router firmware features that will autogenerate a MAC for a guest network.
    • dobbsbob 13y ago
      That's why there was federal malware that captured MAC addresses on tormail when it was shut down. Easy for them to get Google to match it up to an identity
  • Elzair 13y ago
    Try tens of millions.
• progx 13y ago
  That mean, that the NSA know all passwords too? google must work with the NSA and must give them access to everything, but all is secret because FISA Laws.
• sspiff 13y ago
  > And, although they have never said so directly, it is obvious that Google can read the passwords. This is not necessarily true - they could encrypt this data so that it requires a user password to read, and transmit these settings for client-side decryption. They probably don't though, and in all likeliness can read your WiFi password.
  • cbr 13y ago
    This fails if the user forgets their password.
    • sspiff 13y ago
      Good point.
• deleted 13y ago
  [deleted]
• frank_boyd 13y ago
  Another reason to (really) go open-source/independent.
  • koide 13y ago
    How independent you'd have to be to be secure? Quite a whole lot. If you use a VPS, you can (will) be owned by your VPS provider and any Internet provider your traffic goes through. If you use colocation or self host, you will have to live without or self host/mantain/develop many alternatives for usual tools AND you can (will) be owned by all the internet providers your traffic goes through. Not a very nice scenario.
• jheriko 13y ago
  when did settings and data become vague terms precisely? sure people might not make the connection that their wifi password is both a setting and some data... do we really need to be alerted to this? although maybe a little info box or something with details of exactly what is sent might be appreciated by the power user...
• darkr 13y ago
  802.11x/EAP-TLS have been around for ages and are well supported on most hardware... As long as Google aren't collecting private keys _and_ usernames/passwords.
• holri 13y ago
  This means that I will never allow a phone with a proprietary system into my WIFI.
  • rimantas 13y ago
    How does non-proprietary system help you in this case? How do you know what I have on that system?
• tytso 13y ago
  The author is worried about WiFi passwords? If you trust that your WiFi is secure in general, you're in trouble. WPS is horribly insecure, for example, and that's what most home users use. Most user-chosen passwords are incredibly easy to guess for another. The better thing to do is to assume that your network traffic is always under surveillance (since the NSA is tapping Tier1 network providers), and to encrypt everything, or use network protocols which encrypt everything. The only thing WiFi passwords are good for is to prevent your neighbors from using your network and using up all of your bandwidth (which would slow down your network access) and preventing drive-by spammers/hackers from doing things which you might then get blamed for.
  • devx 13y ago
    Isn't it about time we get new security standards for Wi-Fi? Is there anything in the works right now to replace WPA2?
    • a-priori 13y ago
      The problem isn't limited to WPA2. As far as I know, in and of itself it's actually fairly secure. Most of the problem is that passwords are either easy for computers to crack or hard for humans to remember. The middle ground has disappeared as computational power has increased.
      • prawks 13y ago
        > passwords are either easy for computers to crack or hard for humans to remember Obligatory xkcd comic: https://xkcd.com/936/ https://xkcd.com/936/
        • vezzy-fnord 13y ago
          I loathe whenever people post that comic for one simple reason. Although mathematically the password given in the comic has a higher entropy and would take more time to crack under normal circumstances, the problem is that it follows a very simple and easily describable pattern: smash (four) dictionary words together into a combination. Crackers will simply start using wordlist rules to generate large lists of meshed together dictionary words and use them if they have good reason to believe you're using this pattern (pretty sure it's simple with tools like Crunch). Whether they'll guess the proper order is unknown, but as with any other case people will use certain permutations and combinations more than others.
• PeterisP 13y ago
  Are wifi passwords considered a security issue? I treat it the same way as a flimsy lock on a garden shed - I'd prefer both the shed and wifi to be open, but there's a formal "lock" to keep out teenage pranksters and drunks.
  • DanBC 13y ago
    Google having all the WIFI passwords is about as worrying as a government having a 3 day cache of everything - not very worrying unless they do stuff with it. Since Google has misused access to WIFI hotspots to slurp data it's a little bit more worrying. Since it's probably personal information it's also probably covered by data protection laws in some countries.
    • VMG 13y ago
      What stuff could they do? Log into your AP to torrent Breaking Bad episodes?
      • kamjam 13y ago
        Or someone else could do something that lands you in trouble... https://news.ycombinator.com/item?id=6358837 https://news.ycombinator.com/item?id=6358837
      • sudomal 13y ago
        Grab some confidential client documents that a not-so-clever employee dropped in their shared folder? Your example is at one end of the scale, my example is at the other end and there's lots between.
        • gizzlon 13y ago
          If you think your example is on one end of the scale you got too little imagination =)
      • deleted 13y ago
        [deleted]
• wglb 13y ago
  Or, in other words, Google remembers the things that we agree to have it remember.
  • jellicle 13y ago
    In contract law, there's a concept called "meeting of the minds". A contract is formed when there has been a meeting of the minds between two parties as to what the deal is, and the parties have taken some concrete action to initiate the deal - often signing something, or shaking hands, or handing over money, or something like that. The operative question is: when someone signs into a Google account on an Android device, and without any notification whatsoever the device sends his passwords to Google - which is what happens - has there been a meeting of the minds? Are both parties in agreement about what the deal is here?
    • wglb 13y ago
      I believe that there is also the concept of "Let the Buyer Beware". If someone says, which is what the android service does, that it is going to backup your data to the cloud. Not much of a stretch to think of your wifi password as part of that.
    • Oletros 13y ago
      > when someone signs into a Google account on an Android device, and without any notification whatsoever the device sends his passwords to Google - which is what happens - Data backup is opt in and there is a pretty screen in the setup to enable it if you want
• 16s 13y ago
  It's only been in the last few years that home wifi routers came with passwords by default. Before that, they defaulted to open access with no password.
• NanoWar 13y ago
  Ehem, and later this year Apple gets your finger print!
  • drp4929 13y ago
    ... and you think Android phone makers are not in mad rush to get a finger print sensor as early as possible ?
    • chinpokomon 13y ago
      It didn't do much to boost sales of the Atrix. The fingerprint reader doesn't do much to boost security when passwords are ultimately still being used. You don't need someone's finger when the account you are signing into still has inadequate security measures to begin with.
• ddalex 13y ago
  Don't worry, Google already knows EVERYTHING.
• cbr 13y ago
  Security is about tradeoffs. How bad would it be if someone else got this information? How helpful is it to me to give it to this third party? Wireless passwords are a huge pain: visit someone's house, ask them for their password, and then feel guilty while they look through various papers to find a long string of hex digits which are so annoying to enter on the phone. This pain makes the tradeoff well worth if for me (and I suspect for nearly everyone) when balanced against the low risk of Google doing something nasty with the saved passwords. (Disclaimer: I work for Google, but if I had an iPhone I'd want the same functionality.)
  • nly 13y ago
    QR codes could make entering secure keys in to mobile devices easier. Variations of Wi-Fi quick set-up can also be made reasonably secure, implementations just suck.
    • jami 13y ago
      In a world of unlimited bandwidth, I'd prefer to leave my wi-fi open (I won't live in fear of terrorists war-driving on my specific block), but I saw this framed QR code for wi-fi password idea on Pinterest: http://www.apartmenttherapy.com/share-your-wifi-password-with-guests-192845 http://www.apartmenttherapy.com/share-your-wifi-password-wit...
• niix 13y ago
  So
• thrillgore 13y ago
  It's troubling to see this, but I've always used MAC Filtering on my home network on top of WPA2 to limit what devices can connect to my network.
  • nly 13y ago
    MAC filtering is useless, even in combination with WPA2. An attacker only has to sniff for a MAC your AP is happy to talk to and then changes theirs.
    • qbproger 13y ago
      Is there a way to lock down a router in a way that can't be so easily spoofed?
      • deleted 13y ago
        [deleted]
      • nly 13y ago
        The best thing you can do is make sure your WPA2 password is totally random and long. Everything else is icing or next to negligible importance.
  • Jayschwa 13y ago
    Spoofing MAC addresses is trivial.
• nly 13y ago
  Google can also install anything on my phone remotely.
• d0m 13y ago
  That's how they can give internet for free, now I get it.
• guelo 13y ago
  Your WiFi password is only useful for someone who is within 100 feet of your house. If you have federal agents surveilling you from 100 feet away you have way bigger problems than your WiFi password.
  • brudgers 13y ago
    In general, I agree that distance is a factor. However, the range at which signals can be intercepted is substantially greater and repeating and recording equipment also comes into play. As do actors other than Federal agents.
  • LaGrange 13y ago
    While I don't like at all the idea of government surveillance without court order, I find the idea of corporate surveillance even more horrifying. Actually, this is what amuses me in the whole privacy affair. So a bunch of companies were using and abusing your data to target ads at you and shape your news stream so that it's more addictive, and people were cheering. A government (still mostly democratic, though not from my non-US perspective) is revealed to snoop on people illegally and people rage. I don't actually question the rage – but I see the complacent acceptance of the private companies using the same data as amusing. A large part (not whole, though) of what NSA does is taking your stuff from the place it already shouldn't have been. We're complaining about a fireplace in a burning forest.
    • anywherenotes 13y ago
      current government is irrelevant. The data captured now will exist likely forever. If at any point there's a new leader who wants to wipe out a race, he'll have much easier time than checking everyone's papers. I don't mind getting targeted ads, I prefer them to spam ads.
      • oneeyedpigeon 13y ago
        If all things are equal, then I too prefer targeted ads to non-targeted ads (I'm not going along with the "spam ads" labelling because all ads are spam). However, if it's a choice between a company having all my private data and sending me targeted ads, and the opposite of each, I tend to lean towards the latter.
• njharman 13y ago
  > backing up Wi-Fi passwords along with other assorted settings. And, although they have never said so directly, it is obvious that Google can read the passwords. That's not obvious. It's possible, common, and dare I say a "best practice" to store stuff like this encrypted. To be decrypted only on the device. Also, wifi passwords, Oh my!!! Security wise you should treat your wifi network as open whether it is or not. I.e. isolate it, firewall it, do not trust it.
• Zoomla 13y ago
  Google don't need your Wi-Fi passwords, they have admin rights to a computer inside your network (your phone).
• ovoxo 13y ago
  While the idea of Google knowing every wi-fi password is bad, they already know everything you search for and they also have a very good idea about all the websites you visit. So ...
• Havoc 13y ago
  If you're running an actual corporate network then a wifi password had better not be the sum total of the protection. For home use - who cares? It would be a sizable mission to make use of the password...and that would get them what? A couple of lolcats and my skyrim saved games? Nice.
• thomasahle 13y ago
  Funny story: I was once visiting my friends house in the English midlands. I had been there once before, but this time I had to find the way there myself. I managed to get the entire way to his street, but then I realized that I had forgotten his house number. He didn't pick up his phone, and I didn't want to knock on every door on the road. I was lost. Then I realized that the previous time I had visited, I had logged on his wifi. It was from a different phone, but with Google's sync all my old wifi passwords had been synced. I didn't remember the name he had given it, but I could walk along the road until I suddenly connected. Saved the night.
• shmerl 13y ago
  It's completely ridiculous that Google "backs up" passwords in clear text without encrypting them. Mozilla does that properly in their Sync service. So why can't Google do that?
  • noselasd 13y ago
    Maybe some men in black visited google and told them not to.
• diminoten 13y ago
  What does that mean? "Google knows"? That data exists in a database owned by Google, or that Google actively farms that data and makes use of it? Are you saying Google's using this for gain, or for any reason? Is there any evidence whatsoever to suggest that this data has ever been accessed by a Google employee ever, for any purpose whatsoever? Slight tangent, but the difference between "can" and "does" is a vast one I don't think people are getting, with all these privacy issues coming about these days. Here's a scary thought: any person who owns a gun/car/knife/taser/baseball bat can kill someone else with it. They could do it. Unless it "does" happen, and there's evidence that it happened, they don't get in trouble. What Google can do is almost endless. What it does do is what matters.
• gdamjan1 13y ago
  I hope the owncloud android app will one day have 'backup service' support, so that I can backup my android to a service I own/manage.
• chinpokomon 13y ago
  Does MAC filtering at the router level help at all? If the backup option is turned on, does Google also save your MAC addresses? If not, that seems like a good start to prevent someone from connecting to your network, even if they know the password. Obviously this won't help for public hot spots, but I always assume that public hot spots are already open to anyone. What if you are connecting to a Wi-Fi network using MSCHAP or MSCHAPv2? Does Google now know my domain login and password? That seems like a huge gaff.
  • consider_this 13y ago
    MAC filtering is trivially defeated by anyone who knows something about netsec. MSCHAP is not good enough anymore either.
• ffrryuu 13y ago
  So does the NSA, and not just your Wi-Fi passwords either. With the new iPhone, soon your fingerprint and movement data too.
• joosters 13y ago
  Why all the NSA crap in this thread? You don't need to add in a government agency to make this treasure trove of passwords valuable or dangerous. One day, this data will leak out, and then there will be trouble. Just having a reliable set of millions of real world passwords is invaluable - they'd be useful for brute-forcing other hashed password files.
• gjbondgaurav322 13y ago
  Absolutely, man Chrome is the best browser in the world and through that he can know everybody password...
• ChrisAntaki 13y ago
  When you buy a new Android phone, during the first setup it asks you if you'd like to enable this feature. I've always click "no". Not sure why the author assumes most Android users would enable this feature... unless he didn't realize it was an option on the initial setup.
• creatrixcordis 13y ago
  Great! Now the NSA knows every Wi-Fi password in the world! Which i am sure they are willing to share if just pushed a little.
• donniezazen 13y ago
  I do not agree with the statement that users aren't aware of if their settings are being backed up. It is one of the options that users get when setting up Google account on any Android phone.
• dinkumthinkum 13y ago
  The author must not realize that Google's "customers" are advertisers, not Web searchers or Android users. Why is the government having the data more scary than just Google having it, if we're going to be upset about it ...
• anigbrowl 13y ago
  And, anyone who does run across the setting can not hope to understand the privacy implication. I certainly did not. Why not? I see 'back up my settings' and I assume it means everything. For a computer security reporter to clutch his pearls and say 'I certainly did not' makes me wonder why he think he's qualified to write a column on this subject. Strictly outrage bait.
• Fando 13y ago
  Just forget about any internet privacy altogether. A new era has arrived.
• bobzibub 13y ago
  IM(Paranoid)O, it puts the "inadvertent" collection of SSIDs while driving down every street taking pictures for Google View into a new context. They gave a simply implausible explanation that this data was recorded "inadvertently". (No, fitting all those vehicles with the equipment and software would cost serious money!) Marry the Geo-location, SSID, phone owner and passwords and you've got real information for the authorities. On Everyone.
• darknezz19 13y ago
  tactile fearmonger execution.