8 ms·

Google also knows all the secrets of General David Petraeus, or anyone else that uses Gmail. And everything you've (secretly) searched for. Google's business

by crb 13y ago

Google also knows all the secrets of General David Petraeus, or anyone else that uses Gmail. And everything you've (secretly) searched for. Google's business model is based on aggregating that information and gaining value out of the data, mostly in the form of advertising. As soon as it lets a major secret out, even just once, it's game over, and no-one will ever trust a secret to Google again. This is why they publish videos saying that no-one can ever walk out of a Google data centre with a hard drive. I continue to use the services I use because I find the benefit I gain from them, more useful than the potential risk of exposure. Should these secrets be encrypted? If they were, it would be possible for Google to steal your key if they wanted to. This is the same kind of perception problem that led to the Chrome team being hauled over the coals in public for not encrypting saved passwords. They have to be available to be useful, but people would rather perceive they weren't available.

batemanesque 13y ago
I agree that it's unlikely Google as a whole would decide to read/use confidential data. on the other hand, the idea that someone w/in Google might abuse their position is completely plausible. if we know that people at the NSA were passing around phone sex calls by US troops, do you really want to keep trusting that no-one at Google will ever do anything problematic w/ yr data? edit: to be clear, I use Google services all the time & store a lot of confidential data w/ them. but there need to be institutional (whether at Google or outside it) safeguards that go beyond trusting a company as a whole to always behave in a way compatible w/ its own rational self-interest.
- Amadou 13y ago
  Given that Google has a VC arm, I am stunned every time I run into a VC who uses gmail and other google-hosted services as part of their business. They are handing their competition an enormous chunk of their business proprietary information and trusting them not to peek at it without even a contract. To me, that level of naivety with respect to operational security is just baffling. All it takes is one unscrupulous person in the right place at Google and those convenient, "free" services could end up costing millions. It isn't like the people in the finance industry have a reputation for being upstandingly moral either.
  - ganeumann 13y ago
    For this to be a worry, every person up both branches of a very large hierarchical organization tree--all the way up to where a Google Ventures employee and a Gmail developer both report to the same person--would have to agree to it. Google Ventures, no matter how spectacularly they might do as VCs, will always be several orders of magnitude less important to Google than Gmail. Google Ventures invests $300 million per year. Say they are always, every year, one of the top VCs so they--every year--deliver 3x on the money invested a few years before. They are still delivering less than $1 billion, less than 2% of Google's revenue. In reality, it will probably be more like 1%, plus or minus 4%. And also, in reality, it won't be considered revenue, it will be Extraordinary Gains from Non-operational Events, or some such accounting gibberish, and nobody on Wall Street will give them any credit for it.
    - Amadou 13y ago
      For this to be a worry, every person up both branches of a very large hierarchical organization tree--all the way up to where a Google Ventures employee and a Gmail developer both report to the same person--would have to agree to it. That's ridiculous. The risk isn't institutionalized abuse, the threat is an unscrupulous guy in the Ventures group who has a buddy who works in the gmail (or other) groups. Calls him up one night and says, "Can you do me a big favor? Check out so-and-so and see what he's working on." It isn't about Google's bottom line on wall street, it is about an individual abusing access to further his own career.
      - ganeumann 13y ago
        You make the false assumption that people in different divisions of a very large company would be more likely to help each other outside of the corporate reward structure than they would be to help someone outside the company, who they might just happen to have personal or social obligations to. If there were an unscrupulous person in the gmail group, he would be more likely to break company policy (and, I think, the law) with someone who does not work for Google than with someone who does, unless it were motivated by someone up the chain at Google itself. Saying that someone at Gmail is sharing your secrets may be a worry. That they would share them with Google Ventures is far less likely than that they would share them with someone else entirely. And frankly, if someone were to try to profit from stolen information, they'd be looking at hedge fund manager emails and investment banker emails. The very slight edge you might get from seeing some VC's email is worth less than a cup of coffee at Starbucks, if you risk-adjust it and discount it back to the present.
- tripzilch 13y ago
  > on the other hand, the idea that someone w/in Google might abuse their position is completely plausible. > if we know that people at the NSA were passing around phone sex calls by US troops, do you really want to keep trusting that no-one at Google will ever do anything problematic w/ yr data? Already happened: http://gawker.com/5638874/david-barksdale-wasnt-googles-first-spying-engineer http://gawker.com/5638874/david-barksdale-wasnt-googles-firs...
  - batemanesque 13y ago
    exactly. fill the most solipsistic company in the world w/ self-exalting geeks & you're bound to get more than a few creeps who don't understand social boundaries.
- TsiCClawOfLight 13y ago
  You should all read "the silicon jungle". It's by an ex-googler, and it's amazing.
- bsullivan01 13y ago
  All it takes a few, not "Google as a whole." I am not a fan of Google, but I feel that in Larry Page's era few things are sacred when it comes to making money. Maybe a Googler decides to read some Goldman Sachs' trader emails, or Google in general can sell trend data. Who knows? They have (IMO) ruined search and destroying any trust in its fairness, yet they are a monopoly, have a lot of goodwill and nothing is happening. So far.
amirmc 13y ago
> "As soon as it lets a major secret out, even just once, it's game over, and no-one will ever trust a secret to Google again." I used to think this but now I'm not so sure. With the way services like FB and others slowly change settings, Sony gets hacked and other data breaches, news about govt spying etc, I wonder whether the mass public is suffering from Learned Helplessness [1]. After all, what alternatives do most people really have? [1] http://en.m.wikipedia.org/wiki/Learned_helplessness http://en.m.wikipedia.org/wiki/Learned_helplessness
- jmcintyre 13y ago
  From http://gawker.com/5637234/gcreep-google-engineer-stalked-tee.. http://gawker.com/5637234/gcreep-google-engineer-stalked-tee.... >In at least four cases, Barksdale spied on minors' Google accounts without their consent, according to a source close to the incidents. In an incident this spring involving a 15-year-old boy who he'd befriended, Barksdale tapped into call logs from Google Voice, Google's Internet phone service, after the boy refused to tell him the name of his new girlfriend, according to our source. After accessing the kid's account to retrieve her name and phone number, Barksdale then taunted the boy and threatened to call her. In other cases involving teens of both sexes, Barksdale exhibited a similar pattern of aggressively violating others' privacy, according to our source. He accessed contact lists and chat transcripts, and in one case quoted from an IM that he'd looked up behind the person's back. (He later apologized to one for retrieving the information without her knowledge.) In another incident, Barksdale unblocked himself from a Gtalk buddy list even though the teen in question had taken steps to cut communications with the Google engineer. I guess there are similar incidents happening at almost all cloud providers, but even if detected by the company, we don't hear about them because they're really bad PR. All they come up with is, "trust us, things are secured". And no one cares anyway because Gmail, Docs and Outlook.com are slick and convenient.
  - Ziomislaw 13y ago
    Wish I had more upvotes.
  - superuser2 13y ago
r0h1n 13y ago
> As soon as it lets a major secret out, even just once, it's game over, and no-one will ever trust a secret to Google again. Just out of curiosity, how would we know even if a secret was let out to, say, the NSA or US Govt? Because (a) Google isn't allowed to legally acknowledge it and (b) US LEOs will use "parallel construction" to obscure the fact that they obtained such secret information. Moreover, if you're not a US citizen, even lesser chances of ever coming to know what information is being handed over/intercepted by the US Govt. If Presidents of countries can be targeted for surveillance, no reason a common person cannot. Please note, I am not saying Google was specifically guilty of passing on info to the NSA in these cases, but just that, even if they were forced to, there's no way the affected users would come to know. Link: http://worldnews.nbcnews.com/_news/2013/09/02/20291489-snowden-leak-journalist-nsa-spied-on-emails-of-brazil-and-mexico-presidents http://worldnews.nbcnews.com/_news/2013/09/02/20291489-snowd...
- educating 13y ago
  > Just out of curiosity, how would we know even if a secret was let out to, say, the NSA And the smartest thing to do, whether you are the NSA or some other foreign government or any entity that holds that information, is to keep quiet about it. The less others know that you know something, the more power you have. For that reason, it is unlikely that we will see these powers used by the NSA, or other government. It is in their best interest to hold on to that data as secretly as possible and as restrictively as possible, to avoid the chance of others getting a hold of the data. Snowden if anything has only given the NSA and all others who hold the information that we do not know about reason to be careful open even mentioning that they have the data, to anyone.
  - SideburnsOfDoom 13y ago
    > For that reason, it is unlikely that we will see these powers used by the NSA, or other government. The "parallel construction" mentioned above is how they do use these powers while obscuring the use of these secrets.
- DominikR 13y ago
  Is this Googles failure or are goverments the issue? You cannot prevent that some entity will have private data about you, once you start using mainstream online services whose focus is on mainstream issues like ease of use, portability of data and seamless access from multiple devices. Ensuring that the legal frameworks we live within have strong privacy laws makes more sense to me, because what are the realistic options for any of the mayor tech players right now, when they face a data request from the US goverment other than fighting it in the courts? (which they do) Moving all Google employees to Iceland or some asian country and closing all offices in the US/Western Europe? Closing down any service that collects private data?
willvarfar 13y ago
All these secrets have been sent in plaintext between Google data-centres over 'dark fibre' we now suspect the NSA has been wholescale recording. There are belated efforts by google to encrypt the traffic between its data centres, but its basically too late.
- mmagin 13y ago
  It's not 'dark fibre' if you're using it.
  - jethro_tell 13y ago
    He's just talking about the time between the bits.
    - moocowduckquack 13y ago
      Surely that would be half lit.
  - packetslave 13y ago
    Dark fiber is a fairly well-accepted industry term for fiber that you operate yourself, with your own lasers, as opposed to capacity that you lease from a telco and just provide your bits via serial or whatever. It has also been considered to be pretty secure against eavesdropping due to multiplexing and just the sheer amount of data that can be shoved down a single long-haul fiber these days (5+ Tb/sec). Unfortunately, that's no longer necessarily true when you're up against an adversary with nation-state resources.
coldtea 13y ago
>Google's business model is based on aggregating that information and gaining value out of the data, mostly in the form of advertising. As soon as it lets a major secret out, even just once, it's game over, and no-one will ever trust a secret to Google again. Really? Because from what I've seen, the general public (including companies) would just continue using it without caring.
deleted 13y ago
[deleted]
devx 13y ago
By that logic Google wouldn't encrypt the data between servers, in response to NSA revelations either. Yet, they're doing that. The point is it should at least be secure from outsiders/internal spies.
orblivion 13y ago
These are all great points but let us know for God's sake. You trust them, and I sure trust them with a lot of secrets. But they have to ask. I would have no idea if not for Hacker News. CyanogenMod is on my list. EDIT: Oh, and "backing up" my contacts without asking me. That made me livid, that's the height of arrogance. And yet I still use Android.

by crb 13y ago

batemanesque 13y ago

I agree that it's unlikely Google as a whole would decide to read/use confidential data. on the other hand, the idea that someone w/in Google might abuse their position is completely plausible. if we know that people at the NSA were passing around phone sex calls by US troops, do you really want to keep trusting that no-one at Google will ever do anything problematic w/ yr data? edit: to be clear, I use Google services all the time & store a lot of confidential data w/ them. but there need to be institutional (whether at Google or outside it) safeguards that go beyond trusting a company as a whole to always behave in a way compatible w/ its own rational self-interest.

Amadou 13y ago
Given that Google has a VC arm, I am stunned every time I run into a VC who uses gmail and other google-hosted services as part of their business. They are handing their competition an enormous chunk of their business proprietary information and trusting them not to peek at it without even a contract. To me, that level of naivety with respect to operational security is just baffling. All it takes is one unscrupulous person in the right place at Google and those convenient, "free" services could end up costing millions. It isn't like the people in the finance industry have a reputation for being upstandingly moral either.
- ganeumann 13y ago
  For this to be a worry, every person up both branches of a very large hierarchical organization tree--all the way up to where a Google Ventures employee and a Gmail developer both report to the same person--would have to agree to it. Google Ventures, no matter how spectacularly they might do as VCs, will always be several orders of magnitude less important to Google than Gmail. Google Ventures invests $300 million per year. Say they are always, every year, one of the top VCs so they--every year--deliver 3x on the money invested a few years before. They are still delivering less than $1 billion, less than 2% of Google's revenue. In reality, it will probably be more like 1%, plus or minus 4%. And also, in reality, it won't be considered revenue, it will be Extraordinary Gains from Non-operational Events, or some such accounting gibberish, and nobody on Wall Street will give them any credit for it.
  - Amadou 13y ago
    For this to be a worry, every person up both branches of a very large hierarchical organization tree--all the way up to where a Google Ventures employee and a Gmail developer both report to the same person--would have to agree to it. That's ridiculous. The risk isn't institutionalized abuse, the threat is an unscrupulous guy in the Ventures group who has a buddy who works in the gmail (or other) groups. Calls him up one night and says, "Can you do me a big favor? Check out so-and-so and see what he's working on." It isn't about Google's bottom line on wall street, it is about an individual abusing access to further his own career.
    - ganeumann 13y ago
      You make the false assumption that people in different divisions of a very large company would be more likely to help each other outside of the corporate reward structure than they would be to help someone outside the company, who they might just happen to have personal or social obligations to. If there were an unscrupulous person in the gmail group, he would be more likely to break company policy (and, I think, the law) with someone who does not work for Google than with someone who does, unless it were motivated by someone up the chain at Google itself. Saying that someone at Gmail is sharing your secrets may be a worry. That they would share them with Google Ventures is far less likely than that they would share them with someone else entirely. And frankly, if someone were to try to profit from stolen information, they'd be looking at hedge fund manager emails and investment banker emails. The very slight edge you might get from seeing some VC's email is worth less than a cup of coffee at Starbucks, if you risk-adjust it and discount it back to the present.
tripzilch 13y ago
> on the other hand, the idea that someone w/in Google might abuse their position is completely plausible. > if we know that people at the NSA were passing around phone sex calls by US troops, do you really want to keep trusting that no-one at Google will ever do anything problematic w/ yr data? Already happened: http://gawker.com/5638874/david-barksdale-wasnt-googles-first-spying-engineer http://gawker.com/5638874/david-barksdale-wasnt-googles-firs...
- batemanesque 13y ago
  exactly. fill the most solipsistic company in the world w/ self-exalting geeks & you're bound to get more than a few creeps who don't understand social boundaries.
TsiCClawOfLight 13y ago
You should all read "the silicon jungle". It's by an ex-googler, and it's amazing.
bsullivan01 13y ago
All it takes a few, not "Google as a whole." I am not a fan of Google, but I feel that in Larry Page's era few things are sacred when it comes to making money. Maybe a Googler decides to read some Goldman Sachs' trader emails, or Google in general can sell trend data. Who knows? They have (IMO) ruined search and destroying any trust in its fairness, yet they are a monopoly, have a lot of goodwill and nothing is happening. So far.

amirmc 13y ago

> "As soon as it lets a major secret out, even just once, it's game over, and no-one will ever trust a secret to Google again." I used to think this but now I'm not so sure. With the way services like FB and others slowly change settings, Sony gets hacked and other data breaches, news about govt spying etc, I wonder whether the mass public is suffering from Learned Helplessness [1]. After all, what alternatives do most people really have? [1] http://en.m.wikipedia.org/wiki/Learned_helplessness http://en.m.wikipedia.org/wiki/Learned_helplessness

jmcintyre 13y ago
From http://gawker.com/5637234/gcreep-google-engineer-stalked-tee.. http://gawker.com/5637234/gcreep-google-engineer-stalked-tee.... >In at least four cases, Barksdale spied on minors' Google accounts without their consent, according to a source close to the incidents. In an incident this spring involving a 15-year-old boy who he'd befriended, Barksdale tapped into call logs from Google Voice, Google's Internet phone service, after the boy refused to tell him the name of his new girlfriend, according to our source. After accessing the kid's account to retrieve her name and phone number, Barksdale then taunted the boy and threatened to call her. In other cases involving teens of both sexes, Barksdale exhibited a similar pattern of aggressively violating others' privacy, according to our source. He accessed contact lists and chat transcripts, and in one case quoted from an IM that he'd looked up behind the person's back. (He later apologized to one for retrieving the information without her knowledge.) In another incident, Barksdale unblocked himself from a Gtalk buddy list even though the teen in question had taken steps to cut communications with the Google engineer. I guess there are similar incidents happening at almost all cloud providers, but even if detected by the company, we don't hear about them because they're really bad PR. All they come up with is, "trust us, things are secured". And no one cares anyway because Gmail, Docs and Outlook.com are slick and convenient.
- Ziomislaw 13y ago
  Wish I had more upvotes.
- superuser2 13y ago

r0h1n 13y ago

> As soon as it lets a major secret out, even just once, it's game over, and no-one will ever trust a secret to Google again. Just out of curiosity, how would we know even if a secret was let out to, say, the NSA or US Govt? Because (a) Google isn't allowed to legally acknowledge it and (b) US LEOs will use "parallel construction" to obscure the fact that they obtained such secret information. Moreover, if you're not a US citizen, even lesser chances of ever coming to know what information is being handed over/intercepted by the US Govt. If Presidents of countries can be targeted for surveillance, no reason a common person cannot. Please note, I am not saying Google was specifically guilty of passing on info to the NSA in these cases, but just that, even if they were forced to, there's no way the affected users would come to know. Link: http://worldnews.nbcnews.com/_news/2013/09/02/20291489-snowden-leak-journalist-nsa-spied-on-emails-of-brazil-and-mexico-presidents http://worldnews.nbcnews.com/_news/2013/09/02/20291489-snowd...

educating 13y ago
> Just out of curiosity, how would we know even if a secret was let out to, say, the NSA And the smartest thing to do, whether you are the NSA or some other foreign government or any entity that holds that information, is to keep quiet about it. The less others know that you know something, the more power you have. For that reason, it is unlikely that we will see these powers used by the NSA, or other government. It is in their best interest to hold on to that data as secretly as possible and as restrictively as possible, to avoid the chance of others getting a hold of the data. Snowden if anything has only given the NSA and all others who hold the information that we do not know about reason to be careful open even mentioning that they have the data, to anyone.
- SideburnsOfDoom 13y ago
  > For that reason, it is unlikely that we will see these powers used by the NSA, or other government. The "parallel construction" mentioned above is how they do use these powers while obscuring the use of these secrets.
DominikR 13y ago
Is this Googles failure or are goverments the issue? You cannot prevent that some entity will have private data about you, once you start using mainstream online services whose focus is on mainstream issues like ease of use, portability of data and seamless access from multiple devices. Ensuring that the legal frameworks we live within have strong privacy laws makes more sense to me, because what are the realistic options for any of the mayor tech players right now, when they face a data request from the US goverment other than fighting it in the courts? (which they do) Moving all Google employees to Iceland or some asian country and closing all offices in the US/Western Europe? Closing down any service that collects private data?

willvarfar 13y ago

All these secrets have been sent in plaintext between Google data-centres over 'dark fibre' we now suspect the NSA has been wholescale recording. There are belated efforts by google to encrypt the traffic between its data centres, but its basically too late.

mmagin 13y ago
It's not 'dark fibre' if you're using it.
- jethro_tell 13y ago
  He's just talking about the time between the bits.
  - moocowduckquack 13y ago
    Surely that would be half lit.
- packetslave 13y ago
  Dark fiber is a fairly well-accepted industry term for fiber that you operate yourself, with your own lasers, as opposed to capacity that you lease from a telco and just provide your bits via serial or whatever. It has also been considered to be pretty secure against eavesdropping due to multiplexing and just the sheer amount of data that can be shoved down a single long-haul fiber these days (5+ Tb/sec). Unfortunately, that's no longer necessarily true when you're up against an adversary with nation-state resources.

coldtea 13y ago

>Google's business model is based on aggregating that information and gaining value out of the data, mostly in the form of advertising. As soon as it lets a major secret out, even just once, it's game over, and no-one will ever trust a secret to Google again. Really? Because from what I've seen, the general public (including companies) would just continue using it without caring.

deleted 13y ago

[deleted]

devx 13y ago

By that logic Google wouldn't encrypt the data between servers, in response to NSA revelations either. Yet, they're doing that. The point is it should at least be secure from outsiders/internal spies.

orblivion 13y ago

These are all great points but let us know for God's sake. You trust them, and I sure trust them with a lot of secrets. But they have to ask. I would have no idea if not for Hacker News. CyanogenMod is on my list. EDIT: Oh, and "backing up" my contacts without asking me. That made me livid, that's the height of arrogance. And yet I still use Android.