8 ms·
Even with everything you say, Google was still defeated by the NSA. Will Google ever catch up in this arms race? "95% encrypted" == "100% compromised"
by gohrt 13y ago
Even with everything you say, Google was still defeated by the NSA. Will Google ever catch up in this arms race? "95% encrypted" == "100% compromised"
- tptacek 13y agoGoogle appears to have been so on the ball with this stuff that the NSA literally had to send bag men to their cages in order to retain access.
- chris_mahan 13y agoWait, so until google can defend its cages against the g-men, then all efforts will be in vain. Also, in other countries, I assume those g-men have access to those cages.
- dlinder 13y agoWhen your opponent uses Navy submarines to tap undersea cables right under the Soviets' noses, you probably shouldn't trust your leased fiber with unencrypted data. This interception could occur where undersea cables make landfall without any datacenter antics.
- sixothree 13y agoI've seen no indication that Google considers the NSA any sort of opponent.
- swombat 13y agoI think they do now. There has to be some sort of sense of personal professionalism of the many highly qualified security experts working at Google, that is hurt by the revelations that the NSA basically fucked them over and drew a slide with a smiley face on it about how they fucked them over.
- unreal37 13y agoWith governments around the world (see Brazil and India) now banning Google products for official government use, I can imagine overall usage of Google products will decline outside of the U.S. This is a threat to Google's international business. They have a vested financial interest in reducing the hacking against their systems.
- wonderzombie 13y agohttp://www.washingtonpost.com/business/technology/google-encrypts-data-amid-backlash-against-nsa-spying/2013/09/06/9acc3c20-1722-11e3-a2ec-b47e45e6f8ef_story.html http://www.washingtonpost.com/business/technology/google-enc... “It’s an arms race,” said Eric Grosse, vice president for security engineering at Google, based in Mountain View, Calif. “We see these government agencies as among the most skilled players in this game.”
- bhousel 13y agoWhy would NSA agents go through all the trouble of tapping cables when they could probably just gain employment at Google and do whatever they want. I don't think encryption would make a difference here.
- selmnoo 13y agoThere's greater risk of facing problems of all sorts when you have rogue agents on the inside (what if they get found out? how will that be met by news journals? people who find out about it? the trust dynamics between CEOs and government agencies that request access in a legal way, when needed?). The risk of things going wrong when you're tapping cables is much less pronounced as far as I can see.
- samstave 13y agoAnyone care to comment on FBs Max Kelly, head of security flip-flop employment between FB and NSA? How can that guy be trusted with anything? http://www.dailymail.co.uk/news/article-2347047/Former-Facebook-security-chief-working-NSA.html http://www.dailymail.co.uk/news/article-2347047/Former-Faceb...
- fnordfnordfnord 13y agoApparently unconstrained by resources, they decided to attack from multiple angles.
- bjt 13y agoI'm not sure why you think that's so easy to do. You need a person who: 1. Has the technical credentials and interviewing skills to get hired at Google (not easy). 2. Has a security clearance. 3. Wants to be a spy. 4. Can get themselves assigned to the team working on datacenter interconnects. 5. Can set up a tap on the interconnect without getting caught. That sounds both hard and expensive to me.
- samstave 13y agoTake those requirements in reverse and apply them to an already employed NSA person -- then send them out to apply for jobs as an asset.
- chiph 13y agoyou probably shouldn't trust your leased fiber with unencrypted data. Or even your own fiber (Google owns tens of thousands of miles of it). There's nothing to prevent the black-hat guys from digging down to a cable in the middle of nowhere and installing an optical tap. Especially if they did it before commissioning, after which signal levels would start being monitored.
- gwright 13y agoThe article seems to suggest that it was inter-site links that were compromised and not actual Google data centers. Those compromises could happen at telco data centers or even in the field (e.g., by splicing monitoring equipment into a cable).
- mkr-hn 13y agoGoogle might have an easier time recruiting edge producing developers than the NSA after the leaks.
- hackula1 13y agoI imagine anyone with a line on their resume that says "NSA - Software Developer - 2009:Present" is going to have a hard time finding a new job at many companies (although certainly not all).
- mkr-hn 13y agoI would expect Google and similarly enormous companies to have a process in place to keep rogue agents from inserting backdoors and malicious code.
- hackula1 13y agoWhile this another angle, I was referring to the fact that many people will see these engineers as immoral and spineless. I know that I would not hire the person who drew that smiley face or any of their accomplices.
- w_t_payne 13y agoAnd if you did hire that person, I would never trust you again with my business.
- w_t_payne 13y agoYou have to trust your developers. You can do audits, but the problem is intractably difficult. Developers have a TREMENDOUS amount of power. Trust is absolutely, utterly, irreconcilably fundamental to the job. If you cannot trust your developers, you are screwed every which way to Sunday. If your developers are compromised, you have to assume that your whole business is compromised.
- andyzweb 13y agohttp://xkcd.com/898/ http://xkcd.com/898/
- dragonwriter 13y ago> Even with everything you say, Google was still defeated by the NSA. Well, actually, per the article, by GCHQ. Who, as well as using the data themselves, also allows the NSA access to it.