Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google backs off on previously announced Allo privacy feature

theverge.com

Post reply on HN
Print view View original

91–100 of 133 posts

Re: Google backs off on previously announced Allo privacy feature

#91

Post by themihai »

otabdeveloper1 wrote: post #63
nevir wrote: post #48

Earlier quoted context omitted.

The benefits of this sort of encryption & privacy infrastructure: * Protects you (user) from eavesdroppers between you and Google. * Protects your data from eavesdroppers inside Google's data centers. * Protects your data at rest (on disk). * Protects your data from malicious employees. * Enforces a great deal of scrutiny over who can access your data, and what they are allowed to see. But, yes, they process and stor…

> SSL only handles the first two bullet points. Only the first point. If Google works like every other data center in the world, then SSL stops the moment your data hits their first load balancer.

Most datancenters are lost once the internal network is hacked so I think that's a different issue. Encryption wouldn't help either because the attacker could get the keys too.

Re: Google backs off on previously announced Allo privacy feature

#92

Post by themihai »

themihai wrote: post #54
Zigurd wrote: post #36

Earlier quoted context omitted.

That's fine as far as trusting Google keeping their employees from doing bad things. But that's not the first concern one would have. Pervasive surveillance programs have penetrated service providers' data centers. Law enforcement can get warrants to access this information too easily, and many service providers turn over information on request, rather than requiring a warrant.

Well if you trust Google you don't need on-disk encryption in the first place. SSL already solved the transport issue.

My point that you have no control over the data once you send it to Google. You don't even know if they even encrypt it on their disk/server anyway.

Re: Google backs off on previously announced Allo privacy feature

#93

Post by tptacek »

zeveb wrote: post #79
idlewords wrote: post #78

Earlier quoted context omitted.

"Russia, if I Googled correctly." You clearly trust Google to some extent, since you search with it. I don't think you can accuse Google of not taking security seriously. They are making a security tradeoff that allows governments and insiders access to private data. This is a legitimate tradeoff to make, and a legitimate thing to criticize them for. Apple makes a different choice, and it's important that we have a d…

> I don't think you can accuse Google of not taking security seriously. I don't think they take my security, and the security of my data, seriously. They seem to care very much about their security. > They are making a security tradeoff that allows governments and insiders access to private data. This is a legitimate tradeoff to make No, at this point I don't believe that it is legitimate, any more than it's legitima…

Exactly how does almost singlehandedly transitioning the global Internet to forward-secure curve-based TLS help their security and not yours? All I can see in that work is cost for them.

Re: Google backs off on previously announced Allo privacy feature

#94

Post by Sylos »

nzp wrote: post #77
romanovcode wrote: post #29

Earlier quoted context omitted.

>Couldn't Google have made its billions still being not evil No. Google is advertising company and advertisement companies need a lot of user data for targeted ads.

Even if they weren't (mainly) an advertising company, even if they charged for all the free things, they'd still need all the data they suck in to provide services they provide.

That's simply not true. They collect a ton of data which they wouldn't have to collect, if they wouldn't run advertisements or could even just delete this data much earlier.

There's even crap like Android not allowing you to selectively turn off the Internet Permission for apps, for which there is no good reason other than Google needing an internet connection to display their ads.

Re: Google backs off on previously announced Allo privacy feature

#95

Post by CaptSpify »

zeveb wrote: post #79
idlewords wrote: post #78

Earlier quoted context omitted.

"Russia, if I Googled correctly." You clearly trust Google to some extent, since you search with it. I don't think you can accuse Google of not taking security seriously. They are making a security tradeoff that allows governments and insiders access to private data. This is a legitimate tradeoff to make, and a legitimate thing to criticize them for. Apple makes a different choice, and it's important that we have a d…

> I don't think you can accuse Google of not taking security seriously. I don't think they take my security, and the security of my data, seriously. They seem to care very much about their security. > They are making a security tradeoff that allows governments and insiders access to private data. This is a legitimate tradeoff to make No, at this point I don't believe that it is legitimate, any more than it's legitima…

Additionally: The google of tomorrow != the google of today. Even if you assume that google currently has the best security/privacy setup in place, they could suddenly turn around tomorrow and hand that to whoever they wanted.

Re: Google backs off on previously announced Allo privacy feature

#96

Post by navait »

tombrossman wrote: post #22
NetStrikeForce wrote: post #8

Earlier quoted context omitted.

One implies the other.

A fair percentage of people (myself included) are far more concerned about protecting our data from marketers, advertisers, and data brokers, than we are about going 100% 'tinfoil hat' mode and worrying whether the NSA is monitoring my messages for thought crimes. These are two very distinct issues and not everyone is concerned about both equally.

One of those things can kill you, or imprison you. The other one can send you mildly annoying ads.

Re: Google backs off on previously announced Allo privacy feature

#97

Post by zeveb »

idlewords wrote: post #83
zeveb wrote: post #79

Earlier quoted context omitted.

> I don't think you can accuse Google of not taking security seriously. I don't think they take my security, and the security of my data, seriously. They seem to care very much about their security. > They are making a security tradeoff that allows governments and insiders access to private data. This is a legitimate tradeoff to make No, at this point I don't believe that it is legitimate, any more than it's legitima…

Google's business is based on destroying what you and I consider to be privacy, so I don't see how you could expect them to change their minds about that. Google and similar companies have a coherent worldview in which they collect user data, protect it from outsiders and inside threats, and do benign and wonderful things for users in return. Within that worldview, they do an excellent and commendable job. Calling th…

> I'm curious about your comments on Apple. If I back up my phone to iCloud, how can Apple "MITM any time they want"?

I was referring to iMessage: my understanding is that it Apple is the CA for all iMessage keys, and thus they can issue a certificate to anyone, if they wish to or are compelled to.

Re: Google backs off on previously announced Allo privacy feature

#98

Post by kryptiskt »

tptacek wrote: post #93
zeveb wrote: post #79

Earlier quoted context omitted.

> I don't think you can accuse Google of not taking security seriously. I don't think they take my security, and the security of my data, seriously. They seem to care very much about their security. > They are making a security tradeoff that allows governments and insiders access to private data. This is a legitimate tradeoff to make No, at this point I don't believe that it is legitimate, any more than it's legitima…

Exactly how does almost singlehandedly transitioning the global Internet to forward-secure curve-based TLS help their security and not yours ? All I can see in that work is cost for them.

That's easy, TLS is great for Google as ISPs and wifi providers can't replace ads with their own in transit.

Re: Google backs off on previously announced Allo privacy feature

#99

Post by tptacek »

kryptiskt wrote: post #98
tptacek wrote: post #93

Earlier quoted context omitted.

Exactly how does almost singlehandedly transitioning the global Internet to forward-secure curve-based TLS help their security and not yours ? All I can see in that work is cost for them.

That's easy, TLS is great for Google as ISPs and wifi providers can't replace ads with their own in transit.

That is some Alex Jones level reasoning. There's no end-user security you can provide that can't be reframed that way.

Re: Google backs off on previously announced Allo privacy feature

#100

Post by nevir »

otabdeveloper1 wrote: post #63
nevir wrote: post #48

Earlier quoted context omitted.

The benefits of this sort of encryption & privacy infrastructure: * Protects you (user) from eavesdroppers between you and Google. * Protects your data from eavesdroppers inside Google's data centers. * Protects your data at rest (on disk). * Protects your data from malicious employees. * Enforces a great deal of scrutiny over who can access your data, and what they are allowed to see. But, yes, they process and stor…

> SSL only handles the first two bullet points. Only the first point. If Google works like every other data center in the world, then SSL stops the moment your data hits their first load balancer.

Google does not work like every other data center in the world. All internal services communicate over SSL (or similarly encrypted links)
Post reply on HN