Google encrypts data amid backlash against NSA spying • Hacker News Board

Re: Google encrypts data amid backlash against NSA spying

#81

Post by Zigurd » Sat, Sep 07, 2013, 3:16 AM UTC

chris_mahan wrote: post #59

zmmmmm wrote: post #20

Earlier quoted context omitted.

I would assume Google is big enough and smart enough to competently vet and deploy trusted encryption techniques.

Against the NSA? The same NSA we ask to intercept Russian, Chinese, Japanese, German, and Iranian encrypted Internet traffic? (To name a few. I'm sure the French are in there too.) Russia and China, I am sure, have enough smart people working on their cyber defenses that the NSA would have to be very, very, very good to penetrate those defenses. And if indeed they are, then do you think Google stands a chance?

Read up on the Crypto AG exploit. How many foreign governments still use Crypto AG gear for diplomatic communications?

Yes, they should be a lot more security conscious. But you might surprised how many trusted commercial vendors.

Re: Google encrypts data amid backlash against NSA spying

#82

Post by niels_olson » Sat, Sep 07, 2013, 3:21 AM UTC

jka wrote: post #77

anologwintermut wrote: post #41

Earlier quoted context omitted.

The revelations that NSA is running a HUMINT program should make it very clear that you can't trust everyone at Google or any other major provider. Those risks are mitigable, but it's expensive and I doubt most places take sufficient steps to prevent it. Even without that, trusting companies because their employees are honest is hard. There are some people at the NSA who really really care about privacy and not spyin…

Google (and other organizations) collecting and securing such vast troves of information -- and building the technology to analyze it quickly -- obviously makes them hugely valuable to attackers and defenders alike, since the data they are storing is the very information that attackers/defenders try to keep from each other. Encrypting it and securing it very well at a technology level means that the human element (I'…

I'm not aware of much successful recruiting. Most moles turn on their own. The game for the intel guys is like baseball: a lot of waiting and then serious hustle to make sure a fresh mole gets trained, vetted, rendered effective without getting caught.

Re: Google encrypts data amid backlash against NSA spying

#83

Post by Zigurd » Sat, Sep 07, 2013, 3:22 AM UTC

rayiner wrote: post #74

I can't believe traffic between data centers wasn't already encrypted.

Eh. If you own the whole fiber from place to place, you might be lulled into thinking the data never leaves your premises.

Re: Google encrypts data amid backlash against NSA spying

#84

Post by aaron42net » Sat, Sep 07, 2013, 3:27 AM UTC

tlrobinson wrote: post #27

Are they suggesting the NSA is tapping intra-data center communications? I hadn't seen that suggested before. That's interesting. I hadn't considered that could be how Prism works, but it would make sense if these companies weren't encrypting those connections previously. Somehow I assumed they were.

Most companies have historically considered dark fiber (where nobody else's network gear is involved) to be secure enough. Passively decoding dumps of hundreds of gigabits or terabits spread over many colors of light (DWDM) into useful data was generally thought of as prohibitively expensive and therefore not a viable threat.

The routers that can handle those speeds don't encrypt the link itself, so the most common solution is to do per-connection encryption between hosts with SSL or SSH or similar. Do you run SSL when talking to all of your internal APIs, databases, etc?

What about between nodes in EC2, particularly between availability zones? Those are potentially subject to the same sort of sniffing without Amazon's involvement.

Re: Google encrypts data amid backlash against NSA spying

#85

Post by bsullivan01 » Sat, Sep 07, 2013, 3:49 AM UTC

sjbach wrote: post #4

A salient bit: [Eric] Grosse echoed comments from other Google officials, saying that the company resists government surveillance and has never weakened its encryption systems to make snooping easier — as some companies reportedly have, according to the Snowden documents detailed by the Times and the Guardian on Thursday. “This is a just a point of personal honor,” Grosse said. “It will not happen here.” Some folks a…

“This is a just a point of personal honor,” Grosse said. “It will not happen here.”

Some folks are inclined to distrust Google, but there are people here who really, really care about security.

You bringing us to tears Mr Googler. I remember the "personal honor" or whatever about being adamant in providing the best results (now full of Google crap and advertiser sites) about not mixing ads with content (need I show examples?) and in many pages everything is ads, trying to trick the users in clicking them. Oh and all that crap about doing the right thing, "not evil" or whatever.

Google as a corporation is a just as scummy, if not more, as other corporations and will do anything for a dollar. So I trust them. Not. Sure they are decent people there, just as they are at Oracle or IBM but most will go with the flow and even defend the new policy.

Re: Google encrypts data amid backlash against NSA spying

#86

Post by aniket_ray » Sat, Sep 07, 2013, 3:52 AM UTC

adrianlmm wrote: post #12

myko wrote: post #10

Earlier quoted context omitted.

What US company doesn't cooperate with the NSA? Google responds to lawful requests by the US government as appropriate. It's up to US citizens to change the law if they don't like it.

If Google really wants to help then it should stop tracking their users, stop spying on me and stop trying to force me to sing up to G+, they cannot give data to the NSA if they stop getting it as simple as that, but, all the NSA has to do is buy the information from Google, after all, they sell it.

Employees at Google are not tracking you.

Programmatic algorithms on some Google properties are processing your data to show you the most relevant content (search, G+ posts, mail, news etc) and advertisements. There is a big difference between this "tracking" and the kind of snooping that spy organizations do.

By the way I'll be surprised if all spy organizations and not just NSA aren't trying their best to get more information on certain people from wherever they can.

Re: Google encrypts data amid backlash against NSA spying

#87

Post by thrownaway2424 » Sat, Sep 07, 2013, 3:52 AM UTC

chris_mahan wrote: post #59

zmmmmm wrote: post #20

Earlier quoted context omitted.

I would assume Google is big enough and smart enough to competently vet and deploy trusted encryption techniques.

Against the NSA? The same NSA we ask to intercept Russian, Chinese, Japanese, German, and Iranian encrypted Internet traffic? (To name a few. I'm sure the French are in there too.) Russia and China, I am sure, have enough smart people working on their cyber defenses that the NSA would have to be very, very, very good to penetrate those defenses. And if indeed they are, then do you think Google stands a chance?

You think Google is just running all their datacenter traffic through a Sonicwall or something? Think about it.

Re: Google encrypts data amid backlash against NSA spying

#88

Post by thrownaway2424 » Sat, Sep 07, 2013, 3:54 AM UTC

tlrobinson wrote: post #27

Are they suggesting the NSA is tapping intra-data center communications? I hadn't seen that suggested before. That's interesting. I hadn't considered that could be how Prism works, but it would make sense if these companies weren't encrypting those connections previously. Somehow I assumed they were.

Google has datacenters all over the world, including in hyper-intrusive surveillance states like India. The NSA is not the only reason to encrypt long-haul private traffic.

Re: Google encrypts data amid backlash against NSA spying

#89

Post by aniket_ray » Sat, Sep 07, 2013, 3:55 AM UTC

grandalf wrote: post #64

I think it's too late. Google has shown that it can't be trusted, especially about privacy.

What do you mean? Care to share more details?

AFAICT, Google has been completely transparent about giving users control about how their data is shared. It's been ahead of the pack in protecting its users rights even going to courts to protect users.

Disclaimer:I am an Engineer@Google.

Re: Google encrypts data amid backlash against NSA spying

#90

Post by nl » Sat, Sep 07, 2013, 3:56 AM UTC

Zigurd wrote: post #5

> Encrypting information flowing among data centers will not make it impossible for intelligence agencies to snoop on individual users of Google services, nor will it have any effect on legal requirements that the company comply with court orders or valid national security requests for data. How does this do anything about pervasive NSA spying? The NSA has broken SSL and VPNs by corrupting the CAs and the VPN vendors…

How does this do anything about pervasive NSA spying?

Google clearly suspects the NSA is installing devices on the leased lines they use for inter-datacenter communications.

Properly implemented, this will stop that.

The NSA has broken SSL and VPNs by corrupting the CAs and the VPN vendors.

I suspect Google won't use a commercial VPN implementation. Corrupted CAs can be bypassed by using self-signed certificates, which will be fine for communication within the same company.