131–140 of 614 posts
Every business that can should be ditching their Google services right now.
Earlier quoted context omitted.
> What matters is that large cloud systems are fundamentally incapable of protecting data. I don't believe that's true. 1. Google (and others?) is already aggressively increasing the amount of encryption it does on traffic between its datacenters. So they have been addressing this problem before it was even brought to light. 2. We easily have the encryption abilities to do many more things than we do with secure clou…
>In theory, fully homomorphic encryption could allow the best of both worlds above. I completely encrypt my data on my machine --- nobody else has the key --- then send it into the cloud where cloud companies can do operations for me like searching, sorting, filtering, etc, all without ever decrypting the data or learning what it is. Can you explain this to me? I don't understand how you can search encrypted data.
The idea is this: I encrypt my data and give it to the cloud. I also encrypt the algorithm I want the cloud to use. In this case, it could be a search algorithm with the search query hardcoded. Right now, it would have to be encoded as a circuit and then encrpyted from there into a different circuit.
The cloud runs my encrypted data through this "transformed" circuit, yielding some encrypted output. The cloud tells me the output. I then decrypt it with my original key.
It's crazy that this works (longstanding open problem solved in 2005 or 06 I think). The name "homomorphic" comes from functions f, like homomorphisms, in which "order doesn't matter":
f(data) = f(Decrypt(Encrypt(data))) = Decrypt(f(Encrypt(data))).
From the article: "Two engineers with close ties to Google exploded in profanity when they saw the drawing." That about sums up my reaction as well.
Why didn't they release these documents a long time ago when everyone was racing to judgement that Google, Yahoo, et al were secretly in cahoots with the NSA helping to build drag-net surveillance extranet stuff for them? These are very important revelations! I mean, when Greenwald/Snowden/Guardian released the original PRISM accusations, these slides would have provided a much much more important set of evidence, in…
We're still talking about Snowden. This is the reason.
Can anybody trust Google services anymore? It seems like it's pretty much a no-go at this point. Even if Google hands over select data from within their systems, it appears we cannot even trust that it makes it that far without being compromised. Every business that can should be ditching their Google services right now.
Earlier quoted context omitted.
You know what would outrage the public? ESPN being shut down. Most people do not actually care about their privacy. Even if everyone had the technical chops needed to understand what has been happening, most people never spend much time contemplating the importance of privacy rights.
> You know what would outrage the public? ESPN being shut down. No better way to state it. Our government is fucking us with our pants on but we're too distracted (by people getting paid hundreds of millions of dollars to throw a fucking ball around) to care.
If that graphic - that taunting smiley face, drawn when it was assumed that no one was watching - isn't enough to outrage the general public, I don't know what it will take. This is not super technical - it's easily explained and should be easily understood by the masses. And it should cause outrage.
People will no doubt come on this thread and remind everyone that of course the government always had access - you must have been a fool not to think so. But I just can not get over how angry it makes me. Honestly I thought that using google products with some exploitation of the contents for advertising was an acceptable exchange. This is just a total betrayal and I cannot believe that the Google board is not aware…
This might be a good time to go back and look at what you said to all those cypherpunks who kept talking about the need to build security into Internet protocols from day 1. Whitefield Diffie had pointed out this problem -- that online services could violate user privacy without any technical barriers -- in the 1970s and pointed to it to motivate public key cryptography. Throughout the 90s and 00s people were saying…
Earlier quoted context omitted.
> So does this suggest that Google's SSL encryption can be removed just as easily as that smiley face implies? Well, yes, if you are Google. The removal of SSL is done by Google's own front end servers at the boundary between the public internet and Google's own network, and Google's own network (including its private datacenter-to-datacenter fiber connections) are apparently not encrypted (which saves compute overhe…
Tell me if I understand this right: Google thought it was okay to not encrypt that 'internal' traffic, because even when trans-continental, that traffic was on 'private' Google fiber carrying only Google traffic, not the public internet. It was theoretically on a network that only Google had access to. That's why it seemed okay not to encrypt it, right? (Otherwise, I don't know why Google would have thought it didn't…