Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's end-to-end key distribution proposal

code.google.com

Post reply on HN
Print view View original

71–80 of 95 posts

Re: Google's end-to-end key distribution proposal

#71

Post by matchu »

tubelite wrote: post #21
jpgvm wrote: post #11

Earlier quoted context omitted.

The blockchain (as most people understand it atleast) is an implementation of a Merkle tree. Which is why Git/Bitcoin are eerily similar - they both utilize Merkle trees for integrity. The real innovation in the "blockchain" was using proof of work in combination with the Merkle tree in order to enforce a single history. Take that away and yes, it looks alot like Git. :)

And if you consider that a git commit is actually "proof of work" and find a way to quantify the value of that commit (fixes issue x which was worth y points, passes all regression tests), you would have... gitcoin.

For fun: Stripe's CTF3 included an implementation of Gitcoin in which the work wasn't actually semantically valuable contributions to a repo, but rather brute-forcing the commit message until the commit hash meets a certain criterion.

https://github.com/ctfs/write-ups/tree/master/stripe-ctf3/le...

Re: Google's end-to-end key distribution proposal

#72

Post by 8475693 »

yutah wrote: post #68
magicalist wrote: post #66

Earlier quoted context omitted.

This is part of End-To-End[1]. There's no way for their code to see the email contents, even locally in the browser. That's the whole point, in fact. [1] https://code.google.com/p/end-to-end/

If you can see your emails on your Android device and Google is admin on your device, why do you say that it is impossible for them to read your emails? I don't mean that they could read them in the cloud but if they can read them locally on your Android device and for example they could send a message back to Google saying "I think this guy should get ads for a new router".... but of course they could do much worst…

End-to-end is a browser extension that doesn't work on Android.

Re: Google's end-to-end key distribution proposal

#73

Post by skj »

oceanstone wrote: post #69
skj wrote: post #59

Earlier quoted context omitted.

Google responds to legal requests for information. The whole PRISM scandal was indicating that the NSA had some kind of direct link into the databases themselves. This assertion is what Google denied, and still denies. There's been a bit of a wandering definition for PRISM, from "they have NSA software with root access to all machines!" to "they receive LEO requests for information, which they review, and sometimes f…

> The whole PRISM scandal was indicating that the NSA had some kind of direct link into the databases themselves. Though, as Google and Yahoo later found out, the NSA was directly tapping cables between their data centers [1]. [1] http://www.wired.com/2013/10/nsa-hacked-yahoo-google-cables/

That appears to be several things:

1) True.

2) Consistent with statements made by Google.

3) Quickly mitigated by Google when it began encrypting traffic between data centers.

Re: Google's end-to-end key distribution proposal

#74

Post by fryguy »

blueskin_ wrote: post #14

So it seems they invented PGP keyservers with a monitoring protocol as a bag on the side? I've had keys on keyservers for years. The monitoring side is interesting though. It's also unclear how the whole directory will be compressed to 140 bytes - iirc, the best compression algorithms reduce text by ~80-90%, so it might work for a week or so, I guess.

Presumably the 140 characters is more like a git revision number than reversible compression.

Re: Google's end-to-end key distribution proposal

#75

Post by blueking »

TeMPOraL wrote: post #54
blueking wrote: post #34

Earlier quoted context omitted.

Thats how google works. Piecemeal. You think loon was about internet for the poor and oppressed ? Thats just how they get their foot in the door. Im sure google just wanted to write a draft spec for the fun of it. Google is a front for US intelligence. We should give no quarter. Shun them.

At the risk of sounding like a fanboy apologist, I must say you're making a lot of serious accusations against a one of the most benevolent company in the history of mankind. Some serious evidence should follow. Picking on Project Loon... come on, is there anything Google could do that you wouldn't immediately label as evil forefront of US intelligence?

The do no evil line is bullshit. This is not a benevolent company by any standard. The services are not free, you are just paying in a different currency.

Here is more on loon and look further up for links to the PRISM slides and documentation showing the companies involved including google were compensated financially by the NSA. The evidence is damning.

http://m.slashdot.org/story/194413

Look the bottom line here is these guys betrayed us. They are traitors, and we need to cut them out of our future.

Re: Google's end-to-end key distribution proposal

#76

Post by blueking »

skj wrote: post #59
denom wrote: post #58

Earlier quoted context omitted.

More to the point, what is the truth? Google leadership post 9/11 knew what "certifying" their communication systems meant and took the money to do it. Whether they knew that the program was named Prism is irrelevant, in my opinion.

Google responds to legal requests for information. The whole PRISM scandal was indicating that the NSA had some kind of direct link into the databases themselves. This assertion is what Google denied, and still denies. There's been a bit of a wandering definition for PRISM, from "they have NSA software with root access to all machines!" to "they receive LEO requests for information, which they review, and sometimes f…

Go look at the slides. The NSA isn't lying in its own internal documents. Of course google is in on it. Do you get how huge this infrastructure is ? Its a massive engineering effort to manage that kind of information flow.

What has happened here is google has got scared. Because without trusting users all their business models fall apart. So they are lying. Its that simple.

Re: Google's end-to-end key distribution proposal

#77

Post by blueking »

yutah wrote: post #68
magicalist wrote: post #66

Earlier quoted context omitted.

This is part of End-To-End[1]. There's no way for their code to see the email contents, even locally in the browser. That's the whole point, in fact. [1] https://code.google.com/p/end-to-end/

If you can see your emails on your Android device and Google is admin on your device, why do you say that it is impossible for them to read your emails? I don't mean that they could read them in the cloud but if they can read them locally on your Android device and for example they could send a message back to Google saying "I think this guy should get ads for a new router".... but of course they could do much worst…

Android was designed to leak as much information about the user as possible all the time, even to third parties. Spy satellites have less invasive software.

Re: Google's end-to-end key distribution proposal

#78

Post by contingencies »

TLDR is: Distributed (as in DNS) directory with append-only entries keyed by hash-of-email and third party replication/validation/logging.

Discussion of spam implications at https://moderncrypto.org/mail-archive/messaging/2014/000727....

Widespread encryption could be a recipe for Google (as the largest of the proposed directories) sliding in an identity reputation scheme (eg. based on location / communications history) and brokering it as a service.

Re: Google's end-to-end key distribution proposal

#79

Post by vidarh »

asuffield wrote: post #52
desas wrote: post #49

Earlier quoted context omitted.

It's not that simple (in the UK at least), you only have to stop processing information if "unwarranted and substantial damage or distress" is being caused.

Additionally, all stop processing / deletion regulations require a court order, which will be subject to all the usual requirements of justice.

It only takes a single successful demand before an append-only log because untenable.

Re: Google's end-to-end key distribution proposal

#80

Post by vidarh »

magicalist wrote: post #64
vidarh wrote: post #39

Earlier quoted context omitted.

You would not be able to stop individual users from doing so, but you could potentially make it legally untenable for commercial/corporate operators. But personally, regardless of legality, if Google implements this with the degree of disclosure of e-mail details, I'll find another operator that isn't implementing this proposal.

The whole point is ease of key exchange. Of course if you don't want any hint of your email details out in the world you shouldn't use it.

Ease of key exchange does not justify publishing what is effectively a public ledger of who I start communicating with when.
Post reply on HN