Live data from Hacker News

Google encrypts data amid backlash against NSA spying

washingtonpost.com

71–80 of 153 posts

Re: Google encrypts data amid backlash against NSA spying

#71
post #4

A salient bit: [Eric] Grosse echoed comments from other Google officials, saying that the company resists government surveillance and has never weakened its encryption systems to make snooping easier — as some companies reportedly have, according to the Snowden documents detailed by the Times and the Guardian on Thursday. “This is a just a point of personal honor,” Grosse said. “It will not happen here.” Some folks a…

Completely off topic but trying to scroll the way HN handles 'quoted' / 'code' bits is terribly painful. Has anyone solved this? I'm using 'Hacker News Enhancement Suite' but this problem still make me unhappy and constantly causes me to rewrite such blocks in my own posts.

Re: Google encrypts data amid backlash against NSA spying

#72
post #20

Earlier quoted context omitted.

I would assume Google is big enough and smart enough to competently vet and deploy trusted encryption techniques.

Against the NSA? The same NSA we ask to intercept Russian, Chinese, Japanese, German, and Iranian encrypted Internet traffic? (To name a few. I'm sure the French are in there too.) Russia and China, I am sure, have enough smart people working on their cyber defenses that the NSA would have to be very, very, very good to penetrate those defenses. And if indeed they are, then do you think Google stands a chance?

Do we think that Google (which boasts among current and former employees: Joshua Bloch, Guido van Rossum, Sebastian Thrun, Luis von Ahn, and that's just off the top of my head) might have some superstar cryptologists in there with equal or greater talent than people working for the Russian government? Why would that be so unbelievable?

Re: Google encrypts data amid backlash against NSA spying

#73

Earlier quoted context omitted.

Their business is data, buy they have gone beyond that, they just don't want to know what I'd like to buy, they want to know were I live, my phone number, the places I visit, they want to know where I'm every single second of the day, screw that.

They're not forcing you. You can give them that or you might consider the benefits not worth it and you won't, it's not an NSA type issue.

They are not forcing me yet they are still tracking me, with dirty tricks like this one:

http://www.huffingtonpost.com/bob-bowdon/why-has-google-been...

yeah, the are clever when is about getting your info.

Re: Google encrypts data amid backlash against NSA spying

#75
post #19

Earlier quoted context omitted.

Or so they say. I'm not convinced that this is not Google's version of "trust us". Keep in mind there is no PR loss for Google to adopt a pro-encryption stance now. If they are really serious about this, they would a) stop trawling emails and b) help develop tech for seamlessly encrypting both in-flight and at-rest email.

Meanwhile, Google Argues for Right to Continue Scanning Gmail "This company reads, on a daily basis, every email that's submitted, and when I say read, I mean looking at every word to determine meaning," said Texas attorney Sean Rommel, who is co-counsel suing Google. http://abcnews.go.com/Technology/wireStory/google-argues-con... http://www.mercurynews.com/business/ci_24021944/google-argue...

By your definition of 'reading', our providers router is reading your email as well. Why don't you sue it?

Re: Google encrypts data amid backlash against NSA spying

#76
post #65

Earlier quoted context omitted.

I'm not sure what your point is. If you don't want your email accessed, don't send it unencrypted from your client, and definitely don't send it via a service that has features (search, spam, google now, etc) and is payed for by a system (contextual advertising) that explicitly accesses the contents of your email. Download Thunderbird and a PGP client[1]. Boom, done. Use another email service. Boom, done. I'm not obj…

Diluting the expectation of privacy about e-mail in general has implications under constitutional law. The 4th amendment only protects against unreasonable searches by the governmnet. The use of mail connotes private communication. As in contrast to post (which is presumed public). Implied consent to forfeighting the right to stop 3rd parties reading your e-mail is not something the public has an interest in establis…

No, this is not correct. The particulars of your agreement with a third-party for storage of your email does not extend government rights to examine that data (the ads in your inbox are as non-public as the email in there too). Even the horribly flawed ECPA recognizes that (it buttresses it, in fact). Moreover, Google[1] is currently standing behind the US v Warshak shield and requiring warrants for email contents.

The problems with the third-party doctrine are much more fundamental than the ways in which that third-party is storing and displaying your data, activities that continue for any webmail client even in the absence of ads when doing spam filtering, searching, etc. Merely the fact that a third-party is involved at all is enough for the outdated sections of the ECPA to rear their ugly heads. Here's hoping the Supreme Court takes up a case like US v Warshak soon.

[1] http://arstechnica.com/tech-policy/2013/01/google-stands-up-...

Re: Google encrypts data amid backlash against NSA spying

#77
post #4

A salient bit: [Eric] Grosse echoed comments from other Google officials, saying that the company resists government surveillance and has never weakened its encryption systems to make snooping easier — as some companies reportedly have, according to the Snowden documents detailed by the Times and the Guardian on Thursday. “This is a just a point of personal honor,” Grosse said. “It will not happen here.” Some folks a…

The revelations that NSA is running a HUMINT program should make it very clear that you can't trust everyone at Google or any other major provider. Those risks are mitigable, but it's expensive and I doubt most places take sufficient steps to prevent it. Even without that, trusting companies because their employees are honest is hard. There are some people at the NSA who really really care about privacy and not spyin…

Google (and other organizations) collecting and securing such vast troves of information -- and building the technology to analyze it quickly -- obviously makes them hugely valuable to attackers and defenders alike, since the data they are storing is the very information that attackers/defenders try to keep from each other.

Encrypting it and securing it very well at a technology level means that the human element (I'd argue) becomes the easiest way to get access to it - i.e. someone with sysadmin access, DB access, or just working on a project where the APIs and/or tools available can produce valuable information. This is true even if the 'player' (with system access) has to be 'recruited' by the attacking or defending team some time after taking up the job.

Couple this with the fact that even the security agencies themselves are prone to corruption, malfeasance, human error, (no-one is perfect), and insiders, and you could easily end up with a confusing mess. Bear in mind that everyone wants their agents to operate and be able to communicate back without detection, again regardless of which team.

Compartmentalization must also come into conflict with inter-agency sharing rules -- at some level, people need to know what is going on and make decisions -- and trust must be a big issue for many of these groups - they probably spend a ton of time watching themselves and others, and watching for information leaks / canaries / spread of misinformation.

I'm certain there'll be some fascinating stories eventually from all of this - it all continues to make me believe that concentration of power and information (which I think are continuing as a trend) only end up in creating dangerous situations, and that decentralization is ultimately the preferable way to go (in that it prevents a small number of people from having too much power/influence/control, and equally protects those same people from being targets themselves).

Re: Google encrypts data amid backlash against NSA spying

#78
post #65

Earlier quoted context omitted.

Diluting the expectation of privacy about e-mail in general has implications under constitutional law. The 4th amendment only protects against unreasonable searches by the governmnet. The use of mail connotes private communication. As in contrast to post (which is presumed public). Implied consent to forfeighting the right to stop 3rd parties reading your e-mail is not something the public has an interest in establis…

No, this is not correct. The particulars of your agreement with a third-party for storage of your email does not extend government rights to examine that data (the ads in your inbox are as non-public as the email in there too). Even the horribly flawed ECPA recognizes that (it buttresses it, in fact). Moreover, Google[1] is currently standing behind the US v Warshak shield and requiring warrants for email contents. T…

No, this is not correct.

Your talking statutes, not the constitution. Obviously the constitution trumps both statute and executive readings. Reasonable is per the constitution, an it is plastic in case law. That's why the questions are important, fundamentally. In any event, its worth keeping in mind the right level of abstraction.

Re: Google encrypts data amid backlash against NSA spying

#80
post #10

Earlier quoted context omitted.

What US company doesn't cooperate with the NSA? Google responds to lawful requests by the US government as appropriate. It's up to US citizens to change the law if they don't like it.

Wait, how are we supposed to change laws we don't know about?

We know about the laws that allowed this.
Post reply on HN