Forgot your password?
typodupeerror
Privacy Encryption Google

Google Speeding Up New Encryption Project After Latest Snowden Leaks 248

Posted by samzenpus
from the keep-your-eyes-on-your-own-paper dept.
coolnumbr12 writes "In a new leak published by the Guardian, New York Times and ProPublica, Edward Snowden revealed new secret programs by the NSA and GCHQ to decrypt programs designed to keep information private online. In response to NSA's Bullrun and GCHQ's Edgehill, Google said it has accelerated efforts to build new encryption software that is impenetrable to the government agencies. Google has not provided details on its new encryption efforts, but did say it would be 'end-to-end,' meaning that all servers and fiber-optic lines involved in delivering information will be encrypted."
This discussion has been archived. No new comments can be posted.

Google Speeding Up New Encryption Project After Latest Snowden Leaks

Comments Filter:
  • by riT-k0MA (1653217) on Monday September 09, 2013 @08:55AM (#44796341)
    Although impenetrable to Government spying I doubt it would be impenetrable to Google, who would not think twice of harvesting all data sent though this encryption method.
    • by ArsenneLupin (766289) on Monday September 09, 2013 @08:55AM (#44796351)
      ... and then hand it on to the NSA.

      Don't forget, gmail.com is part of Prism!

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        ... and then hand it on to the NSA.

        Don't forget, gmail.com is part of Prism!

        google == bigbrother

    • by Big Hairy Ian (1155547) on Monday September 09, 2013 @09:05AM (#44796437)
      Yep always remember google is the man in the middle
      • End-to-end (Score:5, Insightful)

        by DrYak (748999) on Monday September 09, 2013 @09:26AM (#44796579) Homepage

        If the "end-to-end" is correctly implemented, i.e.: not like in the bad definition in the summary (fiber optics and server encrypted), but like usually understood for privacy (i.e.: decrypted form only exist on end-point totally controlled by end users), google, nsa or any other man in the middle doesn't matter.

        That requires 2 important details:

        - sound encryption.
        The maths behind current encryption seem sound. But the implementation must be good too. NSA has notoriously interfered undercover with lots of software development team, leading to bad implementation which could leak data or have predictible key due to broken random generator, etc.
        Opensource is a lot less likely to be tainted as errors are much easier to spot. You don't know what NSA could have hidden in closed source software whithout the knowledge of the software vendors themselves.

        - secure environment.
        There's no point in having the most perfect encryption ever if the NSA could simply bypass it and use a hidden backdoor or abuse an exploit to break into and simply tap the clear message from one of the end points.
        Skype EULA clearly states that they are ready to conform with local law about collaboration with law enforcement (could probably be even implementing wire-taping point). Also I think by now backdoors inside Windows are more or less accepted to be existing in our post-Snowden world.
        Again, opensource software, both user application and the OS on which they are running, would be more difficult to abuse, as backdoors and exploitable bugs would be easier to observe.

        But in a theoretical pefrect wold of rainbow, unicorns, perfect crypto implementation and secure machine, you can then use safely an untrusted network and untrusted servers: data that will transit through them will be always encrypted and meaningless.

        • by chihowa (366380)

          Besides being gibberish, I don't think they used the word "servers" on accident. However sound the encryption is, expect it to be deployed as a big star network with Google's servers in the middle. What benefit does Google gain from making traffic hidden from their prying eyes?

        • Re:End-to-end (Score:4, Informative)

          by petermgreen (876956) <plugwashNO@SPAMp10link.net> on Monday September 09, 2013 @09:49AM (#44796759) Homepage

          But in a theoretical pefrect wold of rainbow, unicorns, perfect crypto implementation and secure machine

          And properly verified key management.

          If the system works by having some authority tell clients both what network addresses they should connect to and which keys are and aren't valid for which other clients then the system is only as secure as that authority is.

        • Re:End-to-end (Score:4, Informative)

          by LordLimecat (1103839) on Monday September 09, 2013 @10:15AM (#44797043)

          Opensource is a lot less likely to be tainted as errors are much easier to spot.

          This is speculation. Not having the source to closed-source, we can only assume that theyre tainted, but we know for a FACT this has happened with open-source via public commits; and in a number of instances the bogus code remained undetected for years.

        • by gmuslera (3436)
          Something in the Google's end decrypts the information to send it to you, is not like they send you an encrypted file and you manually decrypts it with pgp (you can store there only pgp encrypted files, but for that don't matter if google encrypts or not). So if ordered, they can do the decryption without user intervention, or even send it to the NSA at the same time they send it to you. They are still in US, still have to follow its (secret) laws, still have to give anything to the NSA if they ask, no matt
        • But the end-points would still be known... Essentially, leaking your entire address book...
          Sure, there's TOR and similar ideas, but requires trusting third party servers, that might very well be NSA hubs as well...

          And forget about running your own TOR instance unless you want the police to come knocking on your door, we've heard about that on slashdot before... :)
        • But it wouldn't work from a business perspective. Google can't run their mail system for free - they have to pay for it somehow. They do that by statistical targeting of advertisements based in part on automated analysis of the emails.

    • by gl4ss (559668)

      it's either penetrable for both or neither...

      if they have some master key, some inbetween possibility or some such, then it is as good as government having it, since they'll appear with a secret court order at the office and the only way to battle it is to somehow prove that they can't comply.

      naturally such would end up on export restrictions too? or are they developing this in zurich?

    • If its end-to-end encryption, then it would be impenetrable to anyone who was not one of the endpoints; thats sort of the point.

      • That's not entirely true. If an SSL handshake negotiates an RSA symmetric key, then anyone holding the server's private key can decrypt the captured stream after the fact. To achieve Perfect Forward Secrecy (the inability for a stream to be decrypted some time in the future), you must use an ephemeral DH key negotiation.

  • by Anonymous Coward

    If Google cares about security, then why does it insist that companies synchronize passwords with their Google Apps domains using unsalted MD5 checksums?

  • Meaningless ... (Score:5, Insightful)

    by gstoddart (321705) on Monday September 09, 2013 @08:56AM (#44796363) Homepage

    Google said it has accelerated efforts to build new encryption software that is impenetrable to the government agencies

    Unless Google is going to devise a crypto system they don't have any access to the keys, this is meaningless.

    Because when those government agencies can walk in the door with a secret warrant and demand the keys, there is nothing Google can do.

    The US lawmakers have essentially made crypto in America irrelevant when any party knows the keys.

    The rest of the world needs to be stepping up their game, but all of their governments want the same ability to spy.

    I fear the US has more or less decided that the entire world should be operating on less security to protect their interests. And I'm not sure why everybody is playing along with that.

    • Re:Meaningless ... (Score:5, Interesting)

      by Xest (935314) on Monday September 09, 2013 @09:14AM (#44796485)

      Not really meaningless.

      The problem is that the NSA/GCHQ have been farming literally everything that goes in and out of these companies whether it's relevant to their investigations or not. If Google succeed in implementing end-to-end encryption then they wont be able to do this.

      Yes you're right they can still walk through the door with a warrant and demand the key but that forces them to be far more targeted in their investigations. It means they have to be able to justify, even if only to a secret court, that the person in question should have a warrant served against their data.

      If nothing else that means no more "accidental" gathering of the data of Americans in breach of the 4th amendment. It also means the NSA can no longer rely on GCHQ to gather data on US citizens to bypass the 4th amendment because GCHQ doesn't get to use America's secret courts to serve warrants on US citizens, and nor do we have secret courts in the UK through which it could do it.

      So this sort of thing does matter. It matters in that at least the spying they do is all logged down on paper somewhere and has to be justified to at least some degree rather than done automatically against everyone with fuck all oversight.

      It's far from perfect, but at least Google are trying to do something and it's better than the current status quo.

      • Re:Meaningless ... (Score:5, Insightful)

        by six025 (714064) on Monday September 09, 2013 @09:26AM (#44796591)

        It's far from perfect, but at least Google are trying to do something and it's better than the current status quo.

        It's an admirable goal, but it comes down to trust. How does Google know, or more importantly how do we know, that someone from the NSA has not embedded themselves in the implementation team in order to weaken the encryption or insert a back door?

        At this point it's kinda like introducing time-travel as a plot device to the Star Trek cannon. Once time travel is introduced, absolutely anything is possible. In terms of encryption, hence forth it will be very difficult to trust anything related to computing.

        Peace,
        Andy.

        • Re:Meaningless ... (Score:5, Insightful)

          by Xest (935314) on Monday September 09, 2013 @10:01AM (#44796881)

          Agreed but if you're of the opinion that nothing can be trusted anymore so there's no point trying then you might as well just resign yourself to the fact that it's all over, the spy agencies have won and just let all your data be public.

          But I think it's still worth fighting, and every little bit of effort no matter how small - such as forcing them to get someone into Google, and getting that person to risk detection puts a lot of extra pressure on these agencies and contrary to popular belief they do not have infinite resources. There are only so many developers they can afford to buy off, only so many spies they can train to plant, and the more they have the more chance there is of one getting caught red handed further embarrassing the shit out of the agencies and their programmes.

          The point is simply that there is far more of us, and far fewer of them, and every attempt at frustration no matter how small, every successful encryption attempt that they can't deal with no matter how trivial is something that takes up their relatively limited manpower. Just one person producing a blob of what they deem suspicious or interesting data is potentially enough to take out a number of their analysts for a few days at a time as they try to deal with it.

          There are far more people with far more skills capable of producing far more data that frustrates their operations than they can possibly hope to deal with, hence why sitting down crying defeat and doing nothing is exactly what they want. This effort by Google no matter how much of a token gesture is just one simple example of something that has the scope to greatly frustrate the NSA's efforts and if all tech company's and a bunch of individuals to boot followed their lead then it'd have a measurable impact on the ability of their program to perform blanket spying.

          Even the requirement to obtain just one warrant is going to take an agent out of the field and into the realm of paperwork for likely a half day or day.

          Then at the end of it all, when it turns out that billions are being poured into this program yet the likes of Boston are still happening, there's going to reach a point where someone says "We need to stop funding this white elephant", because that's how politics works.

          • Then at the end of it all, when it turns out that billions are being poured into this program yet the likes of Boston are still happening, there's going to reach a point where someone says "We need to stop funding this white elephant", because that's how politics works.

            And yet the War on Civil Liberties^W^WDrugs continues.

          • Agreed but if you're of the opinion that nothing can be trusted anymore so there's no point trying then you might as well just resign yourself to the fact that it's all over, the spy agencies have won and just let all your data be public.

            I think his idea was that Google cannot be trusted, because they are a US and Prism partners, not that nothing can be trusted anymore. Sounds reasonable to me.

        • by swillden (191260)

          It's an admirable goal, but it comes down to trust. How does Google know, or more importantly how do we know, that someone from the NSA has not embedded themselves in the implementation team in order to weaken the encryption or insert a back door?

          For one thing, all code at Google is reviewed before being submitted, and nearly all code at Google is in a single source repository that is accessible to all 20,000 Google engineers. It's effectively open source, internally, with a pretty large population of smart people looking at it, including a non-trivial number of serious security geeks, up to and including world-class cryptanalysts.

          Google is particularly well-suited to be able to achieve something like this.

          (Disclaimer: I work for Google on crypt

      • by Jawnn (445279)

        Yes you're right they can still walk through the door with a warrant and demand the key but that forces them to be far more targeted in their investigations.

        Hasn't yet, so WTF are you on about?

        • Re:Meaningless ... (Score:5, Insightful)

          by Xest (935314) on Monday September 09, 2013 @09:37AM (#44796653)

          You're obviously unaware of what's been going on so I'll give you a brief summary.

          The NSA and GCHQ have been spying on absolutely everyone by listening in on and intercepting all data going to and from companies like Google. They haven't been going into these companies with a warrant for everyone, they've been doing all this without a warrant.

          If this no longer works such that they're forced to go in with a warrant then that's still forcing them to take an extra costly and time consuming step that they don't take currently.

          That's WTF I am on about.

      • Meaningless if (Score:4, Interesting)

        by Anonymous Coward on Monday September 09, 2013 @09:36AM (#44796643)

        Sure, NSA has been farming Google's queries and emails and all the other stuff unencrypted. And for Google's PRISM link, they need a warrant if its for a USA citizen. (Well at least if they think it is, at least 51%). That means nothing to us non US citizens. (I'm a brit, my countries spy agency even spies on me for the NSA and the politician who signed off on it, William Hague, traitor to his country, is 'Sir William Hague' not 'Traitor William Hague'!).

        So Google's encrypting data forces them to get a warrant, well sort of, and only for USA people.

        Except NSA has also been getting warrants that let it get the keys to the certs, and also has access to the cert authorities, and it also has backdoors into the encryption itself, making the encryption meaningless. A PR stunt. "Accidental" gathering of American data still continues and for most of the world the same "massive deliberate" capturing of our data, private, political, news, business secrets the lot, continues unabated.

        Android is still rooted, MS Phone is still rooted. Google's services are still part of the surveillance machine, willing or not.

        It's a token response, but the real solution is to avoid letting your important communications transit the US, or US based services.

        I've cancelled VPN's, webservers, Skype, stopped using Google, email has been moved. These are *real* measures that can be taken, not *PR Stunt* measures.

      • Yes. Meaningless. (Score:5, Informative)

        by Cid Highwind (9258) on Monday September 09, 2013 @09:39AM (#44796663) Homepage

        TFA is pretty short on technical details, but this sounds like it's end-to-end between Google datacenters, not customers. So when the NSA comes a-knocking with the inevitable secret court order to hand over keys, they'll be right back to capturing everything and filtering on the NSA side.

        • by Xest (935314)

          ...and if Google change the keys regularly?

          The point is it may be a token gesture but no matter how small it's still going to create a headache for the NSA and still cause them to not be able to gather some data.

          Or to put it another way, it's still better than doing nothing.

          • ...t's still better than doing nothing.

            Ah, you're one of those, eh? Yes, let's play charades. That will make us feel good enough to end any resistance.

        • by swillden (191260)

          TFA is pretty short on technical details, but this sounds like it's end-to-end between Google datacenters, not customers. So when the NSA comes a-knocking with the inevitable secret court order to hand over keys, they'll be right back to capturing everything and filtering on the NSA side.

          Not meaningless.

          Without encryption, the NSA may be able to get access to all of the data without bothering with any sort of judicial process. With encryption, they'll have to get said secret court order. That's a big difference, even if it's not as big as it should be.

          Then we have to fix the FISA process such that there's real oversight, but that's not something Google can do. That requires voters to care and politicians to do their jobs. Google is doing what they can.

      • by chihowa (366380)

        It's far from perfect, but at least Google are trying to do something and it's better than the current status quo.

        I don't see how this really follows. There is lots that Google could be doing right now, without some new encryption project, that they aren't doing. For example, play around with "openssl s_client" and try connecting to Google's servers. They automatically degrade the cipher used to the weakest cipher that the client will allow (bottoming out at RC4-MD5, it seems). I know that's a fast cipher that has good hardware accelerators available, but they could raise their lower limit or use the strongest common c

      • It's far from perfect, but at least Google are trying to do something and it's better than the current status quo.

        In my opinion, it's little more than theater. Turn the map around for a second and look at it from the NSA's side. They have shown absolutely no hesitation to do whatever it takes to access literally everything, and from what I've read, they (or the FBI, or whoever it is that handles their direct interaction with civilians) can be damned intimidating. Do you honestly think that they would allow themselves to be cut out of a datastream as valuable as Google's? If I was them, -I- sure as hell wouldn't. It

      • by fnj (64210)

        ... they can still walk through the door with a warrant ...

        "With a warrant", BWAHAHAHA! What fantasy makes you think they need a warrant for anything? They walk up to the door; if it doesn't open they bust it in; then they TELL you that you have a choice. Either hand over all the data NOW and never breathe a word to anybody that they were ever there, or you will go to the Gulag right now and nobody will ever find you again.

    • by mschaffer (97223) on Monday September 09, 2013 @09:17AM (#44796513)

      Is Google even allowed to pursue such an undertaking? What's to stop the NSA from requiring access by design? It's not as if Google could say anything about it if this were the case.

      • by wvmarle (1070040)

        As long as Google were true to their case, they'd drop development in such a case (or intentionally stall it, or whatever). With or without stating the true reason.

    • Unless Google is going to devise a crypto system they don't have any access to the keys, this is meaningless. Because when those government agencies can walk in the door with a secret warrant and demand the keys, there is nothing Google can do. The US lawmakers have essentially made crypto in America irrelevant when any party knows the keys.

      You mean "any third party". For peoples communication to be "secure" they need to keep a private key and others need to use their public key to send data. This of cou

      • by gstoddart (321705)

        And I have little reason to believe Google is looking at doing anything but encrypting the traffic, not preventing themselves from being able to see the content.

        This could prevent some snooping, but it doesn't fundamentally change the fact that the NSA would just come in and say "OK, put us where it isn't encrypted".

    • by Bob9113 (14996)

      Unless Google is going to devise a crypto system they don't have any access to the keys, this is meaningless.

      From the synopsis:

      Google has not provided details on its new encryption efforts, but did say it would be 'end-to-end,'

      "End-to-End" means Google will not have access to the keys, unless Google is attempting to redefine that term. Here's the definition from Wikipedia [wikipedia.org]:

      End-to-end encryption (E2EE) is an uninterrupted protection of the confidentiality and integrity of transmitted data by encoding it at it

      • The definition says nothing about who has access to keys, other than to say that the destination requires keys and knowledge of algorithms used.
        It's still end-to-end encryption if a third party is responsible for generating keys and handing them out.
        Think S/MIME and e-mail, a certificate authority generates keys for users to encrypt mail to each other. The mail is encrypted from end to end, but the keys are controlled by another party.

    • by rvw (755107)

      Google said it has accelerated efforts to build new encryption software that is impenetrable to the government agencies

      Unless Google is going to devise a crypto system they don't have any access to the keys, this is meaningless.

      Because when those government agencies can walk in the door with a secret warrant and demand the keys, there is nothing Google can do.

      They could setup an independent organisation, funded by them, outside US jurisdiction, like in Iceland, and work from there.

    • I fear the US has more or less decided that the entire world should be operating on less security to protect their interests. And I'm not sure why everybody is playing along with that.

      Have you considered the possibility that maybe they aren't playing along with that at all but simply have the good sense to know when to shut up?

  • by fuzzyfuzzyfungus (1223518) on Monday September 09, 2013 @08:59AM (#44796393) Journal
    For an entity like Google (large, technically sophisticated; but most of their worthwhile data probably count as 'business records' for the purposes of nigh-limitless subpoena-under-cover-of-darkness powers, do the feds really bother sucking on the fiber when they could just flash a badge and get what they want?

    If so, actually-working-encryption should create an interesting little jump in the number of information demands (whether they are the kind that Google is allowed to talk about, and whether it will be 'Google received 123,345 demands last year, and only one this year! (The one demand was "We want all of it.") are different questions).

    If they already aren't sucking on the fiber because doing it through Legal is easier, this probably isn't bad security practice; but won't really slow the feds down much. They certainly don't have an aversion to genuinely covert behavior; but they also have crazy expansive 'legal' abilities to obtain information (and, especially when paid, often plenty of help from the companies who have the data...)
    • by bmo (77928) on Monday September 09, 2013 @09:08AM (#44796447)

      >do the feds really bother sucking on the fiber

      Haven't you been paying attention to the articles here and elsewhere?

      They have been.

      --
      BMO

      • I know that they have been in locations that wouldn't be so easily subpoenaed into submission (peering points that focus on cost/bit, not storing data, infrastructure in areas they don't technically have jurisdiction in, etc.); but (as best I can figure out from the poor-to-nebulous description in TFA) this sounds like Google attempting to secure their own LANs/private WANs, and possibly the SSL/TLS connections that users use to access their already-trivially-subpoenaed material on Google's servers). I have
  • by ggraham412 (1492023) on Monday September 09, 2013 @09:11AM (#44796461)

    Since Snowden’s leaks about PRISM, Google has been leading the charge for legal rights to disclose information about government requests with users.

    I don't see how a new encryption effort helps. Anytime you trust a third party to handle your data in the cloud, you are open to having that data compromised because somebody else codes it, somebody else builds it, somebody else deploys it, somebody else administers it, etc. Many who fell for the charming upstart company with the motto "Don't be evil" the first time around feel burned, and there is no technical solution to that problem.

    • by wvmarle (1070040)

      Honestly I doubt Google (and the others) were really voluntarily helping the NSA, because if anything providing data to the NSA means work (and more work to keep it secret), and that costs money. Bad for business.

      These taps are generally enforced onto them by the NSA, be it directly or via the courts. The companies directly involved are all American companies - companies in other countries invariably were forced into cooperation by their national secret service (who in turn was "asked" by the NSA).

      • by gl4ss (559668)

        Honestly I doubt Google (and the others) were really voluntarily helping the NSA, because if anything providing data to the NSA means work (and more work to keep it secret), and that costs money. Bad for business.

        These taps are generally enforced onto them by the NSA, be it directly or via the courts. The companies directly involved are all American companies - companies in other countries invariably were forced into cooperation by their national secret service (who in turn was "asked" by the NSA).

        ..if it's "voluntary" or not just saves the feds one trip to the judge. it's voluntary in the sense that they help them do it - it's also good business because the government has to pay for their time(it's not a tax, so it's paid for with tax money...), it's very good business also due to the fact that the expenses are not checked by anyone and the government side of the budget is also secret so nobody can really question the expenses....

        • by wvmarle (1070040)

          ..if it's "voluntary" or not just saves the feds one trip to the judge. it's voluntary in the sense that they help them do it - it's also good business because the government has to pay for their time(it's not a tax, so it's paid for with tax money...), it's very good business also due to the fact that the expenses are not checked by anyone and the government side of the budget is also secret so nobody can really question the expenses....

          Indeed, they've received a lot of money from the government. However if that amount can be seen as unreasonably high, it may point to graft. And that'd be at least as serious a situation (and quite interesting as usually it's the company manager that bribes the government official, not the other way around).

      • I agree Google was put between a rock and a hard place by the NSA. It doesn't change the problem with the cloud itself: there is no practical technical way to make it reasonably secure, unless you're a bobbing cheery Alfred E. Newman "What me worry?" type. Trust is therefore key to commercial cloud computing, to a much greater extent than corresponding "locally resident" solutions. It's a problem for everyone, I'm only singling Google out because of the original post.

        • by wvmarle (1070040)

          Indeed, cloud security is a big issue, and will always be so.

          I'm currently using a cloud server for my web site and email needs - all my mails, as cyrus mail store, are stored there. It's not in the US so should be out of reach from the TSA at least, though security is a bit of an concern for me. Until recently I had my own physical server with fast Internet connection but due to changing circumstances I had to change that.

          My mails are stored unencrypted on the server. My hard drive is unencrypted - I reall

  • Skip TFA (Score:5, Insightful)

    by SirGarlon (845873) on Monday September 09, 2013 @09:13AM (#44796467)

    I read TFA, and I wish I hadn't. It's just a fanboi gushing about how awesome Google is.

    What it fails to mention is the fundamental tension between developing encryption technology and Google's business model of pervasive surveillance.

    Quotations from Google executives such as:

    "This is a just a point of personal honor," Grosse said. "It will not happen here."

    fail to convince me. I am sure Mr. Grosse means what he says, but his actual ability to follow through on his personal honor is limited. It's the Almighty Dollar that is ultimately calling the shots at Google, or any company.

  • Given that the reports of the Snowden NSA documents indicate that the NSA worked with willing private sector companies, why should anyone believe that this is nothing more than a public relations push by Google? I think Google is trying to restore trust by appearing to be doing something while in fact being just as open and cooperative with the NSA as it has always been. I will believe that there is some pushback by private companies when there are actual public (not secret) court cases brought by the gover
  • Does this include subpoenas and disavowed backdoors for the NSA?
    I will believe it when it really gets tested.

  • by sjbe (173966) on Monday September 09, 2013 @09:18AM (#44796527)

    Google has not provided details on its new encryption efforts, but did say it would be 'end-to-end,' meaning that all servers and fiber-optic lines involved in delivering information will be encrypted."

    Which is meaningless in the face of a subpoena or national security letter or a a wrench [xkcd.com]. Anything Google does suffers from the problem of trusting a third party. Even if Google's solution were 100% effective technologically, they still are a third party and cannot be trusted 100% to not give the keys out.

  • Google, Money, Mouth (Score:5, Interesting)

    by Greyfox (87712) on Monday September 09, 2013 @09:24AM (#44796565) Homepage Journal
    If Google wanted to impress me, they'd include a spot to paste a GPG public key in gmail and auto-encrypt all mails with it on the client side for gmail users or at the entry point of their network for all other mail users. As it stands Google is very much part of the problem, not very much part of the solution.
    • by CRCulver (715279) <crculver@christopherculver.com> on Monday September 09, 2013 @10:07AM (#44796945) Homepage

      If Google wanted to impress me, they'd include a spot to paste a GPG public key in gmail and auto-encrypt all mails with it on the client side for gmail users or at the entry point of their network for all other mail users.

      Auto-encrypting it on the client side would be extremely insecure, because Google or an adversary could inject Javascript code to capture the message while it is still plaintext. The only way to securely use GPG with webmail is to type the message in a text editor, encrypt and only then paste the cipertext into your webbrowser. Ideally people would stop using webmail and go back to dedicated e-mail applications, but the cat's already out of the bag (and even e-mail has been superseded in many people's lives by Facebook messages).

  • by etash (1907284) on Monday September 09, 2013 @09:25AM (#44796569)
    uses the obselete since a decade RC4 as the encryption algorithm for its httpS.
  • by jools33 (252092) on Monday September 09, 2013 @09:26AM (#44796583)

    You'll be on one end and the NSA is on the other, ready to forward to your intended receiver. Seriously can we still trust google with anything?

  • US Trust is gone (Score:5, Insightful)

    by EmperorOfCanada (1332175) on Monday September 09, 2013 @09:58AM (#44796857)
    I don't think people outside the US really care if US companies use 10,000 bit quantum spiral elliptical gluon encryption with a half twist of lemon. If the NSA comes to those companies with the Open Sesame court orders then it doesn't matter. This is a massive opportunity for non-US companies to say, "We ignore any pressure from the US." Along with their governments to say, "If a local company gives data to the US government then they go to jail." Put these two together and people will start flocking to their service (assuming it is roughly equal to the US one) so create euromail.eu or whatnot and you've got customers.

    Right now is the time to have a marketing shtick where you tell people that you spend all day every day thinking up ways to keep the NSA away from their data.

    Also this is the time for Linux to strike. The key is that there are two assumptions being made by most people out there. First is that any US company with closed source software has been strong-armed into leaving a back door. Second is that the NSA have broken any common encryption scheme. So if you use the common ones they might as well be plaintext. But if you are able to use opensource obscure encryption schemes then you stand a chance.
    • by jeti (105266)

      US companies won't regain any trust until the US government lifts all gag orders that came attached to NSLs.

  • So, Google is voluntarily giving up the ability to scan our e-mail for adwords?

    • Nope. This doesn't appear to be encryption for the end user at all - just between their own datacenters.

      If they wanted to help the end user, they could've incorporated a GnuPG plugin into Gmail years ago.

      • Whereas they actually changed their APIs so frequently that the author of the one good plugin (FireGPG) gave up.

  • by wvmarle (1070040) on Monday September 09, 2013 @10:52AM (#44797433)

    I wonder what the consequences could be for the Internet at large.

    Apparently there are backdoors in popular encryption software programs. That in itself should be alarming: if the NSA knows about it, who says the underworld hasn't found out about it already? Or is now directly searching for backdoors, knowing that they exist?

    The NSA is after your privacy - which is a very bad thing, but something that doesn't hit most people directly.

    Cybercriminals are usually after your money. If encryption is not secure, they can easily start listening in on credit card transactions done "securely" over HTTPS.

    They can also start to intercept financial orders, decrypt them, alter them (i.e. payment redirected to another recipient, while still sending the intended recipient a "transaction accepted" reply), and sending them on correctly encrypted so the payment processor is none the wiser; after all it's encrypted so it's true. And it's going to be really hard for the intended recipient to file a complaint.

    It won't be the end of the Internet as we know it, but there are some serious considerations to make.

  • by WaffleMonster (969671) on Monday September 09, 2013 @12:34PM (#44798821)

    Support TLS 1.2 and TLS-SRP in your browser.

  • Encryption is mostly a matter of trust; the technological aspect is of comparatively minor consideration.

    End-to-end encryption is meaningless if there's backdoor. The NSA can compel Google to install a backdoor and then gag them. Google cannot tell you about it. For all we know, they are already sending every search you execute to the NSA's analysis servers. I'd bet on it. And they cannot tell us. It doesn't matter if you have HTTPS Everywhere, because it's meaningless as the data becomes cleartext,
  • What new leak? Wasn't Snowden allowed into Russia on the condition that he would stop leaking? What's going on here?

Testing can show the presense of bugs, but not their absence. -- Dijkstra

Working...