Google Speeding Up New Encryption Project After Latest Snowden Leaks 248
coolnumbr12 writes "In a new leak published by the Guardian, New York Times and ProPublica, Edward Snowden revealed new secret programs by the NSA and GCHQ to decrypt programs designed to keep information private online. In response to NSA's Bullrun and GCHQ's Edgehill, Google said it has accelerated efforts to build new encryption software that is impenetrable to the government agencies. Google has not provided details on its new encryption efforts, but did say it would be 'end-to-end,' meaning that all servers and fiber-optic lines involved in delivering information will be encrypted."
Not impenetrable to Google (Score:4, Insightful)
Re:Not impenetrable to Google (Score:5, Insightful)
Don't forget, gmail.com is part of Prism!
Re: (Score:2, Insightful)
... and then hand it on to the NSA.
Don't forget, gmail.com is part of Prism!
google == bigbrother
Re:Not impenetrable to Google (Score:4, Informative)
End-to-end (Score:5, Insightful)
If the "end-to-end" is correctly implemented, i.e.: not like in the bad definition in the summary (fiber optics and server encrypted), but like usually understood for privacy (i.e.: decrypted form only exist on end-point totally controlled by end users), google, nsa or any other man in the middle doesn't matter.
That requires 2 important details:
- sound encryption.
The maths behind current encryption seem sound. But the implementation must be good too. NSA has notoriously interfered undercover with lots of software development team, leading to bad implementation which could leak data or have predictible key due to broken random generator, etc.
Opensource is a lot less likely to be tainted as errors are much easier to spot. You don't know what NSA could have hidden in closed source software whithout the knowledge of the software vendors themselves.
- secure environment.
There's no point in having the most perfect encryption ever if the NSA could simply bypass it and use a hidden backdoor or abuse an exploit to break into and simply tap the clear message from one of the end points.
Skype EULA clearly states that they are ready to conform with local law about collaboration with law enforcement (could probably be even implementing wire-taping point). Also I think by now backdoors inside Windows are more or less accepted to be existing in our post-Snowden world.
Again, opensource software, both user application and the OS on which they are running, would be more difficult to abuse, as backdoors and exploitable bugs would be easier to observe.
But in a theoretical pefrect wold of rainbow, unicorns, perfect crypto implementation and secure machine, you can then use safely an untrusted network and untrusted servers: data that will transit through them will be always encrypted and meaningless.
Re: (Score:3)
Besides being gibberish, I don't think they used the word "servers" on accident. However sound the encryption is, expect it to be deployed as a big star network with Google's servers in the middle. What benefit does Google gain from making traffic hidden from their prying eyes?
Re:End-to-end (Score:4, Informative)
But in a theoretical pefrect wold of rainbow, unicorns, perfect crypto implementation and secure machine
And properly verified key management.
If the system works by having some authority tell clients both what network addresses they should connect to and which keys are and aren't valid for which other clients then the system is only as secure as that authority is.
Re:End-to-end (Score:4, Informative)
Opensource is a lot less likely to be tainted as errors are much easier to spot.
This is speculation. Not having the source to closed-source, we can only assume that theyre tainted, but we know for a FACT this has happened with open-source via public commits; and in a number of instances the bogus code remained undetected for years.
Re: (Score:2)
But end-points is still known (Score:2)
Sure, there's TOR and similar ideas, but requires trusting third party servers, that might very well be NSA hubs as well...
And forget about running your own TOR instance unless you want the police to come knocking on your door, we've heard about that on slashdot before...
Re: (Score:2)
But it wouldn't work from a business perspective. Google can't run their mail system for free - they have to pay for it somehow. They do that by statistical targeting of advertisements based in part on automated analysis of the emails.
Re: (Score:3)
Re: (Score:3)
Re: (Score:2)
it's either penetrable for both or neither...
if they have some master key, some inbetween possibility or some such, then it is as good as government having it, since they'll appear with a secret court order at the office and the only way to battle it is to somehow prove that they can't comply.
naturally such would end up on export restrictions too? or are they developing this in zurich?
Re: (Score:2)
If its end-to-end encryption, then it would be impenetrable to anyone who was not one of the endpoints; thats sort of the point.
Re: (Score:2)
That's not entirely true. If an SSL handshake negotiates an RSA symmetric key, then anyone holding the server's private key can decrypt the captured stream after the fact. To achieve Perfect Forward Secrecy (the inability for a stream to be decrypted some time in the future), you must use an ephemeral DH key negotiation.
If Google cares about security... (Score:2, Interesting)
If Google cares about security, then why does it insist that companies synchronize passwords with their Google Apps domains using unsalted MD5 checksums?
Meaningless ... (Score:5, Insightful)
Unless Google is going to devise a crypto system they don't have any access to the keys, this is meaningless.
Because when those government agencies can walk in the door with a secret warrant and demand the keys, there is nothing Google can do.
The US lawmakers have essentially made crypto in America irrelevant when any party knows the keys.
The rest of the world needs to be stepping up their game, but all of their governments want the same ability to spy.
I fear the US has more or less decided that the entire world should be operating on less security to protect their interests. And I'm not sure why everybody is playing along with that.
Re:Meaningless ... (Score:5, Interesting)
Not really meaningless.
The problem is that the NSA/GCHQ have been farming literally everything that goes in and out of these companies whether it's relevant to their investigations or not. If Google succeed in implementing end-to-end encryption then they wont be able to do this.
Yes you're right they can still walk through the door with a warrant and demand the key but that forces them to be far more targeted in their investigations. It means they have to be able to justify, even if only to a secret court, that the person in question should have a warrant served against their data.
If nothing else that means no more "accidental" gathering of the data of Americans in breach of the 4th amendment. It also means the NSA can no longer rely on GCHQ to gather data on US citizens to bypass the 4th amendment because GCHQ doesn't get to use America's secret courts to serve warrants on US citizens, and nor do we have secret courts in the UK through which it could do it.
So this sort of thing does matter. It matters in that at least the spying they do is all logged down on paper somewhere and has to be justified to at least some degree rather than done automatically against everyone with fuck all oversight.
It's far from perfect, but at least Google are trying to do something and it's better than the current status quo.
Re:Meaningless ... (Score:5, Insightful)
It's far from perfect, but at least Google are trying to do something and it's better than the current status quo.
It's an admirable goal, but it comes down to trust. How does Google know, or more importantly how do we know, that someone from the NSA has not embedded themselves in the implementation team in order to weaken the encryption or insert a back door?
At this point it's kinda like introducing time-travel as a plot device to the Star Trek cannon. Once time travel is introduced, absolutely anything is possible. In terms of encryption, hence forth it will be very difficult to trust anything related to computing.
Peace,
Andy.
Re:Meaningless ... (Score:5, Insightful)
Agreed but if you're of the opinion that nothing can be trusted anymore so there's no point trying then you might as well just resign yourself to the fact that it's all over, the spy agencies have won and just let all your data be public.
But I think it's still worth fighting, and every little bit of effort no matter how small - such as forcing them to get someone into Google, and getting that person to risk detection puts a lot of extra pressure on these agencies and contrary to popular belief they do not have infinite resources. There are only so many developers they can afford to buy off, only so many spies they can train to plant, and the more they have the more chance there is of one getting caught red handed further embarrassing the shit out of the agencies and their programmes.
The point is simply that there is far more of us, and far fewer of them, and every attempt at frustration no matter how small, every successful encryption attempt that they can't deal with no matter how trivial is something that takes up their relatively limited manpower. Just one person producing a blob of what they deem suspicious or interesting data is potentially enough to take out a number of their analysts for a few days at a time as they try to deal with it.
There are far more people with far more skills capable of producing far more data that frustrates their operations than they can possibly hope to deal with, hence why sitting down crying defeat and doing nothing is exactly what they want. This effort by Google no matter how much of a token gesture is just one simple example of something that has the scope to greatly frustrate the NSA's efforts and if all tech company's and a bunch of individuals to boot followed their lead then it'd have a measurable impact on the ability of their program to perform blanket spying.
Even the requirement to obtain just one warrant is going to take an agent out of the field and into the realm of paperwork for likely a half day or day.
Then at the end of it all, when it turns out that billions are being poured into this program yet the likes of Boston are still happening, there's going to reach a point where someone says "We need to stop funding this white elephant", because that's how politics works.
Re: (Score:3)
And yet the War on Civil Liberties^W^WDrugs continues.
Re: (Score:2)
Agreed but if you're of the opinion that nothing can be trusted anymore so there's no point trying then you might as well just resign yourself to the fact that it's all over, the spy agencies have won and just let all your data be public.
I think his idea was that Google cannot be trusted, because they are a US and Prism partners, not that nothing can be trusted anymore. Sounds reasonable to me.
Re: (Score:2)
It's an admirable goal, but it comes down to trust. How does Google know, or more importantly how do we know, that someone from the NSA has not embedded themselves in the implementation team in order to weaken the encryption or insert a back door?
For one thing, all code at Google is reviewed before being submitted, and nearly all code at Google is in a single source repository that is accessible to all 20,000 Google engineers. It's effectively open source, internally, with a pretty large population of smart people looking at it, including a non-trivial number of serious security geeks, up to and including world-class cryptanalysts.
Google is particularly well-suited to be able to achieve something like this.
(Disclaimer: I work for Google on crypt
Re: (Score:3)
So, fucking, what? How do we know every one of you is not on the NSA payroll?
I guess at some level, you can't. However, Google does have a non-trivial number of independently-wealth employees, who would be hard for the NSA to buy out, at least with money. Virtually everyone who was here pre-IPO. And I think that if any hint of anything like you describe made it's way to the ears of the upper management -- especially Sergey Brin, who has a real thing about government surveillance and control, and way too much money for anyone to manipulate -- it would be outed.
No way we can ever trust you again. Even if you don't work for NSA, NSA can come tell you what to do, while also preventing you from talking about it. It's a shame, and not your fault, but it still is.
I don't think that's tr
Re: (Score:2)
Yes you're right they can still walk through the door with a warrant and demand the key but that forces them to be far more targeted in their investigations.
Hasn't yet, so WTF are you on about?
Re:Meaningless ... (Score:5, Insightful)
You're obviously unaware of what's been going on so I'll give you a brief summary.
The NSA and GCHQ have been spying on absolutely everyone by listening in on and intercepting all data going to and from companies like Google. They haven't been going into these companies with a warrant for everyone, they've been doing all this without a warrant.
If this no longer works such that they're forced to go in with a warrant then that's still forcing them to take an extra costly and time consuming step that they don't take currently.
That's WTF I am on about.
Meaningless if (Score:4, Interesting)
Sure, NSA has been farming Google's queries and emails and all the other stuff unencrypted. And for Google's PRISM link, they need a warrant if its for a USA citizen. (Well at least if they think it is, at least 51%). That means nothing to us non US citizens. (I'm a brit, my countries spy agency even spies on me for the NSA and the politician who signed off on it, William Hague, traitor to his country, is 'Sir William Hague' not 'Traitor William Hague'!).
So Google's encrypting data forces them to get a warrant, well sort of, and only for USA people.
Except NSA has also been getting warrants that let it get the keys to the certs, and also has access to the cert authorities, and it also has backdoors into the encryption itself, making the encryption meaningless. A PR stunt. "Accidental" gathering of American data still continues and for most of the world the same "massive deliberate" capturing of our data, private, political, news, business secrets the lot, continues unabated.
Android is still rooted, MS Phone is still rooted. Google's services are still part of the surveillance machine, willing or not.
It's a token response, but the real solution is to avoid letting your important communications transit the US, or US based services.
I've cancelled VPN's, webservers, Skype, stopped using Google, email has been moved. These are *real* measures that can be taken, not *PR Stunt* measures.
Yes. Meaningless. (Score:5, Informative)
TFA is pretty short on technical details, but this sounds like it's end-to-end between Google datacenters, not customers. So when the NSA comes a-knocking with the inevitable secret court order to hand over keys, they'll be right back to capturing everything and filtering on the NSA side.
Re: (Score:3)
...and if Google change the keys regularly?
The point is it may be a token gesture but no matter how small it's still going to create a headache for the NSA and still cause them to not be able to gather some data.
Or to put it another way, it's still better than doing nothing.
Re: (Score:2)
...t's still better than doing nothing.
Ah, you're one of those, eh? Yes, let's play charades. That will make us feel good enough to end any resistance.
Re: (Score:3)
TFA is pretty short on technical details, but this sounds like it's end-to-end between Google datacenters, not customers. So when the NSA comes a-knocking with the inevitable secret court order to hand over keys, they'll be right back to capturing everything and filtering on the NSA side.
Not meaningless.
Without encryption, the NSA may be able to get access to all of the data without bothering with any sort of judicial process. With encryption, they'll have to get said secret court order. That's a big difference, even if it's not as big as it should be.
Then we have to fix the FISA process such that there's real oversight, but that's not something Google can do. That requires voters to care and politicians to do their jobs. Google is doing what they can.
Re: (Score:3)
It's far from perfect, but at least Google are trying to do something and it's better than the current status quo.
I don't see how this really follows. There is lots that Google could be doing right now, without some new encryption project, that they aren't doing. For example, play around with "openssl s_client" and try connecting to Google's servers. They automatically degrade the cipher used to the weakest cipher that the client will allow (bottoming out at RC4-MD5, it seems). I know that's a fast cipher that has good hardware accelerators available, but they could raise their lower limit or use the strongest common c
Re: (Score:2)
It's far from perfect, but at least Google are trying to do something and it's better than the current status quo.
In my opinion, it's little more than theater. Turn the map around for a second and look at it from the NSA's side. They have shown absolutely no hesitation to do whatever it takes to access literally everything, and from what I've read, they (or the FBI, or whoever it is that handles their direct interaction with civilians) can be damned intimidating. Do you honestly think that they would allow themselves to be cut out of a datastream as valuable as Google's? If I was them, -I- sure as hell wouldn't. It
Re: (Score:2)
"With a warrant", BWAHAHAHA! What fantasy makes you think they need a warrant for anything? They walk up to the door; if it doesn't open they bust it in; then they TELL you that you have a choice. Either hand over all the data NOW and never breathe a word to anybody that they were ever there, or you will go to the Gulag right now and nobody will ever find you again.
Re: (Score:2)
If you only deal in absolutes you'll get nothing you want.
I agree that secret courts must go, but I'm quite happy to see other bits of the problem dealt with or frustrated in the meantime. You have to chip away at these things bit by bit, frustrate their efforts and highlight reasons why they're bad, costly, and don't work. If you just sit there and say "Secret courts must go or nothing" then you'll be given nothing.
Re: (Score:2)
So what you're saying to cut a long story short is that you have no idea what the solution is but you'll tell everyone else they don't have one either anyway?
How helpful.
Is Google allowed to do this? (Score:4, Insightful)
Is Google even allowed to pursue such an undertaking? What's to stop the NSA from requiring access by design? It's not as if Google could say anything about it if this were the case.
Re: (Score:2)
As long as Google were true to their case, they'd drop development in such a case (or intentionally stall it, or whatever). With or without stating the true reason.
You mean contradictory (Score:3)
You mean "any third party". For peoples communication to be "secure" they need to keep a private key and others need to use their public key to send data. This of cou
Re: (Score:2)
And I have little reason to believe Google is looking at doing anything but encrypting the traffic, not preventing themselves from being able to see the content.
This could prevent some snooping, but it doesn't fundamentally change the fact that the NSA would just come in and say "OK, put us where it isn't encrypted".
Re: (Score:2)
Unless Google is going to devise a crypto system they don't have any access to the keys, this is meaningless.
From the synopsis:
Google has not provided details on its new encryption efforts, but did say it would be 'end-to-end,'
"End-to-End" means Google will not have access to the keys, unless Google is attempting to redefine that term. Here's the definition from Wikipedia [wikipedia.org]:
End-to-end encryption (E2EE) is an uninterrupted protection of the confidentiality and integrity of transmitted data by encoding it at it
Re: (Score:2)
The definition says nothing about who has access to keys, other than to say that the destination requires keys and knowledge of algorithms used.
It's still end-to-end encryption if a third party is responsible for generating keys and handing them out.
Think S/MIME and e-mail, a certificate authority generates keys for users to encrypt mail to each other. The mail is encrypted from end to end, but the keys are controlled by another party.
Re: (Score:2)
Unless Google is going to devise a crypto system they don't have any access to the keys, this is meaningless.
Because when those government agencies can walk in the door with a secret warrant and demand the keys, there is nothing Google can do.
They could setup an independent organisation, funded by them, outside US jurisdiction, like in Iceland, and work from there.
Re: (Score:2)
I fear the US has more or less decided that the entire world should be operating on less security to protect their interests. And I'm not sure why everybody is playing along with that.
Have you considered the possibility that maybe they aren't playing along with that at all but simply have the good sense to know when to shut up?
Re:Meaningless ... (Score:5, Informative)
Because all government's want to spy on their citizens. European governments used to be the best at fascism but have been playing catch up to the US for a while now.
But do all government's of the world wish to permit industrial espionage on their soil, or is it political power first over protecting national business interests...
Statement by Director of National Intelligence James R. Clapper on Allegations of Economic Espionage [tumblr.com]
"...It is not a secret that the Intelligence Community collects information about economic and financial matters, and terrorist financing...."
Re:Meaningless ... (Score:4, Informative)
Your excerpt stops before it gets to the good bit. I will add a bit more, and suggest that anyone that is interested read the whole thing. The link below that is from a former head of the CIA that discusses aspects of the same topic.
Statement by Director of National Intelligence James R. Clapper on Allegations of Economic Espionage [tumblr.com]
What we do not do, as we have said many times, is use our foreign intelligence capabilities to steal the trade secrets of foreign companies on behalf of - or give intelligence we collect to - US companies to enhance their international competitiveness or increase their bottom line.
Why We Spy on Our Allies [cryptome.org] - By R. James Woolsey, former Director of the Central Intelligence Agency
Re:Meaningless ... (Score:4, Insightful)
Ahh, so Clapper says they only collect the data [1] but do not actually inhale it.
Next you will be trying to convince us all that access to the gathered intelligence data is strictly controlled and only after [secret] court approval [slashdot.org], for terrorism related reasons only.
[1] Probably because American's have been expelled from various countries various [nytimes.com] times [nytimes.com] for economic spying, so James Clapper cannot very apply the default PR script which is to deny it ever happens... as you are trying to lead us to believe applies in this case... cold fjord.
Re: (Score:2)
Even if you believe what Clapper/Woolsey et. all say (and quite frankly who does now after so many lies cover-ups and partial hangouts have been exposed in such quick succession regarding the Snowden leaks?), Edward Snowden walked out with all that data and we only know about it because he went public and was not in it for industrial espionage. How many before him had been doing the same only working for some company or other, we will never know.
Does any country want all their home grown companies data stor
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Here comes the real test: (Score:4, Interesting)
If so, actually-working-encryption should create an interesting little jump in the number of information demands (whether they are the kind that Google is allowed to talk about, and whether it will be 'Google received 123,345 demands last year, and only one this year! (The one demand was "We want all of it.") are different questions).
If they already aren't sucking on the fiber because doing it through Legal is easier, this probably isn't bad security practice; but won't really slow the feds down much. They certainly don't have an aversion to genuinely covert behavior; but they also have crazy expansive 'legal' abilities to obtain information (and, especially when paid, often plenty of help from the companies who have the data...)
Re:Here comes the real test: (Score:5, Informative)
>do the feds really bother sucking on the fiber
Haven't you been paying attention to the articles here and elsewhere?
They have been.
--
BMO
Re: (Score:2)
Why would we believe Google twice? (Score:3)
I don't see how a new encryption effort helps. Anytime you trust a third party to handle your data in the cloud, you are open to having that data compromised because somebody else codes it, somebody else builds it, somebody else deploys it, somebody else administers it, etc. Many who fell for the charming upstart company with the motto "Don't be evil" the first time around feel burned, and there is no technical solution to that problem.
Re: (Score:2)
Honestly I doubt Google (and the others) were really voluntarily helping the NSA, because if anything providing data to the NSA means work (and more work to keep it secret), and that costs money. Bad for business.
These taps are generally enforced onto them by the NSA, be it directly or via the courts. The companies directly involved are all American companies - companies in other countries invariably were forced into cooperation by their national secret service (who in turn was "asked" by the NSA).
Re: (Score:2)
Honestly I doubt Google (and the others) were really voluntarily helping the NSA, because if anything providing data to the NSA means work (and more work to keep it secret), and that costs money. Bad for business.
These taps are generally enforced onto them by the NSA, be it directly or via the courts. The companies directly involved are all American companies - companies in other countries invariably were forced into cooperation by their national secret service (who in turn was "asked" by the NSA).
..if it's "voluntary" or not just saves the feds one trip to the judge. it's voluntary in the sense that they help them do it - it's also good business because the government has to pay for their time(it's not a tax, so it's paid for with tax money...), it's very good business also due to the fact that the expenses are not checked by anyone and the government side of the budget is also secret so nobody can really question the expenses....
Re: (Score:2)
..if it's "voluntary" or not just saves the feds one trip to the judge. it's voluntary in the sense that they help them do it - it's also good business because the government has to pay for their time(it's not a tax, so it's paid for with tax money...), it's very good business also due to the fact that the expenses are not checked by anyone and the government side of the budget is also secret so nobody can really question the expenses....
Indeed, they've received a lot of money from the government. However if that amount can be seen as unreasonably high, it may point to graft. And that'd be at least as serious a situation (and quite interesting as usually it's the company manager that bribes the government official, not the other way around).
Re: (Score:2)
I agree Google was put between a rock and a hard place by the NSA. It doesn't change the problem with the cloud itself: there is no practical technical way to make it reasonably secure, unless you're a bobbing cheery Alfred E. Newman "What me worry?" type. Trust is therefore key to commercial cloud computing, to a much greater extent than corresponding "locally resident" solutions. It's a problem for everyone, I'm only singling Google out because of the original post.
Re: (Score:2)
Indeed, cloud security is a big issue, and will always be so.
I'm currently using a cloud server for my web site and email needs - all my mails, as cyrus mail store, are stored there. It's not in the US so should be out of reach from the TSA at least, though security is a bit of an concern for me. Until recently I had my own physical server with fast Internet connection but due to changing circumstances I had to change that.
My mails are stored unencrypted on the server. My hard drive is unencrypted - I reall
Skip TFA (Score:5, Insightful)
I read TFA, and I wish I hadn't. It's just a fanboi gushing about how awesome Google is.
What it fails to mention is the fundamental tension between developing encryption technology and Google's business model of pervasive surveillance.
Quotations from Google executives such as:
fail to convince me. I am sure Mr. Grosse means what he says, but his actual ability to follow through on his personal honor is limited. It's the Almighty Dollar that is ultimately calling the shots at Google, or any company.
Why believe this? (Score:2)
"impenetrable to the government agencies" (Score:2)
Does this include subpoenas and disavowed backdoors for the NSA?
I will believe it when it really gets tested.
Subpoena or National Security Letter or wrench? (Score:3)
Google has not provided details on its new encryption efforts, but did say it would be 'end-to-end,' meaning that all servers and fiber-optic lines involved in delivering information will be encrypted."
Which is meaningless in the face of a subpoena or national security letter or a a wrench [xkcd.com]. Anything Google does suffers from the problem of trusting a third party. Even if Google's solution were 100% effective technologically, they still are a third party and cannot be trusted 100% to not give the keys out.
Re: (Score:2)
By encrypting this inter-DC traffic it forces governments to go to Google and ask for the data.
That presumes that the NSA has not broken the encryption. Given that breaking codes is pretty much what the NSA does I wouldn't feel to comfortable trusting that Google's encryption is secure. Additionally it seems clear that the NSA already is able to force companies like Google to let them tap into their data centers whether they want to or not. It doesn't matter if the communication line is secure if they can just go get the data from the data center. To do that they can simple walk in the a national
Don't Forget... (Score:4, Informative)
Google has gotten lots of $$$$ from the NSA and the CIA and is in complete bed with them. Google gives -everything- to the NSA and CIA
Things that make you go HMMMMM...
http://gizmodo.com/confirmed-nsa-paid-google-microsoft-others-millions-1188615332 [gizmodo.com]
http://www.infowars.com/googles-deep-cia-and-nsa-connections/ [infowars.com]
http://www.pcworld.com/article/217550/google_watchdog_white_house.html [pcworld.com]
http://www.theregister.co.uk/2013/06/10/palantir_denies_powering_prism_spy_system/ [theregister.co.uk]
http://www.wired.com/threatlevel/2012/05/google-nsa-secrecy-upheld/ [wired.com]
http://www.prisonplanet.com/nsa-funds-new-top-secret-60-million-dollar-data-lab.html [prisonplanet.com]
Google, Money, Mouth (Score:5, Interesting)
Comment removed (Score:5, Insightful)
Re: (Score:2)
There is a chrome plugin now, called Mailvelope, soon for Firefox. Complete gpg in client-side. Not by google, though. Seems to work but as ever, can you get all friends and family to use it?
Regular PGP over email still leaves the message metadata out in the open. The messages have to be transmitted over an anonymized layer using something like I2P-Bote if the who, when, where of the messages is to be secured-- at that point PGP becomes moot.
funny, says the company that... (Score:3)
Re: (Score:2)
Re: (Score:2)
Not really. It switches to HTTPS for me right now.
End to End (Score:3)
You'll be on one end and the NSA is on the other, ready to forward to your intended receiver. Seriously can we still trust google with anything?
US Trust is gone (Score:5, Insightful)
Right now is the time to have a marketing shtick where you tell people that you spend all day every day thinking up ways to keep the NSA away from their data.
Also this is the time for Linux to strike. The key is that there are two assumptions being made by most people out there. First is that any US company with closed source software has been strong-armed into leaving a back door. Second is that the NSA have broken any common encryption scheme. So if you use the common ones they might as well be plaintext. But if you are able to use opensource obscure encryption schemes then you stand a chance.
Re: (Score:2)
US companies won't regain any trust until the US government lifts all gag orders that came attached to NSLs.
End to end? (Score:2)
So, Google is voluntarily giving up the ability to scan our e-mail for adwords?
Re: (Score:2)
Nope. This doesn't appear to be encryption for the end user at all - just between their own datacenters.
If they wanted to help the end user, they could've incorporated a GnuPG plugin into Gmail years ago.
Re: (Score:2)
Whereas they actually changed their APIs so frequently that the author of the one good plugin (FireGPG) gave up.
Consequences for the Internet at large (Score:5, Insightful)
I wonder what the consequences could be for the Internet at large.
Apparently there are backdoors in popular encryption software programs. That in itself should be alarming: if the NSA knows about it, who says the underworld hasn't found out about it already? Or is now directly searching for backdoors, knowing that they exist?
The NSA is after your privacy - which is a very bad thing, but something that doesn't hit most people directly.
Cybercriminals are usually after your money. If encryption is not secure, they can easily start listening in on credit card transactions done "securely" over HTTPS.
They can also start to intercept financial orders, decrypt them, alter them (i.e. payment redirected to another recipient, while still sending the intended recipient a "transaction accepted" reply), and sending them on correctly encrypted so the payment processor is none the wiser; after all it's encrypted so it's true. And it's going to be really hard for the intended recipient to file a complaint.
It won't be the end of the Internet as we know it, but there are some serious considerations to make.
Start by fixing chrome (Score:4, Insightful)
Support TLS 1.2 and TLS-SRP in your browser.
So what? (Score:2)
End-to-end encryption is meaningless if there's backdoor. The NSA can compel Google to install a backdoor and then gag them. Google cannot tell you about it. For all we know, they are already sending every search you execute to the NSA's analysis servers. I'd bet on it. And they cannot tell us. It doesn't matter if you have HTTPS Everywhere, because it's meaningless as the data becomes cleartext,
what new leak? (Score:2)
The relationship between Google and Uncle Sam (Score:4, Insightful)
When I read TFA, and it states that ...
In response to NSA's Bullrun and GCHQ's Edgehill, Google said it has accelerated efforts to build new encryption software that is impenetrable to the government agencies
As if nobody knows the cozy relationship between the founders of Google (and Google Inc. itself) and Uncle Sam.
The only way we can be sure that something that is truly important to us does not fall into the hands of NSA is to NOT put it online, period.
Re:The relationship between Google and Uncle Sam (Score:4, Informative)
Well, you can encrypt it yourself, with a private key you don't give to NSA lovers like RSA, and give your public key to your friends(and vice-versa, naturally).
Re: (Score:3)
The process of creating keys, encrypting and public key distribution is so difficult for public that not even 1% of my contacts have it.
We need really easy methods and software in order to make this happen. I am using this Firefox (and Chrome) plugin called Mailvelope. But even that one is difficult to understand for most people.
Besides, I think Gmail and others could possibly add a field to accounts where we could put our public key and it would be sent on the email header (if we assume! they really want t
Re: (Score:3)
The process of creating keys, encrypting and public key distribution is so difficult for public that not even 1% of my contacts have it.
Actually, if even only one percent of Americans regularly used responsibly strong crypto, NSA would be deluged with having three million people they actually couldn't spy on without exerting tremendous effort (physical break-ins to taint with HW etc.).
Re:The relationship between Google and Uncle Sam (Score:5, Insightful)
Google has been one of the best in this regard, both in the consistency and the tenacity of their resistence. For instance, unlike Yahoo and MS, Google famously has repeatedly refused to work with the Chinese government when they request details on dissidents.
I dont want to sit here advocating for Google as if they have no faults, but I find it hillariously counterproductive that people would go after Google of all things for not being "for the consumer" enough. Who besides google works closely with the EFF, particularly with the ChillingEffects site? Who besides google has shown the guts to say "get a warrant" to unofficial government requests?
People seriously are going to read "Government compels businesses to disclose information via FISA court order", and take away "gee these businesses sure have a cozy relationship with the govt"?
Re: (Score:2)
Well, only if you ignore that early Snowden-leaked slide from the NSA presentation that showed Google to be one of the earlier companies they had direct access to....
Re: (Score:2)
And we still have the issue of just how complicit the companies were - just b/c the slides mention many a big-name company as being sourced, does not mean they willingly said "Here, have our data." I think we should probably treat it as if they had cooperated until we have evidence that suggests otherwise (beyond them saying "We didn't"). Still, most of what we've heard implies that the NSA planted capture devices on or near-site and captured whether the companies wanted them to or not.
Re: (Score:2)
I think we should probably treat it as if they had cooperated until we have evidence that suggests otherwise (beyond them saying "We didn't").
What if the NSA acquired said data by tapping the companies' network connections? Unless the NSA volunteers an explanation of how they were getting the data, in that case there will never be any evidence.
Re:The relationship between Google and Uncle Sam (Score:5, Insightful)
Well, only if you ignore that early Snowden-leaked slide from the NSA presentation that showed Google to be one of the earlier companies they had direct access to....
Or if you believe Google, who consistently insist they didn't provide said access, and whose insistence is consistent with the rest of their actions. My guess is that the NSA was tapping Google's network connections. Remember that back in 2008 (when the slide said PRISM started getting Google data) Google hadn't yet started using SSL by default on everything.
Re:The relationship between Google and Uncle Sam (Score:4, Insightful)
Re: (Score:2)
Google has always stated that they would support a totalitarian government
I think Google would prefer to be the totalitarian government, but support it? Not so much.
Re:The relationship between Google and Uncle Sam (Score:4, Insightful)
Eventually businesses have to comply with government demands, as refusal to do so results in either official action (Executives being jailed for obstruction of justice) or unofficial sanctions (made-up charges of tax evasion for minor paperwork errors, overly destructive raids ceasing hundreds of servers while investigating something suitably scandalous like child porn).
Google has put up a lot more resistance than most companies would or have.
Re:The relationship between Google and Uncle Sam (Score:5, Insightful)
The problem is that no matter how good intentions you are willing to attribute to the Google company (or that they really have), how good is that encryption, they are under US law, they must follow their (secret laws) orders, and don't tell us that they are following them. In practice, from the outside, is almost as bad as i.e. Microsoft, you can only trust in what they release in fully open source form (Chromium, android AOSP), but not web services or binary programs like Chrome. Adding a level of encryption more a placebo than something that does a real difference.
Want to recover lost market? Move to other country, one outside US and snooping allies laws. That will do more on giving the impression that you care about your users privacy than adding encryption in a place where you have the give the unencrypted content anyway.
Re: (Score:2)
Shall we get MicroShafted instead?
Re:Oh come on! (Score:5, Insightful)
They'll never regain the trust of their users, along with Microsoft, Apple and all of the other bend-over-backwards in the US.
Give it a year or two, and no one will even remember the NSA/Google scandal anymore. Sadly.
Re: (Score:2)
rofl .. lmao .. cheers mate :DDDD
Re: (Score:2)
old and derelict .. that's not being done anymore . just an annoyance specially since you contribute nothing to the discussion. grow up . those days are over.