Google's Gdrive Raises Instant Privacy Concerns

An anonymous reader writes "The rumor mill is already raging over the potential functionality and capacity for Google's online storage service we talked about earlier this week (the company says 'it makes sense' to put all its Web apps under the same umbrella). But Internet rights advocates are now crying foul over liability issues, a probable lack of encryption and a cash-cow model that could scan all your personal data for advertising keywords. From the article: "'Google would be wise to offer users an option to encrypt your information,' says Nimrod Kozlovski, a professor of Internet law at Tel Aviv University. 'It really needs to have really detailed explanations of what the legal expectations are for storing your info.'""

Comments

you have the choice

[yagu]

You have the choice to:

• Not use the google service
• encrypt your data you choose to store online with them
• use some other service

Seriously, the issues raised are the same as with the other on-line storage services. And, this move by Google mostly integrates/consolidates what they already offer, albeit with the extension of storing any kind of data. I think it's great, I've started storing much of my data on line in various forums and I love the internet access. At your parents house and need a file? Download from the clouds. Got a special inside track on a new job and they need your resume, quick? From the clouds. Serenity now!

If you've got data you think sensitive, encrypt it, or figure out a different way to store it. Personally, from anecdotal, but plentiful, observation, those who store their data "in"/on the internet:

• are far less likely to lose data
• have much more universal access to their data
• will probably spend less overall (no upgrades to disk drives) to store their data
• and bother me far less with support issues

As for the screaming about Google figuring out a way to make money doing this, hwah? Kind of what running a company is about. And the more money they figure out how to make by ads makes the price point that much less for you and me, or anyone willing to trust Google. For the moment, I am. I'm assuming I'll get enough warning signs to not trust them, I'll move my data elsewhere. For now, good for Google.

This isn't new, just big. And, from a personal standpoint, I hope it's one more ding in Microsoft's armor. The more there are alternatives to data locked up in Microsoft's products, the better chances of real competition, and ultimately progress (finally!) in technology. (sorry, had to dig... this is slashdot, right?)

Re:you have the choice

[ByOhTek]

You make a lot of good points, but remember - the guy who the quoted from a lot of the complaints... is a nimrod.

Bad humor aside, you are right. It's not like anyone is being force to use it - it's not like anything is being changed and there are exising users - this is a new product and everything is out in the open. Like anything else network related: if it's important, don't put it on the web like a dummy.

Re:you have the choice

[skeeto]

encrypt your data you choose to store online with them

I can think of at least one interesting way to set this up using FUSE. Once this service becomes available, someone writes a FUSE filesystem for it. Then you use encfs to mount an encrypted filesystem on top of the mounted gdrive. Viola! Mount a gdrive locally and hide its contents from Google too.

Re:you have the choice

[lazlo]

One other point: What this Nimrod is suggesting is that you can't trust Google to respect the privacy of your data, but that you can trust them to encrypt it for you. I don't quite see how that works...

Re:you have the choice

[Lord Aurora]

AHHHH MICROSOFT rabble rabble rabble /rant

Re:you have the choice

[Anonymous Coward]

You have the choice to:

        * Not use the google service
        * encrypt your data you choose to store online with them
        * use some other service

Seriously, the issues raised are the same as with the other on-line storage services.

Um, yeah. That doesn't mean that those issues shouldn't be raised to make dumb people aware of them.

Re:you have the choice

[SpaceWanderer]

Is this do-able? How easy would it be for somebody to set this up who doesn't know anything about encryption

Re:you have the choice

[MarsDefenseMinister]

encfs is a piece of cake. If you can use the mount command, you can use the encfs command.

Re:you have the choice

[skeeto]

EncFS does all the work for you. You can either go with the default settings or you can choose "paranoid mode" and it cranks everything to the max. Example,

$ encfs /tmp/enc /tmp/raw

Creating new encrypted volume.
Please choose from one of the following options:
enter "x" for expert configuration mode,
enter "p" for pre-configured paranoia mode,
anything else, or an empty line will select standard mode.
?>

Standard configuration selected.

Configuration finished. The filesystem to be created has
the following properties:
Filesystem cipher: "ssl/blowfish", version 2:1:1
Filename encoding: "nameio/block", version 3:0:1
Key Size: 160 bits
Block Size: 512 bytes
Each file contains 8 byte header with unique IV data.
Filenames encoded using IV chaining mode.

Now you will need to enter a password for your filesystem.
You will need to remember this password, as there is absolutely
no recovery mechanism. However, the password can be changed
later using encfsctl.

New Encfs Password:
Verify Encfs Password:

Just had to hit enter, then make up a password.

Re:you have the choice

[omeomi]

One other point: What this Nimrod is suggesting is that you can't trust Google to respect the privacy of your data, but that you can trust them to encrypt it for you. I don't quite see how that works...

Well, the first implies trusting the company and its policies. The second implies trusting the company _and_ any employee who has access to the data. At least if it's encrypted before being written to disk, there's probably a few less people who have access to the unencrypted data. I still wouldn't store anything sensitive on it that I hadn't encrypted myself. Frankly, I just store files on my Linux box, and SCP into it if I need a file...

Re:you have the choice

[davester666]

Yes. Basically, the article seems to read "the sky is falling because the exact same issues that apply to storing your email on Google's servers also apply to storing your document's on Google's servers".

Re:you have the choice

[Anonymous Coward]

Thanks for the info

-SW

Re:you have the choice

[rtb61]

Here is an interesting point for you. What about minors and protecting their privacy, they can not legally agree to any privacy invasive contracts, and google by law must seek to protect the privacy of minors. Has google been lax and allowed their single minded drive for profits to over ride it's legal and moral responsibilities.

Then there is second and third party privacy. When people have records of other parties on their hard drives and google starts scanning and recording that data for a flood of psychologically targeted and manipulative marketing aimed at people who never agreed to anything, would that be fair or even legal. The same problem still holds with email, at which point is the email the senders or the receivers and if the receiver does not wish to have anything to do with the privacy invasive nature of the googlites where is their choice.

Just like google wanted to store medical records, it wants to target it's services at the medical practitioners and not give the patients/you any choice. Google as a commercial back up service can then scan records about you, with out your choice, simply because some one else was to naive enough not to encrypt the data before allowing the google marketing sneaks to snoop through those records.

Googlite employees driven to troll as a result of share options is evil. Yes, we know, every one that disagrees with google is a nimrod, and believes the sky is falling and wears a tin foil hat and blah, blah, blah ;).

Re:you have the choice

[Anonymous Coward]

Please don't encrpyt! Information wants to be freee!!!!!

Re:you have the choice

[Anonymous Coward]

It's really not that simple.

As with GoogleBase, what if someone else stores files containing someone else's personal information? Examples could include an organization that keeps its contact list on the online storage, or maybe a hiring manager might get the idea of storing resumes on the online storage, or whatever else. If they treat online storage as their local hard drive, someone else's information will eventually get stored there.

Not everyone automatically uses encryption either.

Re:you have the choice

[Anonymous Coward]

You have the choice to:

- Not use the Microsoft service
- encrypt your data you choose to store online with them
- use some other service

Seriously, the issues raised are the same as with the other on-line storage services. And, this move by Microsoft mostly integrates/consolidates what they already offer, albeit with the extension of storing any kind of data. I think it's great, I've started storing much of my data on line in various forums and I love the internet access. At your parents house and need a file? Download from the clouds. Got a special inside track on a new job and they need your resume, quick? From the clouds. Serenity now!

If you've got data you think sensitive, encrypt it, or figure out a different way to store it. Personally, from anecdotal, but plentiful, observation, those who store their data "in"/on the internet:

- are far less likely to lose data
- have much more universal access to their data
- will probably spend less overall (no upgrades to disk drives) to store their data
- and bother me far less with support issues

As for the screaming about Microsoft figuring out a way to make money doing this, hwah? Kind of what running a company is about. And the more money they figure out how to make by ads makes the price point that much less for you and me, or anyone willing to trust Microsoft. For the moment, I am. I'm assuming I'll get enough warning signs to not trust them, I'll move my data elsewhere. For now, good for Microsoft.

--

You still agree, right? Right?

Encryption as a double edged sword

[pwnies]

First off, if you're that concerned about your data being secure, you probably should just store it on a personal webserver and encrypt it yourself.
That being said, I really don't see this as a major concern for Google in relation to the success of Gdrive. A large percentage of people today really don't care about whether or not their personal data is scanned an analyzed, as proven by the information people list on social networking sites like facebook, myspace, livejournal, etc.
So the real question here is whether or not Google (and the small percentage of users that would use encryption) would benefit enough from this feature to offset the time needed to develop it and the hassles that will come along with it. I think that alot of the users wont realize that if Google encrypts their data with the password that the users provide, then there will no longer be that friendly "Forgot your password? Let us reset it for you." button. People will then be constantly complaining that they can no longer access their data if they forgot their password and had it reset (Because the data is encrypted based on their old password obviously). The only way that Google would be able to recover that data for the user is a.) by brute forcing it, or b.) by using precomputed hashes in a rainbow table format (though something tells me that Google is smart enough to use salts and this wouldn't be an option). Realistically, even Google doesn't have the resources to go around brute forcing people's passwords. This means the only real way that Google could encrypt the data would be to store their passwords as plaintext in case the user forgot it, which is really just providing security as the cost of losing alot more security. All in all I don't see the process being beneficial for Google or the users.

Re:Encryption as a double edged sword

[_14k4]

I think that alot of the users wont realize that if Google encrypts their data with the password that the users provide, then there will no longer be that friendly "Forgot your password? Let us reset it for you." button. ...why would the button go away? Why can't the security questions, mother's maiden name, and whatnot be answered just like they are today? Because now there are file up there on the Google servers? If your security questions are as crappy as your passwords... you probably won't forget your password.

Re:Encryption as a double edged sword

[Asgard]

If the contents are encrypted then Google can't have the password (or else it is useless), so there is no way for them to provide you with your password. The best they can do is wipe your drive and give you a clean slate.

Re:Encryption as a double edged sword

[_14k4]

...you are making the assumption that the gdrive would have a different password, no?

How is gdrive any different than the current docs.google.com with a different API tacked on?

Re:Encryption as a double edged sword

[nahdude812]

The idea behind encryption is that even Google shouldn't be able to read your data. If Google holds both the encrypted data and the key, then it is barely different from having it stored unencrypted, but you get to keep your "Forgot the password to my data" option. If Google can't read your data (as is being suggested in the article), then it also can't give you access to it when you forget.

Re:Encryption as a double edged sword

[_14k4]

Ahh, gotcha. I was figured I'd just create a truecrypt volume/file up there, and go with that. ;)

Re:Encryption as a double edged sword

[Donny Smith]

>The idea behind encryption is that even Google shouldn't be able to read your data.

Riight, so this is the reason why you don't use Gmail...

And the whole fucking point is that they be able to read your data and show those stupid ads.
Unless they count on the laziness factor - that 99.9% of people are too lazy or don't care - and allow encryption knowing that most folks won't use it anyway. This might happen as they'd score big PR points at a low cost.

The idea behind Gdrive is that people store their crap non-encrypted so whenever there's I/O to it (voice mail, Web office, searching thru your Google phone address book, etc.), they can create on-the-fly ads for you.

*snerk*

[bladesjester]

I have no plans to use gdrive or google apps for the reason outlined as well as others.

However, I have to ask...

Am I the only one who got a chuckle out of the professor's name? Nimrod

Re:*snerk*

[Anonymous Coward]

I'm not sure where Nimrod got such a bad rap -- as king of Assyria he was anything but a dork.

And his surname is KosloWski, not KosloVski, as it is in the fine summary.

Re:*snerk*

[themushroom]

Only a Nimrod (Kozlovski) would risk all their data like that. :)

Re:*snerk*

[mrmagos]

Am I the only one who got a chuckle out of the professor's name? Nimrod

What's so bad about being a hunter?

Re:*snerk*

[Culture20]

Genesis 10:8 Cush was the [father/ancestor] of Nimrod, who grew to be a mighty warrior on the earth.

Re:*snerk*

[Anonymous Coward]

Strong Bad TGS:10 Corn is no place for a mighty warrior.

Re:*snerk*

[aclarke]

Come on, mods, ignorance is no excuse. Genesis 10:9

Re:*snerk*

[g0at]

No, but you're not the only un-educated knob, either.

Re:*snerk*

[bladesjester]

Kid, humor is where you find it.

Maybe you'll understand that when you stop being a troll. =]

Re:*snerk*

[g0at]

Ah. So what makes it reasonable to laugh about someone's name but not, say, his race? If the OP had written something like "am I the only one who finds it funny that a professor is Israeli", would it just be "humour where you find it"? How about "am I the only one who finds it funny that a nigger could teach"? etc.

Re:*snerk*

[bladesjester]

I'm sorry that you're so uptight that you fail to see humor in the world and are, in fact, I'd say you're getting bent out of shape over this just to have something to gripe about.

Well, as the OP, I can say that race and nationality have nothing to do with it.

It's a great example of a difference between cultures, and in my opinion is indeed amusing. An intelligent Nimrod, which is slang for someone stupid (and he does indeed seem to be quite intelligent).

In my time, I've encountered quite a few amusing names - among them Placenta, Cantaloupe, and Jesus Pagan (pronounced hey-sus pay-gon. Jr, if you believe it. Even more amusingly, he worked in robotics. It just seemed fitting. He was a heck of a guy and, in my opinion, proof that the divine has a sense of humor).

Not that you would understand the humor behind any of them because you just want to be a troll instead of seeing the humor inherent in life.

Re:*snerk*

[g0at]

Pardon that I failed to notice you were the OP. I will admit that I'm in a bad mood at the moment, for unrelated reasons. That has perhaps coloured the tone of my postings.

The point that I was originally trying to make was one of education and awareness:

An intelligent Nimrod, which is slang for someone stupid (and he does indeed seem to be quite intelligent).

The reason this seems funny is because of a lack of awareness of the slang term's origin. Were this conversation being had before the time of Chuck Jones and John Steinbeck, there would be no humour at all.

I have to admit that I had the same reaction as you did, and then wondered to myself why "nimrod" has the meaning that it does. I looked it up, learned something, and was thankful that I did not embarrass myself by posting a similar "heh heh, what a dorky name" remark — though, on a different occasion were I feeling a little less mature and self-aware, I may very well have.

In my opinion, laughing at the guy's name (which itself carries some weight of history and knowledge deeper than probably you or I ever regularly conjure) simply shows ignorance, or at least an unwillingness to appreciate a broader worldview. Sure, "nimrod" is still an amusing slang and I'm sure to use it myself hundreds of times again — but it's no so funny in and of itself with a bit of awareness.

-ben

Re:*snerk*

[bladesjester]

No, kiddo, the reason it seems funny is the cultural disconnect, and like it or not Steinbeck is a part of the culture. You're "if this were before the time of Steinbeck" comment just shows how much you don't get it and how far you are going out of your way to be uptight.

"In my opinion, laughing at the guy's name (which itself carries some weight of history and knowledge deeper than probably you or I ever regularly conjure) simply shows ignorance"

First off, *most* names have a deeper meaning than most people think. Secondly, it isn't always a sign of ignorance. As I said, sometimes you need to appreciate the humor in the world around you, which you still don't seem to understand (Heck, Jesus Pagan understood and was quite a good sport about it. We used to joke with each other regularly on a variety of things including our own names).

Research is a fine thing, but don't let it kill the joy in life. Just because you understand the roots of something doesn't mean it still isn't amusing. It just means that you're uptight.

I know you're probably at that point in life where you think that being a geek and an intellectual means that you have to kill the fun in everything, but it doesn't and you may learn that sometime.

Finally, I can assure you that I am neither a "doorknob" nor am I uneducated. In fact, I am educated, at least moderately intelligent, and have quite a lot of experience in a wide variety of fields (intellectual, cultural, and otherwise).

Stop being so bloody serious. You'll die of a heart attack or aneurism by the time you're 40. The world is full of humor. Take some time to find and enjoy it. Yelling at it just makes you look like an ass.

Life doesn't take you seriously. Return the favor.

Re:*snerk*

[g0at]

Okay. I apologize for calling you a knob. Your rant is at least as mouth-breathing and defensive as mine, though.

I didn't see what value was added to the universe by posting a question about whether anybody else found his name funny. Many people likely did. Did you really want to take a poll? Or simply make your opinion known?

-b

Re:*snerk*

[bladesjester]

Kid, my rant isn't mouth breathing in the least nor is it defensive. In fact, its purpose was to teach you something. I hope you learn the lesson some day - more people need to.

As for why I said it, spreading mirth is often a positive thing.

You have a great deal to learn. (Among them is that following an "apology" with an insult is not the mark of an apology.)

Re:*snerk*

[g0at]

I bow down to you, wise sir! You are wholly correct; your lesson is restrained and gentle in tone, and reverently received. With luck this fresh sapling that I am shall grow up to be as humble as you.

-b

Re:*snerk*

[MillionthMonkey]

I'm not sure where Nimrod got such a bad rap -- as king of Assyria he was anything but a dork.

As usual, this is all Bugs Bunny's fault.

but what

[old and new again]

if i don't care about the privacy of the data i'm uploading, what if i upload random pron and i just want the space (i f i have something private, ill pay for my own hosting and encrypt ot my way, not google's way

Nimrod Kozlovski

[Anonymous Coward]

And I thought I had it bad growing up!

Re:Nimrod Kozlovski

[sm62704]

Well hell, with a name like "Anonymous Coward" I can see why you would get picked on. My name got its share of yuks, especially since I wore coke bottle glasses* "Oh, mcgrew, you've done it again!"

But I really felt sorry for another kid in class, Charlie Salmon.

-mcgrew

* Coke bottles used to be made of very thick glass back before the stone age. Mr. Magoo was a nearaly blind cartoon character who was too vain to wear his glasses and unwittingly did good in every episode. Yes, I'm a geezer. I see they brought Charlie Tuna back.

No, Google does NOT need to use encryption

[Sycraft-fu]

Because that's not useful. If they encrypt your data for you, guess what? They have the key! If you want your data safe from them, YOU need to encrypt it. That's just how it works. If you send your data in the clear to someone else and then they encrypt it for you, that means they can get at your data. Same deal is you send them data and the encryption key as well (see AACS). The only way to give it to them, but not let them at it is for you to encrypt it yourself, and to not give them the key. Then and only then can you be assured that while they have a copy, they can't read it.

Seriously people, get Truecrypt, it isn't hard.

Re:No, Google does NOT need to use encryption

[barzok]

Seriously people, get Truecrypt, it isn't hard.

Unless you're a Mac user. No TrueCrypt there (yet). Have to use other methods.

Re:No, Google does NOT need to use encryption

[The MAZZTer]

They can still implement encryption that allows the user to provide a key... but I suppose there is no way to guarantee the key isn't saved somewhere, other than Google's word.

Re:No, Google does NOT need to use encryption

[JazzLad]

Yet another reason not to be a Mac user?

I kid, I kid! Man, I used to have great Karma, I wonder what happened.

Re:No, Google does NOT need to use encryption

[Anonymous Coward]

This need not be true. The encryption could be done in the Google client and then Google doesn't need to know the key.

Re:No, Google does NOT need to use encryption

[Burz]

Umm, like the one built-into OS X: encrypted disk image.

But overall a file encryption tool like gpg may be more secure than letting google or others see the disk I/O flow over the net. In that scenario, which truecrypt isn't designed for, I believe a disk encryption scheme becomes weak.

Re:No, Google does NOT need to use encryption

[N7DR]

Because that's not useful. If they encrypt your data for you, guess what? They have the key! If you want your data safe from them, YOU need to encrypt it. That's just how it works.

That's only how symmetric key cryptography works. If the only reason that this system was insecure was that Google would have the decryption key, then one would use public key cryptography to circumvent the weakness.

However, the real hole in letting them encrypt the data is that you have no way to stop them from keeping an unencrypted version somewhere.

So your conclusion is correct, but for the wrong reason.

Re:No, Google does NOT need to use encryption

[barzok]

I'm aware of encrypted disk images BUT the problem really is that if I use TrueCrypt on my work computer (Windows) and my wife's laptop (also Windows) to protect my data, I can't upload that to Google and then bring it down for use on my MacBook.

If I use an encrypted disk image on the Mac, I can't use it on the Windows systems.

Re:No, Google does NOT need to use encryption

[Burz]

So the compatibility problem is the same with either type of disk image.

If you use GPG, then you can encrypt or decrypt on any OS.

Re:No, Google does NOT need to use encryption

[barzok]

The OP stated that one should just use TrueCrypt. I was pointing out that it's not viable if you need to use OS X. That's all.

Jesus Christ

[Jugalator]

At least let Google say something on their plans first...?

Besides, what's so special even if they'd do this? It's the norm to not encrypt mails. It's the norm to not encrypt instant messages on servers on services that provide offline messaging (Messenger, ICQ, ...). Software may send usage information to some company's servers. Game companies analyze your system to detect cheats, and could in the process find a lot of other things on it.

As usual, when this is released, I think *gasp* that the users will just have to decide for themselves if they care for having encryption or not. They'll also be free to encrypt their data. Why the rumor mill? Just chill and take it for what it is, as with any other service. It's not like Google will force you onto it. Then I could see the fearmongering kicking in early be more motivated.

I trust Google as of now...

[explosivejared]

Disclaimer: I don't see myself being an early adopter or anything of this service, but not because of privacy.

cash-cow model that could scan all your personal data for advertising keywords

What, like the "disaster" that Gmail is? I'm all for Internet privacy, but get some perspective. I trust this service in the hands of Google. They've done nothing to shake that trust, and to be frankly I have good faith that they won't. They're a data miner, sure, but they have always done in the least intrusive way as possible. Get this, I even like their ads sometimes! I know, unbelievable right! So thanks for being watchdogs and all, but as of right now, Google has my trust.

Re:I trust Google as of now...

[Jugalator]

Agreed -- Google hasn't done anything evil about their information other than by machine analyzing the data to provide relevant ads. I think the reason is simple enough... Even if they were evil enough to do anything more, they ought to have the brains to understand how damaging that would be to their brand when it's the god damn core of their business model. Managing information. I mean, I can't even see how Google would even want to do this even from a business perspective. It would just take them to be discovered having done something fishy once and they could risk losing a lot of their reputation.

Re:I trust Google as of now...

[Anonymous Coward]

Agreed -- Google hasn't done anything evil about their information other than by machine analyzing the data to provide relevant ads

... that you are aware of. It would be foolish to think that the CIA, FBI, NSA, Mossad, or whatever spy agency that you can think of has not placed operatives inside of Google as confidential informants. All of that personal information is like candy to them.

Re:I trust Google as of now...

[MightyYar]

CIA, FBI, NSA, Mossad, or whatever spy agency I'll have to remember to encrypt my emails the next time I plan an overthrow of the US and Israeli governments. Thanks!

Gadzooks, where do you people come from? Email is sent in plaintext from server-to-server. If you are sending something that you don't want others to read, reconsider your choice of email or encrypt the data. Maybe terrorists are so stupid that they send each other plain-text emails like, "Hey Ahmed, lets blow up that pizza place next week!", but I doubt it.

Re:I trust Google as of now...

[fmobus]

Yeah, and for some reason that could never happen in other e-mail services. Never!!

If you want failproof privacy, roll your own encryption. Period.

Re:I trust Google as of now...

[vux984]

They've done nothing to shake that trust, and to be frankly I have good faith that they won't.

Pretty much anyone who has ever dated has been in this situation. And yet the world is littered with broken hearts, cheating/backstabbing boyfriends/girlfriends, bitter breakups, and vicious divorce proceedings. I'm not saying one shouldn't trust people, but your a complete idiot if you think you can't get brutally hurt. At least with love the risk is worth it... what does google give you? Free webmail? Some online storage? Yeah. That's worth handing over my private life for. I can get a service like that for pennies a month. My private life is worth more than that. Is yours really that worthless?

They're a data miner, sure, but they have always done in the least intrusive way as possible.

Ah, so as long as you don't realize it, or even know about it, then its ok.

So thanks for being watchdogs and all, but as of right now, Google has my trust.

If you ever stop trusting them they still have everything you ever gave them, and more.

Your email, your conversations, your documents, your address, the business you associate with, the people you associate with, your friends, your family, the stocks you track, your political leanings, and much much more.

Some us are thinking ahead so that hopefully people like you don't get raped by the future. Your privacy is important, its a shame you value it so poorly.

Re:I trust Google as of now...

[apt142]

The other situation that I would be concerned with is not so much that Google would want to read and/or misuse my data but rather that the RIAA/MPAA, or some other untrustworthy entity would want to. In the case that the government on behalf of an entity or itself would attempt to compel Google to give up those files, I would like to feel that they aren't handed over on a whim.

Google was the only major search engine that denied the government a copy of their search results about a year ago. They were willing to back that up with lawyers as well. If you feel that you can trust them to do that again and again, I think it makes a case for storing as much as you can on Google's Gdrive.

Re:I trust Google as of now...

[a whoabot]

First they fear the CIA and Mossad, then it's the Freemasons, Rotarians, and Lionists. No joke, it's in the Hamas covenant.

Re:I trust Google as of now...

[t0p]

Google may have done nothing evil in USA/Europe. But in China, they gave the authorities info to help identify anti-establishment bloggers.

Re:I trust Google as of now...

[Anonymous Coward]

Pretty much anyone who has ever dated has been in this situation. And yet the world is littered with broken hearts, cheating/backstabbing boyfriends/girlfriends, bitter breakups, and vicious divorce proceedings. I'm not saying one shouldn't trust people, but your a complete idiot if you think you can't get brutally hurt. As a man in his 20s who hasn't, maybe I am not in the best position to talk on the subject, but I do believe that with the proper precautions you can minimize to nearly zero the chances of anything bad happening when you know the relevant parameters. When you know the rules and risks you can insulate yourself from harm very effectively. Sometimes you have to opt out all together because the risk is too great, or even worse, unable to be determined with any degree of accuracy. With google, you know exactly what they have, it's everything you've given them. If there's something you don't want them to have, don't let them see it. Don't e-mail it in plaintext, don't upload it to gdrive, don't blog about it. The very purpose of the internet is to share information, trying to control who you want to share it with isn't always going to be fool proof since the net is fundamentally an open forum by default. And you still have encryption. Truecrypt your files before upping them to your gdrive/webserver and let google look at them all they want; there's nothing they can do, no contextual ads they can serve, no data they can mine or possible value they can extract from random noise in an encrypted file.

The biggest threat from google is what we don't know about them. This includes all the possible future ways they could use the data they already have on you. Because it's an unknown value it represents a huge risk to your privacy. That being said, Google still offers a lot of great services, and for content you already intended for many other people to see, they are a great choice, and currently one of the safest places to go for those kinds of services. It's never going to be safer or more secure than running your own services (in theory anyway, of course it's possible to screw up your own security too), but that isn't a practical option for most people. Deal with google with the mindset that everything you type into any of their services is written on a postcard; it can be read by anyone and likely will be. If you have something to hide, something you want to keep private, you'd never use a postcard to communicate it.

Re:I trust Google as of now...

[GoofyBoy]

>they ought to have the brains to understand how damaging that would be to their brand when it's the god damn core of their business model.

I value my privacy enough to NOT trust it others based on a fact/promise/hope/dream that they will stick to a business model in the distant future.

Re:I trust Google as of now...

[ockegheim]

Yes, their ads are pretty straightforwardly keyword based- I keep getting the same "Sing confidently" ads sitting next to emails about my professional choir gigs. If I saw an ad like "We show you exactly how to write a Mac application mostly in Lua", I'd be a little worried.

I'd still click on it though.

Re:I trust Google as of now...

[ockegheim]

...and it's funny how a "you have a reply" email from Slashdot has an ad for a "Free Server Monitor Tool".

Not News...

[Anonymous Coward]

At least for long. This is just like all the concerns over gmail. It will all pass.

I am so tired of hearing about this.

[Evil Kerek]

#1 - Everything on the internet is not free. Actually, nothing is truly free - there's a cost SOMEWHERE. #2 - You do not have to use G So stop getting your panties in a wad. Just because YOU don't like the idea of it, doesn't mean some of us couldn't care less and like the idea of free storage. Everyone acts like GMail is the only mail system out there or that they are being forced to use it. Don't like the ads? Don't like that Google might read your mail? DON'T USE IT. You have plenty of choices out there - it's not Google's responsiblity to provide you with free anything. Get over yourselves.

For Encryption...

[epiphani]

Use truecrypt. Open, GPL, quick and easy.

Re:For Encryption...

[cromar]

For the lazy :)

Looks pretty cool, but I am guessing that it couldn't be used in conjunction with gDisk. Also, "only" Windows and Linux are supported.

Re:For Encryption...

[Mazin07]

You'd have to create a local encrypted "container" (which is a filesystem in itself), fill it with data, and then put it on your gDiskDriveSpaceBox.

It's like storing a safe at the rental storage unit.

Re:For Encryption...

[jawtheshark]

Except Truecrypt ain't GPL... Otherwhise I'd be able to get it with an apt-get. I can't...

I do use Truecrypt on Windows, but I know it's limited to mainly Windows. The Linux support is nice, but it doesn't even have all features.

Re:For Encryption...

[Random Destruction]

There are programs that encrypt individual files a la truecrypt too. I don't recall which off the top of my head, but I had one set up for online data storage. The big benefit of this method is when you update one file, you upload one file, rather than your whole encrypted volume. The one I used even encrypted the file names, so you couldn't guess what they were other than by size.

Re:For Encryption...

[The MAZZTer]

A safe that you would have to physically and completely remove and take all the way home before you could open it to add or remove anything, and then take it all the way back to commit your changes.

Re:For Encryption...

[PopeRatzo]

Truecrypt is a really nice solution, not necessarily to gDrive (although it might be), but to protecting your privacy generally.

But I suggest you get it quickly. I believe that as soon as some "killer" encryption app that is user-friendly(for non-techies) and secure comes along, we will see efforts to outlaw private, personal use of encryption.

There's a guy named Zimmerman who can tell you just how badly the government would like to make it against the law to encrypt data or communications. And the idea that he got in trouble just because foreign countries could get hold of pgp is simply a flimsy excuse. There have already been cases where the personal use of encryption alone has been used as probably cause for the search and seizure of person and property.

Sure, I'm a paranoid, but that doesn't change the fact that the corporate authoritarians who are running our government are engaged in a full-court press to take away our freedom and our privacy. And they are succeeding at an unprecedented rate.

I hope one of you out there comes up with a simple app for encrypting data that works well with gDrive. And thanks, cromar, for the link to Truecrypt. I played with it a while back, but now I see that it's been improved to the point that I'm going to use it on all of my external storage.

Re:For Encryption...

[Anonymous Coward]

Not all GPL projects have Debian package maintainers, thus those packages will not be available through apt.. FYI, TrueCrypt is OpenSource but I didn't see a license listed on their SourceForge site.

Re:For Encryption...

[jawtheshark]

I linked to the damned license, you dolt! It isn't GPL and you can bet that a very popular application would get a Debian package maintainer. Heck, I'd volunteer if it were GPL.

Re:For Encryption...

[Anonymous Coward]

I'm not very familiar with the behind-the-scenes design of TrueCrypt, so I have to ask, in order to change, say, one file, does TrueCrypt have to re-encrypt the entire volume? It would seem like if you were creating an encrypted filesystem, you would have some sort of block-level encryption scheme. That is, when you wanted to re-encrypt a single file, you would only have to re-encypt the changed blocks of data for that file, and re-write just the blocks of the single file which changed, and possibly re-encrypt and re-write inodes/FAT or other filesystem data blocks.

It doesn't seem like you'd have to download the *entire* file and re-upload the *entire* file. But, again, I don't really know how either gDrive or TrueCrypt work. It may be that TrueCrypt can do block-level changes, but maybe gDrive, behind the scenes, downloads the whole file, makes the change, and re-uploads the entire file, instead of just a list of changed/appended/truncated blocks?

Re:For Encryption...

[VGPowerlord]

Zimmerman? Was he the one that said "Privacy? Google?! Pssh!"?

Re:For Encryption...

[Kadin2048]

You're assuming that the storage device (GDrive or what have you) gives you block-level access to your files. I'm not sure that's a good assumption; I think it will probably be geared towards small documents and will require you to download a file in its entirety in order to edit it.

Even if TrueCrypt doesn't require you to read and load the entire .tc file into memory in order to decrypt part of it (I don't know if that's true or not; I really don't know a darn thing about the internals of TrueCrypt), you still might end up having to download the entire file to get it out of GDrive. It all depends on how Google designs it, and I can't imagine that providing block-by-block access to very large files like encrypted sparse files or disk images is really a primary design criterion. If you believe that they're going to monetize the service by scanning and showing context-sensitive ads, they have a strong motivation to only offer file-level access, and even then to only offer access through a web browser (where you can see the ads). Either one would break the ability to use an encryption system like TrueCrypt remotely.

That's not to say you couldn't use encryption at all, even if you only have file-based access: you could write a little script that just encrypted every file with GPG as you uploaded it and then decrypted it as you pulled it down; although it would make it a lot harder to have universal access to your files from anywhere (you'd need to have the client software installed), it would work better for small files.

Re:For Encryption...

[Mazin07]

Your sibling post pretty much sums it up. While TrueCrypt doesn't have to re-encrypt the whole volume, it's still one giant file you'd have to download and reupload if you wanted to make changes.

Re:For Encryption...

[Anonymous Coward]

The one I used even encrypted the file names, so you couldn't guess what they were other than by size. Well, that's easy. Pad with noise.

Re:For Encryption...

[jvkjvk]

But I suggest you get it quickly. I believe that as soon as some "killer" encryption app that is user-friendly(for non-techies) and secure comes along, we will see efforts to outlaw private, personal use of encryption.

Sure, I'm a paranoid, but that doesn't change the fact that the corporate authoritarians who are running our government are engaged in a full-court press to take away our freedom and our privacy. And they are succeeding at an unprecedented rate. I don't quite understand how this would happen.

We would need a law that differentiated "corporate" and "personal" encryption, because I can tell you right now that there is no way any multinational is going to hand over their encryption keys to the US government or go unencrypted. It's simply not in their best interest to do so.

I also believe that such a law differentiating classes of encryption users {corporate, personal} would be almost impossible to enact and if enacted would be challenged immediately.

It seems to me that if they want usable encryption we get it too.

This outlook is probably only good for 20-50 years, however. I can certainly imagine dystopias where technology provides the ultimate chains instead of creating space for essential freedoms in that time period.

This is not to say that we are not already some ways down that path but I can't see anything like what you propose happening anytime soon (i.e 20 years)...

Re:For Encryption...

[PopeRatzo]

I don't quite understand how this would happen.

I understand your feelings, jvkjvk. I didn't understand how the government would take away the right to habeas corpus, or how it could hold American citizens as "enemy combatants" or how it could eavesdrop on the entire internet. I thought for sure that someone, somewhere in Congress or surely the Supreme Court would say "wait, we have a Constitution here, that says you have to do things a certain way". I didn't realize that our system of checks and balances was a fiction or that our system was so vulnerable to a committed sociopath who wanted to bring down our system of laws (Bush or Cheney, take your pick). Even failing all of those, I was sure that our press, the watchdogs of our freedoms, would leap into the fray and scream bloody murder if someone tried to do what the Bush Administration did. Unfortunately, it seems that they've been so beaten down by being told they were too "liberal" for the last 2 decades, and corporate interests have so thoroughly enforced their ownership, that there doesn't seem to be an effective press any longer in this country. They're too big worrying about one candidate's cleavage and another candidate's haircut.

I didn't understand how it would be possible for the government to do searches and seizures without a warrant, in lieu of a declared war, or for that matter how, so soon after Viet Nam, a massive mobilization of our troops causing thousands of American lives could be engaged without a formal declaration of war, especially in lieu of the target of that invasion having attacked the US. I didn't understand how it would be possible that we'd fight that war using corporate-led army of private mercenaries who would be above the law of any world nation. I didn't understand how it would be possible for a Presidential election to be decided by a couple of Republican-appointed Supreme Court justices after they forced a state to STOP COUNTING VOTES.

But that's where we are today. Trust me, before a woman or a black man is elected President, personal users of encryption will be considered outlaws. Hell, did you ever think that someone whose grandson used a legally available piece of software for its intended purpose could be considered an outlaw and fined hundreds of thousands of dollars, having had a private squad of thugs raid her house and seize her computer?

I could go on, but it's Friday night and this vodka/cranberry juice is starting to put me into a good mood. It's been a long week and fighting fascism is thirsty work. I pray that a lot more of you highly-skilled, technically savvy, bright people give it a try (fighting fascism, not vodka/cranberry), but until the government seizes your iPods and your Xboxes and your 42" HDTVs it probably won't happen. But then again, with the sources of cheap credit which fuel our consumer economy drying up, it just might. When it does...meet the boys on the battle front.

Peace, citizens.

Re:For Encryption...

[TheVelvetFlamebait]

But I suggest you get it quickly. I believe that as soon as some "killer" encryption app that is user-friendly(for non-techies) and secure comes along, we will see efforts to outlaw private, personal use of encryption.

Nope, I'm not buying it. It's a question of incentives, and there really isn't incentive enough to outlaw it now. It's not like the government gets anything out of spying on people; they do it to show they're serious about security, to appease a frightened population. If everyone starts using encryption, sure they won't be able to say they've foiled as many terrorist plots, but at the same time it would show that no-one would care that much. They've really got nothing to gain from flatly opposing the people.

If there was going to be an anti-encryption law, it would've been passed by now. When everyone is wound up, and only a few people use encryption, so only a few people would be inconvenienced (i.e. now), that's when it should have been proposed.

Re:For Encryption...

[rajkiran_g]

Open source: Yes
GPL: No
Moreover, the truecrypt license does not comply with the DFSG due to an advertising clause:
From Section III.1

Phrase "Based on TrueCrypt, freely available at http://www.truecrypt.org/" must be displayed by Your Product (if technically feasible) and contained in its documentation. Alternatively, if This Product or its portion You included in Your Product comprises only a minor portion of Your Product, phrase "Portions of this product are based in part on TrueCrypt, freely available at http://www.truecrypt.org/" may be displayed instead. In each of the cases mentioned above in this paragraph, "http://www.truecrypt.org/" must be a hyperlink (if technically feasible) pointing to http://www.truecrypt.org/ and you may freely choose the location within the user interface (if there is any) of Your Product (e.g., an "About" window, etc.) and the way in which Your Product will display the respective phrase.

Your Product (and any associated materials, e.g., the documentation, the content of the official web site of Your Product, etc.) must not present any Internet address containing the domain name truecrypt.org (or any domain name that forwards to the domain name truecrypt.org) in a manner that suggests that it is where information about Your Product may be obtained or where bugs found in Your Product may be reported or where support for Your Product may be available or otherwise attempt to indicate that the domain name truecrypt.org is associated with Your Product.

Re:For Encryption...

[Anonymous Coward]

You should be able to: rsync, gzip and mcrypt piped over ssh, no?

Re:For Encryption...

[haakoneide]

TrueCrypt is not GPL. They use their own homegrown license which is incompatible with the Debian Free Software Guidelines.

Re:For Encryption...

[PopeRatzo]

Nope, I'm not buying it. It's a question of incentives, and there really isn't incentive enough to outlaw it now.

Incentive? Do you think there's "incentive" for the government to be eavesdropping on domestic use of the internet or telephones? Do you think there's "incentive" for holding US citizens without habeas corpus or searches and seizures without warrants?

Your notion that the time to outlaw encryption should have been when it was first used, but you've got it wrong. There's no danger to an outlaw administration when it's just a few geeks who are using encryption. It's when a large number of citizens starts using it that it becomes a problem for them. It might not be a law passed that bans pgp, but rather a requirement that all encryption have "back doors" for use by the government. But it will happen. We will see, very soon, a day when personally encrypted data packets sent over the internet, without "escrowed keys" is illegal. It's already considered probable cause for further surveillance and searches.

VelvetFlamebait, I understand that it boggles logic and reason. But there we are.

Re:For Encryption...

[cytg.net]

truecrypt sucks the big one on linux unfortunatly ... encfs is problart your best alternative .. but for online storage ? well ...

Re:For Encryption...

[Anonymous Coward]

forced a state to STOP COUNTING VOTES.

The Supreme Court didn't stop the count. They stopped the recount.
The reason was simple enough, for anyone with a basic understanding of statistics.
Gore was going to keep requesting recounts until he won.
The election was so close statistically that you could keep changing the outcome just by recounting the votes again.
That's not a very fair way to determine a winner.
Would you let Bush request recounts after the outcome had been flipped to Gore? If so, we'd still be waiting on the outcome.
Do you really think the hand recount was more accurate than the initial machine count?

There are many valid complaints about our country, but this one gets on my nerves every time I hear it.

Re:For Encryption...

[PopeRatzo]

The election was so close statistically that you could keep changing the outcome just by recounting the votes again.

Wow, you really believe that?

Would you let Bush request recounts after the outcome had been flipped to Gore?

Yes, if there was a reasonable expectation that there were legit votes that had not been counted.

Do you really think the hand recount was more accurate than the initial machine count?

Yes, without a doubt.

The election in Florida was a famously crooked setup. Katherine Harris, who was later rewarded with a position in the Bush White House, was Secretary of State, and had promised to deliver the election for George Bush and his brother Jeb ("Jeb"?). As soon as she saw a favorable result, she wanted all the counting to stop. 2000 will go down in history as one of the most unfair elections in our history. I well remember the famous pictures of the GOP lawyers, faces screwed up in fury and spittle flying, banging down the doors behind which the election judges were trying to count votes. The election was decided by thugs like that.

People like you, who get your opinions fresh off the AM radio, will eventually pass away, and historians with access to all the documentation and with a longer, historical view, will write about it for years to come. If Bush had been a passable president, it might not be such a big deal, but it turned out that we've been saddled with the worst president in US history. It will take decades to wash away his offal from the Presidency.

Re:For Encryption...

[TheVelvetFlamebait]

Incentive? Do you think there's "incentive" for the government to be eavesdropping on domestic use of the internet or telephones? Do you think there's "incentive" for holding US citizens without habeas corpus or searches and seizures without warrants?

Yes. More searches, more discoveries of terrorist plots, or at least more people to watch for terrorist activity, bigger numbers of terrorists caught/tracked when they report back to the people, and finally, bigger re-election prospects from the paranoid voters. Are you actually suggesting there is no incentive to do something as risky as what they're doing now?

If everyone started using encryption, it would be a sign that people either have stopped caring to the same extent as they did when the government was elected, or they care about their fellow citizen's privacy and rights. Either way, banning encryption would become a stupid political move, as opposed to now, when it would be a much smarter political move.

I do not get it

[bogaboga]

When it comes to GDrive, I wonder whether anyone is being forced to use it. I doubt this is the case. If this is not the case, why not just avoid it? Shhesh?

Re:I do not get it

[MillionthMonkey]

When it comes to GDrive, I wonder whether anyone is being forced to use it. I doubt this is the case. If this is not the case, why not just avoid it? Shhesh?

There are many reasons one might not succeed in avoiding it. For instance, one might send a sensitive document to someone unaware of these issues who then uploads it to GDrive. Not everyone is going to have seen this story that you're complaining about.

Can't say I'm concerned

[Yalius]

It's a free service, some will find it useful, some won't. I mean, what kind of nimrod would expect his data to be 100% perfectly private and encrypted if he's outsourcing his data retention to someone else, and then question the company storing his data for, um, storing his data in the form he transmitted it? I just don't get the OMFGism.

Re:Can't say I'm concerned

[Anonymous Coward]

I've been using JungleDisk and Amazons S3 service for some time now. It is 100% perfectly private and encrypted, and it's outsourced to someone else, and I wouldn't use a service that wasn't.

"Internet rights advocates are now crying foul"

[serviscope_minor]

Simple, don't use it. Seriously, google aren't in the business of simply giving stuff away out of the goodness of their hearts. They're giving things away because they think that they can generate revenue. Pretty much the only thing they get for storing your data "for free" is the data itself.

Just like your emails: you pay them by giving data so that they can search it advertise to you. Why would anyone think that they would do anything else with more of your data.

If you are sufficiently naive to think that a company will simply give you free online storage for no benefit to themselves, than I have a bridge to sell you. Lots of traffic, one careful owner...

Re:"Internet rights advocates are now crying foul"

[Anonymous Coward]

"google aren't?"
Perhaps I underestimated the power of Google. Not only is it powerful; now it's plural.

Re:"Internet rights advocates are now crying foul"

[Anonymous Coward]

http://alt-usage-english.org/excerpts/fxcompan.html

Use of a plural verb after a singular noun denoting a group of
persons (known as a noun of multitude) is commoner in the U.K. than
in the U.S. Fowler wrote: "The Cabinet is divided is better,
because in the order of thought a whole must precede division; and
The Cabinet are agreed is better, because it takes two or more
to agree."

Re:"Internet rights advocates are now crying foul"

[sqrt(2)]

I block every ad google serves up in every location and form. Besides the nebulous value I am for data mining (and have fun mining largely encrypted data and fake/garbage demographic information), what revenue am I providing the company? They'd be lucky to break even on a freeloader like me. I guess I should be happy that stupid people exist, they're subsidizing my ad-free e-mail account and an awesome search engine.

Re:"Internet rights advocates are now crying foul"

[Anonymous Coward]

Your sense of entitlement really makes you seem like an asshole, you know.

Re:"Internet rights advocates are now crying foul"

[sqrt(2)]

There is no sense of entitlement, although I wont deny I can be an asshole at times. I know the free ride would be over if too many people were like me, which is why I do not encourage the same behavior I practice. And when it ends--when, not if--I wont be angry because I know I wasn't paying a dime for what I was getting when I had it.

Oooh, is there a sale?

[Anonymous Coward]

Oooh, is there a sale on tinfoil these days?

Why use it?

[east coast]

If you got data that is so sensitive that you're worried about Google processing it for some kind of ad targeting purpose you should be worried enough to spend a few bucks and get a webhost for your data. You can get a webhost with a couple of gigs of storage and more transfer for ~10 bucks a month. What's the issue?

That's a real name?

[xgr3gx]

Is that guy's name really Nimrod?
I've always heard it used as an insult, example "You're such a nimrod".
Well, I am a dumb American, so I guess that's par for the course :). Oh any why do you need online storage? Use SSH/SFTP and you're all set.
I guess that only works for all us geeks who leave our machines on 24/7, or run our own servers.
Ah, the poor non-techy people.

Re:That's a real name?

[waztub]

Actually, Nimrod is a fairly common Israeli name. It's from the Bible.

Re:That's a real name?

[xgr3gx]

I never knew...thanks! I've been enlightened.

Re:That's a real name?

[rkanodia]

In the Bible, Nimrod is described as a mighty hunter. The name acquired its newer meaning thanks to Bugs Bunny, who used to refer to Elmer Fudd as a 'poor little Nimrod'.

Re:That's a real name?

[pla]

Oh any why do you need online storage? Use SSH/SFTP and you're all set. I guess that only works for all us geeks who leave our machines on 24/7, or run our own servers.

As a geek who leaves (some of) his machines on 24/7, and also makes extensive use of SSH tunnels, might I ask how you make the use of remote filesystems transparent, in particular on a (corporate standard) Windows desktop?

I know you can tunnel Samba, but the only way I know of requires having a local Linux box not running Samba, with it running the forwarding tunnel back to your home server; Then you can map the forwarded ports on the local machine, which really point to your remote machine. Big hack - Having used it myself, I wouldn't recommend it to my worst enemy.

If you know of a better way, I'd love to hear it (no sarcasm intended)!

The Cost of Using GDrive

[aquatone282]

The cost of using GDrive is allowing Google to mine the information you store with them so they can refine the type of advertising they present to you on the other services they provide for "free."

Looks like our pr0n collections will have to stay hidden on our hard drives unless we don't mind receiving ads for hot singles waiting to meet us NOW everytime we check our gmail accounts. . .

Re:The Cost of Using GDrive

[dedazo]

I don't understand why Google doesn't let me *pay* for their services and applications? I know you can pay for extra storage on GMail, but why don't they have a way for me to give them $50 a year or whatever and not have them scan my everythings and show me ads?

I spend that much any given weekday having dinner with two friends, I'll gladly pay for GMail and Docs and everything else. Just give me a good SLA with no legal bullshit and it's on.

Wrong.

[l4m3z0r]

If they encrypt your data for you, guess what? They have the key! If you want your data safe from them, YOU need to encrypt it.

This is patently wrong. Why can't I supply them with a public key that they use to encrypt, but I never reveal my private key thats used to decrypt the data. I mean honestly this is what public key encryption was invented for.

That said they dont need the key as you gave them the DATA to encrypt in the first place. So you'd have to trust them that once they encrypt it they throw away that data stream. But this is not a problem of key distribution as we have already solved that.

Re:Wrong.

[Paul Rose]

Maybe I'm just completely mising your point, but:

This is patently wrong. Why can't I supply them with a public key that they use to encrypt,

Because if they are doing the encryption then they have the plaintext.

They store two copies, the text that they encrypt and allow you to read, and the plaintext that they mine for info.

Re:Wrong.

[Professor_UNIX]

Why do you assume they would have the plaintext? Look at Mozy for an example of what the parent commenter was talking about. You can either use their key to encrypt your data, in which case they can also decrypt it without you needing a separate key, or you can use your own encryption key and the software encrypts the data which it before it sends it to Mozy's servers. Why can't Google do the same thing?

Re:Wrong.

[Paul Rose]

Because the parent to my post says that "they" encrypt the data.
Maybe we just disagree about the meaning of "you" and "they" in this context.
If "you" use their software to encrypt your data before uploading it then I say that "you" are encrypting it.
That is fine so long as you trust the encryption software (perhaps you inspected the source, etc.).

Re:Wrong.

[l4m3z0r]

Maybe I'm just completely mising your point, but:

Yes actually you are, you would realize had you read past the , that ends your quote, that I said the same exact thing you just did. I was pointing at that the parent framed it as a problem with key distrobution, which it isnt. I was trying to point out that while we solved the key problem we still have the problem of the plaintext and "trust".

Too Late

[gbr]

Really, it's far too late to be concerned about it. If Google already has your email, and your documents via Google Docs or Writely services, then they have too much already.

and Workman

[rueger]

Aficionados of Appalachian culture will surely know the name Nimrod Workman, who made a name for himself as a folksinger after retiring from a life as a Kentucky coal miner.

Check out Appalshop for recordings and a film about Nimrod.

This is Madness. This is Slashdot.

[njfuzzy]

This is idiotic. Seriously. The "product" in question is a rumor. No details are confirmed about how it will work, what advertising hooks there will be, what features it will have, or whether it will ever see the light of day. You know what criticizing it at this point makes you? Not an analyst, not an expert, not a technologist. It makes you a guy with a guess and a blog.

Re:This is Madness. This is Slashdot.

[grassy_knoll]

Ahem.

It makes you a guy with a guess and a blog.

Note to self: get blog.

My concern here is not my usage....

[Churla]

I know to avoid things if it involves giving private information to Google. "Do no evil" motto or not they have already shown they can and will bend to the right political pressure (i.e. China), or the right financial pressure (i.e. focused ad targeting).

My concern is how many people will blindly use it who don't know better. How many of those people will be ones I have to deal with? How much information about me will they be storing on G that I won't have control over? What happens when the government gets power happy again and decides that since it's stored on a public server they should have transparent access to it?

TANSTAAFL...

Re:My concern here is not my usage....

[jeiler]

My concern is how many people will blindly use it who don't know better. How many of those people will be ones I have to deal with? How much information about me will they be storing on G that I won't have control over? What happens when the government gets power happy again and decides that since it's stored on a public server they should have transparent access to it?

And again ... this differs from email how? We face this situation every single day, but I don't see anyone freaking when they get an email unless it's from some "foreign dignitary" with a Nigerian bank account.

Common Sense lacking?

[Bryansix]

How do any of these concerns also not apply to GMAIL. In fact there are software packages you can use to turn your gmail account into a "G Drive" already and utilize those 5+ Gigs for file storage.

Because in that case you gave them the plain text

[Sycraft-fu]

The only way encryption keeps someone out is if they never get the plain text, and never get the key. If I give you a disc and say "Here, encrypt this with my key, then burn it," you can read the data before you do so. There's nothing I can do to stop you. Likewise, if I give you encrypted data, and give you the key but say "don't use this" you can look at my data because you have the key (this is what HD-DVD and Blu-Ray do). The only way to keep someone out is for them to have nothing but the cypher text. So if I give you an encrypted disc and no key and say "Keep this safe for me," then you can't read it.

Encryption isn't a magic wand you wave and make everything safe with. It is a system of mathematics that has some very real constraints on its use. If someone has the clear text at any time, or the decryption key at any time, you are implicitly trusting them with that data.

Hmm..

[Selfbain]

Do they write these articles from scratch or do they have a program that just generates them from a template whenever Google makes an announcement?

Want another M$?

[jhRisk]

Granted Google has not yet shown us they're capacity for evil (tm) the way M$ has over the years but give them a chance... they're still young. Bottom line is that the same arguments I've seen here for why it's not a big deal (ex. do this, do that or don't use them) are the very ones used for why M$'s monopoly is not so bad (ex. use Linux, do this, do that) Problem is M$'s stanglehold at this time makes those options less "adaptable" for the masses. If we knew then what we know now we would have prevent M$ from even getting there.

But Google can do no evil, right, therefore despite this company being at that very point where we can do something before the ignorant masses consume their products in such quantities to the point where, like M$, change is difficult, we shouldn't worry about the same thing happening here, right? Yeah... right. Unfortunatley I see another monopoly coming but this time on personal information products which may not restrict our freedom of choice in the same sense as the M$ one does (eg. our ability to choose alternate technologies) but will be so valuable and so entrenched in everything that it'll be just as difficult to move away from.

We realistically could see most people, companies and even the governments depending on Google the way we did on Blackberries. It took the RIM injunction scare of 2006 to open some eyes up since even emergency services were depending on Blackberries (sigh.) Think beyond this on Google product, their 700MHz band bidding and every isolated move they've made in the past 5 years or so. Look at all of it holistically and as much as I like them and their products I don't like where it potentially leaves us in the future.

Re:Want another M$?

[msuarezalvarez]

Granted Google has not yet shown us they're capacity for evil [...]

Indeed, there are no flashy Evil Capable on google's pages. MS's marketeers are clearly way ahead of them!

Re:Want another M$?

[Taleron]

Not meaning to stray offtopic, but why do people still use the dollar sign for the S in abbreviating Microsoft, especially on Slashdot? I mean, I understand the reason for the usage, but peppering one's posts with "1337" letter replacements looks completely asinine at this point.

Re:Want another M$?

[jhRisk]

Sorry you feel that way but it's awfully presumptious for you to think you know why someone would use "M$." I do so simply because of the abbreviation and character recognition as it makes it easier to read especially when there's many mentions. If G# was the acceptable abbreviation for Google I would use that one too. Nothing in that post is bashing M$ or in any way related to what you are inferring I'm trying to say by its usage by the way. Also...

Not meaning to stray offtopic, but why do people still find the need to try to stray offtopic?

Not meaning to stray offtopic, but why do grammar, language and other nazis still troll around trying to teach us feeble minds how to properly conduct ourselves online?

Sorry but you asked for it ;)

Re:Want another M$?

[Taleron]

That has to be a wholly worse reason than my "presumptuous" assumption. Take a moment to think about your assertion of "not bashing" Microsoft while using a typically derisive play on the company's acronym. Using M$ instead of MS doesn't diminish the number of uses in the paragraphs, nor does putting a vertical line through an S somehow make it easier to read to anyone familiar with the English language; the only way it makes your post more readable is because it's more annoying and each use stands out like a sore thumb in otherwise fine writing (rather presumptuous yourself that you think you know what I thought of you, isn't it? The rest of the post was good, that's why I felt the need to reply).

I like to think Slashdot has a certain level of decorum users try to adhere to, is all. And I was simply trying to be polite about being offtopic.

Re:Trust the large corporation

[Anonymous Coward]

Holy fuck. How did you afford the tinfoil for a hat THAT big?

Do we need legislation?

[rueger]

Many valid points are made here, not the least of which is that sensitive information should secured locally, not via some free web service. And of course, Google does tell you what they will and will not do with your data, as do most places like Facebook etc.

What I'm interested to watch is how legislation, or even case law evolves as more and more information moves on-line. Will lawmakers force on-line services to encrypt customer data, or to meet minimum levels of security? Will servcies like Google find themselves liable for large settlements if a user's data is lost of their account hacked? It would seem that lawsuits are inevitable.

If there are legal minimums for data protection and encryption for web based services, what happens to the millions of small sites, forums, and blogs that offer users the choice of logging in to post messages, or of accessing other services on-line? Will they disappear? Will sites under a certain size be exempted?

Re:Do we need legislation?

[Forbman]

well, what happens if Iron Mountain screws up your company's backup tapes, loses them, they get destroyed in transit between IM and your company, etc.?

Re:gdrive?

[The Angry Mick]

i got dibs on the ../pr0n directory

Would that be called the "G-Spot"?

OT: WTF is up with their "printer friendly" page?

[noidentity]

Here's the supposed printer-friendly page: http://www.popularmechanics.com/technology/industry/4234444.html?do=print

That's not printer-friendly, and only partly reader-friendly! (OK, so I gave away the real reason I'm using the printer-friendly page)

Re:Because in that case you gave them the plain te

[Ephemeriis]

If someone has the clear text at any time, or the decryption key at any time, you are implicitly trusting them with that data.

Exactly. If you're already trusting Google to do the encryption or hang on to the key or whatever...then why bother having them encrypt it in the first place? Your privacy has already been compromised and you're already relying on Google to do what they claim they're going to do. If you are genuinely concerned about about your security/privacy then you aren't going to want to rely on Google for any of it - encrypt your own files, with whatever software you trust, and then upload them.

Re:Time for a change.

[dedazo]

Google has been one of the least invasive and coercive companies.

The recent barrage of articles concerning privacy and Google would lead me to believe you don't read Slashdot, but I know that's probably not the case, so we must assume that you're just...

M$'s Live Desktop Rape Service

... bashing Microsoft, as usual.

Email and other communications should be encrypted.

And you didn't even RTFA.

Just remember

[SCHecklerX]

Part of a good security strategy is to have off-site backups of important data. So, it is better to put stuff on Google's servers than it is to risk losing it when your system crashes, don't you think? For sensitive information, encrypt before storing (or store it on google as a truecrypt volume? I haven't used the gdrive thing, but if it can be mounted, then this seems the optimal solution).

I have a Chinese friend with Yahoo Mail...

[ZombieRoboNinja]

She's studying in the US, but most of her family is back in China, and she uses her Yahoo mail account to communicate with them.

She does this knowing full well that Yahoo is reading her mail and will rat her family out to the government if she says anything that smells like dissidence. She told me she always tries to be careful how she words things, just in case. But she doesn't bother encrypting things or switch email addresses, because she's NOT a political dissident, and she has "nothing to hide." To me, the whole thing seemed terribly Orwellian. Watch what you say, Big Brother is listening.

Hey, wasn't there a case where some foreign branch of Google did the same thing a few days ago, turning data over to the government without even a warrant?

Hey, don't WE have a horrifically intrusive federal government that thinks nothing of trying to push corporations into illegally revealing sensitive information?

Personally, I use gMail, because I too have "nothing to hide" - no weird political affiliations, etc. But I wonder how long before I start to subconsciously self-censor what I write people, just to be sure.

"But if you want to keep your secrets, don't use Google/encrypt your communications!" I hear the cry. This is of course true; if my friend and I WERE political activists, we'd probably both be taking a lot more steps to secure ourselves. But we're not, and it's honestly not practical to start sending out public keys to everyone who wants to chat with us via email. So in comes the self-censorship, which IMO has a far more damaging chilling effect on political dialogue than may be immediately evident.

how could Google encrypt?

[eean]

Whats the point of having Google encrypt and decrypt your info? They'll have to turn it over, decrypted, if served with papers. And wouldn't release it otherwise.

Encryption has to happen client-side.

relevant ads for essentially random/encrypted data

[StandardDeviant]

Cool, I might be able to find some new powernoise musicians that way! :D Merzbow has reminded me at times of what it must sound like to pipe a tarball into /dev/dsp.

(My gdrive would probably contain one large encrypted file. Tar + gpg + free offsite backup, sounds like a win to me.)

These "privacy advocates" have no business

[IGnatius T Foobar]

I don't know who these supposed "privacy advocates" are, but as far as I'm concerned they can go f**k themselves. If they don't trust their data on Google's servers, then don't use the service. END OF DISCUSSION.

Re:These "privacy advocates" have no business

[Anonymous Coward]

So you are simple and have nothing to hide... that makes you, yes, a simple average moron sharing everything with beloved Google.

Re:These "privacy advocates" have no business

[Anonymous Coward]

He wasn't talking about whether you have or haven't got something to hide(like the "patriot"'s do), he was talking about whether or not you trust Google to keep your data secure and not look at it or not.

Re:These "privacy advocates" have no business

[mattwarden]

Or encrypt it before you upload to google.

How long before some open source software is written to do this seamlessly, just like truecrypt does on your local drive? I'm betting 2 weeks after launch. Actually, I'm betting it is being designed right now by someone.

Re:These "privacy advocates" have no business

[IGnatius T Foobar]

So you are simple and have nothing to hide... that makes you, yes, a simple average moron sharing everything with beloved Google.

Me personally? I have my own server at a hosting center, and another at home with a tape drive for backups, so I don't personally have any use for GDrive. As for the rest of the world ... people can make decisions for themselves whether they want to trust Google with their data. They don't need self-proclaimed "privacy advocates" making decisions on their behalf.

Re:Because in that case you gave them the plain te

[Anonymous Coward]

Way to point out exactly what the poster was saying. The GGP said that you can't let google encrypt it because they have the key. That is stupid. The key allotment isn't the problem. If it was just a matter of them having the key you could do public/private keys, but as you and he were saying, they have the original data and don't need to decrypt it.

Moron

[Anonymous Coward]

That's what you get for being stupid enough for getting an Abble Mak

Re:Moron

[Anonymous Coward]

What do you feel gives you the right to criticise someone else for their choices? Is it your inability to spell simple words, or your failure to create coherent sentences?

Stay in school, kiddo.

eCryptfs

[omnirealm]

When Google provides a Linux filesystem (either native or via FUSE), people can use eCryptfs to prevent Google from reading the contents of their files. eCryptfs stacks on top of other filesystems and encrypts the data.

Re:Trust the large corporation

[m4ximusprim3]

zzzz..*snort* roomba!...zzzzzzzzz *dreams of capresso* Back OT: I don't trust them as far as I can throw them. But, that doesn't mean it's not a useful service and that I won't use it. I'll just stash my bank records somewhere else. See? simple!

Re:Time for a change.

[Anonymous Coward]

M$'s Live Desktop Rape Service

What?

Re:Time for a change.

[Joe U]

There's a problem with the way things have been done, that's why we are having this discussion.

Actually, Twitter, this is more of a 'I have not personally seen or used your service, and you have not published detailed specs, so I will write some suggestions on how to fix the problems you have'

The other options are things like M$'s Live Desktop Rape Service

Yeah, you don't have too much free time on your hands. Tell your mom to stop sending the sugary snacks to your apartment over the garage, they're getting you too worked up.

Is every file sensitive?

[Xzarakizraiia]

I don't really see the issue here- as long as users can determine which of their files get uploaded to it and which don't (and I can't imagine anything other than that being the case), what is the problem? I have plenty of data that isn't sensitive in the least. My data that is sensitive isn't going on Gdrive (or .Mac, or any other server that I do not control). Maybe everyone else doesn't have as much random, unimportant junk as I do...

That's precisely it

[Sycraft-fu]

You either trust them or you don't. If you do, then what is the encryption supposed to buy you? You trust them right? If you don't, well then why would you trust their software to encrypt it, but not send the key?

You don't necessarily need encryption

[Mr. Pibb]

You can just use any obsolete archiver if you don't want Google scanning your data. Sure, they could write a module to unzip your files, but are they going to bother with LHarc and .ZOO files?

Re:Time for a change.

[Anonymous Coward]

Hey, it's Twitter the M$ troll, erhm...I mean Erris.

Legal expectations?

[BobaFett]

'It really needs to have really detailed explanations of what the legal expectations are for storing your info.'

You've given Google your data, they can look at it all they want. Simple enough? They will certainly have the service agreement you have to accept when you use the service, with things like how much your copyright on your works protects you and what license you explicitly grant them by uploading copyrighted works to their storage, things like that. But basically, you stored your data on their disk, assume it's their data now. If you don't like it, well, disk space is pretty cheap now, order few disks from Newegg.

Now, protecting the data from 3rd parties is just good business sense for Google: they plan to make money somehow by analyzing the data, if anyone can see the data then anyone can do whatever Google plans to do and take a portion of that money.

Fool me once, shame on you. Fool me twice...

[$criptah]

If people trust a company with the data, then I can blame nobody but them. During the past years there was so much information about data loss and security breaches that it makes me want to un-plug my computer when I am not at home. Given the fact that Google, Yahoo, Comcast and other big companies constantly play favorites and bend over in front of foreign governments, I do not and will not utilize their services for any serious business.

I trust only myself or dead people. If you need space, get an external hard drive or two. Store data there, encrypt, remove all old stuff that is no longer need and repeat. Your habit will save you in a long run. There is an article on Slashdot about YouTube's refusal to publish information from one of the bloggers who exposes controversial subjects. "Don't tase me, bro" has been sitting on 'tube for weeks now while this poor guy from Egypt cannot publish his material online. Does this sound right to you? Is this a company that you would like to support? Is this ethics? What do you think Google is going to do if Chinese government asks it to provide data stored on your hard drive given the fact that you may be in charge political opposition? I hope that it is not that complex to figure this out...

Why no encryption?

[Anonymous Coward]

I currently use Google Browser Sync, this has built-in encryption, so any information you send to Google is already encrypted and they have no knowledge of what it contains. Why would this service be much different. I don't see any reason for them NOT to encrypt the information.

I let my E-mail Provider Read All My Mail

[Jon_S]

This same paranoia came up when GMail came out. People all freaked out that Google was reading their mails to match up ads.

I don't have GMail. I pay for a service (*) rather than look at ads.

But you know what, I still let my e-mail provider read all my mails. How else does anyone think that spam filters work? You can't filter out spam without reading the e-mails.

It's not like Eric Schmidt is there reading each message looking for the good ones.

* service = fastmail.fm I highly recommend them.

Good Sense and Protection Money

[blueZhift]

There's a lot of talk about encryption here, but it is unlikely that "ordinary" users are going to use it or care. But I would say that if I had any illegal or questionable materials, good sense would make it unlikely I would store them on a Gdrive. And as far as Google data mining my files for ad purposes, my guess is that they will offer a paid service wherein your data is not scanned by them at all, beyond virus scanning I would guess. So if you pay the protection money, then it's cool, if you trust Google that is...

Instant Privacy Concerns?

[brentonboy]

Just add water!!

Nothing specific to Google

[ozzee]

There already exist drive in the sky web services. I suspect Google's gdrive is only a me-too comparable service. If we're so paranoid (which I probably am), then the game is already won by the bad guys. Case in point, over the last year, I have needed to wipe my hard drive clean four times because something went awry, just unexplicable things like network services starting to do strange things. No virus check found anything. With the guise of a Microsoft update, my computer can be surreptitiously surrendering all kinds of information against my will, we don't need a gdrive for that, it's already possible and more than likely happening to almost all who use Windows.

I can think of a few fixes but it's probably not going to be something that will happen fast or without a fight.

um, ok

[pak9rabid]

It takes a special type of douche bag to 'rage over' a free service. If you don't like it, then don't use it..

Imagine if....

[gentlemen_loser]

Microsoft knew as much about you as Google does:

It appears that you are trying to erase emails that your mistress sent you. Would you like to:
o Forward them to your spouse?
o Click on the banner ad to delete them?
o Forward them to all of your contacts?
o Buy an update to Office for the low price of $799.00 to delete them?
o See other options?

Third

[hhawk]

If you transfer you data to a third party, there is really little chance that someone isn't going to have access to it, including Admin. users on the system.

If you really need to use it you could of course encrypt before you upload.

Home based RAID systems now sell for $300-$500 with TeraByte size drives. Or put the data on a Flash drive and store it in your bank vault.

Griping about vaporware

[ElizabethGreene]

Does no-one else observe the futility of griping about a product that does not exist yet? Let's see what they come up with before gathering the pitchforks and torches. -ellie

The Obligatory post...

[MedBob]

I, for one, welcome our new storage overlords!

---
What the hey. My karma sucks anyway!!!!!

My goodness ..

[ScrewMaster]

says Nimrod Kozlovski,

You mean there actually are people named Nimrod?

Ho-ho-ho!

[Anonymous Coward]

The M$ Live Desktop Rape Service!!! HAHAHAHAH!!! OMG, that's so hilarious, even if it pretty much confirms you're a sociopath!

Do you have a wife? Sister? Daughters? Because if you do, you should think about seeking psychological help. If you're a 15 year-old living in your mom's basement, then it's OK. You'll probably grow out of it.

I'll take two

[torkus]

Seriously. This is another pile of shi....erm... sensationalist 'cry wolf' journalism.

Google has my data that they're storing for me, for free, because i gave it to them...along with my email...and a spot on my MSIE toolbar, and a spot on on the MSIE searchabr, and a spot on my desktop for desktop search...

Seriously, we coudl all say to encrypt it but 99% of people out there won't. Ease of use + free > privacy to most people. In fact google still keeps your data private. Yes, they'll give you targeted advertizing...same as every other 'free' website. They do it better, with a better interface, faster, and are less intrusive. Know what? Sometimes their adds are actually USEFUL. So yeah, if i save and upload and work on a presentation about the price of sex slaves in asia and a link pops up offering a tour...remind me why i should complain?

Half the time the adds are...pre-emptive searching.

Privacy Nazis

[llimllib]

If the Privacy Nazis kill my google data service or render it unusable, I'm going to be furious. For chrissakes, let me decide what to do with my data!

Privacy Advocates

[hansoloaf]

Privacy Advocates = One law professor in Israel.
So where are the "raised eyebrows among privacy advocates worldwide" ?
Like many people have said in this thread - don't like it, don't use it.

Gdrive+FUSE+TrueCrypt+"rsync-like" = win?

[Anonymous Coward]

Seriously, if someone figures out a way to send incremental rsync style truecrypt container changes to Gdrive via FUSE, it would get interesting.

BUT, since it's incremental, Google potentially could do some very interesting analysis on incremental container changes. And there's always the temptation to use your Google logon for the container password.

For everyone else, it'll be a FUSE like module with rsync style connections and the link encrypted using your google account logon. Google needs to see the average users Gdrive to do content analysis for their ads. Now, if they did TimeMachine like versioning, sorta like some kind of SVN for your generic files, then they provide some real value. Couple this with kinky single instance storage on Google's end, and they're in business.

gmail attachments from gdrive

[Anonymous Coward]

I hope Google enables me to attach things like pictures or say a resume right from my gdrive within the gmail interface. That way I don't have to be at the right damn computer to attach those docs when I want to send them.

I seriously think this is the next killer email feature that will set someone apart from all others.

no encryption?

[m2943]

Google generally makes APIs available for their services, and they will likely do the same here. So, if you want an encrypted file system with Google storage, all you need is the right client.

I suspect you're going to see a Fuse-based encrypted Google file system within days of the release of the API and service.

If you don't like privacy advocacy

[xant]

You can ignore it. It's the same advice you gave.

If there's a privacy problem, Google is not likely to tell you about it. Not everyone in the world is aware of problems with the privacy of their data. "Advocates" are the people who warn other people about those problems. Everyone should make their own informed decisions. It is ridiculous to think every possible user of GDrive would know the possible issues with it.

That's assuming the problems will actually exist, which I'm not convinced of yet.

Bowie said it best

[Anonymous Coward]

There's a guy named Zimmerman who can tell you just how badly the government would like to make it against the law to encrypt data or communications.

Oh, hear this Philip Zimmermann
I wrote a song for you
About a strange new thing called PGP
With a key that's public too
This software for encryption
So-called breach of export law
Brought a few more privacy
And put the fear in a whole lot more

Re:Bowie said it best

[PopeRatzo]

Nice Dylan/Bowie/Hunky Dory reference, AC. What can you do with "Black Country Rock" or "All the Madmen"?

Re:Bowie said it best

[Anonymous Coward]

Thanks, but I think I exhausted my rather limited filk-fu right there. This coward's taking a bow :-)

New name, same concern

[Anonymous Coward]

we have been emailing ourselves documents and the like for years.

So just store A XOR B there...

[Anonymous Coward]

..and keep B on some other low cost internet storage provider (say Amazon S3 but even they may be too expensive compared to free but thats another issue).

Anyone who wants A has to get a copy of B from somewhere other than Google in order to reverse the computation.

A FUSE based file system could easily do this. Anyone looking at traffic just to google or just to your other provider wouldn't be able to get anything.

Anyone know of anything that already does this?

A little too late to be concerned...

[blahplusplus]

... about privacy. I mean really online unencrypted email gives any bad person in the right place access to a lot of your personal information anyway. If we dumped all the email out of the free emails services, I'm sure we'd have a hell of a lot of data just from that alone.

A message from your non-techie wife

[sweet_petunias_full_]

Hi honey this is your wife. I'm sorry I just uploaded the most incredibly embarrasing pictures of when you were flapping around in your underwear during our vacation to Picasa, YouTube, Gdrive, and any other place that I could find. I hope you don't mind. All of your relatives are laughing their asses off. I accidentally uploaded our tax documents too using some toolbar thingy. You'll just go up there and delete them right? OK I thought that would be possible, thx, bye.

This Is Your Choice!

[Azuma Hazuki]

No one says you have to use this. The only reason this is even an issue is that most people are seeing Google's halo effect (and are taken in by "ooh, shiny, web 2.0!"). It should take even the least computer-savvy person less than 10 seconds of thought to realize that trusting any computer other than YOURS with YOUR DATA is a Bad Idea (TM). Especially when you can't physically get to the machine. What happens if your internet connection dies or is terminated? That's not even getting into the fact that trusting anyONE else with your information is an Even Worse Idea (also TM).

encfs

[haakoneide]

encfs does the same thing, but also encrypts filenames. It isn't "Enterprise-class" though, so I guess if you are a PHB you probably shouldn't use it.

Google shmoogle

[billcopc]

I love how whiney little "experts" pick on Google, when their gripes apply to every online storage system ever.

I use my (leased) servers spread out all over the world for backup storage. That's right, there are copies of my data in 3 different places (plus the original at home). The archives are encrypted, but theoretically someone could boot one of my boxes into single-user, copy a file and try real hard with rainbow tables until they crack it. My life is boring as hell so the likelihood of that happening are nil, but it's feasible.

I could store those files anywhere else... Google, Amazon, or any of the stupid little ad-supported file hosts. Hell I could post the dumb thing on The Pirate Bay, label it as geek pron and let it float in P2P until I need it back. The end result is the same: my files can be accessed by third parties, and I'm not the least bit worried about it. I've taken the necessary steps to keep random idiots out of there by using fairly strong encryption, but a motivated hacker will always end up getting whatever he/she/it wants.

There is no absolute privacy, only relative privacy. The security of a piece of information is directly related to how valuable it is to how many people. Encryption will raise the bar, but the data is never ever 100% safe. Once you accept that fact, you stop worrying about it so much.

Sorta naive suggestion

[jc42]

Google would be wise to offer users an option to encrypt your information

Yeah, I suppose it would be wise, from google's viewpoint. After all, if they offer encryption, many customers would use it. And since google supplied the encryption, google can decrypt it any time they want (or any time a government agent orders them to do so).

What percent of the users do you think would fall for this, and thing that their stuff is secure because google encrypted it?

It is good to see that others here are suggesting various encryption packages that you can install on your own machine. At least someone has some sense.

won't stay

[Anonymous Coward]

It won't stay this way. I have it on good authority google will deploy an encryption solution, one that is client side so that data stored on google's servers is encrypted at all times, at some point after the initial release.

At least, that's what one of the Platypus (gdrive's code name apparently) developers told me at a technology conference.

You don't have a choice and it's worse than that.

[Erris]

I still let my e-mail provider read all my mails. How else does anyone think that spam filters work? You can't filter out spam without reading the e-mails.

What choice do you really have? You could run your own mail server through dyndns but non of the major ISPs will take your mail or send mail to you. Because of this, you are forced to use an ISP of one sort or another. They same things can be said about encrypted email. Without M$ and ISP "support" encryption will remain something restricted to a very few people who will be harassed.

"Reading" your mail for spam filtering is not the kind of profiling privacy experts are worried about. What you should be worried about is a profile based on your buying and reading habits that can be used to smear you, have you watched as a criminal/terrorist, denied health insurance, employment, credit and housing. Even if you are not the sort of person who would end up on a list for challenging some power that is, you should care to protect those other people because they are fighting for the rights of the rest of us.

Now, of all the ISPs, I'd trust Google before the rest but NO ONE should be doing this kind of thing. Your grocer, for example, should not report your purchases to others because it's none of their business. The fact that the grocer can make money that way is irrelevant but does not make up for the greater social harm that is done. People can make money through armed robbery and murder but society protects itself from that kind of thing.