Slashdot Mirror
Google Speeding Up New Encryption Project After Latest Snowden Leaks
coolnumbr12 writes "In a new leak published by the Guardian, New York Times and ProPublica, Edward Snowden revealed new secret programs by the NSA and GCHQ to decrypt programs designed to keep information private online. In response to NSA's Bullrun and GCHQ's Edgehill, Google said it has accelerated efforts to build new encryption software that is impenetrable to the government agencies. Google has not provided details on its new encryption efforts, but did say it would be 'end-to-end,' meaning that all servers and fiber-optic lines involved in delivering information will be encrypted."
Although impenetrable to Government spying I doubt it would be impenetrable to Google, who would not think twice of harvesting all data sent though this encryption method.
If Google cares about security, then why does it insist that companies synchronize passwords with their Google Apps domains using unsalted MD5 checksums?
Unless Google is going to devise a crypto system they don't have any access to the keys, this is meaningless.
Because when those government agencies can walk in the door with a secret warrant and demand the keys, there is nothing Google can do.
The US lawmakers have essentially made crypto in America irrelevant when any party knows the keys.
The rest of the world needs to be stepping up their game, but all of their governments want the same ability to spy.
I fear the US has more or less decided that the entire world should be operating on less security to protect their interests. And I'm not sure why everybody is playing along with that.
Lost at C:>. Found at C.
For an entity like Google (large, technically sophisticated; but most of their worthwhile data probably count as 'business records' for the purposes of nigh-limitless subpoena-under-cover-of-darkness powers, do the feds really bother sucking on the fiber when they could just flash a badge and get what they want?
If so, actually-working-encryption should create an interesting little jump in the number of information demands (whether they are the kind that Google is allowed to talk about, and whether it will be 'Google received 123,345 demands last year, and only one this year! (The one demand was "We want all of it.") are different questions).
If they already aren't sucking on the fiber because doing it through Legal is easier, this probably isn't bad security practice; but won't really slow the feds down much. They certainly don't have an aversion to genuinely covert behavior; but they also have crazy expansive 'legal' abilities to obtain information (and, especially when paid, often plenty of help from the companies who have the data...)
I don't see how a new encryption effort helps. Anytime you trust a third party to handle your data in the cloud, you are open to having that data compromised because somebody else codes it, somebody else builds it, somebody else deploys it, somebody else administers it, etc. Many who fell for the charming upstart company with the motto "Don't be evil" the first time around feel burned, and there is no technical solution to that problem.
I read TFA, and I wish I hadn't. It's just a fanboi gushing about how awesome Google is.
What it fails to mention is the fundamental tension between developing encryption technology and Google's business model of pervasive surveillance.
Quotations from Google executives such as:
fail to convince me. I am sure Mr. Grosse means what he says, but his actual ability to follow through on his personal honor is limited. It's the Almighty Dollar that is ultimately calling the shots at Google, or any company.
[Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
Given that the reports of the Snowden NSA documents indicate that the NSA worked with willing private sector companies, why should anyone believe that this is nothing more than a public relations push by Google? I think Google is trying to restore trust by appearing to be doing something while in fact being just as open and cooperative with the NSA as it has always been. I will believe that there is some pushback by private companies when there are actual public (not secret) court cases brought by the government to force them to do something. Until then I call shenanigans.
Is Google even allowed to pursue such an undertaking? What's to stop the NSA from requiring access by design? It's not as if Google could say anything about it if this were the case.
Google has not provided details on its new encryption efforts, but did say it would be 'end-to-end,' meaning that all servers and fiber-optic lines involved in delivering information will be encrypted."
Which is meaningless in the face of a subpoena or national security letter or a a wrench. Anything Google does suffers from the problem of trusting a third party. Even if Google's solution were 100% effective technologically, they still are a third party and cannot be trusted 100% to not give the keys out.
Google has gotten lots of $$$$ from the NSA and the CIA and is in complete bed with them. Google gives -everything- to the NSA and CIA
Things that make you go HMMMMM...
http://gizmodo.com/confirmed-nsa-paid-google-microsoft-others-millions-1188615332
http://www.infowars.com/googles-deep-cia-and-nsa-connections/
http://www.pcworld.com/article/217550/google_watchdog_white_house.html
http://www.theregister.co.uk/2013/06/10/palantir_denies_powering_prism_spy_system/
http://www.wired.com/threatlevel/2012/05/google-nsa-secrecy-upheld/
http://www.prisonplanet.com/nsa-funds-new-top-secret-60-million-dollar-data-lab.html
The Truth is a Virus!!!
You mean "any third party". For peoples communication to be "secure" they need to keep a private key and others need to use their public key to send data. This of course blocks Google from reading it as well. This is a problem for Google because they like to have the machines read your email to build a profile for targeted advertising. Using secure crypto not only blocks governments, it blocks Google. Unless their plan is as you suggest where Google has the keys, in which case you are correct that it does nothing to prevent spying.
If Google wanted to impress me, they'd include a spot to paste a GPG public key in gmail and auto-encrypt all mails with it on the client side for gmail users or at the entry point of their network for all other mail users. As it stands Google is very much part of the problem, not very much part of the solution.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
uses the obselete since a decade RC4 as the encryption algorithm for its httpS.
If the "end-to-end" is correctly implemented, i.e.: not like in the bad definition in the summary (fiber optics and server encrypted), but like usually understood for privacy (i.e.: decrypted form only exist on end-point totally controlled by end users), google, nsa or any other man in the middle doesn't matter.
That requires 2 important details:
- sound encryption.
The maths behind current encryption seem sound. But the implementation must be good too. NSA has notoriously interfered undercover with lots of software development team, leading to bad implementation which could leak data or have predictible key due to broken random generator, etc.
Opensource is a lot less likely to be tainted as errors are much easier to spot. You don't know what NSA could have hidden in closed source software whithout the knowledge of the software vendors themselves.
- secure environment.
There's no point in having the most perfect encryption ever if the NSA could simply bypass it and use a hidden backdoor or abuse an exploit to break into and simply tap the clear message from one of the end points.
Skype EULA clearly states that they are ready to conform with local law about collaboration with law enforcement (could probably be even implementing wire-taping point). Also I think by now backdoors inside Windows are more or less accepted to be existing in our post-Snowden world.
Again, opensource software, both user application and the OS on which they are running, would be more difficult to abuse, as backdoors and exploitable bugs would be easier to observe.
But in a theoretical pefrect wold of rainbow, unicorns, perfect crypto implementation and secure machine, you can then use safely an untrusted network and untrusted servers: data that will transit through them will be always encrypted and meaningless.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
You'll be on one end and the NSA is on the other, ready to forward to your intended receiver. Seriously can we still trust google with anything?
When I read TFA, and it states that ...
In response to NSA's Bullrun and GCHQ's Edgehill, Google said it has accelerated efforts to build new encryption software that is impenetrable to the government agencies
As if nobody knows the cozy relationship between the founders of Google (and Google Inc. itself) and Uncle Sam.
The only way we can be sure that something that is truly important to us does not fall into the hands of NSA is to NOT put it online, period.
Muchas Gracias, Señor Edward Snowden !
Sure, NSA has been farming Google's queries and emails and all the other stuff unencrypted. And for Google's PRISM link, they need a warrant if its for a USA citizen. (Well at least if they think it is, at least 51%). That means nothing to us non US citizens. (I'm a brit, my countries spy agency even spies on me for the NSA and the politician who signed off on it, William Hague, traitor to his country, is 'Sir William Hague' not 'Traitor William Hague'!).
So Google's encrypting data forces them to get a warrant, well sort of, and only for USA people.
Except NSA has also been getting warrants that let it get the keys to the certs, and also has access to the cert authorities, and it also has backdoors into the encryption itself, making the encryption meaningless. A PR stunt. "Accidental" gathering of American data still continues and for most of the world the same "massive deliberate" capturing of our data, private, political, news, business secrets the lot, continues unabated.
Android is still rooted, MS Phone is still rooted. Google's services are still part of the surveillance machine, willing or not.
It's a token response, but the real solution is to avoid letting your important communications transit the US, or US based services.
I've cancelled VPN's, webservers, Skype, stopped using Google, email has been moved. These are *real* measures that can be taken, not *PR Stunt* measures.
TFA is pretty short on technical details, but this sounds like it's end-to-end between Google datacenters, not customers. So when the NSA comes a-knocking with the inevitable secret court order to hand over keys, they'll be right back to capturing everything and filtering on the NSA side.
0 1 - just my two bits
They'll never regain the trust of their users, along with Microsoft, Apple and all of the other bend-over-backwards in the US.
Give it a year or two, and no one will even remember the NSA/Google scandal anymore. Sadly.
I don't think people outside the US really care if US companies use 10,000 bit quantum spiral elliptical gluon encryption with a half twist of lemon. If the NSA comes to those companies with the Open Sesame court orders then it doesn't matter. This is a massive opportunity for non-US companies to say, "We ignore any pressure from the US." Along with their governments to say, "If a local company gives data to the US government then they go to jail." Put these two together and people will start flocking to their service (assuming it is roughly equal to the US one) so create euromail.eu or whatnot and you've got customers.
Right now is the time to have a marketing shtick where you tell people that you spend all day every day thinking up ways to keep the NSA away from their data.
Also this is the time for Linux to strike. The key is that there are two assumptions being made by most people out there. First is that any US company with closed source software has been strong-armed into leaving a back door. Second is that the NSA have broken any common encryption scheme. So if you use the common ones they might as well be plaintext. But if you are able to use opensource obscure encryption schemes then you stand a chance.
I wonder what the consequences could be for the Internet at large.
Apparently there are backdoors in popular encryption software programs. That in itself should be alarming: if the NSA knows about it, who says the underworld hasn't found out about it already? Or is now directly searching for backdoors, knowing that they exist?
The NSA is after your privacy - which is a very bad thing, but something that doesn't hit most people directly.
Cybercriminals are usually after your money. If encryption is not secure, they can easily start listening in on credit card transactions done "securely" over HTTPS.
They can also start to intercept financial orders, decrypt them, alter them (i.e. payment redirected to another recipient, while still sending the intended recipient a "transaction accepted" reply), and sending them on correctly encrypted so the payment processor is none the wiser; after all it's encrypted so it's true. And it's going to be really hard for the intended recipient to file a complaint.
It won't be the end of the Internet as we know it, but there are some serious considerations to make.
Support TLS 1.2 and TLS-SRP in your browser.