Google To Encrypt All Keyword Searches

Hugh Pickens DOT Com writes "Danny Sullivan reports that in the past month, Google has quietly made a change aimed at encrypting all search activity to provide 'extra protection' for searchers, and possibly to block NSA spying activity. In October 2011, Google began encrypting searches for anyone who was logged into Google. The reason given was privacy. Now, Google has flipped on encryption for people who aren't even signed-in. In June, Google was accused of cooperating with the NSA to give the agency instant and direct access to its search data through the PRISM spying program, something the company has strongly denied. 'I suspect the increased encryption is related to Google's NSA-pushback,' writes Sullivan. 'It may also help ease pressure Google's feeling from tiny players like Duck Duck Go making a "secure search" growth pitch to the media.'"

Comments

Illusion of privacy

[NoImNotNineVolt]

Encrypting the connection between Google and the users isn't going to accomplish anything when the NSA already has full access to Google's servers.
Too little, too late. Way too late.

Re:Illusion of privacy

[geek]

Encrypting the connection between Google and the users isn't going to accomplish anything when the NSA already has full access to Google's servers.

Too little, too late. Way too late.

Google has been very adamant that the NSA does not have access to their servers. I don't know if I believe them or not but that is the premise Google is working off of.

It also means nothing when they cowtow to the national security letters like they do.

Re:Illusion of privacy

[thetoadwarrior]

Doesn't really matter. If they're encrypting it then they can decrypt it so if the NSA wants it then they'll have it.

Re:Illusion of privacy

[AlphaWolf_HK]

Even if Google wanted to tell you that the NSA has access to their servers, knowing full well it would kill their bottom line (assuming it would), they'd be forbidden from telling you the truth anyways.

That's actually the scariest thing.

Re:Illusion of privacy

[dreamchaser]

I understand how it works, and there are plenty of devices that do exactly that with SSL traffic. If they can intercept the traffic and have compromised the certificates, which is certainly possible if not definite, they can decrypt it without the user ever knowing. There are even commercial devices that do exactly that.

Re:Illusion of privacy

[jafiwam]

I dont think you understand how SSL works. Its entire purpose is to defeat MITM.

And YOU don't understand what would happen if "the man" in the middle has access to the certificates, either the masters or the actual certificates themselves.

Do you really think "mysecretdomain.com" certificate from shitty ass low cost certificate provider doesn't have a duplicate key on file at Comodo, Network Solutions, GoDaddy or TwoCows or whatever?

They don't have to brute force or hack anything if they have an appliance in the middle that automatically grabs the certificate from the certificate issuer and spoofs both sides of the connection.

If you want your traffic encrypted, you need to generate your own certificates using software you compiled after you reviewed the code.

Re:Illusion of privacy

[usuallylost]

Do not put to much confidence in SSL. I have tested several firewall products that allow corporations to decrypt SSL traffic coming into their networks. Basically all they need is the ability put a trusted cert on the machine and force you to use a proxy. On a lot of corporate networks your SSL traffic is being decrypted and scanned. My guess is the NSA can do the same thing to you pretty much anytime they want.

Re:Illusion of privacy

[fustakrakich]

...it still is a very string possibility.

Only in theory...

Re:Illusion of privacy

[icebike]

I dont think you understand how SSL works. Its entire purpose is to defeat MITM.

And YOU don't understand what would happen if "the man" in the middle has access to the certificates, either the masters or the actual certificates themselves.

Do you really think "mysecretdomain.com" certificate from shitty ass low cost certificate provider doesn't have a duplicate key on file at Comodo, Network Solutions, GoDaddy or TwoCows or whatever?

They don't have to brute force or hack anything if they have an appliance in the middle that automatically grabs the certificate from the certificate issuer and spoofs both sides of the connection.

If you want your traffic encrypted, you need to generate your own certificates using software you compiled after you reviewed the code.

Was going to post exactly this!.

But to further the point, it is strongly suspected that SSL is already broken by the NSA, and having certificates is no longer necessary.

Google publishes its own certificate. I don't think its signed by anyone but Google, a sign they have totally given up on corrupt certification companies.
They also have changed it occasionally. I notice this when my more selective operating systems prompt me to accept new certificates for some Google Services, that they were happy to use yesterday. (These are always sort of scary events that warrant close inspection).

Re:Illusion of privacy

[swillden]

Even if Google wanted to tell you that the NSA has access to their servers, knowing full well it would kill their bottom line (assuming it would), they'd be forbidden from telling you the truth anyways.

True... but I'm not so certain that they could be compelled to lie. When I look at the pattern of public statements and later revisions from all of the big players (telcos and tech companies), I don't see a single case of anyone actually contradicting an earlier statement. It seems to me that they've all been careful to tell the truth, though they've often been careful about how much truth they've told. Government agencies have been caught lying, but they don't have the same legal requirements to citizens as publicly-traded companies have to shareholders.

Based on that, and on my viewpoint as a Google employee who builds some of the internal security systems that the NSA would have to compromise to snoop, I am completely convinced that Google is telling the truth when it says that it has not given the NSA any sort of direct or indirect access. I'm not certain that the NSA hasn't managed to insert snooping equipment into Google data centers or on Google fiber lines without Google's knowledge. But that's why Google is making a push to get everything encrypted, internally and externally.

Just to quiet the obvious retort: Yes, I know that won't prevent the government from serving Google with warrants and NSLs and obtaining user data that way. But if they have to do it through the front door, with a request that satisfies Google's attorneys with respect to its propriety and narrow scope, then I think we (as a society) have a much more manageable problem. Still a problem, but one that can be addressed with legislation and better oversight. If the NSA is silently devouring the whole Google data stream... that's an entirely different kettle of fish.

Re:Illusion of privacy

[icebike]

That is outright false. I challenge you to provide a citation to a reasonably authoritative site saying that - basically anybody who isn't a kook. You can't.

Clearly you phrased it that way so you could reject any site I offered, based on your own myopic view point.

So here are the rules:
You don't get to reject any source! You have to invalidate every one of these and all of their claims.
After all, extraordinary claims of something being "outright false" require extraordinary proof.

http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html?pagewanted=2&_r=0
http://nakedsecurity.sophos.com/2013/03/16/has-https-finally-been-cracked/
http://www.theguardian.com/commentisfree/2013/sep/05/government-betrayed-internet-nsa-spying
http://www.theregister.co.uk/2013/09/05/nsa_gchq_ssl_reports/
http://www.zdnet.com/has-the-nsa-broken-ssl-tls-aes-7000020312/
http://www.forbes.com/sites/andygreenberg/2013/06/20/leaked-nsa-doc-says-it-can-collect-and-keep-your-encrypted-data-as-long-as-it-takes-to-crack-it/

Re:Illusion of privacy

[icebike]

Exactly as predicted, you toss out the evidence and strut off snorting.

Here it is direct from Snowden:

http://swampland.time.com/2013/09/05/five-revelations-from-snowdens-newest-leak/

The full extent of the NSA’s highly classified encryption cracking program Bullrun is only known by top officials in the NSA and its counterpart agencies in Britain, Canada, Australia and New Zealand. Bullrun has successfully foiled several of the world’s standard encryption methods, including SSL (Secure Sockets Layer), VPN (virtual private networks), and the encryption on 4G (fourth generation) smartphones.

Care to refute Snowden?

We are going back to my rules:

Prove your point about it being outright false or STFU.

Re:Illusion of privacy

[TheGratefulNet]

I personally interviewed at places that were proud of their MitM ssl cert attacks. this was more than 5 yrs ago, too, when almost no one believed this was happening. (no, I didn't take the job, it sickened me to think of myself helping them out).

if you are using a work-provided computer that had the IT group installed o/s, you can't trust it. if you installed your own o/s and never gave root privs to anyone, you may be able to trust it and it should find a 'fishy' cert being pushed on you when you go thru the corp firewall.

I tell people this: if you use a work-provided system, you should not do anything personal on it (no banking, etc). that little lock icon means nothing anymore and we should all be aware of this.

Any different from https://google.com ?

[Valdrax]

How is this different from just using HTTPS Everywhere or typing https://google.com/ into the URL bar?

Power Implications

[Anonymous Coward]

I'm highly interested in the power consumption implications of this move. I remember reading somewhere that Facebook faced a nontrivial increase in power usage when they switched to https for everything, and for a website like Google, those extra cycles are definitely going to add up.

Anyone from a data center care to comment on this?

Re:Power Implications

[Anonymous Coward]

According to one of the head Google staffers responsible for their SSL/TLS operations, it's pretty much a non-issue: https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html

It basically ended up adding less than 1% to the CPU overhead for their servers, didn't require special hardware, and didn't involve any new systems.

One down...

[93 Escort Wagon]

Thing about DuckDuckGo is... they promise I'm anonymous to them. There's value in that, at least to me.

Google's move is certainly welcome, but all it means is - going forward - only Google will be collecting my information as opposed to Google + NSA.

Bullshit PR is Bullshit

[Guppy06]

Google has quietly made a change aimed at encrypting all search activity to provide 'extra protection' for searchers, and possibly to block NSA spying activity.

What would encryption do when the NSA has access to the servers?

'I suspect the increased encryption is related to Google's NSA-pushback,'

Except that pushback itself is also pure political theater. Funny how these court challenges only started happening when stuff started to become public.

Google has made their bed. Let them lie in it.

Different reason cited in TFA

[dkleinsc]

Google may be doing this not for privacy reasons at all, but because they intend to sell the exclusive organic click information and don't want third parties having access to the same information they have about those clicks.

Actually...

[fahrbot-bot]

...what it does is prevent my proxy/filter (Proxomitron) from altering queries and result pages, like stripping out the link redirects, disabling the Toolbar, Suggestions, Instant, etc...

They do provide a work-around if you define www.google.com as a CNAME for nosslsearch.google.com (for schools, etc, that need to filter things). I implemented this w/o updating DNS or my hosts file by adding a proxy rule that alters the "Host" field in outgoing headers to nosslsearch.google.com to be "www.google.com". It's not perfect, but along with disabling Javascript for Google, it helps a lot.

FWIW, I'm switching to use Startpage and DuckDuckGo - not because of extra privacy, but because they let me customize my results to remove all the crap that Google adds.

This isn't just about the NSA

[Monsuco]

SSL is there to keep common snoopers (ISPs, potential identity thieves, punks on the corporate network with wireshark, etc.) from eavesdropping on you. Yeah, the vast resources NSA may very well have the ability to break it, but they're hardly the only threat out there. I'm far more worried about the potential for an identity thief to read my traffic than for the NSA to do so.

The NSA is hardly the biggest threat to your privacy and they're probably not the most dangerous.