Slashdot Mirror
Gmail Goes HTTPS Only For All Connections
Trailrunner7 (1100399) writes "Perhaps no company has been as vocal with its feelings about the revelations about the NSA's collection methods as Google has, and the company has been making a series of changes to its infrastructure in recent months to make it more difficult for adversaries to snoop on users' sessions. The biggest of those changes landed Thursday when the company switched its Gmail service to HTTPS only, enforcing SSL encryption on all Gmail connections. The change is a significant one, especially given the fact that Google also has encrypted all of the links between its data centers. Those two modifications mean that Gmail messages are encrypted from the time they leave a user's machine to the time they leave Google's infrastructure. This makes life much more difficult for anyone—including the NSA–who is trying to snoop on those Gmail sessions."
GMail also does TLS for SMTP, but regrettably Talk (what's left of it) does not do TLS for XMPP server-to-server connections, effectively forcing XMPP server admins to lower their security if they want to federate with Google.
The NSA has compromised certificates so this will make no real difference.
This is the backscatter xray machine of internet security.
Does Google not recall the NSA post it note showing that they intercept the post-SSL server to server commuincations within the googleshpere? NSA doesn't care about HTTPS to google as long as that back channel is still there.
Some drink at the fountain of knowledge. Others just gargle.
The feds have all the SSL keys anyhow.
This is nothing but a waste of bandwidth and only makes tracking easier. Oh, wait... now I get it.
“He’s not deformed, he’s just drunk!”
Are they using SSL, or are they using TLS? Which version of either are they using? Most modern browsers support TLS 1.1 and 1.2, but I can imagine Google falling back to 1.0 or even SSL for compatibility with fossils.
As much as I personally love Google Talk, it's about as dead as you can get. Most links have been redirected to Hangouts, and those that aren't, you have to access manually. If anyone cares, here's the only working link that I'm aware of for Google Talk: http://www.google.com/talk/ind...
NSA LAWYER: Tech Companies Knew We Collected Their Data http://www.businessinsider.com...
Glad to know that the copy of my mail stored for "archival purposes" in the service formerly known as Postini was sent there securely.
What a relief. Now the only people that can get my data are government agencies that ask for it and advertisers that pay for it.
SSL/TLS is only for data in motion, and applications that choose to use it. Anyone who gets access to the backend will still be able to freely read as much content as they like
Anyone with the authorization can decrypt https though... I recall: http://yro.slashdot.org/story/13/01/10/1356228/nokia-admits-decrypting-user-data-claiming-it-isnt-looking
I'm sure the NSA holds a master wild card cert with all the major vendors.
Isn't this a bit like the company that mines your data for profit is complaining about the government that mines your data for power?
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
Sure they use SSL on their SMTP servers, but when testing it using checktls.com I see that they use RC4-SHA, not a Perfect Forward Secrecy algorithm like Yahoo is now using (DHE-RSA-CAMELLIA256-SHA). If NSA were to get a copy of Google's private key, they could decrypt all of the traffic. So to me, no PFS is the same as no SSL.
Because Google wants noone besides themselves spying on your email!
The article briefly mentions this, but does anyone have any additional detail? Are they using opportunistic TLS on SMTP connections?
Don't kid yourself otherwise.
Doesn't the NSA have all the CERT keys anyways? So they won't care if it's encrypted.
I don't know if you've been keeping up. But people fully EXPECT the NSA to be upto nasty secret snooping habits. That is actually the minor part of the story that caused the outrage. The more dangerous fact is that the NSA can demand companies or individuals turn over data to them and impose a gag order thus forcing them to keep it secret.
So AC is right in this case. Just more lip service. Encryption on your own servers is the only way to remain relatively protected.
Entia non sunt multiplicanda praeter necessitatem.
Ultimately, encryption is meaningless. If the NSA (or any other governmental agency) wants something, they will get it.
Even if you invent some suoer-duoer-impossible-to-crack encryption, they will simply go to a secret court (that is accountable to no one) and get a secret order, that you must comply with and that you aren't allowed to talk about under penalty of going to prison, on the grounds of NATIONAL SECURITY.
Until *THAT* problem is addressed, encryption is meaningless.
Just for the Google server, if you use a proper XMPP server (like Prosody, for example).
XMPP server operators are pushing for a wholly encrypted XMPP network with several test-days, where they'll be flipping the switch to allow only encrypted communication, and the final switch to disallow unencrypted communication on May 19, 2014.
It's going to include SSLv3, unfortunately, but we'll get there.
. . . because the NSA stated yesterday that tech companies were fully aware of snooping the who time (http://yro.slashdot.org/story/14/03/20/1745254/nsa-general-counsel-insists-us-companies-assisted-in-data-collection). If they're encrypting, it's either for show (porbable) or to prevent eavesdropping by anyone else but the NSA (unlikely, if this mattered to them they would have done it a long time ago.) So, yeah, this feels like it's for show so that people can continue to have confidence in Google's platforms.
Gmail messages are encrypted from the time they leave a user's machine to the time they leave Google's infrastructure.
Horseshit. The message is not encrypted. It is cleartext travelling over encrypted channels. It is on their machines in the clear, which enables them to do things for you, like search and filter, and against you, like profiling you and anyone who sends you email.
Stop-Prism.org: Opt Out of Surveillance
. . . because the NSA stated yesterday that tech companies were fully aware of snooping the who time (http://yro.slashdot.org/story/14/03/20/1745254/nsa-general-counsel-insists-us-companies-assisted-in-data-collection).
Not only aware, not one to let a dime slip by: "Billing invoices and other documents show Microsoft charging the FBI hundreds of thousands of dollars a month to comply with legal requests for customer information," http://www.dailydot.com/news/m...
I seem to remember hearing they had already cracked SSL among all of the recent revelations.
Either way, this is obviously a PR move. It should give nobody any high hope for Google's intentions...
You know, if I didn't know better, I'd think someone did this on purpose... right now the fortune at the bottom is:
Today is a good day for information-gathering. Read someone else's mail file./quote.
... people fully EXPECT the NSA to be upto nasty secret snooping habits. That is actually the minor part of the story that caused the outrage. The more dangerous fact is that the NSA can demand companies or individuals turn over data to them and impose a gag order thus forcing them to keep it secret.
I agree that the latter IS a big problem. But I don't agree that it's the ONLY problem, or the only BIG one.
National Security Letters are still relatively narrow compared to what the NSA did. They also tapped the fibers Google and others used to communicate with each other, and used these taps to snoop everything that went across them, without Google's knowledge.
I encountered a Google engineer with job responsibilities related to that at a conference last year, and he was LIVID. They'd tapped fibers OWNED BY GOOGLE - trespassing and damaging them (aong with Google's credibility) in the process - with no letters, warrants, wink-wink-nudge-nudge, or what-have-you. Google has since been installing encryption thorughout it's network - not just where it leaves the building, but even from rack to rack.
Maybe they're still stuck disclosing SOME stuff. But at least they're trying to know what it is, do their best to minimize it (and protect their model), and avoid inadvertently firehosing EVERYTHING into the maw of the NSA.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
i though Google had already switched to HTTPS for all connections in January or February.
So says the NSA's lawyer.
It's not so much "lip service" as "bullshit".
I bought this house and you know I'm boss
Ain't no h'aint gonna run me off
There goes HTTPS..
When they get the keys (if they don't have them already) the tapped communications will be certified.
There is absolutely no reason to believe that the certificate trust system is itself trustworthy. The major root signers are all in bed with the NSA, and it is probably a trivial matter for NSA to inject itself into an SSL connection and snoop the data.
As the NSA has more ways to get around this than Obama has crack pipes, it's a nice try but it won't help.
Why would anyone still be doing this? They wont be supporting this really soon now, so everyone should have moved on by now.
---- Booth was a patriot ----
Google is just doing this to make it seem like they really do care about privacy.
however is still ssl only to stop MITM advert hijacking - cough - i mean security.
Anyway know a proxy friendly way to access maps?
Really? I'm not buying it. Google was being named as one of the companies in bed with the NSA, and anything they say, or do, isn't going to convince a great many people that they were unaware of the NSA's behavior. And they can use whatever BS PR crap they want to get the public's trust back.
This whole thing went on for years without anyone coming out to expose both sides. And we continue to forget about the other US spying agencies that are just going to take over where the NSA has now failed. It is completely realistic to think this type of hand in hand co-operation will resume once it dies out of the public eyes, not just the NSA but the other agencies that the media/press, as expected, seem to be ignoring.
Sending encrypted mail is the only way to have a chance at keeping it private.
Exactly. So I have to chuckle when the news reports that an irate Mark Zuckerberg calls the President to voice his displeasure over spying (http://money.cnn.com/2014/03/13/technology/security/mark-zuckerberg-nsa/) . I don't know what he's pretending to be mad about.