Slashdot Mirror
Gmail Goes HTTPS Only For All Connections
Trailrunner7 (1100399) writes "Perhaps no company has been as vocal with its feelings about the revelations about the NSA's collection methods as Google has, and the company has been making a series of changes to its infrastructure in recent months to make it more difficult for adversaries to snoop on users' sessions. The biggest of those changes landed Thursday when the company switched its Gmail service to HTTPS only, enforcing SSL encryption on all Gmail connections. The change is a significant one, especially given the fact that Google also has encrypted all of the links between its data centers. Those two modifications mean that Gmail messages are encrypted from the time they leave a user's machine to the time they leave Google's infrastructure. This makes life much more difficult for anyone—including the NSA–who is trying to snoop on those Gmail sessions."
GMail also does TLS for SMTP, but regrettably Talk (what's left of it) does not do TLS for XMPP server-to-server connections, effectively forcing XMPP server admins to lower their security if they want to federate with Google.
The NSA has compromised certificates so this will make no real difference.
This is the backscatter xray machine of internet security.
Does Google not recall the NSA post it note showing that they intercept the post-SSL server to server commuincations within the googleshpere? NSA doesn't care about HTTPS to google as long as that back channel is still there.
Some drink at the fountain of knowledge. Others just gargle.
The feds have all the SSL keys anyhow.
This is nothing but a waste of bandwidth and only makes tracking easier. Oh, wait... now I get it.
“He’s not deformed, he’s just drunk!”
Are they using SSL, or are they using TLS? Which version of either are they using? Most modern browsers support TLS 1.1 and 1.2, but I can imagine Google falling back to 1.0 or even SSL for compatibility with fossils.
As much as I personally love Google Talk, it's about as dead as you can get. Most links have been redirected to Hangouts, and those that aren't, you have to access manually. If anyone cares, here's the only working link that I'm aware of for Google Talk: http://www.google.com/talk/ind...
Glad to know that the copy of my mail stored for "archival purposes" in the service formerly known as Postini was sent there securely.
What a relief. Now the only people that can get my data are government agencies that ask for it and advertisers that pay for it.
SSL/TLS is only for data in motion, and applications that choose to use it. Anyone who gets access to the backend will still be able to freely read as much content as they like
Please. This was debunked already. http://www.techdirt.com/articl...
Isn't this a bit like the company that mines your data for profit is complaining about the government that mines your data for power?
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
Sure they use SSL on their SMTP servers, but when testing it using checktls.com I see that they use RC4-SHA, not a Perfect Forward Secrecy algorithm like Yahoo is now using (DHE-RSA-CAMELLIA256-SHA). If NSA were to get a copy of Google's private key, they could decrypt all of the traffic. So to me, no PFS is the same as no SSL.
Because Google wants noone besides themselves spying on your email!
The article briefly mentions this, but does anyone have any additional detail? Are they using opportunistic TLS on SMTP connections?
And exactly why should we believe the companies' denials? Why should we believe they have any concern at all about any of this, aside from the possible bad PR?
“He’s not deformed, he’s just drunk!”
I don't know if you've been keeping up. But people fully EXPECT the NSA to be upto nasty secret snooping habits. That is actually the minor part of the story that caused the outrage. The more dangerous fact is that the NSA can demand companies or individuals turn over data to them and impose a gag order thus forcing them to keep it secret.
So AC is right in this case. Just more lip service. Encryption on your own servers is the only way to remain relatively protected.
Entia non sunt multiplicanda praeter necessitatem.
Ultimately, encryption is meaningless. If the NSA (or any other governmental agency) wants something, they will get it.
Even if you invent some suoer-duoer-impossible-to-crack encryption, they will simply go to a secret court (that is accountable to no one) and get a secret order, that you must comply with and that you aren't allowed to talk about under penalty of going to prison, on the grounds of NATIONAL SECURITY.
Until *THAT* problem is addressed, encryption is meaningless.
Just for the Google server, if you use a proper XMPP server (like Prosody, for example).
XMPP server operators are pushing for a wholly encrypted XMPP network with several test-days, where they'll be flipping the switch to allow only encrypted communication, and the final switch to disallow unencrypted communication on May 19, 2014.
It's going to include SSLv3, unfortunately, but we'll get there.
. . . because the NSA stated yesterday that tech companies were fully aware of snooping the who time (http://yro.slashdot.org/story/14/03/20/1745254/nsa-general-counsel-insists-us-companies-assisted-in-data-collection). If they're encrypting, it's either for show (porbable) or to prevent eavesdropping by anyone else but the NSA (unlikely, if this mattered to them they would have done it a long time ago.) So, yeah, this feels like it's for show so that people can continue to have confidence in Google's platforms.
Gmail messages are encrypted from the time they leave a user's machine to the time they leave Google's infrastructure.
Horseshit. The message is not encrypted. It is cleartext travelling over encrypted channels. It is on their machines in the clear, which enables them to do things for you, like search and filter, and against you, like profiling you and anyone who sends you email.
Stop-Prism.org: Opt Out of Surveillance
. . . because the NSA stated yesterday that tech companies were fully aware of snooping the who time (http://yro.slashdot.org/story/14/03/20/1745254/nsa-general-counsel-insists-us-companies-assisted-in-data-collection).
Not only aware, not one to let a dime slip by: "Billing invoices and other documents show Microsoft charging the FBI hundreds of thousands of dollars a month to comply with legal requests for customer information," http://www.dailydot.com/news/m...
I seem to remember hearing they had already cracked SSL among all of the recent revelations.
Either way, this is obviously a PR move. It should give nobody any high hope for Google's intentions...
You know, if I didn't know better, I'd think someone did this on purpose... right now the fortune at the bottom is:
Today is a good day for information-gathering. Read someone else's mail file./quote.
... people fully EXPECT the NSA to be upto nasty secret snooping habits. That is actually the minor part of the story that caused the outrage. The more dangerous fact is that the NSA can demand companies or individuals turn over data to them and impose a gag order thus forcing them to keep it secret.
I agree that the latter IS a big problem. But I don't agree that it's the ONLY problem, or the only BIG one.
National Security Letters are still relatively narrow compared to what the NSA did. They also tapped the fibers Google and others used to communicate with each other, and used these taps to snoop everything that went across them, without Google's knowledge.
I encountered a Google engineer with job responsibilities related to that at a conference last year, and he was LIVID. They'd tapped fibers OWNED BY GOOGLE - trespassing and damaging them (aong with Google's credibility) in the process - with no letters, warrants, wink-wink-nudge-nudge, or what-have-you. Google has since been installing encryption thorughout it's network - not just where it leaves the building, but even from rack to rack.
Maybe they're still stuck disclosing SOME stuff. But at least they're trying to know what it is, do their best to minimize it (and protect their model), and avoid inadvertently firehosing EVERYTHING into the maw of the NSA.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
So says the NSA's lawyer.
It's not so much "lip service" as "bullshit".
I bought this house and you know I'm boss
Ain't no h'aint gonna run me off
Good point. You're very wise to believe the NSA, and to ignore all of the "stories" about Google encrypting everything, and suing the government, and trying to limit search warrants. After all, it would be crazy, completely crazy to think that the NSA would try and cast blame on the very companies that tried to stop them. Why, the fact that the NSA tapped Google's dark fiber between datacenters proves that Google is lying and was giving everything to the NSA!
Another possibility is that the NSA is lying and that a bunch of gullible morons are attacking the very companies which (while not perfect) are trying to protect your data from the government.
Why would anyone still be doing this? They wont be supporting this really soon now, so everyone should have moved on by now.
---- Booth was a patriot ----
Both sides have good reason to lie. The lawsuits are workfare programs for their lawyers, busy work. The encryption is weak, with all the appropriate back doors left wide open. And you're just repeating public relations mumbo-jumbo and taking high drama as truth. Honesty is bad for business, and all of this is strictly business. Your data will remain vulnerable until it is more profitable to protect it than it is to sell it.
“He’s not deformed, he’s just drunk!”
Sending encrypted mail is the only way to have a chance at keeping it private.
Exactly. So I have to chuckle when the news reports that an irate Mark Zuckerberg calls the President to voice his displeasure over spying (http://money.cnn.com/2014/03/13/technology/security/mark-zuckerberg-nsa/) . I don't know what he's pretending to be mad about.
Having one would still show to the end user that the fingerprint has changed. There is already a feature to warn you when the fingerprint of a site has changed, even if the CA still shows it's "secure".