Slashdot Mirror
'Google Just Made Gmail the Most Secure Email Provider on the Planet' (vice.com)
Google announced on Tuesday that it would offer stronger online security for "high risk" users who may be frequent targets of online attacks. The company said anyone with a personal Google account can enroll in the new "advanced protection," while noting that it will require users to "trade off a bit of convenience" for extra security. Motherboard reports: The main advantage in terms of security is the need for a key or token to log in as the second factor, instead of a code sent via SMS or via app. This is much better because there's no way for hackers to steal or phish this key from afar (there have been isolated incidents of hackers using social engineering to gain access to someone's cell phone number by getting the provider to issue a new SIM card, for instance). Thanks to these new features, Gmail is now the most secure email provider available on the internet if you are worried about hackers breaking into your private correspondence. "This is a major step in the right direction in offering the same kind of protection available to high-profile figures to everyday people," Kenneth White, a Washington D.C. based security consultant to federal agencies, told Motherboard. "They have really thought this through, and while it may not make sense for everyone, for those that need it, it's a much needed option."
Hi sir! please enter your gmail password here: ____________
Oh i see, google doesn't protect against this. This seems super secure.
I think you missed the point. It's two factor authentication. If I know your password I still need to know the key to log in.
Sent from my TARDIS
No one else supports the FIDO U2F security key standard in their browser. FireFox should be getting around to it anytime now, and I believe that Opera does. But that's probably why: the valid technical reason is that no one else supports the security standard.
A NYC lawyer blogs. http://www.chuangblog.com/
It's because no other browsers have implemented support for the U2F standard yet, and therefore won't work with FIDO keys. Firefox should support U2F soon, as they just enabled in their Nightly build:
https://www.yubico.com/2017/09/firefox-nightly-enables-support-fido-u2f-security-keys/
Mod parent up.
Without encryption on server and with law enforcement having backdoor access to Gmail, etc., this is meaningless.
Actually, Google does encrypt all of the email (and all other user data) on its servers, and even in-transit between servers in Google data centers, as well as in-transit between Google servers and your browser and (if supported by the other end) in transit between Google servers and non-Google email servers. Google encrypts all the things, all the time.
Oh, and law enforcement does not have "backdoor access", at least not the way that I would interpret the phrase. What law enforcement does have is search warrants, subpoenas and national security letters (though NSLs provide access to metadata only, not content -- not that metadata isn't very valuable). If law enforcement or other authorized agents of the courts present a valid and duly authorized document which legally compels Google to hand over your data, Google will hand over your data. If it's not correctly executed, is overly broad or has some other legal defect, Google will refuse.
If you don't like that warrants, subpoenas and NSLs can be used to access your data, either move it to a jurisdiction not subject to such rules, or take it up with your political representatives. Or switch from email to a communication protocol that was designed with end-to-end security in mind, with all of the limitations that entails (mostly, that you will have a hard time keeping old messages for a long time... and if it's really easy to use, chances are god that implies there is some entity playing a trusted role which could defeat the security).
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
And you have what evidence for this? Unless you actually work at Google in a fairly technically privileged position you would have no way to know if they do or do not have backdoor access under any definition of the term you care to use.
I do work for Google, in security. And I don't have to be in a "privileged" position to know that. The internal architecture is such that providing such a backdoor would require willing collusion by multiple teams, and I know many of the people who would have to be involved. (Aside: I really, really wish that Google would publish details of its internal architecture for securing user data and controlling and auditing access to it. It is really good, innovative and beautifully paranoid. Far better than anything I've seen in my long and wide-ranging career.)
That means nothing to you of course. Just the word of some random guy on on the Internet who may be lying about working for Google, and could possibly even be lying about what Google does, since obviously he has a vested interest.
What might mean more is Google's public, legally-binding, statements to that effect, including statements by it's chief legal counsel. Should those turn out to be false, Google would be in violation of various federal regulations, including SEC and FTC regulations. I think it would also constitute a violation of Google's FTC consent decree.
(Note that IANAL, I'm a programmer. My assertions about legal issues should not be trusted. Do your own research.)
No, Google MIGHT refuse at their discretion. You have no way to be certain of their behavior and you should adjust your own behavior accordingly.
Sure. What I do know is that Google does often refuse, and that Google's lawyers claim to be extremely picky about validating requests. I'm clearly not privy to the details. I guess one other thing we know is that no one has complained publicly about Google disclosing data that they were not legally required to. With NSLs that's more or less impossible, but with traditional subpoenas and warrants it's totally possible. I don't think there would be any way to argue that evidence gathered through improper disclosure would be inadmissible in court, but they could definitely make a public stink about it and make Google look bad. That has not happened.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.