Stories
Slash Boxes
Comments
typodupeerror delete not in

Comments: 155 +-   Google Plans Service to Store Users' Data Online on Tuesday November 27 2007, @08:45AM

Posted by Zonk on Tuesday November 27 2007, @08:45AM
from the could-have-used-this-two-weeks-ago dept.
google
business
internet
storage
achillean wrote this morning with a link to the Wall Street Journal, announcing plans we've all seen coming for a while: an online data storage service from Google. Though the article doesn't come out and call the project 'gDrive' or anything like that, it does indicate the service could be available within the next few months. "Google's push underlines a shift in how businesses and consumers approach computing. They are increasingly using the Web to access applications and files stored in massive computer data centers operated by tech companies such as Salesforce.com Inc., Microsoft Corp. and Google. Such arrangements, made possible by high-speed Internet connections between homes, offices and data centers, aim to ease users' technology headaches and, in some cases, cut their costs."
story

Related Stories

This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • a strategy that could accelerate a shift to Web-based computing doesn't this sound just a little bit like a dumb terminal in terms of computing?
    • if by "a little bit" you mean "a whole lot", yeah, it does.

      There's nothing wrong with a computer as a graphical dumb terminal - if it does what the user needs it to do. There are plenty of users who would be fine with this, and for whom it would work quite well. Cheaper computers with the desired functionality? Nothing wrong with that.
      • The substantial difference between what Google is up to and previous dumb terminal applications is one of scope.
        If the possible participants/locations for working on stuff is wherever there is reasonable internet bandwidth, then some interesting use-cases crop up:
        • Keeping a TODO list as a google document that you can see both at home and at work, blowing by the limitations of Exchange server configurations and mixing personal/work stuff
        • Collaborating on a school project. Tried this actually, and the limi
        • Quite true, but a lot of people don't have things they consider critical on their computers.

          Personally, I wouldn't use it (or would at least keep a backup of anything I don't want to loose), but there are a lot of people who wouldn't care if someone else looked at their data. Data corruption/loss would be a problem though.
  • Upload (Score:5, Funny)

    by niceone (992278) * on Tuesday November 27 2007, @08:50AM (#21491307) Journal
    Once installed, you upload your files by right clicking on them and selecting "I'm feeling lucky".
  • by DeeQ (1194763) on Tuesday November 27 2007, @08:51AM (#21491331)
    first thing I'm going to put up there is personal information to others. Any bets for how long till they are compromised?
  • Call Me Paranoid (Score:5, Insightful)

    by cybermage (112274) on Tuesday November 27 2007, @08:52AM (#21491349) Homepage Journal
    In an age of sealed warrants, if the government even bothers with that, why would anyone put their data out of their sight? When it comes to privacy, I cannot see how the benefits outweigh the risks.
    • In an age of sealed warrants, if the government even bothers with that, why would anyone put their data out of their sight? When it comes to privacy, I cannot see how the benefits outweigh the risks.

      Well see, there is thing called "encryption". If used properly, it can be quite effective in maintaining one's privacy. With Google's track record of protecting user's privacy, I would not be surprised if the service automatically encrypts the data during transit on the desktop and Google does not transmit the

      • Re: (Score:3, Interesting)

        Well see, there is thing called "encryption".

        Okay, some wing-nutty paranoia now. Is there any form of encryption that you believe people like the NSA cannot crack? I suspect stories like "Skype encryption too tough for German police" [zdnetasia.com] are a ruse to encourage criminals to use the Skype which is likely easier to track, and certainly less portable, than prepaid cell phones.

        Besides, if Google doesn't do the encryption, 99.99% of the data will not be encrypted. That should make the people with something to hide p
        • >Is there any form of encryption that you believe people like the NSA cannot crack? Yes, the NSA cannot crack one time pad encryption (OTP), nor will the every be able to. Provided you generate your OTP keys using a pure random number generator (not pseudo-random...so software-based is out of the question), this system is uncrackable. An associate of mine created such a pure random number generator based on radioactive decay. Provided you don't loose (or ever loose) your keys and have a secure way to
        • Is there any form of encryption that you believe people like the NSA cannot crack?

          Yes. I find it highly unlikely that the NSA can crack AES-128 and beyond. The algorithm has been extensively critiqued and found to be strong. And 128 bits and above is beyond the ability of a brute force attack.
          • Re: (Score:3, Interesting)

            The algorithm has been extensively critiqued and found to be strong.

            ...and if the NSA could crack AES-128, what would you expect to hear from them and any security-cleared academics involved? Let me lay it out for you bluntly. They'd say something along the lines of "The algorithm has been extensively critiqued and found to be strong."

            Also, there's quite a difference between what Dr. Joe Honest, working on his stipend until 4pm each day with what he, his TA, and his mighty 3 GHz windows or linux m

            • by Beryllium Sphere(tm) (193358) on Tuesday November 27 2007, @12:45PM (#21494299) Homepage Journal
              As the old saying goes, if you count on crypto to solve all your problems you don't understand crypto and you don't understand your problems.

              The point that your data can and will be attacked while it's in plaintext is well taken. A networked machine running a web browser (the Sendmail of the 21st century) is a low security device, even with a good operating system. Google for "Scarfo", the mobster who was using PGP but also had an FBI keylogger on his computer.

              As regards AES, though, we've got good reason to think it's resistant to cryptanalysis. The NSA is also in charge of protecting government secrets from foreign snoops and has approved AES for protecting classified data.

              The low security of a workstation cuts both ways in an argument about gDrive: because your data is already at risk sitting on your hard drive, storing it encrypted on gDrive might not be any worse.

              Security without threat modeling is like bricks without straw. What are we protecting data against? Loss, primarily. I trust Google's backups more than I trust mine (but I'd tell a client to look for a provider willing to sign an SLA). Unauthorized copying by crackers? AES should be an adequate control to cover that risk. Subpoenas? An attorney with two brain cells to rub together will subpoena the decryption keys, so no help from AES there. Vacuum-cleaner style mass government surveillance, looking for keywords like "Tibet" or "Falun Gong"? AES should prevent that. Government criminal investigation? You could (in the US) argue that surrendering the keys would be self-incrimination and end up paying a lawyer lots of money to argue the point for years. Expensive and undependable security, but then in a criminal investigation there's not much security difference between gDrive and your local machine anyway.

              If you have security needs you should do an analysis like that last paragraph, only longer. For lots of people encrypted files on gDrive might be just fine.
            • Re: (Score:3, Insightful)

              ...and if the NSA could crack AES-128, what would you expect to hear from them and any security-cleared academics involved? Let me lay it out for you bluntly. They'd say something along the lines of "The algorithm has been extensively critiqued and found to be strong."

              Though since the algorithm is public anyone can examine it, including people who are NOT under NDA.

              Also, there's quite a difference between what Dr. Joe Honest, working on his stipend until 4pm each day with what he, his TA, and his mighty 3 GHz windows or linux machine can do, and an organization that has billions in budget normally, can get more anytime they ask, no difficult goals but breaking encryption and signal intercept, and which has made it a point to hire as many of the best minds in encryption as possible for, oh, say the last fifty years or so. And this in a world where quantum attacks are thought to be only a matter of sufficiently developed technology.

              If we're talking about a brute-force, the math is pretty easy to figure out. You decide that you protect your data from X computing power, and you realize that if someone has X^2 computing power, they're going to get your data. Generally speaking, that's the best that you can do.

              If we're talking about flaws in the algorithm that allow someone with a "secret key" to decrypt the data, then we're talking abo

      • ... I would not be surprised if the service automatically encrypts the data during transit on the desktop ...

        That technique is already used on a site called www.passpack.com [passpack.com]. You log in using your account and the site downloads a password protected zip file to your browser. You then type in a second password to unzip the file you can then edit the data/files. when you are finished the file is zipped (password protected) and re-uploaded to the server.

        This means the file on the server is protected (128

      • With Google's track record of protecting user's privacy, I would not be surprised if the service automatically encrypts the data during transit on the desktop and Google does not transmit the keys to their server.

        I'm sorry, what track record would that be?

        Google are quite possibly the world's leading authority on automated information gathering. After all, their ad-based business model fundamentally relies on being able to target those ads, and the continued success of their primary service, the search engine, depends on how effectively and comprehensively they can process the entire WWW.

        As we have seen in the past, with everything from Google Street View to the leaks from a certain other popular search engine

  • Methinks this trend will create a network of vast underground datacenters so large that archaeologists of the distant future will be left wondering whether we were created by metallic silicon creatures.
    • And when they discover how to extract that information from the datacenters...will be distracted by the vast amounts of pr0n.
  • Fudge, I had just started to write a virtual filesystem driver using IMAP as a back-end. (Not fast, but gmail's 5.2G is free.)

    Oh well, I'll put it on the back-burner until I hear more.
  • by brunes69 (86786) <`slashdot' `at' `keirstead.org'> on Tuesday November 27 2007, @08:55AM (#21491393) Homepage
    Unless Google can lobby Rogers to get rid of its arcane practice of capping usage at 60GB / month for it's standard high speed, me, and around 50% of people in Canada with high speed internet, can not make any real use of this service.

    It is pretty sad that a company will give you a nice 6 Mbps link only to cap you at 60 GB, which you could exceed in only 1 day of saturating your link.
    • Re: (Score:3, Insightful)

      Not to mention the standard North American practise of providing terrible up-stream speeds on cable and DSL lines. It'd take ages to upload 5GB (or whatever GMail's current limit is) of data.

      I'm too impatient to back up 5GB of data over my 100Mbit LAN, I'm not doing it at "up to" 800kbits/sec.
  • As a recent convert to google apps, this is very interesting. I have/still have all the concerns about my privacy, but the offering was too tempting to pass up. Of course I use the Firefox Customize Google add on, but also don't really put anything sensitive up there. If they build it right, it could be very nice. I've tried all the online backup apps, and outside of Mozy, don't really like any that much. But I'm now all Linux, so Mozy is no longer an option. Anything that competes with Microsoft is a
    • FTA:

      The Mountain View, Calif., company plans to provide some free storage, with additional storage allotments available for a fee

      Sounds exactly like Mozy [mozy.com], but with mozy you can excrypt everything with your own key, makes uploading no different but you have to decrypt any restored files yourself. Somehow I cannot see Google doing this as they'll want to use their technology to keep a single copy of a file on their servers if several people upload the same one.

      I'm not sure how they'll manage to slip adverts in either, maybe you'll only be able to access file restores with a web UI?

      So, all in all, Mozy is better. Now we all need t

    • I have/still have all the concerns about my privacy, but the offering was too tempting to pass up.

      And that is why things in today's database-driven, surveillance-obsessed society are going to get very much worse before they get better.

      It's quite sad that even after the big leak here in the UK last week, things have gone quiet on the political front and there isn't a sustained media attack on our underpowered privacy and data protection laws.

  • Storin' those data
    To network platta
    Drive image good
    As face image could
    Burma Shave
  • Thin client computing is on its way back - like it or not.

    Though nothing new, this is a great idea who's time has finally come - particularly for people with mobile devices connected to wifi hotspots - both of which Google has been investing in.
  • Amazon S3 (Score:4, Interesting)

    by NickCatal (865805) on Tuesday November 27 2007, @09:01AM (#21491459)
    I already do this a bit with Amazon's S3 storage system. It is really nice being able to store files anywhere and paying all of $0.03/month for it.

    But hey, I'll take free any day.

    On a somewhat related note: It would be great if Google bought the LexisNexus people. Having public access to their database would be a great public service.
      • Re: (Score:3, Informative)

        rsync doesn't work with S3, but s3sync [s3sync.net] does
        • Re: (Score:3, Informative)

          If you check the linux forums for Jungle Disk, there are lots of people having problems with the rsync over an S3 bucket mounted through WebDAV. The problem seems to be in the webdav implementation, but its a problem nonetheless.

          But I hadn't found that s3sync before. That sounds like it would do the trick. Thanks Nick for the tip.

          Now my only problem would be the lousy 256 kbps or whatever uplink I get with my Verizon DSL. I wouldn't mind the slow uplink but saturating the uplink also saturates the downl
  • by mwilliamson (672411) on Tuesday November 27 2007, @09:02AM (#21491483) Homepage Journal
    Google needs to incorporate encryption with keys totally held and managed by the end user in such a way that even if Google is subpoenaed or shown national security papers, Google would be technically unable to access end-user's data. Another words, at no time should Google have access to any of the user's cleartext nor the user's secret key. Decryption would all be client-side. A subpoena or national security letter would have to go directly to the end user who would then at least know they are being served.
    • Re: (Score:3, Informative)

      Technically they don't actually need to implement any form of encryption other than SSL for the transfer. There's already plenty of tools arround for users to encrypt their files, and truecrypt can even create an entire filesystem inside a single encrypted file. Thus all google really needs to do is to not prevent users from uploading files they have encrypted themselves. The client-side tools already exist, no need to reinvent the wheel.
          • good point...this would be useful in finding the "container within the container" technique used in truecrypt. The national security letter would be written in such a way that the drives themselves would be monitored at a low enough level to confirm the probable hidden container. Of course, with GFS spread across multiple drive arrays connected to multiple servers connected to multiple data centers residing in multiple countries, it would be a real bitch to implement.
    • by Zarhan (415465) on Tuesday November 27 2007, @09:11AM (#21491575)
      Not gonna happen.

      Their business is advertising.

      So, they will be reading through your documents so they can put up some ads when you are browsing your files online. Putting your home finance excel sheet to gDrive? Be prepared to see TaxPlanner ads on the sidebar. Putting your holiday photos to gDrive for backup purposes? They'll probably go through the EXIF data and send you ads about latest Canon products (or whatever your camera model is).

      • Not gonna happen. Their business is advertising.

        Sorry, I've posted in this thread already so I can't mod you up. But your post is right on the money. All these people talking about encryption are forgetting that storing the data in an independently encrypted way simply isn't in Google's interests. And if people start encrypting everything themselves, as any smart user of the service clearly would if they used it at all, then Google will either find ways to link those users to other services so they can guess which profitable ads to include, or they wil

  • Encryption method? (Score:3, Interesting)

    by BlueParrot (965239) on Tuesday November 27 2007, @09:03AM (#21491493)
    What kind of encryption would you use for this?

    The most secure would be to store a single large archive of all your files encrypted with a strong cipher, but that has the disadvantage that you have to download it all to decipher it.

    Alternatively you could encrypt each file separately, which would speed up access considerably, but also leak more information about what you are storing (i.e many small files vs one big one ).

    I guess if the data is sensitive enough to require the former type of encryption you shouldn't transmit it over insecure connections to begin with...
    • There is no need to decrypt the entire file to be able to use it. You can design a file system so that only the blocks needed are decrypted and you can basically use the file system just like a live file system with the crypto layer keeping it all very much transparent. Using Google's online file storage in such a way that you could mount it like a drive, then sticking a truecrypt [truecrypt.org] container in it would give the desired effect of my previous post.
    • Personally, I'd use the OSS gDrive file manager that will be developed, which will in all probability GPG encrypt each file before uploading and decrypt after downloading, rather transparently. It might even go one step further and assign random filenames to the files while keeping an encrypted lookup table to the original filenames so it can display them to you.
  • A very old idea (Score:3, Informative)

    by Rob T Firefly (844560) on Tuesday November 27 2007, @09:07AM (#21491523) Homepage Journal
    This shouldn't be a surprise to anyone. It's Google, and it's one of the oldest ideas on the Internet which they haven't yet done; before the dot-com bubble burst there were at least half a dozen sites that claimed to provide an online "drive" of sorts - X-drive and E-drive are ones that come to mind, I think they advertised on the radio. Going further back, I remember using an online storage service on CompuServe in 1995 or so.
  • by Jugalator (259273) on Tuesday November 27 2007, @09:11AM (#21491581) Journal
    Hmm, if Google's encryption plans are lacking, how about a mountable GDrive in TrueCrypt, popping up as a partition with the traditional encryption methods of TrueCrypt? :-D

    :-------D

    OK, so that was last part was really unnecessary, but still...!

  • by HangingChad (677530) on Tuesday November 27 2007, @09:49AM (#21491959) Homepage

    I suggest calling it gPorn, because you know that's what's going to be on there.

  • Haven't we the public shown that we don't want our data online this way? And they pursue it anyway. You hear all of these reports about Google becoming the next Microsoft. This sounds very Microsoftish.
  • by bangzilla (534214) on Tuesday November 27 2007, @10:34AM (#21492561) Journal
    Amazon has been doing this for ages - very well I might add. What does Google bring to the party. Advertising? Big whoop. I like the privacy of my data. I don't want Google scanning my data as it scans my email. That's taking things just too far. What next? Google coming around to my house to check my desk draws.....?
    • If Google is intending this service for online storage of personal information, I don't think it's going to succeed... people use Facebook for that sort of thing.

    • On the contrary.

      I've long been planning to put my most personal and important data on Google's servers, using the already existing gmailfs. Using good encryption, of course, which you really should use on local storage as well, if there's even a slight chance that it might get physically stolen.

      Using this would give me a very cheap (actually free) off-site backup, so I know I can still retrieve my stuff even if my house burns down, or if RIAA sends the police to get my computers...

      • Re: (Score:3, Interesting)

        The RIAA wouldn't need to send the police for your computers since they can subpoena Google to get the evidence that they need. They do that for search queries now. Uploading your personal data gives law enforcement one stop shopping to your information. A "portal" to all of your personal information. How convenient...
            • Re: (Score:3, Insightful)

              Do you really think Google has enough computing power to crack 128-bit AES? To crack a symmetric cypher, on average, you need to search half of the key space. That means you'd need to search 2^127 keys. My 2GHz Core 2 Duo can (according to openssl speed aes) do about 40,000 1024 byte blocks per second. In one year, it could do 1.3x10^12. If you had a compute cluster composed entirely of machines of this speed, it would need a shade under 1.3×10^26 machines to be able to crack a single AES-encrypte

    • Re:android (Score:4, Insightful)

      by 4D6963 (933028) on Tuesday November 27 2007, @10:18AM (#21492325)

      Any android device can be a 'dumb' terminal for your data.

      Excuse the necessary pedantry, but do you realise that something cannot be a "dumb terminal for data", and that it's quite an insensible way to formulate it regardless of what the term "dumb terminal" actually means? Are you aware of the fact that "dumb terminals" involve remote processing, and not mere access to remote data? I just had to clarify this, as people keep talking about dumb terminals and thin clients as it actually has little to do with the topic at hand.

Shame is an improper emotion invented by pietists to oppress the human race. -- Robert Preston, Toddy, "Victor/Victoria"