Google Plans Service to Store Users' Data Online 155
achillean wrote this morning with a link to the Wall Street Journal, announcing plans we've all seen coming for a while: an online data storage service from Google. Though the article doesn't come out and call the project 'gDrive' or anything like that, it does indicate the service could be available within the next few months. "Google's push underlines a shift in how businesses and consumers approach computing. They are increasingly using the Web to access applications and files stored in massive computer data centers operated by tech companies such as Salesforce.com Inc., Microsoft Corp. and Google. Such arrangements, made possible by high-speed Internet connections between homes, offices and data centers, aim to ease users' technology headaches and, in some cases, cut their costs."
Everything old is new again (Score:2, Insightful)
Re: (Score:2)
There's nothing wrong with a computer as a graphical dumb terminal - if it does what the user needs it to do. There are plenty of users who would be fine with this, and for whom it would work quite well. Cheaper computers with the desired functionality? Nothing wrong with that.
Re: (Score:2)
If the possible participants/locations for working on stuff is wherever there is reasonable internet bandwidth, then some interesting use-cases crop up:
Re: (Score:2)
Personally, I wouldn't use it (or would at least keep a backup of anything I don't want to loose), but there are a lot of people who wouldn't care if someone else looked at their data. Data corruption/loss would be a problem though.
Less Risk (Score:2)
Less so, I think, than if you're asked to keep track of your own stuff. Businesses drop big bucks on making sure they have backups of all computer files because the average person simply cannot be relied upon to do it themselves, accurately and regularly.
Re: (Score:2)
No. I'd call it "Smart Termional". A dumb terminal is simply a display device, smart terminal can run programs and interact with the user. It makes great sense to keep a word processing document on a server. It is small and only takes a few seconds to move the document to whatever "smart terminal" the user is logged into. If you have ever used one of those systems where your desktop follows your log in it is great. Lo
Upload (Score:5, Funny)
This sounds fun (Score:3, Funny)
Call Me Paranoid (Score:5, Insightful)
Re: (Score:3, Insightful)
Well see, there is thing called "encryption". If used properly, it can be quite effective in maintaining one's privacy. With Google's track record of protecting user's privacy, I would not be surprised if the service automatically encrypts the data during transit on the desktop and Google does not transmit the
Re: (Score:3, Interesting)
Okay, some wing-nutty paranoia now. Is there any form of encryption that you believe people like the NSA cannot crack? I suspect stories like "Skype encryption too tough for German police" [zdnetasia.com] are a ruse to encourage criminals to use the Skype which is likely easier to track, and certainly less portable, than prepaid cell phones.
Besides, if Google doesn't do the encryption, 99.99% of the data will not be encrypted. That should make the people with something to hide p
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
You have a source stream. For simplicity, let's say it's plain text, so you have 26 possible symbols in the input stream. A one time pad is a mapping from each symbol in the input stream to a different symbol, so you need 26 mappings. For it to be secure, you can't use the same mapping twice in a row (you can use two identical mappings in a row, but only as a result of your noise source giving the same thing twice). For your 26-character input stream, then, you need 26 mappings in your one time pad per
Re: (Score:2)
Yes. I find it highly unlikely that the NSA can crack AES-128 and beyond. The algorithm has been extensively critiqued and found to be strong. And 128 bits and above is beyond the ability of a brute force attack.
Re: (Score:3, Interesting)
Also, there's quite a difference between what Dr. Joe Honest, working on his stipend until 4pm each day with what he, his TA, and his mighty 3 GHz windows or linux m
AES security and crypto in general (Score:4, Informative)
The point that your data can and will be attacked while it's in plaintext is well taken. A networked machine running a web browser (the Sendmail of the 21st century) is a low security device, even with a good operating system. Google for "Scarfo", the mobster who was using PGP but also had an FBI keylogger on his computer.
As regards AES, though, we've got good reason to think it's resistant to cryptanalysis. The NSA is also in charge of protecting government secrets from foreign snoops and has approved AES for protecting classified data.
The low security of a workstation cuts both ways in an argument about gDrive: because your data is already at risk sitting on your hard drive, storing it encrypted on gDrive might not be any worse.
Security without threat modeling is like bricks without straw. What are we protecting data against? Loss, primarily. I trust Google's backups more than I trust mine (but I'd tell a client to look for a provider willing to sign an SLA). Unauthorized copying by crackers? AES should be an adequate control to cover that risk. Subpoenas? An attorney with two brain cells to rub together will subpoena the decryption keys, so no help from AES there. Vacuum-cleaner style mass government surveillance, looking for keywords like "Tibet" or "Falun Gong"? AES should prevent that. Government criminal investigation? You could (in the US) argue that surrendering the keys would be self-incrimination and end up paying a lawyer lots of money to argue the point for years. Expensive and undependable security, but then in a criminal investigation there's not much security difference between gDrive and your local machine anyway.
If you have security needs you should do an analysis like that last paragraph, only longer. For lots of people encrypted files on gDrive might be just fine.
Re: (Score:3, Insightful)
...and if the NSA could crack AES-128, what would you expect to hear from them and any security-cleared academics involved? Let me lay it out for you bluntly. They'd say something along the lines of "The algorithm has been extensively critiqued and found to be strong."
Though since the algorithm is public anyone can examine it, including people who are NOT under NDA.
Also, there's quite a difference between what Dr. Joe Honest, working on his stipend until 4pm each day with what he, his TA, and his mighty 3 GHz windows or linux machine can do, and an organization that has billions in budget normally, can get more anytime they ask, no difficult goals but breaking encryption and signal intercept, and which has made it a point to hire as many of the best minds in encryption as possible for, oh, say the last fifty years or so. And this in a world where quantum attacks are thought to be only a matter of sufficiently developed technology.
If we're talking about a brute-force, the math is pretty easy to figure out. You decide that you protect your data from X computing power, and you realize that if someone has X^2 computing power, they're going to get your data. Generally speaking, that's the best that you can do.
If we're talking about flaws in the algorithm that allow someone with a "secret key" to decrypt the data, then we're talking abo
Re: (Score:2)
Disappear... seriously
Re: (Score:2)
Re: (Score:2)
That technique is already used on a site called www.passpack.com [passpack.com]. You log in using your account and the site downloads a password protected zip file to your browser. You then type in a second password to unzip the file you can then edit the data/files. when you are finished the file is zipped (password protected) and re-uploaded to the server.
This means the file on the server is protected (128
Re: (Score:3, Insightful)
With Google's track record of protecting user's privacy, I would not be surprised if the service automatically encrypts the data during transit on the desktop and Google does not transmit the keys to their server.
I'm sorry, what track record would that be?
Google are quite possibly the world's leading authority on automated information gathering. After all, their ad-based business model fundamentally relies on being able to target those ads, and the continued success of their primary service, the search engine, depends on how effectively and comprehensively they can process the entire WWW.
As we have seen in the past, with everything from Google Street View to the leaks from a certain other popular search engine
Re: (Score:2)
For one, there is refusing demands for search data. [washingtonpost.com]
I don't agree with this, but the Google Street View is in general a continuing debate. I am speaking specifically of data that you submit to Google willingly. Not data captured by Google through your public exposure. Google does not break in to your home and take "Google Cribs View" panoramas of your home interior and publish them online.
Privacy must be defended (Score:2)
In the information age, perhaps people's expectations need to change? It needs to be realised what you really do in public is not local but global.
Alternatively, maybe we should introduce legal safeguards that apply to data, taking into account the much greater storage, data mining and communication facilities available today? Just because we can do something, does not mean we should, particularly where "we" means governments, businesses or other groups with disproportionate resources rather than private individuals.
In fact, I would argue that to some extent this is inevitable. Everyone does things in "public" (which apparently includes people obs
Re: (Score:2)
http://www.privacyinternational.org/article.shtml?cmd%5B347%5D=x-347-553961 [privacyinternational.org]
Google were rated "Hostile to Privacy". Read their interim rankings PDF.
Re: (Score:2)
It might be unfair to say google is the single greatest threat to privacy, but certainly the googlites preaching that no one should expect privacy on the internet, that private emails are postcards,
Re: (Score:2)
Juts one point to highlight about google so called protecting people's privacy. Google fought to prevent giving the information away for 'free' not selling that information.
Ironically, as I write this, the top story on the Slashdot homepage [slashdot.org] suggests that Google aren't always so good at protecting people's privacy.
That case is doubly ironic, because it sounds as if there really was a decent case there and so a court probably would have issued the proper order, justifying Google releasing the relevant data. Doing so before that order was issued doesn't sound much like fighting not to give the information away to me, though.
Re: (Score:2)
Re: (Score:2)
Underground storage (Score:2)
Re: (Score:2)
Filesystem over IMAP. (Score:2)
Oh well, I'll put it on the back-burner until I hear more.
Re: (Score:3, Interesting)
Re: (Score:2)
Useless to me w/Rogers (Score:4, Interesting)
It is pretty sad that a company will give you a nice 6 Mbps link only to cap you at 60 GB, which you could exceed in only 1 day of saturating your link.
Re: (Score:3, Insightful)
I'm too impatient to back up 5GB of data over my 100Mbit LAN, I'm not doing it at "up to" 800kbits/sec.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Informative)
512 kbps unlimited bandwidth goes for 50 dollars and 256 kbps for abt $25. i know, kinda sucks, but its getting better all the time. a few years back, many villages that did not see any kind of conne
possibilities (Score:2, Insightful)
Re: (Score:2)
The Mountain View, Calif., company plans to provide some free storage, with additional storage allotments available for a fee
Sounds exactly like Mozy [mozy.com], but with mozy you can excrypt everything with your own key, makes uploading no different but you have to decrypt any restored files yourself. Somehow I cannot see Google doing this as they'll want to use their technology to keep a single copy of a file on their servers if several people upload the same one.
I'm not sure how they'll manage to slip adverts in either, maybe you'll only be able to access file restores with a web UI?
So, all in all, Mozy is better. Now we all need t
Re: (Score:2)
Re: (Score:2)
Try telling the Mozy people.
Re: (Score:2)
Probabilities (Score:2)
I have/still have all the concerns about my privacy, but the offering was too tempting to pass up.
And that is why things in today's database-driven, surveillance-obsessed society are going to get very much worse before they get better.
It's quite sad that even after the big leak here in the UK last week, things have gone quiet on the political front and there isn't a sustained media attack on our underpowered privacy and data protection laws.
BS Post (Score:2)
To network platta
Drive image good
As face image could
Burma Shave
Thin client (Score:2)
Though nothing new, this is a great idea who's time has finally come - particularly for people with mobile devices connected to wifi hotspots - both of which Google has been investing in.
Re: (Score:2)
Thin client computing is on its way back - like it or not.
Why? What advantage does using all these on-line services actually offer me as the end user? How is this service better than my own hard drive (or having a remotely accessible server set up at home that I control)? How are Internet-based applications from the likes of Google or Salesforce.com better than installing software locally in any technical way?
All these services are basically just playing on the convenience of using a remote service, and that in turn is only relevant because of the absurdly awk
Re: (Score:2)
2) This is not a technical issue, but rather one of convenience. You can iron your own shirts too - and loads of people do, but loads of people pay someone else to do their ironing too. I'm not saying that Thin Clients will take over, but they will have a fair share of the market.
3) Yes there are risks with an online provider, but hey,
Re: (Score:2)
If you do all your computing in your proverbial mother's proverbial basement, and that basement happens to be a disused Minuteman silo, then what you say is true. But just as I want to be able to access my home directory whichever of my employer's offices I'm in, and I've been in them on three continents, I'd quite like to be able to have my private (home home?) directory available wherever I am. And my email. And m
Re: (Score:2)
Re: (Score:2)
Amazon S3 (Score:4, Interesting)
But hey, I'll take free any day.
On a somewhat related note: It would be great if Google bought the LexisNexus people. Having public access to their database would be a great public service.
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
But I hadn't found that s3sync before. That sounds like it would do the trick. Thanks Nick for the tip.
Now my only problem would be the lousy 256 kbps or whatever uplink I get with my Verizon DSL. I wouldn't mind the slow uplink but saturating the uplink also saturates the downl
Re: (Score:2)
Re: (Score:2)
In other words, Google now has to come up with and payo ut the revenues of LexisNexis' 32,000 sources to keep the service together.
If you're not aware, that's a lot.
User-centric Encryption needed (Score:5, Insightful)
Re: (Score:3, Informative)
Re: (Score:2)
Re:User-centric Encryption needed (Score:5, Insightful)
Their business is advertising.
So, they will be reading through your documents so they can put up some ads when you are browsing your files online. Putting your home finance excel sheet to gDrive? Be prepared to see TaxPlanner ads on the sidebar. Putting your holiday photos to gDrive for backup purposes? They'll probably go through the EXIF data and send you ads about latest Canon products (or whatever your camera model is).
Re: (Score:3, Insightful)
Not gonna happen. Their business is advertising.
Sorry, I've posted in this thread already so I can't mod you up. But your post is right on the money. All these people talking about encryption are forgetting that storing the data in an independently encrypted way simply isn't in Google's interests. And if people start encrypting everything themselves, as any smart user of the service clearly would if they used it at all, then Google will either find ways to link those users to other services so they can guess which profitable ads to include, or they wil
Re: (Score:2, Insightful)
Sorry, I've posted in this thread already so I can't mod you up. But your post is right on the money. All these people talking about encryption are forgetting that storing the data in an independently encrypted way simply isn't in Google's interests. And if people start encrypting everything themselves, as any smart user of the service clearly would if they used it at all, then Google will either find ways to link those users to other services so they can guess which profitable ads to include, or they will simply cancel the service if it isn't making money and isn't leading to something else they do making money.
It may be true that Google wants to be able to read your data to serve ads, but the real question is, how many people would actually use it on all of their data? And will Google go out of their way to prevent encrypted data uploads for the small percentage of intelligent and vocal users who want encryption? My bet is that they don't provide encryption, but that they don't prevent it either.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
It's doubtful that Google or most other online storage provides will offer that however - they want to tie your data to their applications (e.g. edit your documents online, share your files through their web site) - and that just doesn't work if they can't read your encryption.
Encryption method? (Score:3, Interesting)
The most secure would be to store a single large archive of all your files encrypted with a strong cipher, but that has the disadvantage that you have to download it all to decipher it.
Alternatively you could encrypt each file separately, which would speed up access considerably, but also leak more information about what you are storing (i.e many small files vs one big one ).
I guess if the data is sensitive enough to require the former type of encryption you shouldn't transmit it over insecure connections to begin with...
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
This method has a side effect of reducing the amount of side-channel information that a server-side spook-installed tap can gather. He'll see your access patterns, in terms of whether you're reading and writing
A very old idea (Score:3, Informative)
TrueCrypt support would be tasty! (Score:3, Interesting)
OK, so that was last part was really unnecessary, but still...!
Name Suggestion (Score:5, Funny)
I suggest calling it gPorn, because you know that's what's going to be on there.
baby photos (Score:2)
The file sharing abilties will no doubt h
I don't get it (Score:2)
Re: (Score:2)
The public has show that it loves putting its data on the internet.
Hack I use gmail/yahoo mail for backups. I just email files that I want to backup from my gmail account to my yahoo account. Instant redundant off site backups.
Re: (Score:2)
Web apps like google docs and gmail are great as now I can have all my wordprocessing and spreadsheets accessible from any compliant computer, and from my laptop and desktop without sync issues. Nothing confidential goes into it, but for everything I'm not sensitive about its fantastic
Likewise online storage. I'll use it to back up any files i wouldnt care if the word saw, like my old holiday photos, my mp3s, maybe some downloaded video if usage allowances permit. Presently my photo
Re: (Score:2)
Already Done it;s called Amazon S3 (Score:3, Interesting)
Re: (Score:2, Interesting)
Re: (Score:2)
Sorry, it's been a long day ;)
Re: (Score:2)
If Google is intending this service for online storage of personal information, I don't think it's going to succeed... people use Facebook for that sort of thing.
Re: (Score:2)
On the contrary.
I've long been planning to put my most personal and important data on Google's servers, using the already existing gmailfs. Using good encryption, of course, which you really should use on local storage as well, if there's even a slight chance that it might get physically stolen.
Using this would give me a very cheap (actually free) off-site backup, so I know I can still retrieve my stuff even if my house burns down, or if RIAA sends the police to get my computers...
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Do you really think Google has enough computing power to crack 128-bit AES? To crack a symmetric cypher, on average, you need to search half of the key space. That means you'd need to search 2^127 keys. My 2GHz Core 2 Duo can (according to openssl speed aes) do about 40,000 1024 byte blocks per second. In one year, it could do 1.3x10^12. If you had a compute cluster composed entirely of machines of this speed, it would need a shade under 1.3×10^26 machines to be able to crack a single AES-encrypte
Re: (Score:2)
Some of you laugh because you think it is true.
Some of you laugh because you think it is false.
Some laugh because you remember BillG saying the same thing about 640k.
And very few of you laugh because you know what I know, but none of us will actually admit it.
Re: (Score:2)
Maybe the key in AES256 is divulged a bit at time, in the 95101924th bit, the 814255525181th bit, etc.
Re: (Score:2)
Locking your files with the password "12345" is about as brilliant as it has been [imdb.com] for the past 20+ years.
Re: (Score:2)
Actually, by personal data I don't mean the heaps of movies and music that I've been downloading from the internet... ahum.. I mean linux distributions. More like pictures I've taken, source code I've written, and in general, things I can't download again from the internet.
RIAA would of course want to believe that it contains their precious Imaginary Property, but since it's encrypted, they could only guess.
Re: (Score:2)
and it's already been done- 1GB of storage on Gmail? This is why Zonk is unchecked in my "show stories from" dialog.
Re: (Score:2)
Re: (Score:2)
Re:android (Score:4, Insightful)
Any android device can be a 'dumb' terminal for your data.
Excuse the necessary pedantry, but do you realise that something cannot be a "dumb terminal for data", and that it's quite an insensible way to formulate it regardless of what the term "dumb terminal" actually means? Are you aware of the fact that "dumb terminals" involve remote processing, and not mere access to remote data? I just had to clarify this, as people keep talking about dumb terminals and thin clients as it actually has little to do with the topic at hand.
Re: (Score:2)
Or if the RIAA or MPAA deem you to be in position of copyrighted material or