Google To Encrypt All Keyword Searches 224
Hugh Pickens DOT Com writes "Danny Sullivan reports that in the past month, Google has quietly made a change aimed at encrypting all search activity to provide 'extra protection' for searchers, and possibly to block NSA spying activity. In October 2011, Google began encrypting searches for anyone who was logged into Google. The reason given was privacy. Now, Google has flipped on encryption for people who aren't even signed-in. In June, Google was accused of cooperating with the NSA to give the agency instant and direct access to its search data through the PRISM spying program, something the company has strongly denied. 'I suspect the increased encryption is related to Google's NSA-pushback,' writes Sullivan. 'It may also help ease pressure Google's feeling from tiny players like Duck Duck Go making a "secure search" growth pitch to the media.'"
Illusion of privacy (Score:5, Insightful)
Too little, too late. Way too late.
Any different from https://google.com ? (Score:4, Insightful)
How is this different from just using HTTPS Everywhere or typing https://google.com/ [google.com] into the URL bar?
One down... (Score:5, Insightful)
Thing about DuckDuckGo is... they promise I'm anonymous to them. There's value in that, at least to me.
Google's move is certainly welcome, but all it means is - going forward - only Google will be collecting my information as opposed to Google + NSA.
Bullshit PR is Bullshit (Score:5, Insightful)
Google has quietly made a change aimed at encrypting all search activity to provide 'extra protection' for searchers, and possibly to block NSA spying activity.
What would encryption do when the NSA has access to the servers?
'I suspect the increased encryption is related to Google's NSA-pushback,'
Except that pushback itself is also pure political theater. Funny how these court challenges only started happening when stuff started to become public.
Google has made their bed. Let them lie in it.
Re:Illusion of privacy (Score:5, Insightful)
Encrypting the connection between Google and the users isn't going to accomplish anything when the NSA already has full access to Google's servers.
Too little, too late. Way too late.
Google has been very adamant that the NSA does not have access to their servers. I don't know if I believe them or not but that is the premise Google is working off of.
It also means nothing when they cowtow to the national security letters like they do.
Re:Illusion of privacy (Score:5, Insightful)
Re:Illusion of privacy (Score:2, Insightful)
Not to mention that the NSA probably has backdoors at most major ISP's and can man-in-the-middle decrypt anything they want. As another poster said, it's more or less over.
Re:Illusion of privacy (Score:3, Insightful)
I dont think you understand how SSL works. Its entire purpose is to defeat MITM.
Re:Illusion of privacy (Score:4, Insightful)
Even if Google wanted to tell you that the NSA has access to their servers, knowing full well it would kill their bottom line (assuming it would), they'd be forbidden from telling you the truth anyways.
That's actually the scariest thing.
Re:Illusion of privacy (Score:2, Insightful)
If you want your traffic encrypted, you need to generate your own certificates using software you compiled on multiple independent compilers to counter "trusting trust" after you reviewed the code.
Re:Illusion of privacy (Score:5, Insightful)
Even if Google wanted to tell you that the NSA has access to their servers, knowing full well it would kill their bottom line (assuming it would), they'd be forbidden from telling you the truth anyways.
True... but I'm not so certain that they could be compelled to lie. When I look at the pattern of public statements and later revisions from all of the big players (telcos and tech companies), I don't see a single case of anyone actually contradicting an earlier statement. It seems to me that they've all been careful to tell the truth, though they've often been careful about how much truth they've told. Government agencies have been caught lying, but they don't have the same legal requirements to citizens as publicly-traded companies have to shareholders.
Based on that, and on my viewpoint as a Google employee who builds some of the internal security systems that the NSA would have to compromise to snoop, I am completely convinced that Google is telling the truth when it says that it has not given the NSA any sort of direct or indirect access. I'm not certain that the NSA hasn't managed to insert snooping equipment into Google data centers or on Google fiber lines without Google's knowledge. But that's why Google is making a push to get everything encrypted, internally and externally.
Just to quiet the obvious retort: Yes, I know that won't prevent the government from serving Google with warrants and NSLs and obtaining user data that way. But if they have to do it through the front door, with a request that satisfies Google's attorneys with respect to its propriety and narrow scope, then I think we (as a society) have a much more manageable problem. Still a problem, but one that can be addressed with legislation and better oversight. If the NSA is silently devouring the whole Google data stream... that's an entirely different kettle of fish.
Re:Illusion of privacy (Score:3, Insightful)
But to further the point, it is strongly suspected that SSL is already broken by the NSA, and having certificates is no longer necessary.
That is outright false. I challenge you to provide a citation to a reasonably authoritative site saying that - basically anybody who isn't a kook. You can't.
The best you can come up with is that RSA-1024 is easy enough to brute-force with modern equipment. But moving to RSA-2048, as google has already done, [blogspot.com] still provides very strong protection.
This isn't just about the NSA (Score:5, Insightful)
SSL is there to keep common snoopers (ISPs, potential identity thieves, punks on the corporate network with wireshark, etc.) from eavesdropping on you. Yeah, the vast resources NSA may very well have the ability to break it, but they're hardly the only threat out there. I'm far more worried about the potential for an identity thief to read my traffic than for the NSA to do so.
The NSA is hardly the biggest threat to your privacy and they're probably not the most dangerous.