Google To Encrypt Cloud Storage Data By Default 217
jfruh writes "Worries about snooping are now a permanent part of our computing landscape, but Google is attempting to ameliorate those fears by encrypting all data on its Google Cloud Storage service by default. Data is encrypted with 128-bit AES, and you can manage the keys yourself or have Google do it for you. A Google spokesperson said that the company "does not provide encryption keys to any government."" (Also at SlashCloud.)
Fool me once.... (Score:5, Informative)
Given what we know about the NSA, NSLs, and Lavabits, " [we do] not provide encryption keys to any government" is a worthless statement. With an NSL, Google will turn over everything and won't be able to say anything about it. With an NSL, Google will be required to lie (like claiming data is encrypted when it's not). Lavabits received an NSL and chose to shut down rather than honor it and sell out their customers. Google compiles with their NSLs.
You cannot trust Google or the cloud with your data.
THIS IS NOT GOOGLE DRIVE (Score:5, Informative)
Convenient (Score:5, Informative)
In other news leaked internal NSA documents show that they only begin to have trouble cracking AES at 256-bit key sizes and higher.
Re:what about decryption keys (Score:5, Informative)
According to TFA and the blog post it's server side encryption. Which, of course, does absolutely nothing for security as the NSA will just get the data before it's encrypted.
If you don't want your data read you encrypt it before sending it to someone else.
Re:What does this mean exactly? (Score:5, Informative)
It means that they don't provide the encryption keys. And the unencrypted data is provided to government agencies in accordance with the law. Since there are secret laws, we don't know under what conditions the data is provided.
Re:What does this mean exactly? (Score:5, Informative)
"A Google spokeswoman said via email the company does not provide encryption keys to any government and provides user data only in accordance with the law."
What does this mean, exactly? That they would provide encryption keys in accordance with the law?
It means they will decrypt the data and then hand it over.
Its server side encryption. The server has the keys.
Re:what about decryption keys (Score:5, Informative)
Its AES. Its a symmetric-key algorithm. The encryption key is the decryption key. Whats with all the jokes about decryption keys?
And the fact the keys are symmetric and held by Google renders the entire exercise entirely worthless. If Google have the key to encrypt/decrypt data then they can just hand it to the NSA or whomever at the same time they hand over the data.
The proper and correct thing to do is to provide a pluggable API in their client apps that allows an extension running client side to manage the key and encrypt / decrypt the data. And similarly for their cloud APIs for languages like Java.
Google would have absolutely no idea what the data contains and absolutely no way to retrieve it either. It might mean certain functionality in their apps / services is affected in some ways (e.g. encrypted folders are inaccessible via a browser) but I assume they could spell out the consequences and people motivated to encrypt data would recognize those limitations.