Google To Encrypt Cloud Storage Data By Default 217
jfruh writes "Worries about snooping are now a permanent part of our computing landscape, but Google is attempting to ameliorate those fears by encrypting all data on its Google Cloud Storage service by default. Data is encrypted with 128-bit AES, and you can manage the keys yourself or have Google do it for you. A Google spokesperson said that the company "does not provide encryption keys to any government."" (Also at SlashCloud.)
TFA (Score:5, Interesting)
Of course, if you prefer to manage your own keys then you can still encrypt data yourself prior to writing it to Cloud Storage.
Which is how it should all be done. Relying on Google's honesty, or some Google employee who doesn't want his fingers broken one by one, is just false security.
Re:Call me paranoid (Score:2, Interesting)
It will be difficult to avoid such requests entirely, but this technology, implemented well, prevents the NSA or others from intercepting the data en route and reading it without a court order.
I'd also point out that Google has, in the past, pushed back against data requests.
I want my browser to manage my keys (Score:3, Interesting)
When I first read the summary I thought Google was going to provide me a way to manage my own keys in a practical sense. I would like for my browser to automatically decrypt when I download from Google Drive using private keys stored on my local store (with a pass phrase, of course).
Goggle complies with local laws ... (Score:5, Interesting)
"The new local Google site, expected to be launched Wednesday at Google.cn, will include notes at the bottom of results pages that disclose when content has been removed, said Andrew McLaughlin, senior policy counsel for Google. "Google.cn will comply with local Chinese laws and regulations," he said in a statement. "In deciding how best to approach the Chinese--or any--market, we must balance our commitments to satisfy the interest of users, expand access to information, and respond to local conditions.""
http://news.cnet.com/Google-to-censor-China-Web-searches/2100-1028_3-6030784.html [cnet.com]
When a legal order to turn over info is received they will do it. The only question is what constitutes a legal order.
Re:Call me paranoid (Score:3, Interesting)
Yes, but this prohibits use of Google's many server-side tools for editing documents, spreadsheets, calendar, etc. If confidentiality of your data is to be preserved, that data can never be transferred unencrypted out of machines you control. That prevents the server-side application from checking your spelling, evaluating your spreadsheet calculations, or anything else. The cloud becomes nothing but a distributed filesystem.
But Google wants to read your data in order to advertise to you. That's why they provide the free service and have implemented all of it server side. They are not dishonest about this, but their denial that they share your data with government authorities seems to ignore the fact that a government can force them secretly to disclose anything.