The rest of points are not addressed by this sort of encryption because the keys are on disk too. Google employees have access to the keys. It's like leaving the keys into the lock and claiming it's more secure because it has a lock. In practice the data is protected only by ACL. Encryption is just a marketing keyword in this case.

On disk somewhere (encrypted, with a different key) is not the same as "leaving the keys into the lock" in a large distributed system designed to avoid single points of failure.

There are always weaknesses, but think about why a bank employee can't just decide to take your money. Internal controls are a thing.

>> Internal controls are a thing.

That's what ACL is...The encryption doesn't improve the security of the data if the keys are not stored securely. Simply put the data security is as good as the ACL of the keys is. For your peace of mind you may want to know the processes(i.e. audits, ISO standards/certifications) rather than a marketing keyword("encryption", "military grade" etc). Encryption may be part of that framework but I don't think it's relevant enough to be advertised as a stand alone 'product'. You can be sure that your account balance is not encrypted. It's the ACL process that protects you from a rough employee.

We already know that Google has a relative good security process in place. However this is not about security in the first place. It's about privacy. And here encryption brings no privacy gain because Google has the keys so as I previously said it's just marketing BS. Most people are not worried that Google gets hacked. They are worried that Google is selling their data to 3rd parties for profit and to governments for political reasons.

I think you're defining "security" and "privacy" to mean what you want them to mean. The absolutist definition that's popular in certain circles isn't the common definition.

Privacy is mostly not about keeping data from the government. Your bank account is private for most practical purposes though I'm sure with a warrant, law enforcement can find out about it. It's not going to show up in the news and your competitors aren't going to see your bank statements.

Also, Google isn't handing your private email over to advertisers - never has, probably never will.

Authentication and authorization (ACL's) are useful for both security and privacy. This is what makes cloud computing possible (along with encryption, too).

Yes, we can talk about weaknesses in our systems, but let's not completely dismiss the security and privacy features that are already there.

You and me have different views about privacy. I think you should have control over your data. Google indirectly provides your email information to advertisers. Example: You receive a flight notification. Google reads your email and targets you with ads related to your trip(i.e. hotels, things to do etc based on your age, gender etc) though various channels(i.e. gmail UI, google search, Google Now/AI etc). It wants to do the same with this Allo application. The encryption they claim it's in place it's worthless because it doesn't protect you from this. They try to claim your data is `private` because it's encrypted.

The other case which is uglier is that Google gives your data to foreign governments or other agencies. This may have great consequences. Cloud computing is based on trust and it's possible because the main players(i.e. US government, cloud providers such Amazon) are trusted not to spy their clients but I don't see many rushing to a chinese cloud vendor to host critical data(i.e. email) on their servers.

The security and privacy features we have are currently based on the good will of the provider (i.e. Google). If we talk about encryption of personal data I think it's worth to ask a bit more than a buzzword. One such thing is to do not share the encryption keys.

> SSL only handles the first two bullet points.

Only the first point. If Google works like every other data center in the world, then SSL stops the moment your data hits their first load balancer.

Google does not work like every other data center in the world. All internal services communicate over SSL (or similarly encrypted links)

Though only because they discovered their internal unencrypted links were being systematically compromised on a truly massive scale for years.

False. There was already internal encrypted traffic and the revelations only sped up the migration for the rest.

https://www.washingtonpost.com/business/technology/google-en...

I think the load-balancers do not communicate over SSL. At least not the ones in front of Appengine applications. Perhaps only inter-services communication is encrypted(i.e. app service with database service).

Most datancenters are lost once the internal network is hacked so I think that's a different issue. Encryption wouldn't help either because the attacker could get the keys too.

Encrypted links between processes inside a data center is still a good thing: It protects against malicious actors sniffing traffic (without compromising the machines in the data center)

So again... how is this better than end to end SSL?