News for hackers. Stuff that matters.
Re:Google backs off on previously announced Allo privacy fea... by otabdeveloper1 on Wednesday September 21, 2016 @11:34AM (#12549125)
> SSL only handles the first two bullet points.

Only the first point. If Google works like every other data center in the world, then SSL stops the moment your data hits their first load balancer.

Re:Google backs off on previously announced Allo privacy fea... by nevir on Wednesday September 21, 2016 @02:18PM (#12550815)
Google does not work like every other data center in the world. All internal services communicate over SSL (or similarly encrypted links)
Re:Google backs off on previously announced Allo privacy fea... by makomk on Wednesday September 21, 2016 @02:34PM (#12550948)
Though only because they discovered their internal unencrypted links were being systematically compromised on a truly massive scale for years.
Re:Google backs off on previously announced Allo privacy fea... by puzzle on Wednesday September 21, 2016 @03:38PM (#12551506)
False. There was already internal encrypted traffic and the revelations only sped up the migration for the rest.

https://www.washingtonpost.com/business/technology/google-en...

Re:Google backs off on previously announced Allo privacy fea... by themihai on Thursday September 22, 2016 @07:10AM (#12555971)
I think the load-balancers do not communicate over SSL. At least not the ones in front of Appengine applications. Perhaps only inter-services communication is encrypted(i.e. app service with database service).
Re:Google backs off on previously announced Allo privacy fea... by themihai on Wednesday September 21, 2016 @01:43PM (#12550461)
Most datancenters are lost once the internal network is hacked so I think that's a different issue. Encryption wouldn't help either because the attacker could get the keys too.
Re:Google backs off on previously announced Allo privacy fea... by nevir on Wednesday September 21, 2016 @02:20PM (#12550839)
Encrypted links between processes inside a data center is still a good thing: It protects against malicious actors sniffing traffic (without compromising the machines in the data center)
Re:Google backs off on previously announced Allo privacy fea... by themihai on Thursday September 22, 2016 @07:13AM (#12555982)
So again... how is this better than end to end SSL?