News for hackers. Stuff that matters.
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by lisper on Tuesday September 12, 2017 @12:13PM (#15228526)
> unless compelled to do so by law

That's a pretty significant hedge.

Also, how effective are Google's processes against dishonest employees? It would not be hard for, say, the Chinese government to plant a mole in Google's security team. (Actually, the real nightmare scenario is a Chinese mole in Intel or Apple's hardware team.)

Re:Forget Equifax. Facebook and Google Have the Data That Sh... by saalweachter on Tuesday September 12, 2017 @12:25PM (#15228648)
Honestly Google is one of the few companies I know of which really considers internal threats and has taken precautions to reduce the likelihood that internal bad actors will have access, to reduce the scope of access to any bad actors that slip through, and to ensure that illegitimate accesses will be noticed, reducing the time a bad actor will have access.
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by lisper on Tuesday September 12, 2017 @12:39PM (#15228806)
I believe you. But one still has to wonder who watches the watchmen.
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by saalweachter on Tuesday September 12, 2017 @12:51PM (#15228947)
Crazy libertarian SREs. :-P
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by JadeNB on Tuesday September 12, 2017 @01:20PM (#15229224)
> Crazy libertarian SREs. :-P

A Google search didn't immediately clarify. What is 'SRE'? The most plausible de-abbreviation I could find was "site reliability engineer".

Re:Forget Equifax. Facebook and Google Have the Data That Sh... by saalweachter on Tuesday September 12, 2017 @01:46PM (#15229474)
Site-reliability engineers is the correct de-abbreviation.

While data at Google is tightly protected, everything else at Google is fairly transparent. In particular, you can see who is using what resources. SREs, among other things, monitor and manage this resource usage. Large, abnormal usages ("Why is someone copying all this data off-site?") will be noticed, and some of the people who will notice won't take "because the NSA told us to" as an acceptable answer.

Re:Forget Equifax. Facebook and Google Have the Data That Sh... by klodolph on Tuesday September 12, 2017 @01:49PM (#15229503)
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by joshuamorton on Tuesday September 12, 2017 @01:27PM (#15229288)
That'd be the right abbreviation.
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by arkem on Tuesday September 12, 2017 @12:34PM (#15228748)
Google fights against subpoenas and warrants all the time but sometimes they lose. At that point they have to comply or be held in contempt and I can't really blame Google for complying in that situation.

With many thousands of engineers it is totally possible for bad actors to have infiltrated Google. It's one of the reasons why there are such strict protocols for accessing customer data or production hardware. The idea is that by default no one has access to anything and that all accesses to data and production hardware are logged and audited.

I'm sure there're still opportunities for a rogue employee to do something bad but Google are way better at protecting access to their customer's data than many of the companies I've seen.

Re:Forget Equifax. Facebook and Google Have the Data That Sh... by CaptSpify on Tuesday September 12, 2017 @03:33PM (#15231217)
> Google fights against subpoenas and warrants all the time but sometimes they lose. At that point they have to comply or be held in contempt and I can't really blame Google for complying in that situation.

I can and do blame them without hesitation. They could choose not to store that data, or make it zero-knowledge-based, yet they choose not to.

Just because they've been compelled to hand over data via legal means does not excuse them for doing the wrong/insecure thing in the first place.

Re:Forget Equifax. Facebook and Google Have the Data That Sh... by evanlivingston on Tuesday September 12, 2017 @12:53PM (#15228963)
Do they fight against all subpoenas equally or do they make calls about which to fight and which to comply with? If they choose to comply with some, how do they make that call?