My positive perception mainly comes from this super paranoid dude, Michael Bazzell: https://inteltechniques.com/experience.html. He both hates Google for their data collection and also respects it for their security practices.
Ugh I also hate to hear they’re doing the “we’re secure but who knows about our 3rd parties” practice. State IT does this as well. As long as you sign some contract with them that promises them you do NSA-style security, they’ll buy anything from you. Of course what 5-man IT shop wouldn’t sign a $20,000,000 IT contract when worst case, they get a bad audit and have to spend 50k really quickly to get up to SOC II?
You can literally find a list of State IT contractors for most govs, and just go through them finding all the fly-by-night shops. That being said, the big vendors aren’t that much better either...
tl;dr: everyone sucks and be afraid and use mfa
The thing people need to remember is that the CIA Director's AOL email account got hacked. In 2015. We are so far as a society from where we should be.
Also, FWIW, I said really nice things about the ADMX templates Google offers for managing Chrome installs. Literally yesterday: https://news.ycombinator.com/item?id=16317523
It would seem you still don't understand how Android is built. Google cannot update the phones made by other OEM's. OEM's download the Android source code, add their modifications and create their own forked version of Android. This is like asking Debian to update Redhat's Linux distribution. Blaming Google for the OEM's inability to update their own phones is disingenuous, but it does support your prime directive of disparaging Google every opportunity you get.
>especially when you consider it took Google five months to patch KRACK in the Pixel 2, when third party ROM authors did it in two days.
Those patches were provided by Google incidentally. Additionally, Google patched KRACK in Dec, 2017 on the Pixel phones. So where exactly did you get this 5 months?
>Also, Google's "reputation with security" needs some serious nuance: They are very good at preventing types of exploits they care about, but they are a literal joke when it comes to security that interfaces with submitted content and user choice. Consider that the Chrome Web Store is a literal cesspool of malware, and that a lot of websites blatantly try to force you to install extensions through the Chrome Web Store which steal your browsing data. Since extensions are permitted to request such a huge security hole, Google doesn't consider it their problem that extensions do it maliciously.
Could you point me to the malware on the Chrome Web Store? Since you claim it's a "literal cesspool of malware" it shouldn't be that difficult for you to point to those extensions. I look forward to those links.
July, vendors notified (incl. Google): https://www.nbcnews.com/tech/tech-news/krack-attack-security...
October, my Windows Mobile phone was patched: https://www.bleepingcomputer.com/news/security/microsoft-qui...
October, vulnerability goes public: http://www.businessinsider.com/krack-attack-wi-fi-vulnerabil...
October, Lineage patched: https://twitter.com/LineageAndroid/status/920143977256382464
December, Google patches their own phones: https://arstechnica.com/gadgets/2017/11/pixel-wont-get-krack...
They just don't care about updates, otherwise they would remove certification access to any OEM not providing updates.
Even with Treble they are letting the OEMs do the updates, if they ever take place.
And to add to injury, devices that are upgraded to 8.0 instead of being released with it, don't require Treble compliance.
So, our lovely OEMs are mostly shipping Android 7.0 devices in 2018 to avoid Treble.
It is 100% Google's fault.
I think they care, but they can't do something about it. Because OEM's dislike updates. Updates does not sell new phones.
Google on the other hand actually has it easier if all their devices are up to date. They do not need to maintain old code/branches whatever.
It's still Google's fault that they never had something in place to enforce it. They basically wanted to have anybody on board of the OHA, so they needed to make tradeoffs in their contracts.
https://arstechnica.com/information-technology/2018/01/malic...
>Proving once again that Google Chrome extensions are the Achilles heel of what's arguably the Internet's most secure browser, a researcher has documented a malicious add-on that tricks users into installing it and then, he said, is nearly impossible for most to manually uninstall. It was available for download on Google servers until Wednesday, 19 days after it was privately reported to Google security officials, a researcher said.
Another one: https://arstechnica.com/information-technology/2018/01/50000...
>Researchers have uncovered four malicious extensions with more than 500,000 combined downloads from the Google Chrome Web Store, a finding that highlights a key weakness in what's widely considered to be the Internet's most secure browser. Google has since removed the extensions.
Also, Google's "reputation with security" needs some serious nuance: They are very good at preventing types of exploits they care about, but they are a literal joke when it comes to security that interfaces with submitted content and user choice. Consider that the Chrome Web Store is a literal cesspool of malware, and that a lot of websites blatantly try to force you to install extensions through the Chrome Web Store which steal your browsing data. Since extensions are permitted to request such a huge security hole, Google doesn't consider it their problem that extensions do it maliciously.
Because Google doesn't consider something they gave permission to do malicious things to be an exploit or vulnerability, Google can simultaneously claim that Chrome is the most secure browser, and it be literally the easiest browser to get malware with.
I can definitely agree with you that state level government security has a long way to go and is a pretty scary place. But Google can't fix it, because the biggest problem in government security is still humans, a security layer that Google has repeatedly demonstrated no understanding of.