Jeff Atwood's security blunder regarding email

Re:Jeff Atwood's security blunder regarding email by elchief on Monday April 30, 2012 @12:31AM (#3908037)

gmail has been revamped so that China, with a fuck-ton of resources and desire, cannot get into it. they hired the NSA to help them. maybe it's no longer secure from the NSA, but it is from everyone else.

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by tedunangst on Monday April 30, 2012 @12:50AM (#3908072)

I didn't know the NSA was available to hire.

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by dsl on Monday April 30, 2012 @01:08AM (#3908105)

http://rt.com/usa/news/nsa-epic-foia-court-413/

FWIW, I know security folks at Google and NSA. Google definitely wins the talent war.

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by tedunangst on Monday April 30, 2012 @01:25AM (#3908130)

My objection was principally to the notion that the NSA is just some 3rd party security consultancy one calls up. Whether there was or was not a partnership that can or cannot be confirmed or denied, who knows, but lacking verifiable evidence, I'm just as likely to believe the NSA's advice was along the lines of "use a firewall and an IDS".

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by batista on Monday April 30, 2012 @04:07AM (#3908416)

>My objection was principally to the notion that the NSA is just some 3rd party security consultancy one calls up.

When one is Google, it is. Not to mention that NSA very much cares for the trillions of information Google has to offer them and their continuing compliance.

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by javert on Monday April 30, 2012 @12:39AM (#3908054)

Source?

It's very hard for me to imagine truly trusting that China cannot get into Gmail. Even if you have a great source. :-P

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by btilly on Monday April 30, 2012 @01:24AM (#3908129)

In late 2009, China tried to get into Gmail. According to the forensics done at the time, they managed to compromise 2 accounts. And even then they only managed to read subject lines but not email contents for those accounts.

Google detected them, locked them out, identified over 20 other companies that had been compromised and notified all of them. Furthermore getting compromised was a wake-up call - they immediately took a lot of steps to improve their own security.

See http://techcrunch.com/2010/01/12/google-china-attacks/ for verification of some of this.

So China went after the easier target - users. Users are easy to compromise.

Therefore in 2011 Google notified hundreds of users (including many members of the government) that their accounts had been compromised by China. See http://www.foxnews.com/scitech/2011/06/01/gmail-compromised-... for verification.

Note that this time Google's infrastructure was not targeted. Just end users and still Google tracked it down and notified people.

No system is perfect. I guarantee that Google knows this. But Gmail has a far better claim than any other email system I know of to claim to being able to beat Chinese hackers. (That said, I'm sure that China has not given up.)

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by javert on Monday April 30, 2012 @03:15PM (#3910894)

But, these are just the incidents we know about. Plus, if the email isn't encrypted, many Google employees potentially have access, which throws the door very wide open.

Also, wasn't Google tracking everyone's movement everywhere, on Android? This is not a company I trust.

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by tedunangst on Monday April 30, 2012 @01:32AM (#3908149)

From TC link: "We are telling you this because we are committed to transparency, accountability, and maintaining your trust."

You'd think, if that were true, Google would indicate somewhere that, yes indeed, they do encrypt your email.

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by btilly on Monday April 30, 2012 @12:14PM (#3909844)

Have you thought of the operational costs of both encrypting email and still being able to support efficient searching of said email?

It really makes more sense to store unencrypted, and then secure access. The difficulty that motivated and well-prepared attackers have had in getting access demonstrates that they have done a very good job of securing access.

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by elchief on Monday April 30, 2012 @01:19AM (#3908125)

this didn't happen that long ago.

gmail was broken into by someone representing the chinese government. google fully admitted to this. this admittance did not seem to hurt their rep. they would probably admit to it if it had happened again.

google soon thereafter asked the nsa to help them out with security.

http://www.washingtonpost.com/wp-dyn/content/article/2010/02...

http://www.nytimes.com/2010/02/05/science/05google.html

I am not saying that it's impossible for China to get in, but I'm sure it's a whole lot harder

[ Parent | on HN ]