Jeff Atwood's security blunder regarding email

Re:Jeff Atwood's security blunder regarding email by btilly on Monday April 30, 2012 @01:24AM (#3908129)

In late 2009, China tried to get into Gmail. According to the forensics done at the time, they managed to compromise 2 accounts. And even then they only managed to read subject lines but not email contents for those accounts.

Google detected them, locked them out, identified over 20 other companies that had been compromised and notified all of them. Furthermore getting compromised was a wake-up call - they immediately took a lot of steps to improve their own security.

See http://techcrunch.com/2010/01/12/google-china-attacks/ for verification of some of this.

So China went after the easier target - users. Users are easy to compromise.

Therefore in 2011 Google notified hundreds of users (including many members of the government) that their accounts had been compromised by China. See http://www.foxnews.com/scitech/2011/06/01/gmail-compromised-... for verification.

Note that this time Google's infrastructure was not targeted. Just end users and still Google tracked it down and notified people.

No system is perfect. I guarantee that Google knows this. But Gmail has a far better claim than any other email system I know of to claim to being able to beat Chinese hackers. (That said, I'm sure that China has not given up.)

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by javert on Monday April 30, 2012 @03:15PM (#3910894)

But, these are just the incidents we know about. Plus, if the email isn't encrypted, many Google employees potentially have access, which throws the door very wide open.

Also, wasn't Google tracking everyone's movement everywhere, on Android? This is not a company I trust.

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by tedunangst on Monday April 30, 2012 @01:32AM (#3908149)

From TC link: "We are telling you this because we are committed to transparency, accountability, and maintaining your trust."

You'd think, if that were true, Google would indicate somewhere that, yes indeed, they do encrypt your email.

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by btilly on Monday April 30, 2012 @12:14PM (#3909844)

Have you thought of the operational costs of both encrypting email and still being able to support efficient searching of said email?

It really makes more sense to store unencrypted, and then secure access. The difficulty that motivated and well-prepared attackers have had in getting access demonstrates that they have done a very good job of securing access.

[ Parent | on HN ]