While I don’t disagree with you, for historical purposes I think it’s important to highlight why google started its push for 100% wire encryption everywhere all the time:

The NSA and GHCQ and basically every TLA with the ability to tap a fibre cable had figured out the gap in Google’s armour: Google’s datacenter backhaul links were unencrypted. Tap into them, and you get _everything_.

I’ve no idea whether Snowdon’s leaks were a revelation or a confirmation for google themselves; either way, it’s arguably a total breach.

When I worked at PayPal back in 2003/4, one of the things we did (and I think we were the first) was encrypt the datacenter backhaul connections. This was on top of encrypting all the traffic between machines. It added a lot of expense and overhead, but security was important enough to justify it.

And yet Venmo, a Paypal company, publishes transaction data publicly by default, no need to decrypt anything ¯\_(ツ)_/¯

Venmo publishes raw unencrypted transaction data? Or are you referring to their social network features?

where?

Is Google even required to inform you of a data breach?

They're subject to California law, so yeah.

https://oag.ca.gov/privacy/databreach/reporting

Not that I disagree with your assessment but in the spirit of hn pedantry - google had a very significant breach where gmail was a primary target and that was “only” 16 years ago in mid 2009. So bad that it has its own wikipedia page: https://en.wikipedia.org/wiki/Operation_Aurora

>very significant breach

That page says it was only 2 accounts and none of the messages within the mail was accessed. I wouldn't call that very significant.