Re:Why we have to boycott RSA
by tptacek on Saturday January 04, 2014 @07:23PM
(#7013738)
No organization on the planet has done more to get end-to-end strong crypto, as free as is feasible from the influence of certificate authorities, into the hands of as many people as Google has. Google is the Internet's leading deployer and evangelist of forward secrecy and the pathbreaking pioneer in identity pinning.
[ Parent
| on HN ]
That's all great, but in terms of actually keeping users' data out of the secret policeman's file, Skype was the first and best, until they got their balls cut off.
Google does an excellent job keeping everyone's data out of the hands of black hats, but that's not quite the same thing as making it impossible for governments to snoop.
Instead of bitching about the NSA, how about a GMail client I can audit, a key exchange I can trust, and routine encryption of all emails.
How about PFS and strong payload crypto for hangouts?
I suspect they are hoping for a scenario where customers will just trust them about government snooping. That would enable their security people to cooperate in situations they deem worthy of cooperation. But I think that trust is gone forever. After all, the courts have ruled metadata collection is legal, so why wouldn't Google cooperate with a legal operation?