Tag Info

New answers tagged

0

Anything you type your password into has the theoretical capability to mis-use it. That includes everything you're already using your google account with, such as your PC and smartphone. To answer your question you would need to make a risk assessment of all the things that could go wrong, and work out what to do about it. We can't really do that for you, ...


0

While Google does send similar warnings, this one is clearly a phishing scam trying to steal your account. Phishing scams include e-mails that request your login:password information, or links to fake web-sites that ask for your login:password. For web-sites, the printed link may look valid but the actual link could go someplace different. They often ...


10

You mistyped the URL: http://drive.googe.com http://drive.google.com ^ There I confirmed that the redirect to router.php happens when you mistype the URL, and does not happen when you type it correctly. Note that typosquatting (which is what this is called) is a serious security problem as you no doubt can see. Had the ...


0

Your search queries are definitely very easily accessed as you can see by the recent DNS interception in Turkey. How much information they are able to get depends on how extensive the interception is. Your search queries are the easiest for them to see. Use DuckDuckGo while signed out of Google in an incognito browser for more secure search queries. As far ...


1

As described here: Once registered and qualified by Google, we will send you a simple agreement for joining the GGC program. After you have electronically signed this agreement, Google will ship you servers that you install in your facility and attach to your network. Google will work with you to configure the servers and bring them into service. ...


1

You can encrypt by using the open source Truecrypt software to create an encrypted container. An encrypted container is a file that Truecrypt uses and sort of pretends is a disk drive. It is formatted like a drive, and everything that is written to it is totally encrypted. When you mount it in Truecrypt, you get a drive letter on your computer and ...


0

One specific piece of data you can access with the "Phone State" permission is the IMEI/IMSI of your phone/sim card. This number is used to identify your device for target-ads (so the ad provider could tell whether you've already seen an ad). Since showing ads is a common business model in mobile apps, the "Phone State" permission being requested is as well ...


6

Google not only protects you and your data, but also themselves. The vast majority of internet users out there does not know about security, and does not care about. When offering any insecure path as fallback, user's would use it, and if it is some man-in-the-middle breaking everything else. If your account is compromised, that's not only a problem for ...


3

Googles hands are tied. Google arent just doing it to protect you. They are doing it to protect themselves. They dont want other people to mess with your stuff because they are carrying it for you, and they have a whole lot of legal obligations that come with hosting other peoples stuff. They are obligated to prevent any account being used in a way that ...


4

Was Google evil for requiring you to use the HTTP protocol instead of the Gopher protocol? I don't think most people would argue that it was. But if requiring the use of one protocol over another is not evil, then why would it be evil in this particular case: wrapping SSL around HTTP?


2

As others say, normally you have nothing to lose by using encryption instead of non-encryption, even if you think you don't need encryption. But if you really want to access it non-encrypted (perhaps to prove to someone observing your line that you are doing nothing evil), you could set up some HTTP server, which itself connects to Google by HTTPS, and ...


1

TL;DR: It's better, but it's not good enough. The chance of having a tapped connection versus the costs of this type of security are obvious and require no further consideration than "yes this is required". It is vital to remember that SSL might not be perfect and the implementations are very unlikely to be waterproof. Additionally, especially in a case ...


10

Evil for forcing you to use a secure connection? No, I don't think it's evil. It protects the community at large with no downside to you as an individual. I think its only evil if they're forcing you to use SSL/TLS, then failing to use forward secrecy, thus giving you and everyone else using the service a false sense of security. Without forward secrecy, ...


14

In fact, no, Google is not evil with this, not at all. The first important thing about this is that the use of secure connection is not a user preference or some personalized setting. Some people might find this confusing because they are familiar with a system only from the position of an end-user. Being a software developer myself, I can tell you that ...


8

It's sad that people's first reaction is to defend Google by using the "you don't HAVE to use it" fallacy. As for transaction of money, don't you think your own personal information which they sell to advertisers has monitory value? Google isn't free, it still requires a payment which most people don't even realize they are making. Now, to answer the ...


78

Let me rephrase your question with a few extra details, which are implicit but maybe not obvious to everybody: "Isn't Google being Evil by providing me with a free email service and gigabytes of storage and forcing me into a secure connection when I access that service which they have generously granted to me and that nobody forces me to use even if I don't ...


0

Perhaps they should offer an option to disable SSL if necessary. Perhaps there are some encryption restrictions in some countries or network requirements that would prevent users from accessing the service. I can see some business and user value to providing insecure options, but the defaults should be secure. However, Google likely made this as a business ...


154

It's not just about you. By forcing users to use TLS, they're creating a more secure environment for everyone. Without TLS being strictly enforced, users are susceptible to attacks such as sslstrip. Essentially, making unencrypted connections an option leads to the possibility of attackers forcing users into unencrypted connections. But that's not all. ...


16

If Google wants the content of their servers to be transferred securely, that is entirely within their discretion, even if that content is your email box.



Top 50 recent answers are included