The debate is really happening, because it is impossible to provide a browser-client cloud data service without also creating a massive collection of people's private information. And this entire ecosystem has been largely unregulated to date.
In daily life the debate looks like this: "that service could make my life better, and it's free. But do I feel comfortable sharing my info with this company?" Remember the big news cycle about Gmail's ad targeting technology? But since then millions of people have signed up to use Gmail anyway. So I would not agree that society as a whole has deemed this sort of thing to be wholly bad.
impossible to provide a browser-client cloud data service without also creating a massive collection of people's private information
Well instead of just hoovering up every photo you take with Glass into G+ [1], they could implement even a fig-leaf's worth of client-side encryption. This is far from impossible. Just saying.
[1] Not just by default, but as I understand it, without even the option of turning that off.
Client-side encryption doesn't help much with privacy concerns because the client and the server are both wholly produced by Google, so you have to assume that Google can pierce that encryption if they want to. That's exactly what happened with DropBox.
It helps protect against unauthorized access, but doesn't really address privacy concerns with Google itself.
I did say "fig leaf". But some level of client-side would at least demonstrate good will, or some level of "giving a fsck".
There is a real difference though, which is the difference between code on your client which perhaps you could at least check if you're stubborn enough[1], and plaintext in a datacenter. This can mean the difference between targeted surveillance and mass surveillance.
Dropbox is a separate case - it was always "trust us" (we have your keys) encryption, and not what I would refer to as "client side" at all.
[1] This is a hard problem if you don't trust the OS
Comments
The debate is really happening, because it is impossible to provide a browser-client cloud data service without also creating a massive collection of people's private information. And this entire ecosystem has been largely unregulated to date.
In daily life the debate looks like this: "that service could make my life better, and it's free. But do I feel comfortable sharing my info with this company?" Remember the big news cycle about Gmail's ad targeting technology? But since then millions of people have signed up to use Gmail anyway. So I would not agree that society as a whole has deemed this sort of thing to be wholly bad.
Well instead of just hoovering up every photo you take with Glass into G+ [1], they could implement even a fig-leaf's worth of client-side encryption. This is far from impossible. Just saying.
[1] Not just by default, but as I understand it, without even the option of turning that off.
Client-side encryption doesn't help much with privacy concerns because the client and the server are both wholly produced by Google, so you have to assume that Google can pierce that encryption if they want to. That's exactly what happened with DropBox.
It helps protect against unauthorized access, but doesn't really address privacy concerns with Google itself.
I did say "fig leaf". But some level of client-side would at least demonstrate good will, or some level of "giving a fsck".
There is a real difference though, which is the difference between code on your client which perhaps you could at least check if you're stubborn enough[1], and plaintext in a datacenter. This can mean the difference between targeted surveillance and mass surveillance.
Dropbox is a separate case - it was always "trust us" (we have your keys) encryption, and not what I would refer to as "client side" at all.
[1] This is a hard problem if you don't trust the OS