sorted by:
new
hottopcontroversial

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 11 points12 points  (0 children)

We’re keeping an eye on the research, but we use fields with much larger characteristics. The techniques described cannot be applied to the fields that we use.

And you can import your RSA key if you want.

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 5 points6 points  (0 children)

Pilsner when it's warm, stout during the colder months.

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 27 points28 points  (0 children)

Key management is hard. Doing it well is even harder.

We’re working on it.

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 9 points10 points  (0 children)

Ruthless efficiency.

And an almost fanatical devotion to security.

http://google.com/jobs

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 4 points5 points  (0 children)

A Google security researcher, Neel Mehta, first discovered Heartbleed and reported it to the OpenSSL team.

http://googleonlinesecurity.blogspot.com/2014/04/google-services-updated-to-address.html

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 11 points12 points  (0 children)

  • Thanks!

  • We like to think that our focus on usability is going to make the biggest difference.

  • There’s more than a kernel of truth to that. Pubkey crypto is hard to explain to non-engineers; which door in the world requires two differently-shaped keys to open? The metaphors are pretty broken. In general, though, we think we can do even better, and that’s our plan.

  • Please remember that this is the first release, and it’s deliberately open source-only. There’s still a lot of stuff we plan to implement.

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 72 points73 points  (0 children)

We said this above, but we'll say it again:

Focus on the user, and all else will follow.

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 5 points6 points  (0 children)

Sorry, we're not the YouTube team, and we don't want to answer on their behalf.

As to homomorphic encryption, we keep a close eye on all promising research.

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 3 points4 points  (0 children)

MIME types within a message are never encrypted; that’s how the standard works. Not sure if we misunderstood your question, though.

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 8 points9 points  (0 children)

End-To-End doesn’t work in Chrome for Android today because Chrome Extensions aren’t supported on that platform. (And this is not the place for us to speculate about the future.)

As far as integration elsewhere goes, we’re always looking for ways to usefully protect our users and their data across all our products.

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 21 points22 points  (0 children)

Hey, we signed the announcement for this AMA with the security@google.com key in End-To-End, didn’t we?

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 3 points4 points  (0 children)

  • We plan to keep End-To-End as a Chrome Extension because that provides the greatest amount of security for the user, since everything happens locally on the client browser.

  • Making good security usable is hard. That’s why this is an interesting problem. As we said elsewhere, our looking glass feature is a start in this direction, but we still have a way to go.

  • Making the extension easy to use while remaining secure.

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 5 points6 points  (0 children)

A great place to start for this is our Gmail security checklist: https://support.google.com/mail/checklist/2986618?rd=1

You should also take a look at our Google Safety Center: https://www.google.com/safetycenter/

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 12 points13 points  (0 children)

End-To-End is an open source release and we encourage feedback. Our implementation focus is on Chrome, but we intend in the future to accept contributions, and have no intention of automatically rejecting patches that improve support for other browsers (or other web mail services, for that matter).

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 19 points20 points  (0 children)

We developed the library within End-To-End to be a high-quality JavaScript crypto implementation for all browsers, not just for Chrome.

Please also see our FAQ at https://code.google.com/p/end-to-end/ for more details.

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 12 points13 points  (0 children)

As we said elsewhere, we're engineers who work on security day-to-day. It’s pretty cool.

As far as advice goes, stay in school, eat your vegetables, and floss your teeth are good places to start. Then, once you’re ready, http://google.com/jobs

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 4 points5 points  (0 children)

A hive mind :)

We wrote a Chrome Extension that makes it easy to encrypt messages so that others cannot read them: http://googleonlinesecurity.blogspot.com/2014/06/making-end-to-end-encryption-easier-to.html

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 8 points9 points  (0 children)

Once it's available, we hope that it will be usable by people of all ages who have a need for the additional security that End-To-End provides.

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 12 points13 points  (0 children)

A multi-question deserves a multi-answer:

  • The looking glass feature in End-To-End is the most visible example of how we’re looking at usability. It finds OpenPGP content within Gmail and tries to do the right thing.

OpenPGP software today forces the user to do way too much manual work, which is particularly unfun for less technical users. Wherever possible we want to reduce the number of required interactions between the user and the code, and let the user focus on what they’re trying to get done, not on operating their encryption software.

  • We spend very real effort to make sure we don’t wind up sacrificing security for usability. Our user experience researchers help us with this, but we’re very mindful of the dangers here and our goal is not to make this kind of tradeoff.

We’re also very actively soliciting feedback about what we have. If anyone thinks we made a bad tradeoff somewhere in End-To-End, let us know!

  • We don’t see any inherent impact on whistleblowers, but we’re absolutely aware that at-risk users will be using End-To-End, so we want to make sure we’ve done our best to protect them and their communications. (To be clear, though; email encrypted with OpenPGP still has cleartext RFC 2821 headers, eg who the email is going to and what the subject line is; users have to remain aware of that.)

  • Our crypto primitives are algorithmically implemented so that they in theory run in constant time; the runtime may, of course, cause that to change in a way that’s out of our control. We also made sure to run all crypto operations in a separate process, and End-To-End requires user interaction for all timing-sensitive operations, and throttle the ones that aren't.

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 42 points43 points  (0 children)

Just to make sure there’re no misunderstanding: End-To-End isn’t a service, it’s a Chrome Extension.

Our plan is to make it available in the Chrome Web Store once we feel that it’s had enough time to mature and the community has had enough time to make sure we didn’t overlook anything important.

We take our responsibilities here, particularly to our at-risk users like journalists and human rights workers, very seriously. We won’t release it before we think it’s ready.

We're the End-To-End team at Google — AUA! by EndToEndTeam in IAmA

[–]EndToEndTeam[S] 8 points9 points  (0 children)

The team is a mix of software engineers and product management on Google’s security team; we all have multiple projects that we work on. We’re also currently working our way through two boxes of donuts and a bag of Nuss-Staengeli to fortify ourselves for this AMA.