How many customers are using Google Password Manager? How much revenue does it generate? What would it cost to add E2EE? How would it affect the UX? How much revenue would it generate? What projects would have to be de-prioritized to fund this work?
I agree, a password manager without E2EE is unusable in my eyes. However, I can also understand the institutional reasons this might be the case. I don't think it reflects an organizational aversion to E2EE.
Google Password Manager does in fact have E2EE. It's quite straightforward to enable. Your interlocutor is complaining that it's not the default, which I'm quite sure is a deliberate decision made on the grounds that the typical user, the one for whom the default matters because they won't tweak their settings, needs workable account recovery more than they need defense against the specific kinds of security threats that make E2EE relevant.
LastPass, designed for regular users and one of the most popular password managers, had a breach of user vaults. If they hadn't implemented E2EE then it would have been more devastating than it was (crypto wallets were found from vaults with weak master passwords).
Google's security record at avoiding that kind of breach is just about the best in the industry, and their system that handles custody of password manager secrets is designed to withstand even a compromise of their production infrastructure (https://security.googleblog.com/2022/10/SecurityofPasskeysin...). I would advise almost all users to worry more about getting locked out of their password database than about that. Of course, I would also advise almost all users not to self-custody cryptocurrency.
Your link is about them using E2EE not that they can be as secure as E2EE for users without it. Users would lose their passkeys if they lost all secrets and devices. Google couldn't recover them.
They can still and should still continue using great security practices while protecting E2EE data.
>Of course, I would also advise almost all users not to self-custody cryptocurrency.
There's no point in crypto if you're not holding your own keys. It's the antithesis of cryptocurrency. People can have highly secure self custody wallets on a modern iPhone or Pixel. And their seeds would have been safe if LastPass didn't have terrible security or they used long passphrases.
Suppose that we eliminate net neutrality. Further suppose that, in a few years, I start a video streaming service called "Notflix".
Because ISPs are no longer required to be dumb pipes, they've started charging their customers a premium for access to video content. This is bad for Netflix, of course, because it cuts into their subscriber base.
They crunch some numbers and come up with an amount they're willing to pay the ISPs to exclude their subscribers from this segmented pricing scheme. The ISPs accept this mutually beneficial deal, and everyone's happy, right?
What about Notflix, though? We don't have the capital that Netflix has to pay into this protection racket, so our subscribers must choose between paying the ISP video premium + our subscription fee, or Netflix's subscription fee.
That's an uphill battle and straightforwardly anti-competitive, but is also the precisely the promise of a world without net neutrality.
I also disagree with your assessment that anybody is subsidizing internet giants. All those players pay for the bandwidth they consume to dump their data into the network. The end-user pays for the other end of the connection. Everything is being paid for, proportionally to the usage.
The last-mile ISPs simply want to double-dip. Comcast thinks Netflix should pay both Level 3 AND Comcast for using the pipes, which fundamentally undermines the architecture of the internet.
>I also disagree with your assessment that anybody is subsidizing internet giants. All those players pay for the bandwidth they consume to dump their data into the network. The end-user pays for the other end of the connection. Everything is being paid for, proportionally to the usage.
I know very little about the situation, hence the naive question, that statement was based off all the websites like reddit putting up fake pay walls to show what things would be like without net neutrality.
IANAL and I don't have an answer to this, but I would be deeply alarmed if this were the case. I can understand them making the case that anything on your personal is searchable (though I disagree that this should be allowed).
By asking you to sign in and sync, they're not just requesting access to information on your person -- that's an enormous expansion of their search powers.
The FCC’s regulations weren’t about protecting consumers’ privacy. They were about government picking winners and losers in the marketplace. If two online companies have access to the same data about your Internet usage, why should the federal government give one company greater leeway to use it than the other?
1. Is he implying that the previous FCC was intentionally boosting content providers over ISPs? What motivation would they even have for doing this?
2. Content providers and ISPs do not directly compete with each other in the course of their primary business, so in what respect does the rule create winners and losers in the marketplace?
I suppose he could mean in the advertising marketplace. I guess I would prefer that both Facebook and Comcast be losers in that marketplace though.
3. Two online companies do not have access to the same data. Facebook has data + metadata for any interaction you have with their platform. Your ISP has metadata for interactions you have with any platform, along with data for any plaintext interactions. This is a massive difference in scale.
Users have the choice not to use Facebook, and thus not provide them with data. Users do not have the choice to access the internet without making use of a public utility (i.e. their ISP).
He cites an expert saying:
Rather, the most commercially valuable information about online users . . . is coming from other contexts,” such as social-media interactions and search terms.
I can see how user-shared data might be considered more commercially valuable, but this misses the point about the differences in the kinds of data we are talking about. When someone publishes on social media, they're making an explicit choice to share information with the public.
When that same person visits a website, it is not commonly understood that this act might reveal personal information (though end-users ought to be more aware of this). Consider a teenager doing research on pregnancy tests -- they do not intentionally publish information, but the metadata (webpages visited, time of visits, etc) is potentially revealing.
I primarily write python web-based APIs for a web application + 2 mobile apps. Just the other day, I was dealing with an endpoint that had to update hierarchical data (i.e. a collection of trees).
Due to the circumstances, normalization wasn't an efficient option. I ended up throwing together a barebones tree with a 5-line DFS implementation to traverse it. It handled inserts, updates and deletions (for my use-case) in linear time.
The details aren't so important as the fact that adding a dependency would have been overkill for my needs. This isn't to say that efficient graph implementation libraries should not exist or be used, but I was able to produce this code faster by having that basic CS knowledge.
And because your code was implemented in python (rather than use prebuilt libraries that call back to C) it was 100x slower than it should have been. Im all for knowing the fundamentals but there is a strong argument for knowing the right tool for the job.
re: the debate between Python being slower and C faster, it all depends on context. If the context is "this is going to be called multiple times for every transaction" then yeah, look into recoding it. If the context is "this is going to be called for this particular edge case and may execute 10 times a week and take an extra 3 seconds each time" then there are more productive places to put your energy.
At the level of programming that the grandparent is talking about, I'd accept the judgement of the programmer working on it as to the appropriate solution.
I write python professionally and I use vim exclusively, but I have pylint + jedi plugins and could not imagine working without them.
I'm also not convinced that depriving new programmers of real-time syntax checking actually helps them learn. Wouldn't immediate feedback help them memorize the correct syntax?
I learned working with Visual Studio and, yes, I think that helped. Even jsut being able to press "." and see what methods and properties were publicly available on something was helpful
I must be slow today. I had to read this comment to know what a fast idiot is. I too work with fast idiots. But now I'm slightly embarrassed. Time for more coffee I think.
1. FDR did not propose a wage cap until 1942, 3 years after the Great Depression had ended. It was a temporary wartime fundraising effort (and was quite popular with the public). In fact, health insurance really first came into existence during the Great Depression (mostly to ensure physicians and hospitals got paid).
2. FDR's wage cap did not pass.
What actually happened was the passing of the the Stabilization Act of 1942, which gave FDR a power (that he invoked) to freeze wages and salaries during the war. The freeze was deeply unpopular with the labor movement, who threatened mass strikes. As a compromise, congress exempted health insurance (and other benefits like PTO and pensions) from the freeze.
This was certainly a contributing factor (proportion of US population with healthcare roughly doubled from 1940 to 1945), but ignores the other factors that prompted the rise of employer sponsored healthcare. Indeed, by 1945, less than a quarter of Americans had health insurance.
Rather, the two largest contributors to employer-sponsored health insurance was the demand of health coverage by labor unions and the 1954 legislative change that made health insurance tax exempt.
> The Electrician was functioning as an Electrician, not as a government agent.
I don't think your example vindicates Best Buy, but rather, simply repeats the central question of the case: was the Geek Squad employee simply functioning as a Geek Squad employee?
The prosecution has argued that an employee who happens to stumble on images of child pornography (analogous to your electrician stumbling on a drug lab) is not acting as an agent of the government. I'm inclined to agree with that judgement.
On the other hand, if the employee was conducting extra thorough searches, scrutinizing the files on any customer storage media, or otherwise performing surveillance tasks that had nothing to do with his job, then it seems apparent that the employee was acting as an agent of the law in accordance with a financial incentive from the FBI. It doesn't help, in this case, that the employee lied about having been compensated by the FBI.
Ultimately, this particular case will come down to the details of how and why the employee stumbled across these images. As a general principle, however, it seems wrong to me that any computer in for miscellaneous repairs (touchpad/screen replacement, battery refurbish, etc) should be subject to a search for illegal data pursuant to an FBI incentives program.
I agree, a password manager without E2EE is unusable in my eyes. However, I can also understand the institutional reasons this might be the case. I don't think it reflects an organizational aversion to E2EE.