Google Plans Service to Store Users' Data Online

achillean wrote this morning with a link to the Wall Street Journal, announcing plans we've all seen coming for a while: an online data storage service from Google. Though the article doesn't come out and call the project 'gDrive' or anything like that, it does indicate the service could be available within the next few months. "Google's push underlines a shift in how businesses and consumers approach computing. They are increasingly using the Web to access applications and files stored in massive computer data centers operated by tech companies such as Salesforce.com Inc., Microsoft Corp. and Google. Such arrangements, made possible by high-speed Internet connections between homes, offices and data centers, aim to ease users' technology headaches and, in some cases, cut their costs."

Everything old is new again

a strategy that could accelerate a shift to Web-based computing doesn't this sound just a little bit like a dumb terminal in terms of computing?

Upload

Once installed, you upload your files by right clicking on them and selecting "I'm feeling lucky".

This sounds fun

first thing I'm going to put up there is personal information to others. Any bets for how long till they are compromised?

Call Me Paranoid

In an age of sealed warrants, if the government even bothers with that, why would anyone put their data out of their sight? When it comes to privacy, I cannot see how the benefits outweigh the risks.

AES security and crypto in general

As the old saying goes, if you count on crypto to solve all your problems you don't understand crypto and you don't understand your problems.

The point that your data can and will be attacked while it's in plaintext is well taken. A networked machine running a web browser (the Sendmail of the 21st century) is a low security device, even with a good operating system. Google for "Scarfo", the mobster who was using PGP but also had an FBI keylogger on his computer.

As regards AES, though, we've got good reason to think it's resistant to cryptanalysis. The NSA is also in charge of protecting government secrets from foreign snoops and has approved AES for protecting classified data.

The low security of a workstation cuts both ways in an argument about gDrive: because your data is already at risk sitting on your hard drive, storing it encrypted on gDrive might not be any worse.

Security without threat modeling is like bricks without straw. What are we protecting data against? Loss, primarily. I trust Google's backups more than I trust mine (but I'd tell a client to look for a provider willing to sign an SLA). Unauthorized copying by crackers? AES should be an adequate control to cover that risk. Subpoenas? An attorney with two brain cells to rub together will subpoena the decryption keys, so no help from AES there. Vacuum-cleaner style mass government surveillance, looking for keywords like "Tibet" or "Falun Gong"? AES should prevent that. Government criminal investigation? You could (in the US) argue that surrendering the keys would be self-incrimination and end up paying a lawyer lots of money to argue the point for years. Expensive and undependable security, but then in a criminal investigation there's not much security difference between gDrive and your local machine anyway.

If you have security needs you should do an analysis like that last paragraph, only longer. For lots of people encrypted files on gDrive might be just fine.

Underground storage

Methinks this trend will create a network of vast underground datacenters so large that archaeologists of the distant future will be left wondering whether we were created by metallic silicon creatures.

Forever in Beta

Though the article doesn't come out and call the project 'gDrive' or anything like that...

Ofcourse, it'll be gDrive Beta.

Filesystem over IMAP.

Fudge, I had just started to write a virtual filesystem driver using IMAP as a back-end. (Not fast, but gmail's 5.2G is free.)

Oh well, I'll put it on the back-burner until I hear more.

Useless to me w/Rogers

Unless Google can lobby Rogers to get rid of its arcane practice of capping usage at 60GB / month for it's standard high speed, me, and around 50% of people in Canada with high speed internet, can not make any real use of this service.

It is pretty sad that a company will give you a nice 6 Mbps link only to cap you at 60 GB, which you could exceed in only 1 day of saturating your link.

possibilities

As a recent convert to google apps, this is very interesting. I have/still have all the concerns about my privacy, but the offering was too tempting to pass up. Of course I use the Firefox Customize Google add on, but also don't really put anything sensitive up there. If they build it right, it could be very nice. I've tried all the online backup apps, and outside of Mozy, don't really like any that much. But I'm now all Linux, so Mozy is no longer an option. Anything that competes with Microsoft is a good thing!

BS Post

Storin' those data
To network platta
Drive image good
As face image could
Burma Shave

Thin client

Thin client computing is on its way back - like it or not.

Though nothing new, this is a great idea who's time has finally come - particularly for people with mobile devices connected to wifi hotspots - both of which Google has been investing in.

Amazon S3

I already do this a bit with Amazon's S3 storage system. It is really nice being able to store files anywhere and paying all of $0.03/month for it.

But hey, I'll take free any day.

On a somewhat related note: It would be great if Google bought the LexisNexus people. Having public access to their database would be a great public service.

User-centric Encryption needed

Google needs to incorporate encryption with keys totally held and managed by the end user in such a way that even if Google is subpoenaed or shown national security papers, Google would be technically unable to access end-user's data. Another words, at no time should Google have access to any of the user's cleartext nor the user's secret key. Decryption would all be client-side. A subpoena or national security letter would have to go directly to the end user who would then at least know they are being served.

Re:User-centric Encryption needed

Not gonna happen.

Their business is advertising.

So, they will be reading through your documents so they can put up some ads when you are browsing your files online. Putting your home finance excel sheet to gDrive? Be prepared to see TaxPlanner ads on the sidebar. Putting your holiday photos to gDrive for backup purposes? They'll probably go through the EXIF data and send you ads about latest Canon products (or whatever your camera model is).

Encryption method?

What kind of encryption would you use for this?

The most secure would be to store a single large archive of all your files encrypted with a strong cipher, but that has the disadvantage that you have to download it all to decipher it.

Alternatively you could encrypt each file separately, which would speed up access considerably, but also leak more information about what you are storing (i.e many small files vs one big one ).

I guess if the data is sensitive enough to require the former type of encryption you shouldn't transmit it over insecure connections to begin with...

A very old idea

This shouldn't be a surprise to anyone. It's Google, and it's one of the oldest ideas on the Internet which they haven't yet done; before the dot-com bubble burst there were at least half a dozen sites that claimed to provide an online "drive" of sorts - X-drive and E-drive are ones that come to mind, I think they advertised on the radio. Going further back, I remember using an online storage service on CompuServe in 1995 or so.

TrueCrypt support would be tasty!

Hmm, if Google's encryption plans are lacking, how about a mountable GDrive in TrueCrypt, popping up as a partition with the traditional encryption methods of TrueCrypt? :-D

:-------D

OK, so that was last part was really unnecessary, but still...!

So not smart.

I really hope I'm not the only one that doesn't believe it's too smart a move for anyone to store all their data in a place that they can't physically access.

Isn't this taking a step back?

I love Google, don't get me wrong, but isn't this a step back? Privacy would be another concern. I think I'll just keep sticking my data on my home Terabyte NAS so I can keep it semi private.

Name Suggestion

I suggest calling it gPorn, because you know that's what's going to be on there.

android

I imagine this will be a big part of the android platform. Any android device can be a 'dumb' terminal for your data. Let's just hope it's encrypted for the sake of the people that will inevitably place sensitive data on their 'g-drive' via their phones.

Re:android

Any android device can be a 'dumb' terminal for your data.

Excuse the necessary pedantry, but do you realise that something cannot be a "dumb terminal for data", and that it's quite an insensible way to formulate it regardless of what the term "dumb terminal" actually means? Are you aware of the fact that "dumb terminals" involve remote processing, and not mere access to remote data? I just had to clarify this, as people keep talking about dumb terminals and thin clients as it actually has little to do with the topic at hand.

So how is mass remote sata storage

any easier and safer then buying and external HD for $120 or less and sticking it into your USB port? I'd trust a corporation with my own data as much as I'd trust a crack head to hold my ball of coke while I tie my shoes.

Some say well you can access your data anywhere! What data? Your financial data? Health Data? I sure as hell wouldn't trust anyone but the party thats needs that data with keeping it private/safe. If its online its gonna get snooped on eventually.

The new P2G2P

So anyone will be able to take the latest movie, upload it to a google account, and give the password in a forum.

It's like P2P but Google pays the uploading bandwidth!

You could even use the movie name for the account:

0000000000-MoviesAhoy-TheMatrix
0000000001-MoviesAhoy-Slashdot, the movie
0000000002-MoviesAhoy-Pr0n (1) ...
0003814661-MoviesAhoy-Pr0n (3814660)

I don't get it

Haven't we the public shown that we don't want our data online this way? And they pursue it anyway. You hear all of these reports about Google becoming the next Microsoft. This sounds very Microsoftish.

All your data are belong to us.

...someone had to say it.

Already Done it;s called Amazon S3

Amazon has been doing this for ages - very well I might add. What does Google bring to the party. Advertising? Big whoop. I like the privacy of my data. I don't want Google scanning my data as it scans my email. That's taking things just too far. What next? Google coming around to my house to check my desk draws.....?

Web based applications

Google's push underlines a shift in how businesses and consumers approach computing. They are increasingly using the Web to access applications and files stored in massive computer data centers operated by tech companies such as Salesforce.com Inc., Microsoft Corp. and Google

We've been hearing this prediction for 5 years now and it annoys me when someone makes it. Yes for for small businesses and home users, using online word processors, spreadsheets etc. makes sense as you don't have to worry about backup and you can share them. For medium sized businesses upwards it makes no sense at all. If your internet connection is lost, your business is screwed. For law firms for example, this can cost millions per day or even hour. There's also the usual issues about privacy and storage with 3rd parties.

In the heartland?

http://www.desmoinesregister.com/apps/pbcs.dll/article?AID=2007711260321 [desmoinesregister.com]

I wonder if they'll blame lost data on phishing?

...like they do for Gmail users losing data? Google, the first step is admitting you have a problem....

Disappearing Gmail messages baffle users [computerworld.com]

Your position on this belies your experience

Ever notice how the techies almost always rail against remote storage while the normal computer users think it is a great idea ?

What is really interesting is that Google could, in theory, link duplicate files. For example if 10,000 people have the Will Farrel "SNL/Blue Oyster Cult" video in their storage area, Google could soft link to just one copy and break the link if one particular user ever edited it.

What's the problem

... with them searching your files for advertising keywords? They already do it with the search engine every time you use it. At least if they looked at your stuff and saw you solved, say the Theory of Everything, they'd know when you searched for "Nobel Prize" to give you ads for airline tickets to, and hotels in, Stockholm, rather than ads for buying a Nobel Prize on eBay.

If you want to stuff your pr0n or plans for a dirty bomb on their servers, an obscure compression technique (say the old Apple II ShrinkIt NuFX) after having converted your file to a UUencoded text file, will probably foil their attempts. A couple more such twists, and you'd foil the NSA much less Google.

Re:Recomendation to dissidents

If Google is intending this service for online storage of personal information, I don't think it's going to succeed... people use Facebook for that sort of thing.

Re:Recomendation to dissidents

On the contrary.

I've long been planning to put my most personal and important data on Google's servers, using the already existing gmailfs. Using good encryption, of course, which you really should use on local storage as well, if there's even a slight chance that it might get physically stolen.

Using this would give me a very cheap (actually free) off-site backup, so I know I can still retrieve my stuff even if my house burns down, or if RIAA sends the police to get my computers...

Re:Recomendation to dissidents

second dupe.
and it's already been done- 1GB of storage on Gmail? This is why Zonk is unchecked in my "show stories from" dialog.