Google Did Snag Passwords

I was sick of this story months ago, but...: It's significant when a search engine that already knows everything about us apparently unintentionally learns even more. Google earlier discovered, disclosed, and had third parties audit its collection of unencrypted data broadcast publicly over Wi-Fi while taking photos for its Street View images.

One might expect this would contain password, private information, and email, and Google said today its audits revealed that it did: "It’s clear from those inspections that while most of the data is fragmentary, in some instances entire emails and URLs were captured, as well as passwords," wrote a senior VP on the Google blog.

My reaction? If you're not using an encrypted connection to read email and you're not protecting your Wi-Fi link, then Google accidentally snagging some of your data is the least of your worries.

This is harsh, of course. The majority of users worldwide don't know how to secure their systems and data, nor should they. Operating systems developers, equipment makers, and ISPs have significantly improved basic encryption capabilities so that it's much easier and more likely a user with no special knowledge, after following setup steps, will have a secure link in place.

Take the simple matter of adding an email account to a mail client. In the olden days (say, 2007 and earlier), mail programs asked you to punch in details and connected only to servers and in methods you checked. A few systems and programs offered wizards to set up IMAP and SSL/TLS and authenticated SMTP and so forth, but ISPs were loathe to give everyone security service—too costly from an infrastructure standpoint.

That's changed. When I use nearly any program, host, or hardware to initiate some kind of connection, I am urged and sometimes hectored to use security, and often automagically taken into a secure realm. The iOS that powers the iPhone and iPad asks for email host details first, and then, invisibly, runs through a number of tests to see if it can establish one of several methods of SSL/TLS setups. If it can, it does. If not, it reverts to plain text, but also lets you modify the setup later.

Encryption is increasingly becoming the default. Google's "accident" should drive more people into figuring out how to solve their lack of security retroactively.

Google Permanently Halts Street View Wi-Fi Collection