[jjnoakes]

You don't think Google could correlate the two?

Google knows device A got messages at times X, Y, and Z, and device B got messages at times X+1, Y+2, and Z+1.5.

I'd be willing to bet with some statistical analysis over time, some pretty interesting data could be mined from that raw knowledge.

[tptacek]

Why don't they know that anyways from basic traffic analysis?

[jjnoakes]

This topic was about GCM specifically, which, since it goes through Google servers (unlike, say, my arbitrary browsing, or the network profile of my arbitrary apps), is directly available to Google.

Speculating that Google may have access to my full network profile is a little off-topic, but yeah, if they did have that data, they could certainly do similar analysis on it.

Did anyone say they couldn't?

[tptacek]

So is the answer "there is nothing that GCM is revealing that NSA doesn't already get from simple traffic analysis"?

[jjnoakes]

The answer is "GCM may reveal more to Google than one would expect from using an E2E encryption application (like metadata, and more than one would initially assume)".

The person I initially replied to was talking about Google, GCM, E2E encryption, and that metadata won't reveal anything to Google except time/date of a single message and the message size. I pointed out there may be more information there.

I have no doubt that the NSA can do traffic analysis, or may have some of this data already... I'm not sure why that is in the replies to my comments in this thread.

[tptacek]

That's only a meaningful answer if simple traffic behavior wasn't already revealing the same information. Was it, or wasn't it? I feel like I'm having a hard time getting a straight answer.

[jjnoakes]

Does Google already have simple traffic behavior? If yes, then this information is nothing new to Google. If no, then this information may be new to Google.

Form a straight question and you'll get a straight answer.

[pureIDEOLOGY]

More worried about NSA correlating the two after getting the data from Google, but the one good thing about their centralization model probably is that with millions of users to a central server (and something you do as often as texting) this makes timing analysis extremely difficult.

[jjnoakes]

I have no data to back this up, but I bet patterns would reveal much more than you would intuitively think.