[brudgers]

Encrypt the data on the device. Backup encrypted version in the cloud. Download encrypted backup to new device. Unencrypt on new device. Merge versions on the device.

No need for plaintext on Google servers. No way for monetization by Google.

Or to put my alternative another way, how much is a data set mapping WiFi passwords to networks for the city of Bejing worth to a foreign intelligence agency or other state-level actor? An answer in terms of dollars or 1000 clicks is equally acceptable.

As an alternative, how much is such a data set for Redmond worth to Google?

For extra credit, determine the value of each data set if includes historic data on password changes, changes to the individual password repositories of each user, and changes to the densities of WiFi networks at specific locations.

In the end, it comes down to money in Google's bank account, not delighting users (see Reader). Since Google does not directly profit from the sale of nearly all Android devices, the burden for the thesis of delight is to show an alternative mechanism by which Google directly profits from the plain text storage of passwords.

[jsnell]

You're providing innuendo and "exercises for the reader", not an argument. That's pretty weak.

What would such a data set of Redmond be worth to Google? Nothing. Because accessing those networks for industrial espionage (if I read your innuendo right) would be illegal and immoral. It would drag Google's name in the mud, lose them customers, credibility, and most likely a decent chunk of talented employees. The liabilities would be massive. And what's the gain? I don't know what you think it would be, but it'd have to be pretty damn valuable to outweigh the potential costs.

As for monetization... Android is a moat. The way things are going, whoever controls the client operating system controls the default web browser and the default web search. This is an existential threat to Google. Microsoft winning the mobile OS war would soon make Bing the leading search engine. Apple conclusively winning would allow them to charge monopoly rents on access to the users.

It's like Google Toolbar back in the day. It's possible it provided some information about user behavior. But the real value came in that it added a visible Google search box into IE.

[brudgers]

I look at the money.

Google made $10 billion last year.

In a cyber-war, how much would the Kremlin pay to disrupt every Chinese WiFi network to which an Android device has a current password?

In a shooting war, how much would the US pay? Keep in mind that the modern battlefield increasingly uses ordinary data devices particularly in counter-insurgency operations.

Jim McDonnell, Donald Douglas, Jack Northrup and Leroy Grumman did not start out as defense contractors. They diversified their corporations when voluntarily seizing the opportunity was a good alternative to the threat of compulsion during the Second World War.

This may in fact be the one time that the rules are different. But there's very little historical precedent upon which to premise such a belief. GM produces military vehicles. Westinghouse and GE produce powerplants for ballistic missile submarines.

[edit] The question of how plaintext leads directly to Google profits remains unaddressed. It is not as if Android users can recover their passwords by calling up Google customer service. On the other hand, storing passwords in plain text is usually a decision made to facilitate requests from a company's customers. Asking who constitutes Google's customers is a reasonable place to start when inferring motives.[/edit]

[mik3y]

  I look at the money.

  In a cyber-war, how much would the Kremlin pay to
  disrupt every Chinese WiFi network to which an Android 
  device has a current password?

Do you think Larry Page can be bought?

I'm serious: You need to consider the way Google is run before deciding if any of these theories are plausible.

This is a company which has a history of spurning money-making opportunities in favor of some higher ideal (often times to the chagrin of business-minded types within the company). To give a few examples: Licensing Android, complying with China, accepting paid placements, etc.

You can argue each of those decisions was actually more profitable for Google in the end. And that's the point: Google would not make $10B next year if they sold out their users to the Kremlin this year.

[brudgers]

My opinion about Larry Page's price is that it depends upon who is buying and what they are offering. An offer similar to one from the Kremlin which is easy to refuse might be one he cannot refuse from Fort Meade.

But lest my meaning is misunderstood, an offer from Fort Meade might be one Mr. Page gladly accepts as a US national - I certainly have no more reason to question his patriotism than to believe it to be partisan in the extreme.

Even removing patriotism from the equation, developing and maintaining good relations with governments and their agencies involved across national borders probably makes sound business sense for a company of Google's size. And I have little doubt that Mr. Page places substantial value on international business opportunities.

[mullingitover]

> Do you think Larry Page can be bought?

Absolutely. His price is letting him remain a billionaire. I'm of the opinion that most billionaires would sell their own mothers to organ harvesters if failure to do so would result in them becoming poor.

[baq]

...but the NSA most likely has access to this data right now, for free.

[philsnow]

> Setting up a password for an Android device only needs to be done once for each device->network pairing.

So you want _yet another_ password between the user and his magical experience or whatever ?

I see myself as a "privacy enthusiast", and even I recognize that wanting to encrypt wifi passwords in this way would only appeal to ~0.01% of android users.

You could argue that google could make this an option hidden under the three dots / context menu / whatever that thing is called, but there's probably much lower-hanging fruit than this.

[w0utert]

>> So you want _yet another_ password between the user and his magical experience or whatever ?

I find this a pretty weak objection. Do you really want to trade all your stored passwords for the convenience of not having to enter 1 additional password ('my Android backup password') once every one or two years when you activate a new or additional device?? I wonder how this objection rhymes with having logins on 20+ different websites?

While I don't believe that Google wants to harvest your WiFi passwords (but also don't rule it out), I also don't think it's all that paranoid to assume that Google deliberately chose to not encrypt backups by default, so they can extract useful information from Android device backups. Or do you still believe Android is 'free' because Google is a charity?

[philsnow]

You missed the central part of my argument, so I'll reiterate it here: users don't care about this stuff, and passwords are user-hostile. Google chose to implement this a certain way that works for 99.99% of people.

Now, in the 0.01% case, your counter argument still doesn't hold, in my opinion:

> Do you really want to trade all your stored passwords for the convenience of not having to enter 1 additional password ('my Android backup password')

Yes.

Even strong wifi passwords can be brute-forced within minutes from the curb by anybody with an unmarked van and a measly few GPUs. At this point in the technology race, wifi passwords are really just keeping the honest people out. If you want something stronger, you're going to have to go to machine certificates on each laptop / mobile device.

> once every one or two years when you activate a new or additional device??

Even worse, passwords that aren't used often exit my fingers' memory and are thus lost to time (unless I write them down and store them in my safe deposit box or keepassdroid or whatever, but "hardly anybody" does this, so Google would get phone calls from users every year or two saying "can you give me the password that I'm supposed to be using to keep from giving you my passwords? kthx").

[jordanthoms]

Can you give a source for that - I thought WPA2 AES was still quite secure, assuming you use a long random password?

[philsnow]

Ah, you're quite right, thanks for making me look this up.

I found some Toms Hardware article that goes into "a few GPUs in a desktop" all the way through "renting 20 machines with GPUs from EC2 for a while for <$20 USD", and it seems like a password that is long (>=12 characters for now), doesn't have dictionary words, and uses more than just [a-zA-Z0-9] will be safe from undedicated adversaries for a number of years (probably the life of whatever router you're using).

[archivator]

You could in theory salt the primary account password with a new salt, derive a key from it and use that to encrypt the password list (sending the salt alongside it). This of course implies that the plaintext password never hits Google's servers, which it probably does.

In general, I'm not sure this is a valid threat model. If you're not trusting Bob with your Wi-Fi passwords, why are you trusting him with everything else? If anyone compromises Google, there's far more valuable data on your account than the Wi-Fi list. Even if that's all they gain access to, it's pretty hard to exploit remotely. If someone is targeting you at this scale, you have bigger problems to worry about.

[HNaTTY]

Well I don't agree that there's far more valuable data than the ability to access my internal network. If my wifi network wasn't segregated from my wired network, by getting my wifi password you have bypassed my firewall, giving you access to my/my company's servers.

[archivator]

If someone has the resources to obtain your Wi-Fi password from Google and is determined enough to get within range of your network, you're being targeted by a very dedicated adversary. Things like physical security, TEMPEST and listening devices become valid concerns. This is a highly unlikely adversary for the majority of internet users.

Note that non-targeted attacks (the type that leak password lists) are not a serious threat here.

[kbenson]

That's not necessarily true. I imagine the data would most likely be targeted by a third party that's disinterested in you, but very interested in your adversary's money. I wonder what the going rate rate for all the WiFi passwords on my block would be. Or neighborhood. Or zip code.

[Groxx]

Decrypt encrypted backup on the new device how? What password / key would you use, and how would that be backed up / made known to the user, which it does not do now?

If it's a device password, enjoy re-encrypting if they change it. Or handling two device passwords.

If it's a user password, then how do you change encryption everywhere when they change their password? Only option there is to have Google decrypt and re-encrypt it and push it to every device, since otherwise you losing connection means corrupting your backup, at which point they have it in plaintext, no difference.