So, how does Google, which we all trust with our precious data end up messing up like this several times in a row?
If this is the company with the best security team in the world does that mean we should simply abandon all hope?
If this is the company with the best security team in the world does that mean we should simply abandon all hope?
There was drama in the first instance because they didn't immediately disclose the bug. But disclosure of internally-discovered vulnerabilities in SAAS products isn't a norm. You see disclosure of bugs in consumer products, like the ones Apple issues, because they have to be disclosed to motivate end-user patching. That's not the case for serverside bugs, and you haven't heard about virtually any of the horrible vulnerabilities internal teams at tech companies have caught.
I think you are falling for Google's marketing efforts with a statement like this. Project Zero, where all the positive association around Google's security comes from has little to do with their product security. Their product security hasnt been so stellar, just look at Android. And don't forget the entire company was breached for a while without them knowing. Just trying to put things into perspective.
sadly, they are a bit limited by product strategy.
Unfortunately, Google (and Facebook) has a business model that depends on acquiring as much personal data as possible and keeping it forever.
There is also a difference between "having a team of the best security people" and "having an organization that is best at security" I suspect Google is much more the prior and very little of the latter.
tldr: don't use any Google services that have less than 1 billion monthly active users.
> We discovered this bug as part of our standard and ongoing testing procedures and fixed it within a week of it being introduced. No third party compromised our systems, and we have no evidence that the app developers that inadvertently had this access for six days were aware of it or misused it in any way.
Yeah, imagine how that can go at other "trustworhy" companies holding your personal and credit card data :(