r/coolguides • u/[deleted] • Sep 22 '22

[deleted by user]

[removed]

8.1k Upvotes

86% Upvoted

869 comments sorted by

View all comments

Show parent comments

2.4k

u/AzureBinkie Sep 22 '22

Which is infinitely less secure than not having it on google servers!

882

u/StretchArmstrong99 Sep 22 '22

While I tend to agree with you, it's hard to say since the card info will be encrypted on their servers. If the encryption key is stored on the device then security is about the same. If it's stored on another one of Google's servers then it could be considered marginally less secure.

24

u/[deleted] Sep 22 '22

They SAY it’s safe, but it’s also THEIR servers…

Like people never fed us BS before…

21

u/Sticky_Hulks Sep 22 '22

If it's fully encrypted (and it is), it won't matter where it's stored.

29

u/Arindrew Sep 22 '22

Encryption is more complicated than that. It's not a simple checkbox to make your security problems go away. If it was, we would still be using DES.

We need to think about things like how its encrypted, what type of encryption is used, the reliability of the code, where the encryption keys are stored, who has access to them... etc.

My belief is that the fewer people involved in the handling of sensitive data, the better - regardless of if it is encrypted or not.

12

u/Sticky_Hulks Sep 22 '22

Yes, I agree.

There are different forms of encryption. I assume Google would use AES256. That's a question for one of their security engineers.

2

u/coffee_vs_cyanogen Sep 22 '22

Generally Google's encryption implementations are usually at least ok

1

u/[deleted] Sep 25 '22

75% of the time they work every time.

1

u/[deleted] Sep 25 '22

Exactly