Hacker News Reader

Comment by boulos | Hacker News Reader

Sure. Firebase runs on top of Google Cloud. So if you say use Firebase Functions, that's a "Google Cloud Service" in the diagram [1] in the article. Similarly, Firestore is also a "Google Cloud Service", so all requests to it (from say your Firebase Function) are encrypted as well.

Disclosure: I work on Google Cloud (but disclaimer: not on Firebase).

[1] https://cloud.google.com/images/security/whitepaper-transit-...

View on HN

Thanks @boulos. Appreciate it. I'm unclear on what encrypted at rest means. For example - I'd expect the data in Google cloud store to be encrypted (or have an option to be encrypted) so that if someone were to get access to our DB admin account, they won't be able to see the JSON data in plain text. The only way to see the data would be through API access which can be configured for ACL (and by Google cloud store so we can index and query data which is encrypted at rest).

Encryption at rest [1] protects against someone who has access to the encrypted bytes from not being able to decrypt it. That is, if someone got the raw bytes off our storage somehow, it's not useful to them. If someone has access to your account, then the storage system can't tell if it's you or not.

Data in Datastore (and Firestore fwiw, that needs an update) is encrypted at rest, and today's paper discusses how it's also encrypted in transit between your app and the service. I don't believe Datastore supports Customer Supplied Encryption Keys [2] (yet) but that lets you have a key that even Google can't decrypt the data without you providing it. That's a pretty good way to separate permission from keys.

Disclosure: I work on Google Cloud.

[1] https://cloud.google.com/security/encryption-at-rest/default... [2] https://cloud.google.com/security/encryption-at-rest/custome...

encrypted at rest here means that any data sitting on disk is encrypted. Probably ACLed to the service requiring it. For example, when bigquery writes to disk, it gets encrypted with a key that BQ only has access to.

Reply on news.ycombinator.com