Oi, Google, you ate all our Wi-Fi keys - don't let the spooks gobble them too

Privacy experts have urged Google to allow Android users' to encrypt their backups in the wake of the NSA PRISM surveillance flap.

NSA PRISM surveillance flap

The useful "back up my data" option in Google's Android operating system sends a lot of private information from fandroids' devices to Google's cloud storage service. Such sensitive data includes wireless network passwords, application files and configuration settings.

These backed-up bytes are probably stored in an encrypted form on the advertising giant's servers. However, if it is encrypted, then it's Google that has the decryption keys, not the person or organisation that owns the data. As such, the information is vulnerable to secret demands from government agents and cops for that data.

Oi, Google, you ate all our Wi-Fi keys - don't let the spooks gobble them too | The Register

Android and its password problems open doors for spies

Android password problems

The data stored on Google servers when the "Back up my data" option is selected on an Android device includes Wi-Fi passwords in plain text format. This is not in itself news, but businesses in particular may wish to reconsider its implications in the light of the latest surveillance scandal.

The backup function is, at least on Nexus devices, activated by default, with no password of any kind required for the service. In Google's favour, it has to be said that it does make it clear what users are letting themselves in for, with the description of this function stating "Back up ... Wi-Fi passwords ... to Google servers". Tests by The H's associates at heise Security showed that after resetting an Android phone to factory settings and then synchronising with a Google account, the device was immediately able to connect to a heise test network secured using WPA2. Anyone with access to a Google account therefore has access to its Wi-Fi passwords.

Android and its password problems open doors for spies | The H Security