Google promises better Wave security

Google admits security for its Wave collaboration tool is currently minimal, but promises to bolster its defenses to ready it for enterprise users.

Google's online collaboration protocol Wave has been fairly minimal when it comes to security options, but the search giant is promising improvements in 2010 that will make it more appealing for enterprise users.

The Wave protocol, launched by Google in September 2009, is designed to allow multimedia collaboration and real-time editing within a web environment. Users can chat in real time (and even see responses as they are being typed), but also incorporate other document types, and "replay" waves to see changes and edits made by others.

Currently, the vast majority of people experimenting with the Wave protocol are doing so on Google's own servers. "We've sent out several million invitations and we've seen more than a million active users," Google Wave project manager Dan Peterson said during a presentation at in Wellington last week.

However, Google wants to encourage developers to incorporate the Wave protocol into their own communications systems, just as email is supported by a wide range of servers and clients which can interoperate with each other.

"Google is going to rely on the independent wave for its own growth," developer James Purser noted at the conference. "People will be using the protocol and building on it. "Evolution of the independent wave allows a more rapid evolution of the original wave idea."

One major barrier to corporate adoption of Wave (and to that expanded product rollout) has been a fairly minimal security approach. Because the emphasis in the first version of the product was on making collaboration easy, it also incorporated minimal means of protecting content within an individual wave.

The first sign of that change last week when Google introduced the ability to add rudimentary user permissions to waves. Individual waves can now be set as "read-only", but that permission doesn't extended to components of the wave, a potentially useful feature if (for example) three items on a five-point agenda have been settled but two remain up for discussion.

More problematically, there's still no ability to permanently remove content, an omission Peterson said will eventually be rectified, but one for which Google is reluctant to provide a time frame. "You need to be able to delete things," he said. "That's really the whole of the answer at this stage. We don't have delete but we need to be able to do that."

Google is also still working out how to effectively secure robots and gadgets, which can perform a wide range of operations on individual Waves (such as translating and reformatting). While this is very helpful in automation, a poorly-designed bot could accidentally ruin large amounts of data, while a deliberately malicious bot could be even more problematic.

"What do you do with a malicious agent?" Purser asked, noting this would become a a much greater problem as the platform expanded. "Only App Engine bots are allowed now, but remote agents will happen eventually. They can really make or break Wave. Too many bad bots, and people won't use it."

For now, Google's approach to that issue is focused on developer education rather than changing the technology itself. "What we're trying to do is teach people not to write bad robots," said Google developer relations staffer Pamela Fox. "A lot of people are accidentally running malicious robots." Google may eventually develop a blacklist for problematic robots, Fox said.

Read more on Security policy and user awareness