Comment Re:If you believe this (Score 2) 126
You need your head read. Google has shown time and again that it does not care about your security. There is no need to trade off convenience for security in cloud backup. Encrypt locally and send the data encrypted to backup. This would be great but i bet that Google also holds they keys and decrypts on their end. Google says it wouldn't be able to use your data for their massive data mining and information theft machine if it were properly encrypted. This is why the data sits on their servers unprotected by encryption, they are the antithesis of your guardians of security. If you value your data, turn off all Google services and manage your own backups.
There are two different threat models to consider. Device encryption protects against one, but not the other.
The purpose of device encryption is to protect your data from someone who obtains physical possession of it, because it was lost, stolen, confiscated, etc. The goal really isn't so much to protect it from law enforcement or the NSA -- if the NSA is interested in your data, they'll get it, period -- but against people who might want to, for example, steal your bank account information, etc.
Device encryption obviously does nothing to keep your data secret from someone you actively send the data to. If you have Google's backup services enabled on your phone, then it will back up a bunch of stuff. I don't know everything that's backed up, but I think Wifi configuration is, your list of apps are, the list of accounts on your phone, your contacts, and similar. Separately from device backup, you can also have the Google+ app upload your photos and videos automatically, and you can also configure the device to report your location, in various ways and for various services (there are several controls). Whatever you have backed up is (a) not protected by device encryption and (b) cannot be secure from whoever you backed it up to unless you have some sort of encryption key which the holder does not.
It's also clear that anything that is stored by Google and which isn't encrypted with some key not available to Google is also accessible to the US government and local law enforcement, assuming they have the legal right to demand it from Google. Device encryption does not do anything to defend against that. This is all obvious and not in dispute. It also doesn't make device encryption worthless, it just means that it defends against different threat.
Also, I have to say that from my perspective as a security engineer at Google you couldn't be more wrong about Google's concern for user security. Actually, if you look at the company's track record on security technology creation and deployment, I think that point is unarguable. Perhaps what you really meant to say is that Google doesn't care about your privacy, which is different from (but connected to) security. From my perspective, I think that's also wrong. It seems to me that what Google wants to do is to get your permission to make a trade, your data for targeted advertising in exchange for Google's services, and if you don't want that trade, Google wants to enable you to opt out of it (hence all of the opt out tools, privacy dashboard, etc.). Obviously, if Google is not careful to protect users' privacy, no one will be willing to make that trade, so Google is very, very careful.
(Disclaimer: I'm a Google engineer, but I'm speaking for myself, not in an official capacity.)