Tag Info

Hot answers tagged

39

Google has access (obviously). The police will have access if they have a valid search warrant. A national security letter will give the FBI secret access. Various three-letter agencies may have access, depending on how they're doing at circumventing Google's encryption. (Google started encrypting its internal traffic after it was revealed that the NSA was ...


37

This is Brian Spector; I'm the CEO of CertiVox. Thanks for starting this discussion on PrivateSky, our secure information exchange service. I’ll do my best to answer the intelligent comments and criticisms on this thread. Second, I’ll try my best to walk the reader through step by step on how our integrated key management and two factor authentication ...


19

From a purely technical perspective, if you encrypt it properly before you upload it, and it stays encrypted all the time it is in the cloud, then the data is very safe. However, there are very probably extra levels of legal compliance you need to meet. This is "Personally Identifiable Information" and there are a lot of laws and regulations that apply to ...


18

Figure out the cost level where you start getting uncomfortable. Calculate the GB that would need to be transferred to reach that cost level. See if you think an attacker will be willing to spend that much effort to hurt you for that amount of money. Every time I run this calculation I end up thinking that if somebody hated me that much, they could ...


14

Amazon does have a Type II SAS 70 report. Requesting a detailed copy of that should show all the controls they have in place. It may that people are asking Amazon the wrong questions. As a quick note, the SAS 70 testing in the future will be referred to as an SOC -- one of those accounting industry quirks. Especially with an Amazon-sized company, one looks ...


13

This is a simple cost / benefit analysis, so it's a business question rather than a security one since you've already decided the merits of how to approach the security aspect. Write your code, benchmark it, and compare numbers in a spreadsheet. For the metal * Cost of metal * Cost per hour in terms of electric bill (assume under full load) * Budget for ...


13

Not instantly. Although, that's what I want to believe. What you could do is the following. Download the Truecrypt version 7.1a and create an encrypted storage file (option 1 from the wizard) and choose 3 algorithm based encryption with a SHA-512 key. Put all your sensitive files in here and upload the encrypted file to Google Drive. When you want to work ...


12

According to the white-paper they use SK-KEM, which is an identity-based encryption scheme. This explains why you do not need the public key of B in order to send an encrypted message to him (the email-address is the public key). Usually identity-based encryption relies on a trusted third party. So their claim that they cannot decrypt the messages ...


11

Anything which is encrypted with PBE (as in "Password Based Encryption") can be the subject of an offline dictionary attack (i.e.: the attacker tries potential passwords). This is a worry unless you have a super-strong password, which is not as easy as it can seem because you also have to remember it, and to type it regularly (if you note it down somewhere, ...


11

The most sensible approach is to assume you cant rely on their privacy - it isn't their responsibility, although there are some services whose selling point is securing this data. If you take that stance, as long as you encrypt all data before it goes to the cloud you can be safe (decide on what level of encryption you need in order to be safe) This ...


10

You'll never be able to know. You can however, exercise reasoning and logical judgement based on The company's ToS. The company's track record. Your trust of the company providing that service. The importance/value of the data handled by that service. Regarding password management; call me a little paranoid, but I really never trust any cloud service ...


10

I would say no its not suitable for storing criticial information, From the sound of their terms Google essentially owns everyting you upload as well as anything derivitive of your data as well. Here is an excerpt from the verge.com explaining the differences of the 3 major players, notice Google is very liberal with what they can do with your data. ...


9

There's an infinite amount of security issues with the cloud. To see a nasty laundry list, check out ENISA's documents.


9

Encrypting the data with the public key of each agent is a way to implicitly authenticate the agent. You do not really know (in a setup where communications go through a potentially malicious cloud) if the agent really received the data, but you know that only the proper agent could decrypt it; hence, if the data has gone somewhere at all, then it went to ...


9

It is already possible, via end-to-end voting systems like Helios to publicly store voted ballots in the cloud in an encrypted fashion, so that the public can add them up to confirm the totals, and to also check that their own vote was indeed included in the total. Without giving someone a 'receipt' that they can use to sell their vote. Surprising, but ...


9

There was been at least five issues reported over the past few months Problem with authentication, ie if you could access a hard disc that contained a dropbox folder you would have continuous access to their dropbox data Data stored in dropbox is accessible by dropbox employees A recent code update meant that any dropbox account could be accessed with ...


8

Homomorphic encryption is about encryption schemes which allow computing with encrypted value without decrypting them. For instance, given E(a) and E(b) (the encryption of a and b), you can compute E(a+b) without knowing a, b nor the decryption key. Homomorphic encryption schemes are very useful in voting schemes, with the following structure: voters ...


8

El Gamal encryption allows for multiplication. This occurs within the group on which El Gamal runs; hence you are multiplying numbers modulo a given prime, not "plain" integers. If you can multiply you can divide (inversion in a group of size q is done by raising to the power q-2, so this is a matter of performing some multiplications). El Gamal is ...


8

Agree with Eric. Another point: DOS/DDOS are nasty attacks that relatively easy to make and hard to protect on application level. Think about what other option you have. Let’s say you will go to some other hosting provider and will get same attack, will it be better or worse? With Amazon at least you can be sure that you will continue to have service and ...


8

If you are already settled on using DropBox, then your only choice at the moment is to use a 3rd party program such as PGP (or free/open GPG) to first encrypt the file and place it into your drop box. I know you said you wanted to use public/private keys, but as an alternative, you could also use 7-zip to create secure archives with AES encryption based on ...


8

Consider this from an Information Management or Information Assurance question rather than an Information Protection question. To the question if a service provider's level of security is "safe" (sufficient and appropriate), the answer is YES and NO - depending on the level of protection the specific information requires. My suggestion is you create three ...


8

Amazon claims that AWS VPC is "logically isolated" from the other AWS instances, and from the Internet. "Logically" means that it is done in software, not with dedicated hardware system. An AWS VPC can be connected to your VPN and it will use IPsec for that external connection, but this does not mean that internally IPsec is used. In fact, how the ...


7

Neither is necessarily more secure, but I will give you some opinions and perhaps facts. Host-extract can determine hostnames, which is also possible via virtual host enumeration. DirBuster, skipfish, and fuzzdb can rely on forced browsing, directory indexes, and predictable resource locations to find vulnerable directory structures and other issues. ...


7

The short answer is that when you put your data on the cloud the provider has the technical capability to do what they want with it. They could sell it, trade it, share it, etc. What is keeping them from doing just that is a) the terms of service or contract agreed (read it to make sure they don't have rights to your data as some claim rights over anything ...


7

Homomorphic encryption is a category of systems; some implementations might be weak, and others might be strong, but it doesn't make sense to talk of the entire category as "weak" or cryptanalyzable. Partially homomorphic cryptosystems (which used to be called just "homomorphic" before "fully homomorphic" cryptosystems were discovered) have been used in ...


7

An example of practical use of PHE (and El Gamal in particular) is Helios Voting. With it you can publicly store encrypted voted ballots in the cloud, and also allow the public to both add them up to confirm the vote counts for each candidate, and to check that their own vote was indeed included in the total, without having a receipt that could prove how ...


7

To answer Brian Campbell's questions / statements point by point: If a user of yours was a target of an investigation, a government may forbid you from doing your 30 day rotation of your D-PKG instances, and require you to turn them over for forensic analysis. It may happen, but highly unlikely in the EU and the UK. Not so unlikely in other domiciles. ...


7

Amazon offers a white paper on this very topic for their Amazon Web Service, and touts several clients who have proceeded forward. See the "Interested in HIPAA Compliance?" sidebar here, as well as this whitepaper. Update: I followed up on the link provided below by Mike Schenk, and found the following statement: Q. Does AWS GovCloud offer better ...



Only top voted, non community-wiki answers of a minimum length are eligible