Hot answers tagged

46

Google has access (obviously). The police will have access if they have a valid search warrant. A national security letter will give the FBI secret access. Various three-letter agencies may have access, depending on how they're doing at circumventing Google's encryption. (Google started encrypting its internal traffic after it was revealed that the NSA was ...


37

This is Brian Spector; I'm the CEO of CertiVox. Thanks for starting this discussion on PrivateSky, our secure information exchange service. I’ll do my best to answer the intelligent comments and criticisms on this thread. Second, I’ll try my best to walk the reader through step by step on how our integrated key management and two factor authentication ...


20

Figure out the cost level where you start getting uncomfortable. Calculate the GB that would need to be transferred to reach that cost level. See if you think an attacker will be willing to spend that much effort to hurt you for that amount of money. Every time I run this calculation I end up thinking that if somebody hated me that much, they could ...


19

From a purely technical perspective, if you encrypt it properly before you upload it, and it stays encrypted all the time it is in the cloud, then the data is very safe. However, there are very probably extra levels of legal compliance you need to meet. This is "Personally Identifiable Information" and there are a lot of laws and regulations that apply to ...


18

Given the current state of public cloud, I would argue that in many cases it is in fact more secure than on-premise storage. Granted I work for Microsoft, but my opinion both pre-dates my employment, and extends to competitors like Amazon and Google as well. Companies whose business models are built on data center operational expertise and excellence, are ...


16

The most sensible approach is to assume you cant rely on their privacy - it isn't their responsibility, although there are some services whose selling point is securing this data. If you take that stance, as long as you encrypt all data before it goes to the cloud you can be safe (decide on what level of encryption you need in order to be safe) This ...


15

Amazon does have a Type II SAS 70 report. Requesting a detailed copy of that should show all the controls they have in place. It may that people are asking Amazon the wrong questions. As a quick note, the SAS 70 testing in the future will be referred to as an SOC -- one of those accounting industry quirks. Especially with an Amazon-sized company, one looks ...


15

This is a simple cost / benefit analysis, so it's a business question rather than a security one since you've already decided the merits of how to approach the security aspect. Write your code, benchmark it, and compare numbers in a spreadsheet. For the metal * Cost of metal * Cost per hour in terms of electric bill (assume under full load) * Budget for ...


15

It is hard to quantify exactly, but if you have the DB on a mobile device then I wouldn't say this is particularly any less secure. KeePass encrypts the DB because the file remaining secure isn't expected to be a guarantee. It's certainly preferable that the DB file not get in the wild, but if your security depends on the encrypted file remaining ...


15

Not instantly. Although, that's what I want to believe. What you could do is the following. Download the Truecrypt version 7.1a and create an encrypted storage file (option 1 from the wizard) and choose 3 algorithm based encryption with a SHA-512 key. Put all your sensitive files in here and upload the encrypted file to Google Drive. When you want to work ...


13

Anything which is encrypted with PBE (as in "Password Based Encryption") can be the subject of an offline dictionary attack (i.e.: the attacker tries potential passwords). This is a worry unless you have a super-strong password, which is not as easy as it can seem because you also have to remember it, and to type it regularly (if you note it down somewhere, ...


13

"The Cloud" is marketing speak for "Other People's Servers". I will use that term for the rest of this post. When you store your data on other people's servers, those people are technically capable to look at your files and also show them to anyone who asks. Whether or not they are allowed to look at them and/or let others look at them should be described ...


12

There's an infinite amount of security issues with the cloud. To see a nasty laundry list, check out ENISA's documents.


12

According to the white-paper they use SK-KEM, which is an identity-based encryption scheme. This explains why you do not need the public key of B in order to send an encrypted message to him (the email-address is the public key). Usually identity-based encryption relies on a trusted third party. So their claim that they cannot decrypt the messages ...


12

I would say no its not suitable for storing criticial information, From the sound of their terms Google essentially owns everyting you upload as well as anything derivitive of your data as well. Here is an excerpt from the verge.com explaining the differences of the 3 major players, notice Google is very liberal with what they can do with your data. ...


12

Amazon claims that AWS VPC is "logically isolated" from the other AWS instances, and from the Internet. "Logically" means that it is done in software, not with dedicated hardware system. An AWS VPC can be connected to your VPN and it will use IPsec for that external connection, but this does not mean that internally IPsec is used. In fact, how the "isolation"...


11

Homomorphic encryption is about encryption schemes which allow computing with encrypted value without decrypting them. For instance, given E(a) and E(b) (the encryption of a and b), you can compute E(a+b) without knowing a, b nor the decryption key. Homomorphic encryption schemes are very useful in voting schemes, with the following structure: voters ...


10

Assuming the document ID distribution is uniform and unpredictable, here's the math: 44 characters long Uppercase, lowercase, digits and underscore = 26 + 26 + 10 + 1 = 63 character alphabet Therefore: Total possible combinations: 6344 keyspace: 263 bits ⇐ 44 * log2(63) And we know that brute-forcing a 263-bit key in any reasonable amount of ...


10

You'll never be able to know. You can however, exercise reasoning and logical judgement based on The company's ToS. The company's track record. Your trust of the company providing that service. The importance/value of the data handled by that service. Regarding password management; call me a little paranoid, but I really never trust any cloud service ...


10

I use the KeePass-Dropbox combination. The password database is encrypted using a key derived from a strong master password. Even if somebody acquires your encrypted password database through your cloud account, a strong enough master password renders brute-force attacks infeasible. Simply put: Use a strong master password and stop worrying about this.


10

Any data you upload to Google Drive (or Skydrive, or Dropbox for that matter) should be considered duplicated by the NSA. Apart from arbitrary queries from the aforementioned secret service, law enforcement agencies from any country may gain access to them through legal means (subpoenas and so on). And of course, Google engineers could in theory browse your ...


9

Encrypting the data with the public key of each agent is a way to implicitly authenticate the agent. You do not really know (in a setup where communications go through a potentially malicious cloud) if the agent really received the data, but you know that only the proper agent could decrypt it; hence, if the data has gone somewhere at all, then it went to ...


9

It is already possible, via end-to-end voting systems like Helios to publicly store voted ballots in the cloud in an encrypted fashion, so that the public can add them up to confirm the totals, and to also check that their own vote was indeed included in the total. Without giving someone a 'receipt' that they can use to sell their vote. Surprising, but ...


9

There was been at least five issues reported over the past few months Problem with authentication, ie if you could access a hard disc that contained a dropbox folder you would have continuous access to their dropbox data Data stored in dropbox is accessible by dropbox employees A recent code update meant that any dropbox account could be accessed with ...


9

Consider this from an Information Management or Information Assurance question rather than an Information Protection question. To the question if a service provider's level of security is "safe" (sufficient and appropriate), the answer is YES and NO - depending on the level of protection the specific information requires. My suggestion is you create three ...


9

You can increase the resiliency of your KeePass database to brute force by increasing the number of PBKDF2 iterations when deriving the database encryption key from your password. You can do this in KeePass under File > Database settings > Security. Personally, I use around 5,000,000 rounds (1 s delay). Remember that mobile devices are slower.


9

That's a judgment call you'll have to make for yourself, but their technical overview has what I consider a huge red flag: Which data is stored on the Boxcryptor Key Server Private RSA key (encrypted with the user's password) The fact that your private key is stored on their server, even if it's encrypted with your password, greatly ...


9

Highly customized and patched hypervisors, sandboxes around said hypervisors to mitigate breakouts, and heavy monitoring. Of course, any given server only hosts so many VMs, so a breakout is fundamentally limited to a finite number of guests, if it's able to get past the protections outside the hypervisor. For example, QEMU can be compiled with a hardened ...



Only top voted, non community-wiki answers of a minimum length are eligible