Tag Info

New answers tagged

1

Not a full answer, but another thing to think about: with a system like that the easiest way for an attacker to gain access (ie the weakest link) is to steal the private keys to one of those client certs. Things to think about: Are the linux machines physically secure, or do they leave the building (ie laptops)? Do you have good policies for certificate ...


1

It may not be best practice because you're using a specific-purpose CA (in which case, authenticating your OpenVPN clients) for something else, but security-wise, as long as that CA is secure, your solution is fine. I would recommend however putting the private key of that CA certificate somewhere safe, like a smartcard, a completely offline computer or an ...


0

If you want to be really serious about things, run Boxcryptor in conjunction with Dropbox. Boxcryptor encrypts everything at your end PRIOR to sending to Dropboxs' servers. All that's at Dropboxs end is a load of encrypted stuff. Your keepass db ends up doubly encrypted!


3

Look at it from a service perspective instead of from a "cloud" perspective (there is no such thing as a "cloud"). If a service resides partially on a privately held network as well as on a publicly held network, then it's a "hybrid". For example, I use a security service where I deploy multiple servers within my own network (private "cloud") and the data ...


0

I am a strong believer in defense in depth on this. No matter how strong your password is, it is also one that cannot be changed. So to protect my Keepass DB, I am using three layers: The database has a strong pass phrase (not just a password). I am not using a key file because, for me, the risk of losing the key file outweighs the security benefits. The ...


0

To be frank: There is no such thing like an unpublished web site. There are bots routinely crawling all IP numbers and looking for webservers on the usual ports. When they found a web server, they may try out some well-known misconfigurations or other vulnerabilities to take over the server. In case of success they may send spam emails or attack other ...


1

In the case of Mega we should look at (recent) history to see what their motivation for end-to-end encryption is. The founder, Kim Dotcom, previously ran Megaupload which was continuously under attack by governments for "digital piracy." After about 7 years of operation, in 2012 an international police force arrested Dotcom and seized his assets. In 2013 ...


1

From time to time there is such question popping-up in this site, "How can trust this company?", because it is what your question is up to: can you trust Mega (or put here any other company name, even a not IT-related one). As long as it just you and this company, I will call it the provider from now on, then you just cannot trust them. They may tell you ...


2

You don't know what Mega (or any other cloud service) is actually doing on their servers. There is rarely any way to verify the security claims of a cloud service unless they let you examine their internal systems.



Top 50 recent answers are included