New answers tagged storage
Ultimately, I think you're going to have to figure this out with your PCI auditor, which I am not. I think you're going to have a hard time figuring out how to do this is a way that is a) not overly burdensome to you and the ultimate users of the card data, and b) leaves you with a system that is still PCI compliant and that your auditor will give a stamp ...
Cloud are external service providers: you do not have control on their system, you do not known their internal tools, policy, you do not know their employee. The best bet is therefore to assume cloud is insecure and just encrypt the file before uploading them. This way, from a confidentiality and integrity perspective, you are not bound to trust the cloud ...
The service can create a random encryption key on the client and then encrypt that key with your password, the service will never have access to your plain-text password.
With regard to SpiderOak: it seems that the keys are generated by the client application during installation, after you choose a password, by inputting the password into a derivation function. See Zero Knowledge Explained (2nd paragraph).
Top 50 recent answers are included