It is safe to store photos and documents on skydrive / google cloud services?

Question

I have over 20GB of photos and documents stored on my hard disk without a backup. I'm thinking about saving all of them in a cloud service such as Microsoft Skydrive or google cloud, but I'm wondering if it is really safe... I mean, can I trust these services in privacy and responsibility just as if I was saving these files on an external hard drive?

Answer 1

The most sensible approach is to assume you cant rely on their privacy - it isn't their responsibility, although there are some services whose selling point is securing this data.

If you take that stance, as long as you encrypt all data before it goes to the cloud you can be safe (decide on what level of encryption you need in order to be safe)

This approach gives you a very practical backup, just make sure you protect your encryption keys.

Answer 2

I would say no its not suitable for storing criticial information,

From the sound of their terms Google essentially owns everyting you upload as well as anything derivitive of your data as well.

Here is an excerpt from the verge.com explaining the differences of the 3 major players, notice Google is very liberal with what they can do with your data.

Dropbox

https://www.dropbox.com/terms

"By using our Services you provide us with information, files, and folders that you submit to Dropbox (together, "your stuff"). You retain full ownership to your stuff. We don’t claim any ownership to any of it. These Terms do not grant us any rights to your stuff or intellectual property except for the limited rights that are needed to run the Services, as explained below."

SkyDrive

http://windows.microsoft.com/en-US/windows-live/microsoft-service-agreement?SignedIn=1

"Except for material that we license to you, we don't claim ownership of the content you provide on the service. Your content remains your content. We also don't control, verify, or endorse the content that you and others make available on the service."

Google Drive

http://www.google.com/intl/en/policies/terms/

"You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours.

When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content."

Answer 3

Consider this from an Information Management or Information Assurance question rather than an Information Protection question. To the question if a service provider's level of security is "safe" (sufficient and appropriate), the answer is YES and NO - depending on the level of protection the specific information requires.

My suggestion is you create three big categories of information, Public, Personal and Private. You can ask yourself how much damage would I be willing to endure if I lost "personal" information to help you decide if a specific item of information should go in "private" or not. Private is the category where you need the most burdensome protections, and you don't want to put less valuable information in that category because those extra security measures cost you time, sometimes money, and generally some frustration.

All private information should be stored encrypted. It does not matter if you store it on a local drive or a cloud service, presuming the encryption is the right type (for example AES with 256 bit keys) and the pass-phrase sufficiently complex and is kept private. Odds are your home network is far less protected than networks managed by Microsoft or Google.

All personal information should be stored under the protection of network credentials by a service provider who publishes their security standards. In the case of Microsoft, all of their SkyDrive infrastructure is now on their Windows Azure platform, which meats very stringent protections such as HIPPA. Google, by contrast, is very upfront about scanning most information stored to target ads to you.

If you want to store personal information you can use an enhanced service from Microsoft called Office365. For $6 per month you get a privately segmented Exchange service for email and a full SharePoint (SkyDrive plus many extra features) that is designed to protect your information from being shared outside of your "namespace" (think of it as your domain name). Those Microsoft services have been reviewed in depth and (outside of government classified information which generally requires dedicated hardware), Office365 is approved for all highly regulated environments such as SOX, HIPPA, etc.

If a piece of information is not Private and not Personal, it should be public and then any of the services should be safe for you. Microsoft is hyper-vigilant about not losing customer data as they spend billions of dollars on Windows Azure, so my opinion is they are safe as a backup location.

Let me leave you with a way of thinking about information that was shared by a crusty old IT guy that knew (kids avert your eyes):

Public is a picture of your best friend.

Personal is a picture of your wife in lingerie.

Private is a picture of your best friend with your wife in lingerie.

How much you protect each level of information depends on how embarrassed you would be seeing the picture (document, etc.) on the cover of your local newspaper.

Answer 4

My concern with any cloud service would be that one day you'll wake up and they'll be gone. -- so long as they're a backup, not primary storage, it's an ordinary risk.

Answer 5

As others have mentioned, general-purpose cloud storage providers, like Microsoft, Google, Apple, and DropBox are not completely safe, since although they encrypt your files, they have copies of the keys (needed so they can index your files for search purposes).

And as Rory points out, you can make this super-secure pretty easily: encrypt the backups yourself before putting them in the cloud. This is the best option.

But there is also a middle-ground. There are some cloud storage providers who focus on security by not keeping copies of your encryption keys. SpiderOak are a popular one for backing up documents. Carbonite are also popular, and also offer an option to back up the whole of the machine (i.e. OS as well as documents.)

Answer 6

Why not using a combination of truecrypt volume and those cloud storages! truecrypt for confidentiality and the cloud services for redundancy and backup