Recently I have been looking a little bit into the security topic in Firebase databases and I know about the security rules. My question is, even having implemented the rules, does Google itself have access to the data stored in my database? Can Google legally use and publish this data? In other words, is Firebase database suitable for storing sensitive information, or should I search for other platforms?
-
Yes, just like any cloud service, the provider has access to your data. What they can do with it depends on their privacy policy. In most countries they are bound by law to follow their published policy. Often the free version of these services has a poor privacy policy, but the paid version a good one.– paj28Commented Nov 25, 2016 at 12:59
Add a comment
|
1 Answer
General rule of thumb: if it's not running on your own stack, down to the hardware, someone else has access to it. (of course, it does not mean that if it's running on your own stack, nobody has access, it's just a required condition).
The typical way of handling such an issue is to encrypt all data you store on the leased part of the stack and make sure the decryption keys aren't located there as well.
-
In this particular case, Firebase does operations like querying that require access to plaintext data.– paj28Commented Nov 25, 2016 at 13:26
-
That is why each case is special. There is a class of encryption algorithm called "Homomorphic encryption" that can be used to solve that problem. But it's a delicate and complex problem to solve.– StephaneCommented Nov 25, 2016 at 13:53
-
Homomorphic encryption can theoretically be used to solve that problem. There is no practical version of Firebase or anything comparable that uses it.– paj28Commented Nov 25, 2016 at 14:17