Can we determine how securely files are stored on a cloud storage service?

Question

After asking two questions about the security of online cloud storage, it seems to me that we can only at best speculate as to the security practices of the hosting company, and believe what they tell us. Or can we do something more?

For example, people have assessed that Dropbox and Google Drive are insecure because their employees can technically read your files if they desire due to the encryption keys being stored on their server. We know this through interviews with their representatives and the wordings of their Terms of Service.

However, suppose they were to keep their method of storage a secret. Would we be able to know for sure whether they can read our files?

Additionally, there are services like BoxCryptor or Viivo which will encrypt your file before they are transferred to Dropbox or Google Drive. We can verify that this is true by looking at our file through Dropbox or Google Drive, and see that it is in fact encrypted.

However, there are also storage services like SpiderOak and Sync which offers end to end encryption builtin. However, the same strategy doesn't work because our files will be unencrypted once it is downloaded. For these services, how can we be sure whether or not our files are encrypted like they claim?

Answer 1

Cloud are external service providers: you do not have control on their system, you do not known their internal tools, policy, you do not know their employee.

The best bet is therefore to assume cloud is insecure and just encrypt the file before uploading them.

This way, from a confidentiality and integrity perspective, you are not bound to trust the cloud service provider, you are bound to trust the encryption software which can be far more opened and have received a lot more public scrutiny than any cloud provided tools.

From an availability perspective, I think it is reasonable to trust cloud service provider since data availability is precisely the core of their activity.

Therefore, by combining local data encryption + remote cloud storage, you would achieve the classical CIA security triad (Confidentiality, Integrity, Availability), which I guess should answer your question about cloud storage security :).

Answer 2

In infosec, we always make a compromise between convenience and security.

Note that with any "closed source" package, you can't tell if the encryption is good or not, even if you applied it yourself.

You can always get the GPG (or similar) source, review it, compile it, use it to encrypt your files before uploading.