Storage forum: Cloud storage and sharing, is it secure?

The "Cloud" is NOT safe ..... period.

...you don't understand biology! Sperm do not penetrate ovaries. Conception occurs when a sperm penetrates the outer membrane of an ovum (that's an "egg" for you "eggheads") in the Fallopian tube. The ovum originated in the ovary, but was expelled from the maturing ovarian follicle (that's called "ovulation"). The sperm enters the Fallopian tube from the uterus and swims up the tube to meet the ovum. That's another kind of "Secure Hypertunneled connection".
...OK, back to the Cloud!

On Friday we were told not to place any person or professional data in a cloud application. At this time none of the services in their opinion are secure enough to use for such documents. I thought it was very odd this subject was posted at C/Net the same day we received this notice at work. Most of what our IT has told us in the past has come true and they in this case even sited cases of issues already being reported by these sites. Whatever it is worth I thought I'd share this information with everyone.

There are many different types of clouds. Public and private. These companies use private clouds which Are not available to the public. Google has alreAdy been hacked And user data compromised. The point is who owns the cloud? I hAte using Google as an example but on their website they say they read all of your uploads and they can do whatever they want with your data including public display. Is the op supposed to trust a provider who takes no responsibility for your data?

Their cloud service is designed from the ground up for host based anti-intrusion protection, and it only transfers information in Secure Socket Layer, and encrypts anything recorded on your hard drive. If you must store Passwords, Social Security Numbers, and/or financial information at all, I feel LastPass has the best reputation so far.

If they even smell a breach they make it public - which has only happened once - and it turned out to be a minor incident. If ever there was a cloud provider to trust - I'd trust them first.

Even the associates at LastPass have no access to your encrypted "blobs" in their server farm; so even a disgruntled employee could do little damage.

I don't know if your family is tech savvy or not, but a very easy to use solution that's plenty secure for this is called encrypt<nclick, (or very similar) by two bright sparks. It's easily driven from windows GUI in contextual menus. Just share a pw with siblings, one for each file, or one for each type of file maybe just 1 good PW for everything. Any comoplete newbee can use it. Then pick the cloud service of your choice/dropbox rocks most of the time, but sometimes people have problems with their shared folders, so test before you depend on it. I really like Ubuntuone, but I've never tested their Windows client. I've heard it works fine now, but only used it in Ubuntu myself. At least in Ubuntu, you can choose to sync any folder, not just the stuff in the Ubuntu1 folder that's synced automatically. You can send links to non-colaboraters like with Dropbox as well. Lots of other services&some are more secure, but unless you encrypt yourself before uploading you are taking some risk. You are probably not going to be a target, but TrueCrypt is the most secure of all solutions, but harder to learn than the program I mentioned. Gpgp's pretty easy and probably has a way to integrate with windows GUI like it does for Gnome desktop in Linux.

Many of the online cloud storage services are good. Look at their terms of service and privacy policy. Remember that any service can have a bug, and any service can be hacked. If you use your own encryption before you send your files to the cloud, you will have an additional layer of security. Some (all?) cloud storage services allow you to give people read-only access so you can designate one person to control the info and still let everyone look at it.

Email is insecure if you leave it on the cloud, and email can be intercepted. You can get a certificate and encrypt your email, but the cloud storage may be more convenient.

I use Dropbox and Boxcryptor. One advantage of this combination is that I can access the data from my Windows PC, Android phone and iPad even though its encrypted. Another advantage is that Dropbox keeps backup copies so I can recover information that I inadvertently change or delete.

Fully agree with truecrypt recommendation. Many similar encrypted virtual disk type offerings, but truecrypt stands out as open source freeware (so no hidden backdoors), and has an auto demount option to close the plaintext virtual disk after x minutes of non use. This is important as whilst the virtual disk of decrypted information is mounted (ie open and readable) spyware or other people with access to your pc can read it. Before using this option in truecrypt I had occasionally been called away from my pc and thinking I would be back soon not shut down & demounted the plaintext virtual disk, thus comprimising my security. Now my setting is 5min of non use (ie read or write) and it closes.

As I've said MANY times, you need to read the Terms of Service (TOS) for any public provider of cloud services before you use them for private data or governance (where federal, state or local law prohibits you from providing data (except your own) to anyone else such as medical data (HIPAA/HITECH), criminal data (CJIS) or credit card data (FACT Act). Also, read the FAQs and help. Most will tell you, for example, that everything you post is scanned or read by them (Google, Dropbox, etc.) including by employees overseas.

You sound concerned about the security of your Mom's information and you should be. Now is not the time to provide her credit card, banking information, address, SSN to someone who can easily use this information (even in a foreign country) to open accounts and transfer funds.

One suggestion that someone else made is good. If you are going to use one of these sites, find a way to encrypt the data yourself before you give it to one of these places. Just because they offer their own encryption, most of their employees carry the keys to decrypt your data. So do your own encrypting.

Email, by the way, is NOT safe either but it is better than using a site that tells you that they read your stuff and can do anything they want with it and take no responsibility for it (all in the TOS).

Learn simple encryption. Use PGP or the free version, GPG. You create a set of keys and just give family members the secret key (and the public key as well). There are others that may be easier to use but Cloud storage for the type of data you are talking about is not secure based on my research on the websites of the providers.

Howie

Within the web page for Cnet on "The Public Cloud" issue are adverts for Just Cloud - a supposedly free service to backup on an unlimited basis all files from your comuters and across all devices. Sounds good, and little slider boxes on the Just Cloud web site clickabel from the Cnet webpage describe a few of User favourable comments ..., BUT

As warned in the post on The Public Cloud, it is vital that consideration is given to their terms and conditions which give absolutely no guarantees at all as to the safe access to your files backed up. More importantly, if any user takes up the suggestions they then make of adding limited one off extras to the service they propose what started as free becomes expensive with Just Cloud able to terminate in all sorts of circumstances having got your money

An important issue is that this service states it keeps all its (your) data on just one of its servers and can choose to change the conditions on which you may have subscribed at any time (you only being told if you accessed their website to discover the updated terms - they reserve the right to change the terms at any time AND if you subscribe to any of the extra services BEWARE you are also giving Just Cloud unlimited ability to rebill you at the end of any subscription period without communicating that fact to you on screen (it only appears in their detailed terms)

It becomes apparent that the service is from a United States company and is governed by such law but the actual data may be stored at their discretion anywhere in the world (and probably will be in due course) AND it appears any files backed up are encrypted BY THEIR software on YOUR machine and then submitted to their server and ONLY THEY have the ability to decrypt your files - so if there is any argument and need to get a file back it has to be under their decrytpion terms and ONLY if they feel able to do so (no guarantees there either).

If you do not like any of this but have data stored by them they limit your rights to dispute under the US law to arbitration but you have to pay fees of any arbritrator on a half and half basis (little you v big them!) - limited if you are a consumer (non business) to $1000

So ... can you trust these sort of services to
a) store your data securely (they have the decryption keys and right to ready your data)
b) always backup your data as you expect (they will not be liable if they have not got round to doing the backup at their end due to delays, downtime, or overload etc)
c) enable you to get your data back at all times
d) know that you will not be charged for ever once you have taken a subscription
e) know that the already harsh terms and conditions (including their reservation to withdraw the service at any time without notice to you) will not change to be made even harsher without reference to you
f) reimburse you on their changing their terms of conditions during any period of subscription without YOU having to discover that fact on your own by "periodic visits" to their website

On the above basis I would steer VERY clear of any reliance on such a service which actually guarantees nothing except that they take your money if you subscribe to anything and will continue to do so unless you cancel the means by which they can automatically debit your bank account or credit card!!!

In all probability many other such sites have similar terms - BEWARE - all is not as it seems!! Users and potential customers BE WARNED - PRINT OUT and READ their terms and conditions before parting with a penny!!!

If you had used PGP which is not NSA approved I would have been happy about this.
Bob

Lets think, the cloud will be secure. No logical reason to consider it will be secure. Anytime you park your information whether it be photos, files, personal documents on someone else's server system, there is a fair chance that it can and will be hacked. The proprietors of such server systems, or the cloud, are not likely to highlight their systems have been breached.
Lets think of some high profile hackings. Linkedin, Facebook, The Pentagon, and I could go on and on.
The best way of managing your personal information, is to have a pc or laptop at home, on your home network. This excludes physical hacking. It will need to have good, strong passwords. Then create a vpn, that family members can log into to access the files. A vpn is reasonably straightforward to create, but if you have problems, get in touch with any decent IT store, or consultant, and for a reasonable fee, a vpn will sort you issues. Make sure that when it is set up, you change the password immediately, to prevent access from a nosy IT store representative. Your particular information is really handy for those wishing to hijack identities.
Leave the pc or laptop running, connected to the internet, 24/7 until such time the ubiquitous access is no longer needed. Make sure you allow access only to the folder and files that are relevant to your matters
The Cloud....not for me.

Robin
CCNP MCSE

I consider them INSECURE because of THREE thing! Anybody know where I can get a good proofreader for free?

......trust ANY Media Storage facility that you would be entrusting such personal and important information to, hell, I don't even keep sensitive data on my Laptop. If a system can be created,a system can be hacked no matter HOW many Firewalls are in place or levels of multiple key encoding.

If multiple people need to have sensitive data that can be accessed then why not copy it to a Flashdrive or SD Card and give each person their own? Flashdrives or USB sticks can be carried on keyrings and therefore if on your House/Car keys it is always at hand.

Me personally,I'd be more happy with this method than some "Floaty" facility, if your Data gets hacked,corrupted or lost - WHO do you go to? WHERE can you go physical location wise and complain?