5 ms·

The article is interesting, I learnt about a few apps that could be valuable to me. But what I found most worrying was the lack of acknowledgement that exclusi

by new299 10y ago

The article is interesting, I learnt about a few apps that could be valuable to me. But what I found most worrying was the lack of acknowledgement that exclusively using cloud storage has caviates associated with it. Are we really so comfortable with, unencrypted, cloud storage now that we don't even mention the potential for warrentlsss access and other abuses?

deleted 10y ago
[deleted]
Tloewald 10y ago
Unencrypted?
- fjdlwlv 10y ago
  Well, cloud provider has the decryption key
LeifCarrotson 10y ago
Yes, most people are that comfortable with unencrypted storage. But I expect the most interesting push back will not come from a tiny fraction of the population who care about such things, but from strict rules in governments and large organizations that prohibit storing classified or confidential data in unencrypted cloud storage. Either we'll get encryption as a normal feature, or private clouds. (also sp. caveats, warrantless)
- willstrafach 10y ago
  This is a bit off base. For companies, they have data loss prevention policies in work-enabled devices, constraining work data to only be possible to download to work-approved (usually from their MDM provider) applications, not possible to export and able to be remote wiped from the device by the company at any point they chose. For government, storing classified information in the cloud is already a major violation. Even data designated as FOUO requires special considerations (Although AWS GovCloud is a good solution for serving such needs). In a sense, your "private clouds" estimate is already the path that has been taken, as there are many frameworks and requirements that have been created by gov over the past few years in terms of storing certain types of information. Trying to force all cloud providers to abide by them seems like it would be a losing battle as well, and would not be taken lightly by many.
willstrafach 10y ago
> Are we really so comfortable with, unencrypted, cloud storage now that we don't even mention the potential for warrentlsss access and other abuses? It is worth noting that iCloud allows encryption of your data using a passphrase (Usually the device passphrase but I believe you can set a custom one, if you prefer).
- dhess 10y ago
  As of December 2016, I believe you are, generally speaking, incorrect. iCloud data is encrypted in transit and at rest, but only iCloud Keychain is encrypted "in such a way that Apple cannot read or access" it.[1] For all other data stored in iCloud, Apple both provides and retains access to the encryption keys. Note that this includes iCloud backups you make of your iMessages; however, if you do not back up your iMessage content to iCloud, then technically speaking your iMessages are not part of your iCloud footprint and Apple does not have access to that content.[ibid] Apple's law enforcement guidelines[2] provide more detail about what Apple effectively has access to and can/will provide upon presentation of a warrant. (As of iOS 9.3 and macOS 10.11.4, it appears that notes that you explicitly password-protect in the Notes app are also encrypted with a user-supplied key to which Apple has no access. They don't explicitly mention this functionality in [1] or [2], but they do imply that this is the case in [3].) There have been rumblings [4] since the San Bernardino case that Apple is considering providing what you describe, so that users can provide their own encryption keys for their iCloud content and backups, such that Apple no longer has access to the plaintext. However, Apple has not implemented this functionality yet, and I haven't heard anything about it since the FBI dropped its case against Apple in this matter. [1] http://www.apple.com/privacy/approach-to-privacy/ http://www.apple.com/privacy/approach-to-privacy/ [2] https://www.apple.com/legal/privacy/law-enforcement-guidelines-us.pdf https://www.apple.com/legal/privacy/law-enforcement-guidelin... [3] https://support.apple.com/en-us/HT205794#forgot_password https://support.apple.com/en-us/HT205794#forgot_password [4] [paywall] http://www.wsj.com/articles/in-beefing-up-icloud-security-apple-weighs-privacy-against-convenience-1458089515 http://www.wsj.com/articles/in-beefing-up-icloud-security-ap...
coldtea 10y ago
>Are we really so comfortable with, unencrypted, cloud storage now that we don't even mention the potential for warrentlsss access and other abuses? Most people use the same cloud storage on their desktop or phone anyway too.

by new299 10y ago

deleted 10y ago

[deleted]

Tloewald 10y ago

Unencrypted?

fjdlwlv 10y ago
Well, cloud provider has the decryption key

LeifCarrotson 10y ago

Yes, most people are that comfortable with unencrypted storage. But I expect the most interesting push back will not come from a tiny fraction of the population who care about such things, but from strict rules in governments and large organizations that prohibit storing classified or confidential data in unencrypted cloud storage. Either we'll get encryption as a normal feature, or private clouds. (also sp. caveats, warrantless)

willstrafach 10y ago
This is a bit off base. For companies, they have data loss prevention policies in work-enabled devices, constraining work data to only be possible to download to work-approved (usually from their MDM provider) applications, not possible to export and able to be remote wiped from the device by the company at any point they chose. For government, storing classified information in the cloud is already a major violation. Even data designated as FOUO requires special considerations (Although AWS GovCloud is a good solution for serving such needs). In a sense, your "private clouds" estimate is already the path that has been taken, as there are many frameworks and requirements that have been created by gov over the past few years in terms of storing certain types of information. Trying to force all cloud providers to abide by them seems like it would be a losing battle as well, and would not be taken lightly by many.

willstrafach 10y ago

> Are we really so comfortable with, unencrypted, cloud storage now that we don't even mention the potential for warrentlsss access and other abuses? It is worth noting that iCloud allows encryption of your data using a passphrase (Usually the device passphrase but I believe you can set a custom one, if you prefer).

dhess 10y ago
As of December 2016, I believe you are, generally speaking, incorrect. iCloud data is encrypted in transit and at rest, but only iCloud Keychain is encrypted "in such a way that Apple cannot read or access" it.[1] For all other data stored in iCloud, Apple both provides and retains access to the encryption keys. Note that this includes iCloud backups you make of your iMessages; however, if you do not back up your iMessage content to iCloud, then technically speaking your iMessages are not part of your iCloud footprint and Apple does not have access to that content.[ibid] Apple's law enforcement guidelines[2] provide more detail about what Apple effectively has access to and can/will provide upon presentation of a warrant. (As of iOS 9.3 and macOS 10.11.4, it appears that notes that you explicitly password-protect in the Notes app are also encrypted with a user-supplied key to which Apple has no access. They don't explicitly mention this functionality in [1] or [2], but they do imply that this is the case in [3].) There have been rumblings [4] since the San Bernardino case that Apple is considering providing what you describe, so that users can provide their own encryption keys for their iCloud content and backups, such that Apple no longer has access to the plaintext. However, Apple has not implemented this functionality yet, and I haven't heard anything about it since the FBI dropped its case against Apple in this matter. [1] http://www.apple.com/privacy/approach-to-privacy/ http://www.apple.com/privacy/approach-to-privacy/ [2] https://www.apple.com/legal/privacy/law-enforcement-guidelines-us.pdf https://www.apple.com/legal/privacy/law-enforcement-guidelin... [3] https://support.apple.com/en-us/HT205794#forgot_password https://support.apple.com/en-us/HT205794#forgot_password [4] [paywall] http://www.wsj.com/articles/in-beefing-up-icloud-security-apple-weighs-privacy-against-convenience-1458089515 http://www.wsj.com/articles/in-beefing-up-icloud-security-ap...

coldtea 10y ago

>Are we really so comfortable with, unencrypted, cloud storage now that we don't even mention the potential for warrentlsss access and other abuses? Most people use the same cloud storage on their desktop or phone anyway too.