3 ms·

I am a developer of accounting software and this is exactly the problem I faced when developing the cloud-based version of my accounting software. My solution

by MarkMc 10y ago

I am a developer of accounting software and this is exactly the problem I faced when developing the cloud-based version of my accounting software. My solution was to keep all financial data on the server encrypted. The server is unable to decrypt any financial data because the crypto key is either (a) derived from the user's password; or (b) located on an offline device to allow customer support staff to reset passwords. This means that even an attacker who gains root access to our online servers would be unable to access users financial data. (In fact the cloud version is probably more secure than our old desktop-only version because it encrypts all financial data when cached on the end-user's hard drive) I'm actually considering adding a full end-to-end encryption option, but it would mean that users who enabled this feature would lose their data if they forgot their password. So I suspect that few users would want enable end-to-end encryption in their accounting software. What do HN users think? Is there a market for 'cloud accounting software with end-to-end encryption'?

hackuser 10y ago
I wouldn't use it without end-to-end encryption, and I probably wouldn't trust your implementation of encryption (no offense, but probably you can't be a wizard at both financial software and encryption software) unless you used some proven third-party solution. And even then ... I would just keep the data local and encrypted. Why do I need to put it in the cloud? However, I'm a tiny market of 1, and I and the HN crowd are not representative. While I'd love it if you designed your solution specifically for me, it probably wouldn't be good for your revenues (for good software, I'll pay $100/yr!). People put their financial information online all the time, using QuickBooks, tax software, Mint, etc. Most have no idea what end-to-end encryption means, but if you tell them it's more secure I imagine they will like that. As an 'influencer', I might be more likely to recommend it (with the caveats in the first paragraph). Is there some liability involved? What if there is a breach and their data is stolen? What if you tell them it's encrypted, there's an exploit, and your claim on which they depended turns out to be false?
- MarkMc 10y ago
  Thanks for your feedback. I guess the benefits of putting your financial data in the cloud are the same as for any online system: Access your data from any computer, automatic backups, and easily share your data with other people (especially your accountant or co-workers). The problem is more about marketing - every online system claims to have strong security, and users have no way to test those claims. Users regularly hear reports of data breaches so they become cynical about security do not trust any online system. Curiously, the efforts by the EU to ban end-to-end encryption [0] may lead to an easier marketing pitch in the US: "Security So Strong It's Banned In Europe!" You make a good point about liability. Any data breach has a big impact on the reputation of online system, but particularly so with a company that claims to be stronger than the rest. There may also be extra litigation in such cases. [0] https://techcrunch.com/2016/08/24/encryption-under-fire-in-europe-as-france-and-germany-call-for-decrypt-law/ https://techcrunch.com/2016/08/24/encryption-under-fire-in-e...
  - hackuser 10y ago
    > I guess the benefits of putting your financial data in the cloud are the same as for any online system: Access your data from any computer, automatic backups, and easily share your data with other people (especially your accountant or co-workers). I definitely could see that applying to business accounting, but not to my personal finances. I don't need to look at the latter very often, and very rarely do I need to share it with someone who can't look at my laptop.

by MarkMc 10y ago

hackuser 10y ago

I wouldn't use it without end-to-end encryption, and I probably wouldn't trust your implementation of encryption (no offense, but probably you can't be a wizard at both financial software and encryption software) unless you used some proven third-party solution. And even then ... I would just keep the data local and encrypted. Why do I need to put it in the cloud? However, I'm a tiny market of 1, and I and the HN crowd are not representative. While I'd love it if you designed your solution specifically for me, it probably wouldn't be good for your revenues (for good software, I'll pay $100/yr!). People put their financial information online all the time, using QuickBooks, tax software, Mint, etc. Most have no idea what end-to-end encryption means, but if you tell them it's more secure I imagine they will like that. As an 'influencer', I might be more likely to recommend it (with the caveats in the first paragraph). Is there some liability involved? What if there is a breach and their data is stolen? What if you tell them it's encrypted, there's an exploit, and your claim on which they depended turns out to be false?

MarkMc 10y ago
Thanks for your feedback. I guess the benefits of putting your financial data in the cloud are the same as for any online system: Access your data from any computer, automatic backups, and easily share your data with other people (especially your accountant or co-workers). The problem is more about marketing - every online system claims to have strong security, and users have no way to test those claims. Users regularly hear reports of data breaches so they become cynical about security do not trust any online system. Curiously, the efforts by the EU to ban end-to-end encryption [0] may lead to an easier marketing pitch in the US: "Security So Strong It's Banned In Europe!" You make a good point about liability. Any data breach has a big impact on the reputation of online system, but particularly so with a company that claims to be stronger than the rest. There may also be extra litigation in such cases. [0] https://techcrunch.com/2016/08/24/encryption-under-fire-in-europe-as-france-and-germany-call-for-decrypt-law/ https://techcrunch.com/2016/08/24/encryption-under-fire-in-e...
- hackuser 10y ago
  > I guess the benefits of putting your financial data in the cloud are the same as for any online system: Access your data from any computer, automatic backups, and easily share your data with other people (especially your accountant or co-workers). I definitely could see that applying to business accounting, but not to my personal finances. I don't need to look at the latter very often, and very rarely do I need to share it with someone who can't look at my laptop.