3 ms·

From the feature page: doogiePIM has your privacy in mind. It doesn't use an unsecure Cloud, it stores your data using strong encryption on your disk of choice

From the feature page: doogiePIM has your privacy in mind. It doesn't use an unsecure Cloud, it stores your data using strong encryption on your disk of choice How can cloud storage be "unsecure" if the data is encrypted?

awalton 8y ago
> How can cloud storage be "unsecure" if the data is encrypted? Because security is more than just encryption. If someone puts my data on a simple HTTP web server but the file's encrypted, the only defensive layer between my data and someone else is that encryption - it better be damn good and have used a strong key. I'd rather that file be behind more layers of security than that - I want authorization and authentication, preferably multi-factor authentication. I want the data service provider to have some notion of what addresses I'd likely be accessing from (North America), and which are likely attacks (China, Russia), and act accordingly (e.g. increasing security measures like anti-botting, asking security questions, etc). I want them to have a pretty robust logging infrastructure and intrusion detection, so that when they do eventually get attacked, they can notify who they need to that their data has been compromised and rotate credentials. I want to know they properly handle drives and NV memory that have had my data on them - either securely wiping them, or destroying them outright. This whole idea is known as "defense in depth," - if one layer fails, you have more to fall back on, with the hope that attackers will eventually give up once they've hit too many hurdles to make the attack pay off, or they simply can't surmount the numerous layers of defense. From the perspective of everything I just mentioned, just throwing your encrypted files on a web server feels pretty insecure to me.
gitgud 8y ago
You can encrypt files on a public server, but if you don't hide the keys, then those files might as well be plain text. Data breaches of personal information are becoming increasingly common and it's important for companies to state that security is a priority when it comes to cloud storage.

awalton 8y ago

> How can cloud storage be "unsecure" if the data is encrypted? Because security is more than just encryption. If someone puts my data on a simple HTTP web server but the file's encrypted, the only defensive layer between my data and someone else is that encryption - it better be damn good and have used a strong key. I'd rather that file be behind more layers of security than that - I want authorization and authentication, preferably multi-factor authentication. I want the data service provider to have some notion of what addresses I'd likely be accessing from (North America), and which are likely attacks (China, Russia), and act accordingly (e.g. increasing security measures like anti-botting, asking security questions, etc). I want them to have a pretty robust logging infrastructure and intrusion detection, so that when they do eventually get attacked, they can notify who they need to that their data has been compromised and rotate credentials. I want to know they properly handle drives and NV memory that have had my data on them - either securely wiping them, or destroying them outright. This whole idea is known as "defense in depth," - if one layer fails, you have more to fall back on, with the hope that attackers will eventually give up once they've hit too many hurdles to make the attack pay off, or they simply can't surmount the numerous layers of defense. From the perspective of everything I just mentioned, just throwing your encrypted files on a web server feels pretty insecure to me.

gitgud 8y ago

You can encrypt files on a public server, but if you don't hide the keys, then those files might as well be plain text. Data breaches of personal information are becoming increasingly common and it's important for companies to state that security is a priority when it comes to cloud storage.