6 ms·

RIAA Wants To Start Peeking Into Files You Store In The Cloud

62 points by ygreek 15y ago

Chrono 15y ago
I guess it is time to start encrypting the files I got in the cloud. None of which are copyright'ed or especially secret but better safe than sorry.
cookiecaper 15y ago
Encrypt, encrypt, encrypt. If possible, use ecryptfs or TrueCrypt or some other non-transparent encryption mechanism on files that you back up to remote sites so that you know they are always safely encrypted and don't have to think about it (just copy the lower-level, encrypted container). Both ecryptfs (with filename encryption) and TrueCrypt can back up encrypted versions of your files without even giving away filenames, so RIAA can't go acking for MP3s. Of course, manually using gpg and specifying an unrelated output filename works too. If you're uploading anything remotely important to a third-party service, you should encrypt all of it beforehand. As we see time and time again, it can be really surprising how easy it is for an insider, a random script kiddie, or in this case, a company with a posse of anxious lawyers to grab your data. You need to encrypt that data before it ever leaves your disk for persistent storage on someone else's infrastructure. Encrypt encrypt encrypt.
- switch007 15y ago
  100% agree. Encrypt. Not because of what you are afraid today, but for what might happen in the future. You can't even begin to imagine the ways our privacy will be violated tomorrow.
- nextparadigms 15y ago
  All file locker services should offer a check-box or something by default, before you upload your files, to encrypt them with your own key. That should cover a lot more people than it would if everyone had to do everything by themselves.
  - gst 15y ago
    This should not be a checkbox, but it should be the default. And that's exactly what Wuala is doing.
    - cheez 15y ago
      Wake me up when Wuala open sources their client.
      - rdl 15y ago
        For just doing security reviews, I don't think open source should be a requirement; just available, published source.
  - DasIch 15y ago
    Call me paranoid but I would not even consider that as an alternative to doing the encryption on my own.
    - lsc 15y ago
      This is why I've left some sort of server-side encryption out of the storage product I'm designing. I mean, I'm just using webdav, so it should be easy enough for you to bring your own client with encryption support; something you already trust. The main benefit of encryption in these situations is that you have to trust your provider a whole lot less... If I get compromised through a OS hole? if you are encrypted, you are covered. If I get compromised through a physical attack, governmental or otherwise? if you are encrypted, you are covered. If I do the encryption for you, I give away a bunch of those benefits. If I'm completely compromised, you should assume that any keys I have access to are also compromised. I think giving up "deduplication" is completely reasonable in this regard; the competitive landscape right now is that "cloud backup" costs about 10x what I think it ought to cost for backups (In part due to the fact that many 'cloud backup' services are built to be fast enough to serve webpages; If you let me have 'backup system' level performance, I can do it a whole lot cheaper, but also in part due to the fact that s3 sets the price here, and S3 is still charging "pretty good for 2007" prices.)
joelthelion 15y ago
The RIAA is about to discover client-side encryption by default :)
RexRollman 15y ago
The RIAA really has become a disturbing entity.
- code_duck 15y ago
  The politicians who are willing to accept and act on their greased palm offers are the real problem. In a normal, non-corrupt system, the RIAA would never come anywhere near receiving such powers, anymore than Jim McJones down the street.
cks 15y ago
Why don't the cloud storage service providers encrypt/store all user content in such a way that it can only be read by the user? I doubt there are any ethical benefits in storing the data in such a way that they (the service providers) can read it. Even if there is I doubt that users would agree to such usage.
- jodrellblank 15y ago
  Because then they can't store only one copy of each duplicate file, skip uploading duplicate files, work with file hashes knowing that the same file will have the same hash, and less pleasantly, they can't do analytics, advertising and recommendations on the types and quantities of stored files.
  - bdhe 15y ago
    That's not true. As is, in a lot of crypto problems, there are powerful workarounds that require a lot of work. See here for one idea: http://news.ycombinator.com/item?id=2461713 http://news.ycombinator.com/item?id=2461713 Unfortunately, this starts to become a cat-and-mouse game.
    - jodrellblank 15y ago
      I won't pretend I can follow all the implications of that scheme, but it looks like all files are encrypted with an unchangeable hash of the file as the key? So that all the RIAA has to do is provide a sample mp3 and then DropBox can see who has AES(F, H(F)) stored. Only the files with user generated unknown content can remain mysterious to DropBox, widely used files cannot. And since you use aes(f, h(f)) you can't change the encryption key on any particular file. And since the client software needs to use the local DB and since they have the list of files you uploaded, they have most of the plaintext known if they want to try to decrypt the DB maliciously. But if they do want to, they can leak the password you type in to themselves anyway. Also, how would this scheme interact with DropBox's differential upload and revision tracking feature? ZFS does encryption and deduor too, so yes it is possible, but secure trustable ecrypted DropBox where they also do the encryption part?
cabalamat 15y ago
I'm sure if the MAFIAA thought they could get away with it they'd lobby for mandatory snooping software on everyone's PC so they could check for illegal copies. Because, y'know, human rights and the rule of law are far less important than preserving the music industry's business model for a few more years.
- ygreek 15y ago
  This idea is actually not as crazy as it may seem. Copyright lobby is usually just one step behind the Chinese policies of restricting access to the illegal content, with the only difference in definition of illegal. Chinese have developed such tool, [1], and were planning to install it on every new computer sold in China. But later scaled down it's use. [1] http://en.wikipedia.org/wiki/Green_Dam_Youth_Escort http://en.wikipedia.org/wiki/Green_Dam_Youth_Escort
- 911-inside_job 15y ago
  Well, if you were one of the major owners or CEOs of a recording company what would you value more - your own profits or the human rights of the unwashed masses?
- orangecat 15y ago
  Better yet, get rid of general purpose computing for civilians altogether. That's one reason I support Android; if most people end up on locked down platforms like iOS or WP7, it becomes much easier to pass and enforce draconian laws. Remember the CBDTPA (http://en.wikipedia.org/wiki/Consumer_Broadband_and_Digital_Television_Promotion_Act http://en.wikipedia.org/wiki/Consumer_Broadband_and_Digital_...)? It would actually be feasible if everyone were using iPads.
waterlesscloud 15y ago
Why is the RIAA special? I produce copyrighted material all the time. I demand the right to start looking at everyone's cloud files too.
- salemh 15y ago
  For a specific example. http://news.cnet.com/8301-13578_3-10133425-38.html http://news.cnet.com/8301-13578_3-10133425-38.html
- 911-inside_job 15y ago
  Because they've spent 10s of millions $ on bribing politicians ("lobbing") and you haven't.
yason 15y ago
I welcome thee, dear MAFIAA, to bring out your inspective forces upon the encrypted bits of my tarsnap.com archives. I hereby promise they positively do contain copyrighted materials indeed, and I thus encourage your troops to spend considerable time trying to decipher whatever it is that I've stored in these clouds of the 2010's internet.
michaelhalligan 15y ago
Why does the RIAA have so much power? If their businesses really are shrinking then, well, does the music industry even matter? It's depressing how much damage you can do to society when you use your ill-gotten gains to hire lobbyists to turn ordinary citizens into criminals.

62 points by ygreek 15y ago

I guess it is time to start encrypting the files I got in the cloud. None of which are copyright'ed or especially secret but better safe than sorry.

cookiecaper 15y ago

Encrypt, encrypt, encrypt. If possible, use ecryptfs or TrueCrypt or some other non-transparent encryption mechanism on files that you back up to remote sites so that you know they are always safely encrypted and don't have to think about it (just copy the lower-level, encrypted container). Both ecryptfs (with filename encryption) and TrueCrypt can back up encrypted versions of your files without even giving away filenames, so RIAA can't go acking for MP3s. Of course, manually using gpg and specifying an unrelated output filename works too. If you're uploading anything remotely important to a third-party service, you should encrypt all of it beforehand. As we see time and time again, it can be really surprising how easy it is for an insider, a random script kiddie, or in this case, a company with a posse of anxious lawyers to grab your data. You need to encrypt that data before it ever leaves your disk for persistent storage on someone else's infrastructure. Encrypt encrypt encrypt.

switch007 15y ago
100% agree. Encrypt. Not because of what you are afraid today, but for what might happen in the future. You can't even begin to imagine the ways our privacy will be violated tomorrow.
nextparadigms 15y ago
All file locker services should offer a check-box or something by default, before you upload your files, to encrypt them with your own key. That should cover a lot more people than it would if everyone had to do everything by themselves.
- gst 15y ago
  This should not be a checkbox, but it should be the default. And that's exactly what Wuala is doing.
  - cheez 15y ago
    Wake me up when Wuala open sources their client.
    - rdl 15y ago
      For just doing security reviews, I don't think open source should be a requirement; just available, published source.
- DasIch 15y ago
  Call me paranoid but I would not even consider that as an alternative to doing the encryption on my own.
  - lsc 15y ago
    This is why I've left some sort of server-side encryption out of the storage product I'm designing. I mean, I'm just using webdav, so it should be easy enough for you to bring your own client with encryption support; something you already trust. The main benefit of encryption in these situations is that you have to trust your provider a whole lot less... If I get compromised through a OS hole? if you are encrypted, you are covered. If I get compromised through a physical attack, governmental or otherwise? if you are encrypted, you are covered. If I do the encryption for you, I give away a bunch of those benefits. If I'm completely compromised, you should assume that any keys I have access to are also compromised. I think giving up "deduplication" is completely reasonable in this regard; the competitive landscape right now is that "cloud backup" costs about 10x what I think it ought to cost for backups (In part due to the fact that many 'cloud backup' services are built to be fast enough to serve webpages; If you let me have 'backup system' level performance, I can do it a whole lot cheaper, but also in part due to the fact that s3 sets the price here, and S3 is still charging "pretty good for 2007" prices.)

joelthelion 15y ago

The RIAA is about to discover client-side encryption by default :)

RexRollman 15y ago

The RIAA really has become a disturbing entity.

code_duck 15y ago
The politicians who are willing to accept and act on their greased palm offers are the real problem. In a normal, non-corrupt system, the RIAA would never come anywhere near receiving such powers, anymore than Jim McJones down the street.

cks 15y ago

Why don't the cloud storage service providers encrypt/store all user content in such a way that it can only be read by the user? I doubt there are any ethical benefits in storing the data in such a way that they (the service providers) can read it. Even if there is I doubt that users would agree to such usage.

jodrellblank 15y ago
Because then they can't store only one copy of each duplicate file, skip uploading duplicate files, work with file hashes knowing that the same file will have the same hash, and less pleasantly, they can't do analytics, advertising and recommendations on the types and quantities of stored files.
- bdhe 15y ago
  That's not true. As is, in a lot of crypto problems, there are powerful workarounds that require a lot of work. See here for one idea: http://news.ycombinator.com/item?id=2461713 http://news.ycombinator.com/item?id=2461713 Unfortunately, this starts to become a cat-and-mouse game.
  - jodrellblank 15y ago
    I won't pretend I can follow all the implications of that scheme, but it looks like all files are encrypted with an unchangeable hash of the file as the key? So that all the RIAA has to do is provide a sample mp3 and then DropBox can see who has AES(F, H(F)) stored. Only the files with user generated unknown content can remain mysterious to DropBox, widely used files cannot. And since you use aes(f, h(f)) you can't change the encryption key on any particular file. And since the client software needs to use the local DB and since they have the list of files you uploaded, they have most of the plaintext known if they want to try to decrypt the DB maliciously. But if they do want to, they can leak the password you type in to themselves anyway. Also, how would this scheme interact with DropBox's differential upload and revision tracking feature? ZFS does encryption and deduor too, so yes it is possible, but secure trustable ecrypted DropBox where they also do the encryption part?

cabalamat 15y ago

I'm sure if the MAFIAA thought they could get away with it they'd lobby for mandatory snooping software on everyone's PC so they could check for illegal copies. Because, y'know, human rights and the rule of law are far less important than preserving the music industry's business model for a few more years.

ygreek 15y ago
This idea is actually not as crazy as it may seem. Copyright lobby is usually just one step behind the Chinese policies of restricting access to the illegal content, with the only difference in definition of illegal. Chinese have developed such tool, [1], and were planning to install it on every new computer sold in China. But later scaled down it's use. [1] http://en.wikipedia.org/wiki/Green_Dam_Youth_Escort http://en.wikipedia.org/wiki/Green_Dam_Youth_Escort
911-inside_job 15y ago
Well, if you were one of the major owners or CEOs of a recording company what would you value more - your own profits or the human rights of the unwashed masses?
orangecat 15y ago
Better yet, get rid of general purpose computing for civilians altogether. That's one reason I support Android; if most people end up on locked down platforms like iOS or WP7, it becomes much easier to pass and enforce draconian laws. Remember the CBDTPA (http://en.wikipedia.org/wiki/Consumer_Broadband_and_Digital_Television_Promotion_Act http://en.wikipedia.org/wiki/Consumer_Broadband_and_Digital_...)? It would actually be feasible if everyone were using iPads.

waterlesscloud 15y ago

Why is the RIAA special? I produce copyrighted material all the time. I demand the right to start looking at everyone's cloud files too.

salemh 15y ago
For a specific example. http://news.cnet.com/8301-13578_3-10133425-38.html http://news.cnet.com/8301-13578_3-10133425-38.html
911-inside_job 15y ago
Because they've spent 10s of millions $ on bribing politicians ("lobbing") and you haven't.

yason 15y ago

I welcome thee, dear MAFIAA, to bring out your inspective forces upon the encrypted bits of my tarsnap.com archives. I hereby promise they positively do contain copyrighted materials indeed, and I thus encourage your troops to spend considerable time trying to decipher whatever it is that I've stored in these clouds of the 2010's internet.

michaelhalligan 15y ago

Why does the RIAA have so much power? If their businesses really are shrinking then, well, does the music industry even matter? It's depressing how much damage you can do to society when you use your ill-gotten gains to hire lobbyists to turn ordinary citizens into criminals.