4 ms·

How so? Amazon, Google and Microsoft need access to your unencrypted data in order to provide most of their services (such as databases, analytics, machine lear

How so? Amazon, Google and Microsoft need access to your unencrypted data in order to provide most of their services (such as databases, analytics, machine learning). There's not much they can do with encrypted data. They can store it. They can pass it through. That's it. This problem has to be solved on a political level. There is no technical fix and the legal workarounds appear to be exhausted.

darkwater 4y ago
My RDS data is stored encrypted on disks with a private key AWS operators has no access to [1] (or at least that's what they tell you), and the application layer connection is controlled by a password transmitted over a TLS-only connection, whose private key - again - AWS has no access to. [1] https://aws.amazon.com/blogs/database/securing-data-in-amazon-rds-using-aws-kms-encryption/ https://aws.amazon.com/blogs/database/securing-data-in-amazo...
- fauigerzigerk 4y ago
  You're decrypting data on Amazon's hardware using software provided by Amazon. Of course they can access your unencrypted data if they have to. It comes down to the details of the legal obligation they have under U.S law. Are there limits to what they have to do to help U.S law enforcement, and what exactly are those limits?
- e98cuenc 4y ago
  The data in memory in that server is not encrypted. Amazon owning the server can log in it and read whatever part of the memory they want. I don't see how encrypting data at rest helps you in this scenario. If GDPR makes all the cloud services provided by American companies illegal, what alternatives European companies have? Services like OVH and Hetzner are great as a low cost but they don't provide the same services at all. How about Netsuite (Oracle), Netsuite, etc.? My guess is that ~100% of European companies use some kind of US service and there are no realistic alternatives, are they going to rule all companies are doing something illegal?
zelphirkalt 4y ago
Would creating competing services within Europe, falling under EU law, count as political or technical solution?
- fauigerzigerk 4y ago
  Creating "competing"* services does not solve the problem of how Europeans can continue to use U.S. services if and when they (we) prefer to do so based on technical merit. I don't think it's a good idea to let the world (and the internet) fragment into ever smaller jurisdictions that can no longer find a way to trade with each other. We need a legal agreement to sort this out or everyone will be worse off. * They wouldn't actually have to compete at all if U.S services were banned.

darkwater 4y ago

My RDS data is stored encrypted on disks with a private key AWS operators has no access to [1] (or at least that's what they tell you), and the application layer connection is controlled by a password transmitted over a TLS-only connection, whose private key - again - AWS has no access to. [1] https://aws.amazon.com/blogs/database/securing-data-in-amazon-rds-using-aws-kms-encryption/ https://aws.amazon.com/blogs/database/securing-data-in-amazo...

fauigerzigerk 4y ago
You're decrypting data on Amazon's hardware using software provided by Amazon. Of course they can access your unencrypted data if they have to. It comes down to the details of the legal obligation they have under U.S law. Are there limits to what they have to do to help U.S law enforcement, and what exactly are those limits?
e98cuenc 4y ago
The data in memory in that server is not encrypted. Amazon owning the server can log in it and read whatever part of the memory they want. I don't see how encrypting data at rest helps you in this scenario. If GDPR makes all the cloud services provided by American companies illegal, what alternatives European companies have? Services like OVH and Hetzner are great as a low cost but they don't provide the same services at all. How about Netsuite (Oracle), Netsuite, etc.? My guess is that ~100% of European companies use some kind of US service and there are no realistic alternatives, are they going to rule all companies are doing something illegal?

zelphirkalt 4y ago

Would creating competing services within Europe, falling under EU law, count as political or technical solution?

fauigerzigerk 4y ago
Creating "competing"* services does not solve the problem of how Europeans can continue to use U.S. services if and when they (we) prefer to do so based on technical merit. I don't think it's a good idea to let the world (and the internet) fragment into ever smaller jurisdictions that can no longer find a way to trade with each other. We need a legal agreement to sort this out or everyone will be worse off. * They wouldn't actually have to compete at all if U.S services were banned.