4 ms·

I hope we go the way of the dumb terminal from an ease-of-use standpoint; I want my data to just "be", and not have to worry about syncing/backups/etc. From th

I hope we go the way of the dumb terminal from an ease-of-use standpoint; I want my data to just "be", and not have to worry about syncing/backups/etc. From the freedom/privacy standpoint, however, I'm not sure. I find it surprisingly easy to imagine a US government agency empowered by anti-terror laws to get access to my data. This is why I want encrypted cloud computing for all my stuff. I dunno if the large players could actually do that and have the US govt be ok with it.

epscylonb 15y ago
How can you verify the security of the "cloud" hosted data?.
- tommi 15y ago
  The encryption key must reside only on trusted (client side) devices to allow your data to be hosted by a third party without them actually seeing your data.
  - mooneater 15y ago
    (Golf clap)... and in practice how would one verify such a scheme?
    - nl 15y ago
      What do you mean? Verifying that data going across the wire is encrypted is fairly easy to do. You check the data going out is encrypted and that it is encrypted when it comes back. Is that enough verification for you? Depending on how much you trust the vendor you can go further - run it in a debugger and check where it gets the key for example.
      - deleted 15y ago
        [deleted]
      - mooneater 15y ago
        Of course I agree with you, it is possible in theory. I was being cynical about the full picture -- you need to trust the client hardware and its software are completely malware-free. Which... is kinda hard to verify.
      - BCM43 15y ago
        How do you verify that the key is not being sent over the network by malicious software?
        nl 15y ago
        How do you check if any malicious software is doing something? You check what files are being read, and you correlate with network traffic. You lock down access to files like private keys as much as possible to minimize the possibility of this.
    - darklajid 15y ago
      Tiny device on your keyring? For example (not affiliated): https://yubico.com/ https://yubico.com/
- Locke1689 15y ago
  Client side encryption and open source client software a la Tarsnap.
  - kiloaper 15y ago
    Client side encryption doesn't seem to fit with the ChromeOS concept. All your information is in your Google account, all your documents on Google Docs and none of it is encrypted as far as I know (Open to Correction). An engineer at Google could theoretically look at all your bookmarks, documents, browsing history etc. Add aggressive US "anti-terror" laws into the mix and it looks like ChromeOS is not a good choice for those looking for real privacy.
    - jrockway 15y ago
      If the government wants to read your documents, it's just as easy for them to get a warrant to search your house as it is for them to get a warrant to compel Google to give them your docs.
      - kiloaper 15y ago
        Except, as we've seen with wiretapping and so many other data breaches, if it's 'just there' and can easily be indexed and searched with the click of a mouse, then it will be. Searching someones house requires proper channels to be followed. Looking at files on a PC is so much easier, can be done without the person knowing and is, imho, too great a temptation to resist. The emergence of laws in the US to make such access as easy and automated as possible proves this.
- jefffoster 15y ago
  There's an interesting area of research called Homomorphic encryption (http://en.wikipedia.org/wiki/Homomorphic_encryption http://en.wikipedia.org/wiki/Homomorphic_encryption). In this schema, certain properties of the data are maintained even after encryption. In the general case you would be able to stored encrypted data in the cloud and perform operations on it without needing to decrypt the data.
aangjie 15y ago
From the privacy standpoint am still uncomfortable at the idea of having my data on the cloud even if it's encrypted and would prefer to keep it local. Ofcourse, my rational side points out that i don't have any data that is worth my cloud provider to run brute-force attacks and decrypt.... But then there's also the fact that i have access to a decent set of hdd's and can store it locally rather with ease.with the cost being the attention and time of running smartctl once in a while to check the health of the hdd's and getting a backup...

epscylonb 15y ago

How can you verify the security of the "cloud" hosted data?.

tommi 15y ago
The encryption key must reside only on trusted (client side) devices to allow your data to be hosted by a third party without them actually seeing your data.
- mooneater 15y ago
  (Golf clap)... and in practice how would one verify such a scheme?
  - nl 15y ago
    What do you mean? Verifying that data going across the wire is encrypted is fairly easy to do. You check the data going out is encrypted and that it is encrypted when it comes back. Is that enough verification for you? Depending on how much you trust the vendor you can go further - run it in a debugger and check where it gets the key for example.
    - deleted 15y ago
      [deleted]
    - mooneater 15y ago
      Of course I agree with you, it is possible in theory. I was being cynical about the full picture -- you need to trust the client hardware and its software are completely malware-free. Which... is kinda hard to verify.
    - BCM43 15y ago
      How do you verify that the key is not being sent over the network by malicious software?
      - nl 15y ago
        How do you check if any malicious software is doing something? You check what files are being read, and you correlate with network traffic. You lock down access to files like private keys as much as possible to minimize the possibility of this.
  - darklajid 15y ago
    Tiny device on your keyring? For example (not affiliated): https://yubico.com/ https://yubico.com/
Locke1689 15y ago
Client side encryption and open source client software a la Tarsnap.
- kiloaper 15y ago
  Client side encryption doesn't seem to fit with the ChromeOS concept. All your information is in your Google account, all your documents on Google Docs and none of it is encrypted as far as I know (Open to Correction). An engineer at Google could theoretically look at all your bookmarks, documents, browsing history etc. Add aggressive US "anti-terror" laws into the mix and it looks like ChromeOS is not a good choice for those looking for real privacy.
  - jrockway 15y ago
    If the government wants to read your documents, it's just as easy for them to get a warrant to search your house as it is for them to get a warrant to compel Google to give them your docs.
    - kiloaper 15y ago
      Except, as we've seen with wiretapping and so many other data breaches, if it's 'just there' and can easily be indexed and searched with the click of a mouse, then it will be. Searching someones house requires proper channels to be followed. Looking at files on a PC is so much easier, can be done without the person knowing and is, imho, too great a temptation to resist. The emergence of laws in the US to make such access as easy and automated as possible proves this.
jefffoster 15y ago
There's an interesting area of research called Homomorphic encryption (http://en.wikipedia.org/wiki/Homomorphic_encryption http://en.wikipedia.org/wiki/Homomorphic_encryption). In this schema, certain properties of the data are maintained even after encryption. In the general case you would be able to stored encrypted data in the cloud and perform operations on it without needing to decrypt the data.

aangjie 15y ago

From the privacy standpoint am still uncomfortable at the idea of having my data on the cloud even if it's encrypted and would prefer to keep it local. Ofcourse, my rational side points out that i don't have any data that is worth my cloud provider to run brute-force attacks and decrypt.... But then there's also the fact that i have access to a decent set of hdd's and can store it locally rather with ease.with the cost being the attention and time of running smartctl once in a while to check the health of the hdd's and getting a backup...