5 ms·

I wonder what they would have done had it been named "Basecamp Competitor Business Plan.pdf". Would have been awfully tempting to take a peak. Exactly why they

I wonder what they would have done had it been named "Basecamp Competitor Business Plan.pdf". Would have been awfully tempting to take a peak. Exactly why they shouldn't even be looking at filenames.

corin_ 15y ago
Ultimately a company storing files is almost certainly going to require its staff to look through directories, log files, database tables. And it is certainly going to require staff to have the ability, even if they never have to use it. By giving them your files you are trusting them not to screw you over.
- prof_hobart 15y ago
  If a file storage company that claims to be protecting users' data isn't storing it in an encrypted manner that requires people to jump through all manner of technical and proceduraly hoops to get access to them, then they are failing quite badly.
  - corin_ 15y ago
    Whatever encryption is there (and we don't know what they are doing in this respect), their staff who manage the systems still have access to look up the file name of the Xth file, or if they like to go snooping through all files.
- mike-cardwell 15y ago
  This is true. The problem here is that they went looking through private user data when they didn't need to. If they were only doing it when essential, eg to debug a problem, people wouldn't be complaining. It's the fact that they did it without their being an urgent need to that has bothered people I think. What other trivial reasons have they used to look through peoples data?
- sunir 15y ago
  Unless explicitly authorized by the customer, or for the purpose of providing the service, your staff should not be allowed to look at customer data, and what data they look at should be limited to what's necessary to perform their function. If you do want the right to spelunk through customer data, you need to declare that in the privacy policy. If you declare otherwise, you're breaching the contract with the customer. The problem is that incidents and attitudes like this make the market lose trust with the cloud services industry, which is poison to everyone.
  - jmtulloss 15y ago
    I'm not sure I understand what you're saying here. The only contract with the customer is the privacy policy. The privacy policy is just a promise from a site to abide by certain rules. In the case that there is not a privacy policy, then whatever you tell that site can and will be used against you. From tracking cookies to the most sensitive of files, if you are providing information to a site then you have to assume that it will be used in any way the company sees fit unless they promise otherwise. Ethically there may be different obligations, but to say that there is some implicit "contract with the customer" is simply not the case.
    - sunir 15y ago
      Since 1890 in the United States, the tort law has had concepts of invasion of privacy and breach of trust. Further on a state by state level there may be laws, such as COPPA 2003 in California, which required a privacy policy to be published. Canada and the EU have even more protective laws if you trade there. I feel it is safer and more realistic to presume the first paragraph I wrote is the case and cover yourself with a privacy policy if you want to do otherwise as I mentioned. As always, ask a lawyer if you want professional advice.
  - BadassFractal 15y ago
    I came here to post exactly that. In most serious cloud teams you have very few select people with authorization to look at customer data (the operations team), and everybody else is outside of that group. When debugging the service, you have to pass instructions to that team so that in case confidential data is revealed, only they get to see it.
- Silhouette 15y ago
  > Ultimately a company storing files is almost certainly going to require its staff to look through directories, log files, database tables. Why? (Or at least, why should they see anything private in raw form?) > And it is certainly going to require staff to have the ability, even if they never have to use it. Why? > By giving them your files you are trusting them not to screw you over. By giving themselves the technical ability to examine private user data, they are making a strong (or indeed legally compelling, in some cases) argument for not using their service to store anything private at all. That's a death sentence for most cloud services. We don't accept companies storing passwords in plain text. We don't accept companies transmitting credit card data in the clear, and PCI DSS requires quite strict controls on access to such data even when it's stored internally on the company network. Businesses dealing with sensitive data such as health records are subject to all kinds of regulations on the privacy of that data. Professionals dealing with privileged communications such as between lawyers and clients don't get a pass. Off-site backup services give all kinds of strong guarantees about the security and privacy of the data entrusted to them. Why should we give a pass to anyone else, because they can't figure out how to set up a security system where only the end user can access the unencrypted version of their own data?
  - corin_ 15y ago
    > We don't accept companies storing passwords in plain text. We don't accept companies transmitting credit card data in the clear This is in case somebody gains unauthorised access to the data, not in case staff can't be trusted. For example, paying by credit card over the phone you hand over your phone number to whoever is taking your order, but if they were to enter it into a system that system then has to comply with regulations. As to plain text passwords, again this is in case of the data being stolen. It's all very well saying "Google shouldn't store plain text passwords", but if Google as a company wanted to read my email, they could a.) just replace the encrypted password in my database entry with one that they can use or b.) place code in their login system that would log the plain text password secretly or c.) Go straight into where my emails are being stored and access them there. How do you get around this and make it impossible for them to access your data?
    - 15y ago
wlll 15y ago
If (in the course of essential sysadmin duties) I saw a file named "Basecamp Competitor Business Plan.pdf", or in fact any name, I wouldn't look at it because that would be wrong, no temptation.
- mike-cardwell 15y ago
  Same here. There are countless sysadmins who would look though. Especially if they had a financial interest. There are even more who wouldn't look, but would just mention, "Guess what our 100 millionth file was named" to a Director, who also happened to have access.
- Silhouette 15y ago
  Unfortunately, when around 1 in 3 sysadmins spy on their own colleagues (depending on whose report you read), it's apparent that not everyone has your moral fibre and something more than simply "trust the individual to do the job professionally" is called for.
felipemnoa 15y ago
All the data should be encrypted and only the user's password should be able to decrypt the data. That way you eliminate the problem of someone peaking into your files.
- saurabhnanda 15y ago
  How would a 'forgot password' function work in this case? If you're using something like GPG to encrypt and the password is basically the passphrase for the key, a customer forgetting his/her password would become an irreversible event, and he/she would end up losing all data.
  - felipemnoa 15y ago
    >>How would a 'forgot password' function work in this case? You are screwed. Simple as that.
  - GaryOlson 15y ago
    We have all begun to assume that the business function of restoring a lost password is almost a right. This is a service; and as such a different level of account service should be implemented for the lost password function. If you are willing to assume the risk of all data lost, no password recovery service and no charge. If you want the password recovery service, then a mechanism and equivalent service charge are implemented on your account.
billpatrianakos 15y ago
It's funny you mention that because I actually do have such a file! I also went ahead and used Basecamp too to get a sense of what could be improved or simplified. But of course I didn't even consider uploading that file and this was long before this whole debacle started. We need to trust services like Basecamp, Google Docs and the others... A lot. But we also need to be smart about that trust. A healthy distrust is definitely in order in certain circumstances.
BoppreH 15y ago
The filename could contain enough information to be a big breach of privacy by itself. Think "microsoft bankruptcy proposal.doc"; "google downsizing plans 2012/2.xls"; "ipad 3 presentation draft.ppt". Temptation can be resisted, but in this cases you are in trouble just for glancing.
tintin 15y ago
Very true. What if it was a screenshot of a secret CATalog? Or a scan of some secret Company Anonymous Transfer or whatever. So I hope they never took a look at the "cat.jpg" file because you just cannot tell what's inside.
absconditus 15y ago
Another interesting case would be "Plan to kill the President.ppt".

I wonder what they would have done had it been named "Basecamp Competitor Business Plan.pdf". Would have been awfully tempting to take a peak. Exactly why they shouldn't even be looking at filenames.

corin_ 15y ago

Ultimately a company storing files is almost certainly going to require its staff to look through directories, log files, database tables. And it is certainly going to require staff to have the ability, even if they never have to use it. By giving them your files you are trusting them not to screw you over.

prof_hobart 15y ago
If a file storage company that claims to be protecting users' data isn't storing it in an encrypted manner that requires people to jump through all manner of technical and proceduraly hoops to get access to them, then they are failing quite badly.
- corin_ 15y ago
  Whatever encryption is there (and we don't know what they are doing in this respect), their staff who manage the systems still have access to look up the file name of the Xth file, or if they like to go snooping through all files.
mike-cardwell 15y ago
This is true. The problem here is that they went looking through private user data when they didn't need to. If they were only doing it when essential, eg to debug a problem, people wouldn't be complaining. It's the fact that they did it without their being an urgent need to that has bothered people I think. What other trivial reasons have they used to look through peoples data?
sunir 15y ago
Unless explicitly authorized by the customer, or for the purpose of providing the service, your staff should not be allowed to look at customer data, and what data they look at should be limited to what's necessary to perform their function. If you do want the right to spelunk through customer data, you need to declare that in the privacy policy. If you declare otherwise, you're breaching the contract with the customer. The problem is that incidents and attitudes like this make the market lose trust with the cloud services industry, which is poison to everyone.
- jmtulloss 15y ago
  I'm not sure I understand what you're saying here. The only contract with the customer is the privacy policy. The privacy policy is just a promise from a site to abide by certain rules. In the case that there is not a privacy policy, then whatever you tell that site can and will be used against you. From tracking cookies to the most sensitive of files, if you are providing information to a site then you have to assume that it will be used in any way the company sees fit unless they promise otherwise. Ethically there may be different obligations, but to say that there is some implicit "contract with the customer" is simply not the case.
  - sunir 15y ago
    Since 1890 in the United States, the tort law has had concepts of invasion of privacy and breach of trust. Further on a state by state level there may be laws, such as COPPA 2003 in California, which required a privacy policy to be published. Canada and the EU have even more protective laws if you trade there. I feel it is safer and more realistic to presume the first paragraph I wrote is the case and cover yourself with a privacy policy if you want to do otherwise as I mentioned. As always, ask a lawyer if you want professional advice.
- BadassFractal 15y ago
  I came here to post exactly that. In most serious cloud teams you have very few select people with authorization to look at customer data (the operations team), and everybody else is outside of that group. When debugging the service, you have to pass instructions to that team so that in case confidential data is revealed, only they get to see it.
Silhouette 15y ago
> Ultimately a company storing files is almost certainly going to require its staff to look through directories, log files, database tables. Why? (Or at least, why should they see anything private in raw form?) > And it is certainly going to require staff to have the ability, even if they never have to use it. Why? > By giving them your files you are trusting them not to screw you over. By giving themselves the technical ability to examine private user data, they are making a strong (or indeed legally compelling, in some cases) argument for not using their service to store anything private at all. That's a death sentence for most cloud services. We don't accept companies storing passwords in plain text. We don't accept companies transmitting credit card data in the clear, and PCI DSS requires quite strict controls on access to such data even when it's stored internally on the company network. Businesses dealing with sensitive data such as health records are subject to all kinds of regulations on the privacy of that data. Professionals dealing with privileged communications such as between lawyers and clients don't get a pass. Off-site backup services give all kinds of strong guarantees about the security and privacy of the data entrusted to them. Why should we give a pass to anyone else, because they can't figure out how to set up a security system where only the end user can access the unencrypted version of their own data?
- corin_ 15y ago
  > We don't accept companies storing passwords in plain text. We don't accept companies transmitting credit card data in the clear This is in case somebody gains unauthorised access to the data, not in case staff can't be trusted. For example, paying by credit card over the phone you hand over your phone number to whoever is taking your order, but if they were to enter it into a system that system then has to comply with regulations. As to plain text passwords, again this is in case of the data being stolen. It's all very well saying "Google shouldn't store plain text passwords", but if Google as a company wanted to read my email, they could a.) just replace the encrypted password in my database entry with one that they can use or b.) place code in their login system that would log the plain text password secretly or c.) Go straight into where my emails are being stored and access them there. How do you get around this and make it impossible for them to access your data?
  - 15y ago

wlll 15y ago

If (in the course of essential sysadmin duties) I saw a file named "Basecamp Competitor Business Plan.pdf", or in fact any name, I wouldn't look at it because that would be wrong, no temptation.

mike-cardwell 15y ago
Same here. There are countless sysadmins who would look though. Especially if they had a financial interest. There are even more who wouldn't look, but would just mention, "Guess what our 100 millionth file was named" to a Director, who also happened to have access.
Silhouette 15y ago
Unfortunately, when around 1 in 3 sysadmins spy on their own colleagues (depending on whose report you read), it's apparent that not everyone has your moral fibre and something more than simply "trust the individual to do the job professionally" is called for.

felipemnoa 15y ago

All the data should be encrypted and only the user's password should be able to decrypt the data. That way you eliminate the problem of someone peaking into your files.

saurabhnanda 15y ago
How would a 'forgot password' function work in this case? If you're using something like GPG to encrypt and the password is basically the passphrase for the key, a customer forgetting his/her password would become an irreversible event, and he/she would end up losing all data.
- felipemnoa 15y ago
  >>How would a 'forgot password' function work in this case? You are screwed. Simple as that.
- GaryOlson 15y ago
  We have all begun to assume that the business function of restoring a lost password is almost a right. This is a service; and as such a different level of account service should be implemented for the lost password function. If you are willing to assume the risk of all data lost, no password recovery service and no charge. If you want the password recovery service, then a mechanism and equivalent service charge are implemented on your account.

billpatrianakos 15y ago

It's funny you mention that because I actually do have such a file! I also went ahead and used Basecamp too to get a sense of what could be improved or simplified. But of course I didn't even consider uploading that file and this was long before this whole debacle started. We need to trust services like Basecamp, Google Docs and the others... A lot. But we also need to be smart about that trust. A healthy distrust is definitely in order in certain circumstances.

BoppreH 15y ago

The filename could contain enough information to be a big breach of privacy by itself. Think "microsoft bankruptcy proposal.doc"; "google downsizing plans 2012/2.xls"; "ipad 3 presentation draft.ppt". Temptation can be resisted, but in this cases you are in trouble just for glancing.

tintin 15y ago

Very true. What if it was a screenshot of a secret CATalog? Or a scan of some secret Company Anonymous Transfer or whatever. So I hope they never took a look at the "cat.jpg" file because you just cannot tell what's inside.

absconditus 15y ago

Another interesting case would be "Plan to kill the President.ppt".