3 ms·

I have a question for those familiar with cloud storage. Even I, as an ordinary user, won’t put my data without strong client side encryption in the cloud (eve

by aborsy 4y ago

I have a question for those familiar with cloud storage. Even I, as an ordinary user, won’t put my data without strong client side encryption in the cloud (even then there is a risk). How come major international (say, European) companies store their data in servers of the American countries? What prevents US intelligence agencies and even corporate from snooping into valuable business data in order to stay ahead? It’s like I back up my data to my competitor’s computer. I think there was a decade where the situation was not as clear as it’s now, and cloud companies could collect a lot of data. I don’t think it’s that easy anymore, with the spread of client side encryption and so on (although e2ee has limitations too).

deanCommie 4y ago
The same way as you. Most of these services support client-side encryption or server-side encryption with customer-managed keys with services like KMS: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html https://docs.aws.amazon.com/kms/latest/developerguide/concep... Now if you want to get your tinfoil hat on and say "If it's server-side, then what's stopping Amazon from just lying", the answer is independent auditors. You might not be able to get a tour of the inner workings of these services, but multi-billion dollar customers absolutely ask for it and get it under NDA's.
- aborsy 4y ago
  You are right. I use KMS sometimes, but that’s server side encryption. KMS protects a master key. It doesn’t protect data encryption keys encrypted with that master key. Those keys are exposed outside HSMs, in places like S3 in RAM or sometimes disks. Further, the encryption and decryption of data are done outside HSM. So, I know my disk encrypted with KMS is not protected from AWS. But I guess the audits help here. Also, client side encryption works for things like backups. End to end encryption rules out a lot of features. Therefore lot of companies store data in plaintext (data base, web servers, user facing services etc).

by aborsy 4y ago

deanCommie 4y ago

The same way as you. Most of these services support client-side encryption or server-side encryption with customer-managed keys with services like KMS: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html https://docs.aws.amazon.com/kms/latest/developerguide/concep... Now if you want to get your tinfoil hat on and say "If it's server-side, then what's stopping Amazon from just lying", the answer is independent auditors. You might not be able to get a tour of the inner workings of these services, but multi-billion dollar customers absolutely ask for it and get it under NDA's.

aborsy 4y ago
You are right. I use KMS sometimes, but that’s server side encryption. KMS protects a master key. It doesn’t protect data encryption keys encrypted with that master key. Those keys are exposed outside HSMs, in places like S3 in RAM or sometimes disks. Further, the encryption and decryption of data are done outside HSM. So, I know my disk encrypted with KMS is not protected from AWS. But I guess the audits help here. Also, client side encryption works for things like backups. End to end encryption rules out a lot of features. Therefore lot of companies store data in plaintext (data base, web servers, user facing services etc).