5 ms·
Doesn't say it moves the data, just that the legal entity providing service is the Irish subsidiary.
by fred256 11y ago
Doesn't say it moves the data, just that the legal entity providing service is the Irish subsidiary.
- Hobotron1 11y agoWouldn't the NSA be able to capture the data on the way out anyways?
- JoshTriplett 11y agoIt would be completely irresponsible to not encrypt the data in transit between data centers.
- deleted 11y ago[deleted]
- scintill76 11y agoMaybe, but Gmail just started doing that a year ago: http://www.theverge.com/2014/3/20/5530072/google-encrypts-gmail-between-data-centers-to-keep-out-nsa http://www.theverge.com/2014/3/20/5530072/google-encrypts-gm...
- nullrouted 11y agoLets be fair here though. Google encrypted their PRIVATE data links based on the Snowden reports. Most people/companies would assume their p2p (point to point) links would be private, which to be honest is a fair assumption.
- skuhn 11y agoIt used to be a fair assumption, but now everyone has moved to encrypt any connectivity that goes outside of your physical oversight. Some people are paranoid enough to encrypt cross connects within the same facility that run between cages or floors, which is a sad state of affairs (but, in my opinion, sensible).
- Nevermark 11y agoYes, the sensible solution is for all communication to be encrypted as tools and services get up to speed on that. There is nothing to be gained by continually making judgement calls about which communications need to be secure and which don't. Like a lot of other technology, security needs to become pervasive so we can all take it for granted and worry about productive problems.
- colechristensen 11y agoAnd completely unreasonable not to suspect that the NSA can freely acquire those keys.
- JoshTriplett 11y agoOnly if they already have illicit access to the systems in question. In which case, considering Dropbox doesn't actually encrypt data at rest, it'd be much easier to get the data at the endpoints than in transit.
- skuhn 11y agoData is indeed encrypted on the storage systems (but not on client machines, if that's what you meant).
- JoshTriplett 11y agoIf it were only the end-user client systems, that'd be less of a concern, but the servers that run web frontends and similar also have full access.
- colechristensen 11y agoMy point is that there are a few assumptions you should make * A significant number of encryption technologies are broken or achievably breakable by the NSA * The NSA has already or could easily acquire encryption keys from any large tech company with a court order in one of the secret courts * The NSA has vast means for illicit access into systems and networks
- lwf 11y agohttps://www.dropbox.com/en/help/27 https://www.dropbox.com/en/help/27
- JoshTriplett 11y agoNot even remotely comforting. Talks all about how employees "are prohibited" from accessing your data, but that's unrelated to whether they're capable of doing so. I much prefer the privacy policies of more secure services, which tend to say things like "we do not have the ability to access your data under any circumstances".
- nosir33 11y agoIn terms of alternatives, AWS WorkDocs provides data storage in Ireland (and the US, Singapore and Australia).
- bigiain 11y agoBut since Amazon has offices in the USA, the NSA considers all AWS hosted data in whatever country the Amazon operated data center is located in, to be under US jurisdiction. I had a client who pulled all their (encrypted) data off the Ninefold cloud (Ninefold were at the time a fully Australian owned and hosted company) when they leased data center space and opened an office in CA – due to data sovereignty concerns.
- notatoad 11y agoIsn't Dropbox also entirely aws-hosted?
- bigiain 11y agoYep, and has exactly the same "company officers residing in the US" exposure to the NSA and any of the agencies fighting the war on [drugs|terrorism|pedos|political-rivals] getting closed or open court warrants with or without gag orders. In fact Dropbox is doubly at risk, law enforcement or national security could target either (or both) Dropbox themselves - go straight to Amazon to get access at hypervisor level to their entire infrastructure.