Slashdot Mirror
Web-Based Private File Storage?
steve802 writes "Recently, someone died in our company, and word is getting around that the admins who were given access to his Outlook account have found personal things that are embarrassing at best (the rumor mill differs on what was found). No matter, it raises a question. I have personal stuff in Outlook folders that I would not want someone in IT to see if I suddenly dropped dead: emails to the wife, photos of the kids, that kind of thing. I also keep a journal at home that I save to a server; personal reflections that I never want anyone else to see, especially if I die. So I was thinking that some sort of web-based storage for files, individual emails, and perhaps even Outlook folders would be perfect. All my most private personal stuff in one place. I found CryptoHeaven, which seems to offer some of what I'm looking for — but it is pricey. I'm willing to pay, but something less than $400/year would be nice. Best would be a service with a dead-man's switch, so that if I don't access it in, say, three months, it auto-purges. Any thoughts?"
Slow, but very secure.
Dont use personal info on work systems. Often time anything in there is usually subject to scrutiny.
Why does it have to be web based? If the only requirement is absolute privacy, TrueCrypt will suffice.
I think you mean "emails to the wife, photos of the wife, that kind of thing"
Web-Based Private is an oxymoron. Why does this have to be web-based?
It would be pretty trivial to set up a Linux distro with two hard drives, one with the simple operating system and the other an encrypted drive with a passphrase, and set up the OS to nuke the second drive if the current time is ever greater than three months from the last time the passphrase was successfully supplied.
Solution: Don't do personal stuff on your work account...
They can already read your emails..
I've got to ask the question, but... why?
I mean, if you don't want anybody to find this stuff when you're dead, why bother collecting it when you're alive?
And for the 'pictures' of the wife, what's wrong with a Truecrypt store?
When you die, your writings and works are the only thing left of you. They are the only way for someone to try to dig deeper into your mind and build up an understanding of your true character. A lot of crazy shit happens in a lifetime, someone may really appreciate you leaving a book of your reflections behind.
I'm kind of surprised I haven't seen any comments on the bigger issue - the IT folks entrusted with this data who let data leak (or at least rumors of the content). As a system admin - if you're at that level you're already not trustworthy enough to keep that postion and would probably be reassigned depending on the severity. Understandably if it's something illegal then it needs to be report it but even still - discretion is still required. It's no one else's damned business.
Compare this to your HR person - would you like them to spill your SSN randomly here and there? Just because the guy is dead doesn't mean his data requires less care.
Anywho - as far as technical solutions 1) don't put personal stuff on a work computer, 2) even some web space and an ftp account should be nearly sufficient if you just need a place to store files remotely that isn't easily accessible.
I understand that it be a wicked long time before they crack the passphrase, and that a good passphrase is key. Mine is pretty amazingly awesome (long, case switching, numbers for letters, all that good stuff) but I still feel better knowing that there is a hard limit on the short side that prevents a successful attack.
I recommend Windows Home Server. Of course, it integrates perfectly with your Windows machines (since you're running Outlook you have at least one) and is the best backup and recovery solution I've been able to find for home use (you can roll back individual files). You can have folders mirrored on different drives, and you can control who has access to what folders.
Additionally, through the magic of dynamic DNS you can access your files through the Internet. You get a subdomain off homeserver.com which allows you to check the status of the server, upload or download photos, and if you have expensive enough versions of Windows on your machines at home you can control them via Remote Access.
I've used other NAS solutions for years at home, and I don't regret switching to WHS at all. FYI, I built my own server and installed WHS myself - I didn't buy one off the shelf, though you certainly could if you're not into building computers.
WinRAR? Turn over your geek card.
At least, use gpg to encrypt it and Dropbox to automate uploading/downloading. Bonus points for an automated encryption system (encfs mount point, for example).
Dilbert RSS feed
I only exchange emails with my wife and friends using my gmail account.
Clean house in your work email and stop doing that.
photos of the kids
If you are afraid IT will see pictures of your kids, either you got ugly kids or you took the wrong kinda pictures.
THL phish sticks
After 10 unsuccessful attempts at entering the passphrase in a row, it destroys the key, never to be recovered again.
If I was transporting a copy of the data across national borders, and I didn't want customs to get a copy... a self-destruct sequence makes a lot of sense. But to have a permanent sword of damocles dangling over the data by a thread... If I valued the data so much that I was willing to go to extremes to protect it... and then set it up to be irrevocably trashed that easily... I might as well just delete it now to save myself the aggravation.
Are we still discussing this today? Use your work email for work only. If you don't want it printed and put on the office wall, email from 1) the web using hotmail/gmail/yahoomail/etc. 2) use your personal cell phone 3) use a portable client on a usb drive to send via your personal account. 3) Connect to a pc at your home to send email via logmein/etc. By encrypting you are just going to get management and the IT admins pissed. I tell my users, that if they type it on a company computer then it belongs to the company. If you don't agree, you need to talk to your manager and get the "official" word.
http://www.youtube.com/watch?v=h9gnexnnIDc
It all starts at 0
You could just put a NAS in a closet and use that. You'd have 100% control, and you could do it for $0 if you use something like FreeNas.
I don't respond to AC's.
Yeah, really! I don't know why anyone is paranoid about Google at all when your ISP and cellphone providers have all your data activity records on hand.
I pay a bit extra for the "business" tier of service, so I can actually run my own web and email server on my home machine. I've pretty much been hosting everything on my own server since my college days. Never used / needed a USB stick for working on school projects, just pulled it in over the internet using PuTTy/PSFTP or more likely VNC+ssh. I even presented some final projects over VNC running a little opengl thing over VNC.
I don't have a "smartphone" (call me old skool), but if I did all I'd need is a good ssh client (such as midpssh) and a good VNC client, and I'm in business. Works fine on my Palm TX PDA tethered to my dumbphone.
For offsite backups, I occasionally rsync my home dir over to a friend's server, which I've donated hardware for (including hard disks, among other things). The sensitive stuff like financial records and nekkid pics of the wife are encrypted with PGP. The rest of the porn we all share.
Frankly I'm more worried about data being lost forever than data getting "out". If I get hit by a truck, my dying words scrawled in a pool of blood will be the master password for my keyring vault so my wife can pay the bills online. I'll pass away very anxious about whether she can decipher the special characters properly.
My thoughts are similar to those which have already been posted, but here's my two cents anyways.
1.) Do something about that IT staff. Their behavior is unprofessional at best, borderline illegal at worst. As Network and Systems Administrators, we essentially have the "keys to the kingdom." As such, it is our responsibility to exercise professionalism and discretion at all times. We are entrusted with this data -- employee data, customer data, what-have-you -- because it needs to be managed, secured, transported, and we know how to do that. When I ponder this, it sometimes brings to mind a line from Angels & Demons: "Be delicate with our treasures." If management has asked that the late co-worker's email be opened and archived, and that email happens to contain pictures of him in a tutu and a snorkel dancing hip-deep in a lake, and IT happens to see these photos, it is their responsibility to maintain their professionalism, and to say nothing about it.
2.) Do not, for any reason, store personal data on company resources. Period. Company resources belong to the company, and, as such, the company has the right to inspect any and all data which those resources may contain. My personal data on my laptop, and my personal mail (which sits on an IMAP server which I administer and to which I have physical access) are backed up to DVD every quarter, and those DVDs are placed in an envelope in a sealed plastic bag - along with a hardcopy of my password spreadsheet - in a safe-deposit box. My Will clearly states who gets access to that box if I should happen to fall under a bus, as does the paperwork at the institution which houses the box. It's not the fanciest solution, but it's effective, and I like it.
.... if companies didn't encroach in personal time.
IANAL but write like a drunk one.