Slashdot Mirror
Ask Slashdot: Is Your Data Safe In the Cloud?
With so much personal data being kept on the cloud, including government and health records or your source code, do you have any concerns about it falling into the wrong hands? Do you think the cloud's benefits are outweighed by continuing security issues?
No one is going to care as much about your data as you do. Next question please.
putting the 'B' in LGBTQ+
In many cases maybe your data is even more secure in a cloud than on your own servers, especially if you choose your 'cloud' carefully (outside of your country/jurisdiction).
The real threats to your data are your own employees and your government. The outside 'hackers' come as a very distant third.
You can't handle the truth.
then store it to the cloud w/ you just knowing the keys/passphrases
I do not trust the cloud, because I can't grab it and bury/burn it at my whim. Just like posting on FB, once you have done it - that data is out there, forever.
local storage will never die.
It's still someone else's servers holding my data and I still have to go through some hoop(s) to get at it from other devices. What is so special about it?
::rimshot::
No, seriously - depending on the cloud service, aren't buckets of data encrypted in such a way that only the owner of the data can access them? Cloud service providers may be required to hand over data, but do they have the means of handing over the encryption keys along with it?
For certain cloud services where you're uploading via browser, they may be encrypting your data post-upload, so the request to decrypt may be more trivial. However, if you manage your own (like S3 backups) - or simply use a service that encrypts BEFORE uploading, I'm not sure there's a whole lot Amazon or some other provider could do to hand over the data in any usable form.
Those who are concerned about security of their data should ensure that the backup is encrypted in an acceptable method, or simply stash it in an encrypted container before storing it "online" (I realize there may be limitations of scale with that suggestion).
$ man woman *
-bash:
Unlike all other Ask Slashdots, this question is not prededed by "$USERNAME writes", so who actually proposed this question? A user that didn't get credit? A Slashdot editor? Someone from Sourceforge? The post introducing sponsored Ask Slashdots says that "the sponsors don't pick the questions", but that's still ambiguous. Many people are skeptical about this being thinly veiled astroturfing, so it's important to be as transparent as possible.
I would encrypt any sensitive data I may have before storing it in the "cloud". It would be irresponsible to assume the data can not be read or copied by others.
Note to slashdot: It'll be hard to maintain whatever shred of journalistic veneer and integrity you have left if you start posting advertisements for sister websites as 'sponsorships' of semi-legitimate discussions or stories.
The fact that everyone else does it is still no excuse.
A cloud is a large thing made entirely out of vapour.
I am TheRaven on Soylent News
These days your data is your wealth. Putting it somewhere as vague as 'the cloud' is as dumb as keeping your life savings in a car belonging to someone you don't know and have no idea where that car might be located. (Probably in some trailer court.)
It's a marketing trap - don't fall for it.
Heck, never mind seizure, how about willfully providing this information? Twitter is now providing all public posts to the government.
Bottom line, if it's in a cloud, you have zero guarantee as to how that information will be used and who will end up with access to it.
No Comment.
Servers "in the cloud" are installed, secured, and maintained, by sysadmins like you and me. Some of those sysadmins are good at what they do, and some of them aren't.
I don't get it then, what makes the sysadmins and employees at these companies that run "the cloud" any more or less secure than my own employees and sysadmins? And what makes the government where "the cloud" resides any more respectable of my privacy than my local government? My own reaction is that there's just another layer of security risk here. At least if they're my employees or sysadmins and I find out data is being leaked, I can fire them and do an internal investigation. If some sysadmin is dumping databases at a "cloud" site, then who is ever going to know and how is that ever going to be rectified?
I'm not arguing against "the cloud" and I don't have a good example on hand of where "the cloud" has failed but to me it seems like a lot of these are virtual machines sitting on physical hardware running more software. And every layer is just another potential weak point in the chain of software. Is that not true? Isn't it possible that employees of VM farms are simply cloning and dumping memory or hard disks (or entire VMs for that matter) for their own personal use?
There was a paper a while back about encrypted computing just to address this very fear.
"The cloud" is not intrinsically secure or insecure, because "the cloud" is not a definable entity, as much as the tech press wants it to be. This is a misnomer perpetrated by the poorly-informed press, and not really something that's based in reality.
Just like the title to this Ask Slashdot encourages us to debate the security of something that cannot be intrinsically secure or insecure? If you're telling me that "the cloud" is not intrinsically secure or insecure why are we having this conversation? I mean, I think it's worthwhile to consider what a lot of "the cloud" services are that are out there (the big few that exist) and to debate their security success or potential holes. You can always deflect my arguments by saying that they're just "implementing the cloud wrong" and we won't go anywhere. But it is my opinion that sensitive, personal and secure information should not be handed off to yet another third part for computation or storage unless your trust with them is enough to risk litigation against yourself from all of your customers.
My work here is dung.
Twitter is now providing all public posts to the government.
I've never used Twitter, so maybe I'm missing something.
Isn't Twitter providing all public posts to the whole world?
Actually you are very much on mark there. An article in Politico over the weekend talked about how the Patriot Act is a deterrent for companies to use cloud storage in the U.S.
http://www.politico.com/news/stories/1111/69366.html
Is Your Data Safe In the Cloud?
No. Next story.
I would like to believe that when I host a server at Slicehost (oh, yeah, it's Rackspace now) that they have server administrators who are better trained than I am. That they have backup procedures that are better executed than I would do. That they upgrade their hardware more often than I do.
Likewise, if I put my data on a "cloud" service, I am paying for the assurance that they have secured those servers at least as well as I would, in addition to whatever it is that they specialize in (scalability, availability, redundancy, etc). So, in theory at least, that's what's special about it - that they can do a better job at those things, for less money, than I can.
The reality can be less clear cut, and so, as with any vendor selection process, you have to do your homework and find the ones that seem to do a good job.
I think the press has done us all a disservice by making the cloud into, as you say, a mysterious relic with mystical powers. Hopefully those of us actually making these decisions understand what it really means and can be sober about evaluating options.
Apache guy, Open Source enthusiast, runner
Not true (except maybe in the US, where copyright law seems to only apply in favour of corporations, and the sheeple have ceded control of the political process to lobbyists because the rednecks fear limitations on political campaign donations and pork to the point where privacy legislation is decades behind the rest of the world).
If they are in fact able to get a court order, what is the difference WHERE the data resides? Assuming you are not talking about hosting your data in some government "non-accessible" nation. Unless of course you're planning on destroying or "getting rid" of it. And in that case if they could prove that you destroyed evidence you could have potentially a bigger issue on your hands.
-- Brought to you by Carl's JR
I'm more concerned about what my ISP is going to say when I start uploading data by the gig on a regular basis.
SJW: Someone who has run out of real oppression, and has to fake it.
While I wasn't too thrilled about this whole sponsored post idea, I shrugged my shoulders and moved on. However, this first go at it is somewhat troubling. The question is rather ambiguous, with no information given about who submitted the question, but that's already been discussed.
My big problem with it is why this story seems to be 'floating' in the feed. All morning, it's been at the number two position. I don't really mind the glaring blue story staring at me, but I would appreciate it if it faded to oblivion just like the rest of the articles/stories/slashvertisements, so I don't have to continue to stare at this giant blue SourceForge logo when I browse the news feed. I had tried to keep an open mind, but this whole thing looks like an attempt to whore out the site for money.
(our privacy policy is located at ADD LINK).
I think you forgot something, like making the effort to read the marketing material someone handed you before you copied and pasted it.