Slashdot Mirror
The Cloud: Convenient Until a Stranger Nukes Your Files
jfruh writes "Thanks to a plethora of cloud storage accounts, Dan Tynan thought his days of carrying a thumb drive around with him and worrying about email stripping out his attachments were over. But that was before he discovered that his Box.com account and all the files in it had vanished without a trace. With tech support coming up empty, Tynan had to put on his journalist hat to track down the bizarre sequence of events that ended with his account handed over to another user, who didn't ask for it and didn't even know who Tynan was."
Cloud services take all of your IT problems, and give them to someone else, period. A cloud is not inherently going to fix your problems, or make them worse, but just delegate them to someone who may or may not be able to handle them better.
You do not have a moral or legal right to do absolutely anything you want.
FTFA:
* Financial records. I scan all my paychecks and store them (on SkyDrive, not Box.com - fortunately). Our tax form PDFs are all on some cloud storage service, either SkyDrive or Dropbox, as are all our receipts. These would have been in the hands of a total stranger - perfect fodder for identity theft. And if the IRS suddenly decided to audit us? We'd be at their mercy.
* Health records. We scan all our doctors bills and insurance insurance statements and store them in the cloud. So now we're talking about medical identity theft for us and our kids - a situation that's much harder to resolve than standard financial ID theft.
What an idiot.
Unsure why people are moved to throw their data into the hands of someone (company) that would never treat their data sacred. I don't care what argument you put forth, no one is going to care (security wise) about your data as vigilant as you would (and should). Math wise, the cloud makes no sense to me, even on the free model.
1) wait for you to download your data over the Interwebs (mobile you say... tick tock)
2) There is NO GUARANTEE someone in the company isn't looking at your data or selling it. You're simply trusting they won't
Storage is dirt cheap. 2TB drives are like what 100-200 US per pop give or take. They're compact enough to throw in a messenger bag along with a laptop. Data availability is much faster than downloading it over the wire. Throw on crypto (say Truecrypt) and you have a decent amount of security. Only concern, is your HD goes bad. In either event, another backup 2TB is 100-200. Cloud pay for play? @ 10.00 per month, its STILL the cost if not more than buying your own device.
I can't remember where I first heard this, but the quote is along the lines of:
Whenever you hear a reference to "the cloud", replace it with "someone else's computer" and see how much sense it makes
Once you start doing that it shows you how little control you have over such services and how dependent you are on other parties, especially if you consider them as a panacea to not having to keep your own backups (as the OP seems to have done)
I am Slashdot. Are you Slashdot as well?
He keeps his work files, financial records, health records in the cloud.
Dear sirs and madams, i refrain from even commenting on that for fear of being downmodded hard, and rightly so.
Cloud storage can not be trusted both in terms of privacy and reliability. So follow these steps and you'll be fine:
1) Thou shalt not store unencrypted files in the cloud
2) Thou shalt have backups of files in the cloud
Does that reduce the convenience of the cloud? Yes. Because that is all that online cloud storage can offer - unreliable privacy invading storage.
I make sure to include the local Dropbox, Box.net and Skydrive folders in my PC's nightly backups. If you're going to be backing up your computer anyway (as you should be), it's almost no extra effort to include those folders as well.
For the "someone nuked all my files", this is why you should backup your files (or use a Cloud service with integrated backup/history or better use both).
Remember, a proper Backup uses MULTIPLE Backups and not all from the same service provider.
PS: for the "someone saw all by financial records", you should use an encrypted Cloud service where YOU own the encryption key and where the service provider can NOT help you should you ever lose that key.
Sig (appended to the end of comments you post, 120 chars)
This is rather unfortunate for him, of course, particularly if he didn't have a backup anywhere else (duh!), but I'm sure we'll get a lot of slashdotters saying "See, this is why I'll never use the cloud!", and that's silly. Now, there are other valid reasons to avoid cloud storage (e.g. privacy and security, assuming you're not encrypting the data), but reliability really isn't one of them. Thumb drives die, get lost or get damaged, hard drives fail... there is no perfectly-reliable storage medium, but I'll posit that a good cloud storage provider has a much lower failure rate than anything you can manage yourself.
The solution, as always, is backups. Any one storage medium may fail, but the odds of several of them failing simultaneously is very low. Personally, my most important files live on a RAID-6 array with a hot spare on my home file server, and on my laptop's SSD, on my workstation's HD, and on Google Drive. There is a fair amount of low-priority stuff which lives only on Google Drive. It gets automatically synced to multiple machines, but that wouldn't help if someone else got access to my account and deleted my files (of course, I use two-factor auth). It's still better than what I'd do without a cloud service, which is that I'd have those files only on my laptop.
Hmm... It occurs to me that it'd be trivial to write a small script that uses rdiff-backup to copy the contents of my Drive folder to another folder, then run that in a cron job. Then I'd have automatic, persistent synchronization to multiple devices. I think I'll do that right now :-)
Bottom line: This is a sad story, but not a reason to avoid cloud storage. It is a reason to recommend backups. Especially completely automated, effortless backups.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Yeah Steam is pretty good at running even if you nuke its registry entries (or reinstall Windows) and nuke everything except Steam.exe. It'll redownload all of its missing components and regenerate its registry stuff (though you need to relogin and auth with Steam Guard).
I did have a bit of a hiccup with Steam yesterday when most of their servers seemed to go down for a bit but it was only for like 15 minutes, then they were back up. Though my TF2 hats took a bit longer to come back.
excuse me, are you from the past?
1) You are sharing a work account with your wife who has her own work universe. So when she is working on an article about the "ultimate cloud deletion tool" you will get dragged into her experience without knowing it.
2) you seem to (in theory) have no problem separating your work files from your professional files.
3) you let strangers (yes they are people you are working with but) access accounts that have files that you need for more than the moment. box.com should be no more than a ftp server for transferring files and you should see that the files are deleted after the other party gets them.
4) you don't seem to have any home backup system even though your livelihood seems to be dependent on the availability of that data, not to mention your personal data. dropbox should be the backup of the backup.
In short you trusted your files to a third party and they failed that trust. the lesson is....
p.s. please post a preview of your next article " my cloud provider sold my data to advertisers without my knowledge"
Sanity is the trademark of a weak mind. -- Mark Harrold
You should have Truecrypted. Doesn't keep people from hijacking your account but your files are of no use to them.
Pro Tip: Use a different password other than your login password for the encryption.
Join the Slashcott! Feb 10 thru Feb 17!
I'm the author of the post. You are completely and utterly wrong, and clearly ignorant about how Box.com works. I invited others to share some, but not all, of my box folders. I can actually control the level of access they have to each. I didn't give them my own login and passwords, they created their own. They didn't have access to my entire Box account, only the folders I chose. I could allow them to simply view files, or to edit and upload. So nobody had my password and login but me and Box. I did not violate anyone's TOS. And if I had not identified myself as a member of the press who was writing a story about this, it is highly unlikely I would have gotten any answers from Box at all. dt
Two adages apply here.
1. Security is inversely proportional to convenience.
2. If you want something done right, you've got to do it yourself.
So, lesson learned: Be your own cloud.
sig: sauer
Cloud services are the spiritual succesor to the BOFH. All the power, none of the responsibility.
I have a malicious and friend delete proof dropbox. I simply have my linux server copy and sync the files. if they all disappear, they all reappear as the server puts them all back. The only way to delete them is to rename then with a special prefix, then the server will actually delete them.
IF you trust the cloud for security or reliability, then you are a fool. Always set up your own systems to automatically back up and manage on top of the cloud service.
Do not look at laser with remaining good eye.
I own a Synology NAS. It's great and includes plenty of useful features, including a dropbox/box-like application where one can sync files easily to any of their devices. No storage limit (other than the NAS and the storage of whatever devices I'm syncing to) and there's far more other things you can do besides the dropbox-like feature. Why should I pay a monthly fee to let someone else have all my important files, when I can easily host my own? It works great and I never have to worry about some provider getting hacked or changing their TOS.
Of course, one should back up their NAS (and there's plenty of easy ways to do so on the Synology), but the point is if people are concerned about their data, they should take responsibility for it.
Cue the Nelson "Ha-Ha" picture here...
As a CISSP with 25+ years in the IT industry, I can wholeheartedly advise that anyone who stores their mission-critical data in anyone's "cloud" without local backup copies that are positively under your control, and a "Plan B" ready to access that backup data... then that person is a complete retard (and you should pronounce that as "REE-tard" for the proper level of dramatic emphasis).
Oh, and BTW... if you think your confidential data is secure from anyone else's eye while "encrypted in the cloud", you're doubly retarded.
What is the most disturbing part of this story is it seems that box.com doesn't have any major infrastructure for backup of users data. I would have thought that it would be as simple as pressing a button "undelete" for the box.com support people to restore last available data before deletion.
Well, maybe they do. As the Fine Article says, he did get his data back. It just took them a while to figure out the chain of events that caused it to disappear in the first place.
Here's some real transparency for you.
Get free satoshi (Bitcoin) and Dogecoins
Hey now! You're being very unfair to encased geological samples!
Best Slashdot Co
What has always struck me about "The Cloud"; is that it is mostly wonderful marketing; "The Cloud". Now if you called it remote servers folk would have been a bit tentative, and maybe a bit more mindful of the potential problems. Convenient sure, but sh** happens, and for me, I tend to like to have only myself to blame when something goes wrong with my sh**. Do I use some remote server services (I get a bit creaped-out by sticking stuff in "The Cloud"); sure. But only there, seems to me I'm playing Russian Roulette with my info.
I think you're puttin a little too much stock in one's /. UID length
What I find interesting is that you appear not to have backed up the files elsewhere. While I appreciate the convenience cloud storage offers I also make sure all my files are backed up on some other media so if the cloud goes poof at least I don't lose anything. In your example, you were fortunate it was am administrative error and not box.com simply going out of business overnight. Had that happened, you might never get your files back or even worse someone would have a HD full of you data bought at a bankruptcy auction; which as a second point makes me wonder why you would store such sensitive information as pay checks / tax forms / etc. anywhere nut media you have physical control of to ensure it's security.
On a side note, it is interesting the difference in response you get when you say "I am writing an article..." vs "I need help..."
I'm a consultant - I convert gibberish into cash-flow.
Bitching about it on Slashdot has resulted in more suggestions on how to fix it than filing a ticket with their support team. (though this is not surprising to me)
It also garners flames from fanbois, but I am fine with that.
I'm a good cook. I'm a fantastic eater. - Steven Brust
That sounds like a law you just made up.
Let's try it out:
Brad, if you have any employees, please fire one of them.
Am I going to jail for saying that?
I agree with your premise that the person you responded to does not know how the service works. It is possible to share files with other customers without giving away personal data. I toyed with SecuriSync and it does similar sharing but requires that the recipient has an account in order to touch "shared" data.
With that out in the open, let me explain why on /. you will receive much venom. You don't have to listen, of course, but as a writer I think you understand the value in knowing your audience.
/. is not like other sites. There are numerous experts in numerous technical fields on this site. It's a stomping ground for an experts to provide opinions in their area of expertise without a "Company Slogan" involved. It also has subjects more political in nature where those same strong opinions abound. While there are a few kids, sock puppets, shills, etc... the majority of the audience here is intelligent. They notice spelling and grammar errors, they recognize common fallacies, and look for details beyond just the articles submitted. Submitters are inspected and critiqued right down to the ads on the page the article appears in. Slashdot is a unique environment, the audience is very detail oriented.
Your "about the author" makes claims that you probably intended as humor, but comes off as being egocentric or arrogant. On a site full of Computer Scientists who have been telling people of the dangers of "The Cloud" since the time it was called "Grid", the article and self description appear to be hypocritical and contradictory. If "Dan Tynan has been writing about Internet privacy for the last 3,247" was a true statement how could they not know about the dangers of "The Cloud"? Has Dan ignored the "experts" during his three thousand years of writing and only knows the corporate spin?
An omission of data is very important to the Slashdot crowd, at least as important as what you submit. Again, I mention that the crows is very detail oriented. You may be encrypting data, but that was not mentioned in the article. If you didn't mention it, it never happened.
I think the article itself backs the claim that experts have been giving for years. "Don't trust Cloud!". That said, the article poses no question as to whether or not that statement is correct. The article does not back the expert opinion in any way. The article appears to be a well articulated rant against box.com. Warranted or not, it's bound to receive lots of venomous comments from people on Slashdot.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
I'm the author of the post. You are completely and utterly wrong, and clearly ignorant about how Box.com works.
I invited others to share some, but not all, of my box folders. I can actually control the level of access they have to each. I didn't give them my own login and passwords, they created their own. They didn't have access to my entire Box account, only the folders I chose. I could allow them to simply view files, or to edit and upload.
So nobody had my password and login but me and Box. I did not violate anyone's TOS. And if I had not identified myself as a member of the press who was writing a story about this, it is highly unlikely I would have gotten any answers from Box at all.
dt
Dude, you are funny. You do know that storing stuff on the cloud isn't backing it up, right? That you can lose it at any time? Ya, Mr. I've written a book who's advice I don't follow.
Sure, the cloud is a convient way to access your stuff, but you can lose it at any time. Remember what happened to MegaUpload? Ya, all those legal files, poof!!!!!
So next time, don't be stupid, don't store your only copies of stuff in the cloud, keep a local backup, plus 2 "cloud" backups.
Thanks for the laugh.
Be seeing you...
Dropbox
GDrive
Amazon
SkyDrive
Pitty they are all in USA, any that are NON usa based?
Liberty freedom are no1, not dicks in suits.