Forgot your password?
typodupeerror
Cloud Privacy

Your Cloud Provider (Probably) Isn't Spying On You 85

Posted by samzenpus
from the just-because-you're-paranoid-doesn't-mean-they-aren't-after-you dept.
jfruh writes "Last week the CEO ServiceNow made a minor splash by claiming that it was awfully easy for a cloud provider to spy on the data they stored for you or discriminate based on pricing. But while that's possible, in many cases it turns out to be simply not practical enough to be beneficial. Even moves like restoring outages for higher-paying customers first turn out to be more trouble than they're worth."
This discussion has been archived. No new comments can be posted.

Your Cloud Provider (Probably) Isn't Spying On You

Comments Filter:
  • encryption (Score:5, Informative)

    by schneidafunk (795759) on Monday January 28, 2013 @12:03PM (#42715749)
    The solution which is always repeated is to encrypt any sensitive data.
    • Re:encryption (Score:5, Insightful)

      by hawguy (1600213) on Monday January 28, 2013 @12:07PM (#42715805)

      The solution which is always repeated is to encrypt any sensitive data.

      If you need to actually use your data at some point, the cloud provider could snoop the data from your virtual machine's RAM. And they could probably find the decryption key to your data somewhere in memory too if they looked hard enough.

      • by Anonymous Coward

        There has actually been research to do data processing on encrypted data. Basically the idea has been to convert data in some other form that has the same properties as the original data for the operations that need to be calculated in the cloud.

        Obviously this approach has several limitations but perhaps for most common uses such methods can be found.

        • by dalias (1978986)
          The class of computations for which this is possible is fairly worthless. It's not presently possible for anything with actual loops and flow control, and even if it were, timing vulnerabilities would leak tons of information.
      • by steelfood (895457)

        That depends on if you're talking about cloud storage or cloud computing.

        Encrypting your data is pointless for cloud computing. You're better off asking whether your data is stored in an encrypted file system of some sort. Encrypting your data for putting onto cloud storage is more practical. Yes, the "client" you install may have the ability to root your computer on command, but you might as well unplug the cable going out to the WAN from your home network if you're that afraid of people getting access to

        • by hawguy (1600213)

          That depends on if you're talking about cloud storage or cloud computing.

          Encrypting your data is pointless for cloud computing. You're better off asking whether your data is stored in an encrypted file system of some sort. Encrypting your data for putting onto cloud storage is more practical. Yes, the "client" you install may have the ability to root your computer on command, but you might as well unplug the cable going out to the WAN from your home network if you're that afraid of people getting access to your data.

          Encryption is not pointless even in cloud computing. When I encrypt my data, I know that no matter what bugs or faulty procedures the cloud provider may have (i.e. selling old hardware without erasing the hard drives) that exposes my data to a third party, I know that no one can read my sensitive data. It's just another layer of protection.

          • by ArsonSmith (13997)

            except of course for that vmswap file that you have no control over (IE.. not the system swap partitions or page file, but the one the Hypervisor uses.)

      • Cloud providers won't go to these extremes because they are expensive. They are looking for low hanging fruit, not trying to pick apart your life like a CIA target. Besides, people are all too willing to leave things unencrypted, they don't need to bother with the 1% of users who encrypt their data.

        Encryption works for the same reason that image sharing sites add watermarks to their photos. A watermark won't stop a determined abuser, but it will stop other sites from doing wholesale copies of all their i

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      The whole point of cloud computing is the computing part of it. We do not have any practical fully homomorphic encryption system to date. You just can't reasonably perform computation on encrypted data without decrypting it at some stage.

    • by boulat (216724)

      An encrypted filesystem with block striped volumes across multiple different providers would be a pretty good protection. Even if they had your key, they only had a partial block of data which is impossible to reconstruct without all of the blocks.

    • by ph0ust (2422716)
      The solution might also be to have your own cloud instead of using a public cloud. Personal clouds seem to be growing in number over the last year. None are perfect yet, but I've used younity for a while and find that it is far and away my favorite option. The beta has expanded fast and features are added every month or two. The benefit is I have *all* my files accessible via my mobile devices, but no one else has any access to my data (it isn't stored online). And it's free to boot.
    • by daem0n1x (748565)
      And store the key securely in the cloud, of course.
    • by mpe (36238)
      The solution which is always repeated is to encrypt any sensitive data.

      Actually you'd be better off encrypting ALL your data. Encrypting only some of it can give Eve all sorts of clues, even being able to guess part of the plaintext in some cases.
    • And possibly messing up any advantages that the service offers you.

      Unless you are just using them for storage then you are not really need a cloud service, just an offsite storage.

  • by Anonymous Coward on Monday January 28, 2013 @12:06PM (#42715783)

    My concern isn't that the company as a policy is spying on me, it's the fear that a disgruntled employee would start copying all of the data for their own use.

    • by SJHillman (1966756) on Monday January 28, 2013 @12:25PM (#42716019)

      I already have all of your porn, but it's nice to know you're thinking of me.

      Sincerely,
      Disgruntled Employee

    • by alen (225700)

      so what kind of cool data do you have that would interest someone?

      back when i was in the army i worked in the command group of a 2 star general. i was in the office down the hall and next to the chief of staff. when they needed computer help i saw their email. it was the most boring crap you can imagine.

      • If you work for a large or high-profile corporation (or you manage their cloud data), there are people who will pay you good money for a simple list of employees, email addresses, their position and perhaps their pay grade. Won't make you rich but it'll sure be a nice addition to your retirement fund. Enough to tempt some sysadmins with privileged access (as has happened in the past). And I am sure the contents of some mails from the CFO can be put to profitable use.
        • This has happened at the previous company I worked for, although luckily not at our IT department during my time there.
          But during that time there have been several employees from other companies we supported who moved to the competition with data in their pocket.
      • back when i was in the army i worked in the command group of a 2 star general. i was in the office down the hall and next to the chief of staff. when they needed computer help i saw their email. it was the most boring crap you can imagine.

        And that is the secret. How many Slashdotters do you think will go to join the army cybercorps now they know this?

  • by flyingfsck (986395) on Monday January 28, 2013 @12:23PM (#42715991)
    Data is not the same thing as information.
  • by marcello_dl (667940) on Monday January 28, 2013 @12:35PM (#42716171) Homepage Journal

    Nobody gives a damn about your data, with good statistical confidence.

    OTOH I suspect it is quite important to be able to get your data should the need arise, which is a different concept.
    That's, at least, what I desume from seemingly grossly inefficient developments in IT, e.g. the cloud where your machines are not part of the nodes, or the UI downloaded from the server, instead of having everything available locally and a remote db for syncing data.

    It's a parallel with the development of laws where cronyism replaces democracy. In those system it is not important to put a lot of people in jail, it is vital to make anybody potentially a criminal so you have an excuse to lock people up if the need arises.

    • Re:Priorities (Score:4, Insightful)

      by aaaaaaargh! (1150173) on Monday January 28, 2013 @12:51PM (#42716337)

      Nobody gives a damn about your data, with good statistical confidence.

      I wouldn't be so sure about that. There are tens of thousands of small high-tech companies with trade secrets that the "cloud" providers would like to gain as customers. From source code to email and customer data such companies have all kinds of valuable data. The solution is, of course, not to put any of this data into the cloud except in fully encrypted form for georedundant backups.

    • by Anonymous Coward

      Wow, no that's simply not true as a broad, blanket statement. I currently work for a company where we have at least one competitor that actively tries to steal our customer lists, with some success (and has lead to successful lawsuits). Attempts have ranged from scraping websites to actually physically stealing backup tapes or paper records.

      Now we're in a small enough industry that I very much doubt that information in the cloud would change the risk vector, but these things do happen depending on the ind

  • by Anonymous Coward

    While spying/corporate espionage from a cloud supplier is a concern, the bigger concern is the US gov who have proved time and time again that if your data is in their jurisdiction they can look/take all they like and with the provisions in the "patriot" act they don't even need a warrant or tell anybody they looked at it.

    say no to the cloud, and moreso if the data or supplier is based in the USA

    • This. They might not be able to do it right now (maybe), but you can bet your ass that some department somewhere is working on it. Legally or illegally, they will have access whether you like it or not.
  • Spies in the sky (Score:5, Informative)

    by Wowsers (1151731) on Monday January 28, 2013 @12:43PM (#42716259) Journal

    "Your Cloud Provider (Probably) Isn't Spying On You"......

    But your government probably is.

    • by jxander (2605655) on Monday January 28, 2013 @01:26PM (#42716775)

      The simple fact is : the vast majority of the populace just isn't that interesting.

      Thereby, TFA can easily and honestly say that they're probably not spying on you, because for any given value of "you," it's likely to fall into the uninteresting segment.

      • Yes, it's true. They aren't specifically spying on "you". They are spying on EVERYONE. There is a reason why the NSA has direct interconnects with all the major ISPs. They find some group of keywords passing through, trace the connection back to your home, then they go through everything you have "just in case".

      • by c0d3g33k (102699)

        It's what happens if you somehow become interesting that matters. Involved in an accident with a powerful official or wealthy person? The ability to examine your supposedly private information for some leverage against you would be useful. Decide to participate in an "Occupy" event? Your dossier will be much easier to fill with easy access to all your "private" information. It's not that hard to come up with realistic scenarios in which an "uninteresting" person could be put at risk by unfettered acces

      • by ArsonSmith (13997)

        exactly, as i point out to the people holding out on Facebook accounts due to eavesdropping, first I show that they pretty much are already there, plus I also point out that they are now the short list of people to be spied upon.

    • by mpe (36238)
      "Your Cloud Provider (Probably) Isn't Spying On You"......
      But your government probably is.


      Quite possible several foreign governments. Either because your government trusts them or the CP is happy for them to do so. Especially if the CP is a transnational corporation...
  • I use Spideroak, and their business model is based on privacy and they try to support open source when viable. When most cloud providers are similar, this is the featureset that sways my choice.
    • The problem with any cloud provider is that you have to trust that their claims about privacy are true without any verifiable evidence that they are in fact true.

      Startpage and Duck Duck Go *claim* searches are private, but there is no actual evidence this is true. Believe so at your own peril.

      Likewise, Spideroak's claim that they can't even look at your data themselves is comforting, but still just a claim. It may be true and they may believe it to be true (their site is very convincing), but without an a

  • why pay people over $100,000 per employee per year when accounting for taxes and benefits to spy on data? if dropbox were to spy on your data how would they use it to make more money?

    • by TheCarp (96830)

      Its like casinos and poker dealers. Could a morally bankrupt poker room have mechanic dealers working with professional players to cheat people? Sure they could... but they are making so much money playing it straight that it doesn't make sense. If you can pay the dealers an hourly rate and let them keep tips, and make money hand over fist, why risk that in a scheme that requires you to pay them, and some other people, a lot more?

      I think this analogy is apt because it shows the real problem isn't the casino

  • by pubwvj (1045960) on Monday January 28, 2013 @01:24PM (#42716735)

    The cloud service provider isn't the worry. They couldn't care less. It's the government I'm concerned about. They do care and they have a history of spying and want the right to do so.

    The internet is a postcard. Don't store or transmit anything you don't want seen.

  • Sure, they do not see any advantage now. That does not mean they never will.
    And when they do (perhaps in 10 years) it will be too late to take away your data at that moment. They already have it.

  • Going to keep the identity kinda vague here but I can say that I'm a high-ish level executive for a company that provides cloud services similar to Amazon and I will tell you first hand that we NEVER ever ever would spy or collect data on our customers. It would be a disaster and far more trouble than it's worth. Most mainstream platforms (VMware, OpenStack, whatever you choose) don't even provide facilities for reading on-disk customer data in a true cloud environment easily; I guess if you really wanted t
    • by dstyle5 (702493)
      What about government access to on-disk data? Given how they are trying to pry into as much as they can these days them having easy access to a "terror suspect's" data wouldn't surprise me. I guess they could just put the Carnivore servers in the ISPs that feed the cloud data centers.
  • Humans working in government are probably not listening to your unencrypted phone calls or reading your unencryped emails.

    If you forgot to lock your front door this morning, a burglar is probably not taking advantage of the situation.

    Even if you skip your dog's rabies vaccinations, it probably won't get rabies.

    If you drive home drunk tonight, you will probably arrive safely, and without hurting anyone else or facing serious criminal consequences.

    North Korea probably doesn't intend to nuke anyone.

    If you run

  • Rate of Investment vs Rate of Return.

    Going through all the trouble to spy on Joe Pimpleface Teenager: ROI > ROR.

    Going through all the trouble to spy on a user whose browsing profile and typing habits match Julian Assange or Frank Whizbang, Stock Investor of the Year: ROR > ROI.

    By an order of magnitude.

    So technically, yes, cloud providers probably aren't spying on 90% of the users.

    But if I know I'm one of those 10% of extraordinarily high-interest persons? I'd call it a given that you're being spied

  • Do I believe rackspace spies on me? No

    Do I believe Google does? Of course. In fact they're pretty open about a lot of snooping and they try pushing real name policies and other shit to make it easier to shill crap on the web. Why would I not believe they're not snooping on me every single chance they get?
  • <grandmavoice>Oh, good. I always knew he was such a nice man</grandmavoice>
  • Hey, that's the Internet! Everybody spies on you here. If the big companies like Verizon sell your info [jammer-store.com] to ad makers and other third parties, so what can be done with a small ones?

"Let every man teach his son, teach his daughter, that labor is honorable." -- Robert G. Ingersoll

Working...