[Infowarrior] - Keys to the cloud castle

[Richard Forno]

Science and technology

http://www.economist.com/blogs/babbage/2011/05/internet_security

Internet security

Keys to the cloud castle

May 18th 2011, 17:31 by G.F. | SEATTLE

CONSIDER the purchase of a home in two adjacent gated communities. Both have houses with truly impregnable locks. In one community, whenever you need to enter your house, you visit the management office and show your driving licence. A guard walks you to your home, and lets you in using the master key that opens every door lock in the community. You can stay inside indefinitely. If an employee misuses the key to wander into homes or, heaven forfend, a thief gets his hands on it, all bets are off—the households' sanctity has been compromised.

In another community, the management requires that you privately choose your own lock and corresponding key, which you hang on to and use to enter your abode at will. But if you lose the key, or any copies you have made, you can never re-enter. It will remain a sealed edifice until the universe's heat death. Which would you choose? The latter offers extreme privacy but with an unthinkable penalty for carelessness. The former is convenient but there is the risk of the key falling into the wrong hands.

Users of cloud-based internet storage and synchronization providers, such as Dropbox, SugarSync, SpiderOak, Box.net, and many others, face a similar dilemma. It lies at the root of concerns raised by some security researchers and privacy advocates about Dropbox, the market leader with a reported 25m customers. This Babbage kvelled about Dropbox last August, explaining how simple it was to keep files up to date on all one's computers, and sharing and syncing files with collaborators in group folders.

The complaints cover marketing, where overly broad statements about security have been contested; the ability for any user to determine if a given file is stored by any Dropbox user; and a design choice that would allow a malicious party to copy a single configuration file to sync a user's full Dropbox folder with another computer. Dropbox's mobile apps also encrypt only data in transit, not metadata like file names, despite Dropbox's explicit statement that all mobile data is scrambled.

Taken together, and coupled with vitriol that has been hurled at the company, it would seem that Dropbox has a lot to answer for. When unpacked, however, this Babbage finds much—not all—relates to the kind of gated community Dropbox opted to build. One may move into a Dropbox neighbourhood, or opt for the alternative.

The marketing issues are clear. Dropbox oversimplified a few points related to security, favouring a brief explanation that was not entirely accurate. The most egregious of these statements claimed employees had no access to user data, only metadata. Its detractors say plainly that it lied, although this is hard to prove. Ever since the company was set up in 2007 Dropbox founders and employees told anyone who asked that it could, in fact, decrypt anything it liked.

Dropbox possesses the encryption key to every user's cloud locker, as in the first sort of gated community. This is necessary, in its view, to provide simple web-based access to files and give multiple users shared access to the same directories. The company revised its website to reflect reality, and apologised, but it faces a complaint filed with the Federal Trade Commission (FTC) by researcher Chris Soghoian over this (and certain technical matters). Mr Soghoian believes Dropbox obtained an unfair market advantage through deceptive business practices, and requests further clarification, improved behaviour in future, notification of all users about the change in Dropbox's security explanation, and the option for refunds to paid users. (Mr Soghoian is known for his amusing and disruptive disclosure of Facebook's sock-puppet attempt to manipulate opinion about Google's privacy efforts in social networking.)

The technical issues are another matter. While valid, most relate to storing files in any cloud, not just Dropbox. If you leave the key to your house with anybody other than kith or kin, you probably won't leave jewellery and cash lying about, but nor would you bother to remove less valuable trinkets which, after all, need to be stored somewhere.

Dropbox has massively expanded casual access to cloud storage, but a large part of its users probably lack the sophistication to differentiate between what may be safely stored there or in any similar service. With the right knowledge, customers could determine whether or not they care if any files are disclosed. When information is not encrypted on the computer before being sent to a storage service, there is always the risk of a leak, either deliberate or resulting from a software glitch.

SpiderOak, by contrast, cannot disclose its customers' files, even if it wanted to. That is because it lacks tools to tap any of the data it stores on behalf of users. However, this "zero knowledge" means that if a user loses his key, he can never again access those data.

Internet backup service CrashPlan strikes an interesting balance between the two approaches. Reverting to the same home metaphor, CrashPlan lets users create their own lock and house key—its software generates this encryption data on a user's computer. They can then ask CrashPlan to store it in escrow on their behalf—either with a password CrashPlan can reset or with an unrecoverable private password—or choose to keep it to themselves, explains Matthew Dornquast, the company's boss. In the case of a resettable password and key escrow, the user is not responsible for preserving the long and complicated encryption key, merely a simpler password that unlocks the door; and forgetting that password does not foreclose access to the data. In the other escrow offer, or where the user decides to keep the key himself, the burden of looking after access details falls on him. In all cases, the data are encrypted locally on a computer before being transmitted to CrashPlan.

Dropbox security can be enhanced quite easily, too, by the use of third-party encryption software that manually or automatically manages encryption for files in the cloud-synced folder as well as elsewhere on a computer. This layer acts as a securely locked room within a house in a Dropbox-like neighbourhood. Dropbox might be required to provide access to the house or made to do so, but the valuables could be safely locked away within an unpickable safe.

What the revelations, complaints, accusations and responses have demonstrated is the need for better education about which set of encryption and security choices are most appropriate for what sort of data. The average user simply does not know what he is letting himself in for, or how to gauge the risks involved. As noted computer scientist Nathaniel Borenstein quipped in the comments to a blog post by Mr Soghoian:

What Dropbox provides is more than adequate for most users. Those with a more stringent need for privacy—most often because they are breaking either a just or unjust law—need to take responsibility for their own privacy, not count on a remote, third party service to provide it.