I would not be so harsh on these companies. They
are very quietly *told* that they will comply
with the will of certain agencies. Or else. And
they are not allowed to tell their customers. Or
else... But they are trying to sell security. So
what are they going to do? They are going to
do a doublethink and try to give you something that
is Mostly Secure. Except against certain parties.
The encryption key cannot sit on the 3rd party site.
It has to be resident on your own computer and
under the owners control only. You cannot access
secure data anywhere from any computer. You can
only access it from particular machines on which
you have your secure key, or via a USB key that
contains a copy of the user key.
The user's password for their crypto key should
never, ever go out across the internet. It should
happen locally, within the secure machine.
This is all Crypto 101. It's not like it was
something new or strange.
I do not know the details, so I will ask: is it
the case that:
* The user crypto key is generated on the
the user machine.
* The password for the user key is set on
the user machine and never leaves it.
* The user crypto key never leaves their
machine(s).
* The user's password for their crypto key
is never used outside the confines of their
local machine.
* The data is fully encrypted on the user
machine and only encrypted data transits
the net and sits on the storage server.
* The encryption algorithm is such that
no key except the one on the users
machine can decrypt the remotely stored
data.
Unless all four statements are true, the data
is *not* safe.
If the statement made in the other reply is true,
and you can 'retrieve your data from any internet
device' then it is patently obvious that data
security *is* violated.
Dale Amon
CEO
Immortal Data Corporation
--
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss
