cloud storage privacy concerns

[Chriss Miller]

In https://powershell.one/tricks/filesystem/filesystemwatcher me and Steve Meyerson had a short exchange on cloud storage privacy in the context of using a cloud for version control of projects.

At one I said I do backup a folder tek-tips for most things I maintain tek-tips related:

Chris Miller:
...most cloud drives have a syncing application that starts with your computer and when you maintain all your projects in one root folder that's all you need to configure to backup with sync to a cloud drive.

Steve Meyerson:
I just don't like my stuff on the "cloud" (i.e. some unknown server.), accessible by our Big Brother (U,S.) government. I use an external drive...

(costs also were a concern)

Chriss Miller:
You can encrypt, then upload to a cloud.

To follow up on that, first on the technical level: One basis to use is a powershell FileSystemWatcher, there's a similar thing in WMI, too, but why not start on the shoulders of something that's good to go and totally transparent: https://powershell.one/tricks/filesystem/filesystemwatcher.

Take a look at the second part with an asynchronous approach as the author admits the first simpler solution has a blind spot limitation, which the second asynchronous script does not.

It's not a full solution, but the idea once you have a script to invoke an action for any new, changed or deleted file you can use that to encrypt a new or changed file into a directory that syncs with a cloud drive or just your external drive. At this stage I'd even go for a multi staging process as the goal would be to monitor your project directories while you work on them and even just copying a file you just saved modified could easily fail and would need a retry, so a first staging directory could be just the new and modified files you generate from there into a folder you only use for the next step of encrpting and then forwarding the encrypted files to a directory snyced with a cloud or your external drive. Powershell also offers file en/decryption to do this and more.

Obviously for source version control a tool like Github is much more straight forward to use, which is not the only reason I don't want to elaborate on the details of a staged cloud usage. I'd like to make this a more general discussion also on the political and policy aspects of it.

First I don't hear about suspicion from Steven for the first time, I also know others, who boycott GitHub for their involvement with ICE. See articles like some of VOX.com, LA Times, Vice and more and also what GitHub themselves blog on it: https://github.blog/news-insights/company-news/github-and-us-government-developers/

So, you don't have to believe in conspiracy theories to know that not only US governments will ask and want access to anything in the context of crime investigations besides the threat of industry espionage, and in the bigger picture things like identity theft.

Cloud providers also address their concerns, like here:

https://proton.me/blog/sharing-encrypted-files

Most data on the internet is stored and transmitted using some form of encryption. Encryption is a way of locking files so that only people with the correct key can open them. But different online service providers have different methods of storing those keys. And most platforms keep a key for themselves, including Google, Microsoft, Dropbox, Box, and others.

I'm cautious with such accusations and whether it's just used to convince you to be better off at proton drive (in this case). Besides explaining how file sharing can work in ways they don't get access themselves:

The most secure form of cloud encryption is called end-to-end encryption, which ensures only you and the person you share a file with can access it. Not even the service provider has a key to unlock the file.

Or take what pcloud writes about their privacy policies:

pCloud - Data regions

pCloud is the most secure encrypted cloud storage, where you can store your personal files or backup your PC or share your business documents with your team!

www.pcloud.com

You surely always have the thought about how a cloud provider could technically store something encrypted in ways they couldn't even decrypt your data themselves, whereas they also offer file and directory sharing temporary and permanent where the peer gets the access they can't have. Promising and roughly describing it may not convince you and even if that's not the neuraligic point of which you're concerned the most but the demand of government for access or their capabilities to get it even unbeknown by the cloud providers.

Putting a layer of your own encryption makes all these concerns futile. Besides you could even go one step further and split encrypted files to store half of it in cloud one and the other in cloud two. It becomes harder to get back at your original files, once you need that functionality of your backup, so it surely becomes important to also program the opposite direction of retrieving the encrypted (maybe partial) files and (merge and) decrypt them and test to ensure that works. Sharing with others also becomes a harder job, obviously.

Anyway, I don't like to hear the saying anymore, that there only exists Microsoft Azure, Amazon AWS, Google Cloud Platform and Oracle Cloud. Apples iCloud, works in part based on Google Cloud Platform, but not fully. And many more other cloud providers also don't just work as redistributer of the big 4, just with added services and interfaces. What's ture, I think that over 60% of all cloud storage goes into the big 4, but that still leaves room for others. You can also define your own "cloud" based on web hosting from a local trusted company, cohosting your own server, to name just some options. There's also software like owncloud, nextcloud and others to make more of it than just an FPT or SSH file/upload to rented disk space. Be it only to put a server somewhere at your parents or childrens house to have the safety of more than one place for your backups.

So , what's your take on this? What do you use? What do you know? What would you recommend?

 

[tomk3]

Hi,

in Germany we have strict dataprotection rules, for example data should be on german (or at least EU) servers if they contain personal data (hard to be sure that not)
we found IONOS and their hidrive to fulfil that, in addition with internal encryption and VPN of course.

For backup purposes there are tool like https://freefilesync.org/ which recognize changes and use shadow copy (important for sql data, Outlook OST,...) but have to be started manually (via commandline , too)

Btw :
watching can be done in VFP, too.

wwDotnetBridge Revisited: An updated look at FoxPro .NET Interop

 

[Chriss Miller]

watching can be done in VFP, too.

As I said, there's a similar thing in WMI, too, but I'd want to do one single script file doing the watching, staging and encryption in one place and for that would abandon VFP alltogether. For such a taks VFP will always become glue code only , that brings together other component, which becomes unnecessary when you do it fully in powershell - or also fully in .NET. As we discussed in the other thread VFP also isn't that great with the file system itself, unless you work with DBFs and the only point were VFP would use it's strength is when you also write meta data like a protocol of steps taken, changes detected, encryptions/decryptions and file transports done. VFP needs help to act as a servicee, help to have the kind of file monitoring the .NET or powershell filesystemwatcher provide or the WMI __InstanceOperationEvent class and derived classes.

Rick Strahls article goes quite deep, thanks for mentioning it. I've just browsed it and saw it also handling events asynchronously within VFP, i.e. VFP is informed about events and acts on them. That could also work quite well, but then I think a pure powershell solution could be made more future proof and general.

Anyway, the major point of what I wanted to discuss here is as per title the privacy concerns and how to handle them, less much the very specific backup idea.

 

[Chriss Miller]

Perhaps to guide the discussion a bit. I'd like to hear from anyone interested to share thoughts:

1. How much do you trust / distrust cloud providers? I would also ask for the governments, but we don't need to get into political views here, just mainly the question would you fear your code or (as most of the time it's not just your but) your customers code and data could be breached by government or criminal investigation and also hacking?
2. How much do you understand about cryptographic methods used and how much do you trust advertised features and security strengths?
And, simply practically:
3. What clouds do you use, what do you put up into clouds?