Comments on: A Demonstration of a vulnerability of Cloud Computing. http://www.theprivacyblog.com/online-privacy/a-demonstration-of-a-vulnerability-of-cloud-computing/ Anonymizer's Privacy Blog Tue, 07 Feb 2012 08:52:35 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Les http://www.theprivacyblog.com/online-privacy/a-demonstration-of-a-vulnerability-of-cloud-computing/comment-page-1/#comment-4723 Les Fri, 18 Sep 2009 11:07:36 +0000 http://www.theprivacyblog.com/?p=105#comment-4723 I absolutely love Google Docs from a collaboration and functionality standpoint, but the (in)security worries me. I wish that Google would release an appliance (like their Google search appliance) that I could host in my work network. That would transfer most access risks to within the company network. I absolutely love Google Docs from a collaboration and functionality standpoint, but the (in)security worries me.

I wish that Google would release an appliance (like their Google search appliance) that I could host in my work network. That would transfer most access risks to within the company network.

]]> By: Callum http://www.theprivacyblog.com/online-privacy/a-demonstration-of-a-vulnerability-of-cloud-computing/comment-page-1/#comment-4630 Callum Sun, 29 Mar 2009 21:57:29 +0000 http://www.theprivacyblog.com/?p=105#comment-4630 <strong>Security First Video Surveillance Systems...</strong> Maybe, but I'm not sure it'for everyone.... Security First Video Surveillance Systems…

Maybe, but I’m not sure it’for everyone….

]]> By: lance http://www.theprivacyblog.com/online-privacy/a-demonstration-of-a-vulnerability-of-cloud-computing/comment-page-1/#comment-4622 lance Tue, 10 Mar 2009 21:21:03 +0000 http://www.theprivacyblog.com/?p=105#comment-4622 This is an interesting site. It looks like they are doing all the encryption with JavaScript loaded from the threetags.com site. The big risk here is in the browser itself. There are many ways an attacker can capture your input from within a browser session. An attacker might also be able to use a man in the middle attack to modify the javascript you are received. The fundamental issue is that you are re-downloading the software each time you go to the page, and it is difficult to know if the software has been corrupted. If the site were ever hacked, hostile code could be inserted to capture the passwords of every single user. This would be much safer if is used a signed application binary which then lived locally on your computer all the time. A non-technical risk is that I have no idea who these people are or what kind of history they have that should lead me to trust them. This could simply be a scam for all I know (and lets be clear, I neither know nor suspect any such thing). It looks like they have done some good thinking and hard work on this project. I would certainly not want to imply that it is insecure. The question is always "secure for what purpose?" In this case, I would consider using it for personal (sensitive but low security) applications, but I would not put my life in its hands. This is an interesting site. It looks like they are doing all the encryption with JavaScript loaded from the threetags.com site. The big risk here is in the browser itself. There are many ways an attacker can capture your input from within a browser session. An attacker might also be able to use a man in the middle attack to modify the javascript you are received.

The fundamental issue is that you are re-downloading the software each time you go to the page, and it is difficult to know if the software has been corrupted. If the site were ever hacked, hostile code could be inserted to capture the passwords of every single user. This would be much safer if is used a signed application binary which then lived locally on your computer all the time. A non-technical risk is that I have no idea who these people are or what kind of history they have that should lead me to trust them. This could simply be a scam for all I know (and lets be clear, I neither know nor suspect any such thing).

It looks like they have done some good thinking and hard work on this project. I would certainly not want to imply that it is insecure. The question is always “secure for what purpose?”
In this case, I would consider using it for personal (sensitive but low security) applications, but I would not put my life in its hands.

]]> By: Antrek http://www.theprivacyblog.com/online-privacy/a-demonstration-of-a-vulnerability-of-cloud-computing/comment-page-1/#comment-4620 Antrek Mon, 09 Mar 2009 21:04:12 +0000 http://www.theprivacyblog.com/?p=105#comment-4620 Hi Lance, you mention that, quote: "this vulnerability is not specific to Google, it applies generally to any provider of cloud computing capabilities. I personally avoid cloud computing when I can because I have high security needs". Please have a look at www.threetags.com The site claims to be very secure. What do you think of it? Antrek Hi Lance, you mention that, quote:

“this vulnerability is not specific to Google, it applies generally to any provider of cloud computing capabilities. I personally avoid cloud computing when I can because I have high security needs”.

Please have a look at http://www.threetags.com

The site claims to be very secure. What do you think of it?

Antrek

]]>