Don’t Put Secure Info In The Cloud: [UPDATED WITH NEW INFORMATION]

UPDATED 2240 20140505:  Insync HQ has gotten back to me (and considering they’re in the Philippines, the delay makes sense).  And they’ve been very quick about replying to e-mails and seem very anxious to make sure this problem is fixed.  But it doesn’t seem that it’s something they can control They state:

…we only access your Google Drive so it’s possible that it’s orphaned and
thus not showing on Drive web (ie it’s impossible for Insync to access
someone else’s Drive as Insync would need access to the user tokens
which is approved by the user). 

I’ve still only been able to get a hold of one of the users whose data I saw;  they suggested that it might have been an accidental share as well by an employee.  Which makes the lesson below even more important.   I know that I was accidentally e-mailing someone with a letter difference for about two months earlier this year.

I use quite a few cloud services – Dropbox and Google Drive being two of the more flexible.  And I use InSync to manage synchronizing the data between Google Drive and the desktop.

It’s been a great service – and then today I noticed something strange as I was cleaning up and organizing my Drive folder.  There were a bunch of “shared with me” documents that I hadn’t synced.

And when I did start them synchronizing… well, I was surprised.

If you aren’t gasping yet, then this screengrab should make you sweat:
Yes, that file is exactly what it looks like.  The account information for every bit of financial and web information I would need was in plain text.  I have successfully contacted one party (they had designs for business cards in the folder), and resetting my syncing and purging shared folders seems to have gotten rid of the unwanted data.
I still don’t know if this was a Google Drive problem or an InSync problem.  (InSync has not gotten back to me at this point, and I have no idea who to start with at Google.)  I have no reason for either of the folders to have been shared with me.  I don’t know how the verification for the client works either.
But it does not matter.
Even if it was the most innocent of hiccups, this sort of thing will keep happening.  
If you have confidential information – and I mean passwords and the like – shared on the cloud, the individual files must be encrypted.   Whether you use a tool like TrueCrypt to manage a volume inside your synced drive or GPG (which, you might remember, I suggested you install anyway), you have to make sure that your data is secure whenever it passes through another’s hands.
And while you’re at it, check out my (still relevant) guide to securing your online life, okay?

Writing, Critiquing, and Challenges, oh my!

I've not been making the posts recently, but the challenge has still been going strong. Come write with us this
Read More
<span class='p-name'>Writing, Critiquing, and Challenges, oh my!</span>

Tracking, Advertising, Your Privacy, and this blog

Given the (hopefully temporary) defeat of net neutrality in the United States and my evolving desire to protect your privacy,
Read More
<span class='p-name'>Tracking, Advertising, Your Privacy, and this blog</span>

Four Things To Do on World Refugee Day

About every other post or tweet/toot thread I see about the way the US is treating families of immigrants has some variation of this: "But what can we do?" Here's four ways.
Read More
<span class='p-name'>Four Things To Do on World Refugee Day</span>

Never forget: This land was made for you and me

I'd like to remind you that with countries, just like people, it's easy to let the best of yourself slip away. This land was made for you and me.
Read More
<span class='p-name'>Never forget: This land was made for you and me</span>

It is time to stand.

Read More
<span class='p-name'>It is time to stand.</span>

Neo-Confederate = Current Racist

"Neo-Confederate" is an ugly euphemism, nothing more.
Read More
<span class='p-name'>Neo-Confederate = Current Racist</span>

A Father’s Day Wish. Copy, share, repeat.

Read More
<span class='p-name'>A Father’s Day Wish. Copy, share, repeat.</span>

Weekends are writing time.

The challenge has still been going strong. Come write with us this weekend!
Read More
<span class='p-name'>Weekends are writing time.</span>

There is no perfect candidate. There is only the best one available.

Oh. My. Sweet. Lord. We're already seeing it. The threats that if Democrats aren't "pure" enough, then they're not getting the
Read More
<span class='p-name'>There is no perfect candidate. There is only the best one available.</span>

If there’s one Nazi (or a racist) at the table…

Because this post by David Avallone needs signal-boosted outside of Facebook (or Twitter) alone: "As we say in Germany, if there’s
Read More
<span class='p-name'>If there’s one Nazi (or a racist) at the table…</span>

Popular posts:

  • HOWTO Make Your Hamburger Helper Better
  • If there's one Nazi (or a racist) at the table...
  • The Songs That Chronicle Our Lives
  • Word Porn Quotes
  • I am not a number; I am a free man, OR, why you should never rely on social media
  • It's not being "Awkward", and the difference between Excuses and Explanations
  • I really like you, but I have to break up with you before I don't.