101–110 of 136 posts
An inevitable consequence of this administration destroying US foreign influence and power at an unprecedented rate is that (IMHO) it is inevitable that the EU builds their own cloud and mandates its use for EU data. It is becoming a matter of national security. The interesting thing is that the US is acting in the exact way that they accuse China of acting. Companies like Huawei are forbidden from installing telecom…
Earlier quoted context omitted.
The trick is to collect as little data as possible and to get rid of what you need to collect as quickly as you can. This is in direct opposition to the practices of companies like Microsoft which wants to spy on their users and profit from the data they collect though. There's also an open question of how possible it is to run a system that doesn't collect/store data in a way that makes it possible to be collected b…
This is why I still prefer Signal; this practice seems to be their modus operandi even though they, too, were affected by AWS us-east-1 catastrophe
More recently they've started collected the contents of messages into the cloud too, yet to this very day their privacy policy opens with the lie: "Signal is designed to never collect or store any sensitive information." which hasn't been true for a very very long time. I consider their refusal to update their privacy policy to be a massive dead canary warning people that the service has already been compromised, but feel free to take your chances.
This applies to any company, doesn't it? Your home country can tell you "Give us your data" and you have to comply. "I will never give up customer data" is a very tough promise to keep, if the government threatens you with your business license being revoked, your servers and domains being forcibly seized by the police, and you personally going to jail. (Under the current US administration, we can add "A close examin…
The trick is to collect as little data as possible and to get rid of what you need to collect as quickly as you can. This is in direct opposition to the practices of companies like Microsoft which wants to spy on their users and profit from the data they collect though. There's also an open question of how possible it is to run a system that doesn't collect/store data in a way that makes it possible to be collected b…
This applies to any company, doesn't it? Your home country can tell you "Give us your data" and you have to comply. "I will never give up customer data" is a very tough promise to keep, if the government threatens you with your business license being revoked, your servers and domains being forcibly seized by the police, and you personally going to jail. (Under the current US administration, we can add "A close examin…
The trick is to collect as little data as possible and to get rid of what you need to collect as quickly as you can. This is in direct opposition to the practices of companies like Microsoft which wants to spy on their users and profit from the data they collect though. There's also an open question of how possible it is to run a system that doesn't collect/store data in a way that makes it possible to be collected b…
Earlier quoted context omitted.
This is why I still prefer Signal; this practice seems to be their modus operandi even though they, too, were affected by AWS us-east-1 catastrophe
Signal used to never collect data on users, but they've changed that a while ago and now they keep user's name, photo, phone number, and a list of their contacts permanently in the cloud protected from the government by nothing except by a leaky enclave and a pin ( https://web.archive.org/web/20250117232443/https://www.vice.... ) More recently they've started collected the contents of messages into the cloud too, yet…
I'm also not sure where you've read that they collect the contents of messages, because as far as I'm aware they still aren't doing that and I can't find any info online that indicates that they are (other than their secure backup feature that's opt-in only I suppose)
Earlier quoted context omitted.
I suspect the other 4 eyes are somewhat less willing to do the US regime's bidding these days
On what basis?
Earlier quoted context omitted.
> Maybe I’m misunderstanding something - if I store my data elsewhere , am I not supposed to encrypt it anyway "Cloud" is not only for storage; it's also for compute. Doing compute directly on encrypted data (homomorphic encryption) is very slow and very complicated, so when using a cloud, the data is usually either unencrypted, or encrypted but the key is elsewhere in the same cloud.
Thanks. I get that FHE is not realistic today, but can’t I use ( if it’s really critical) a combination of confidential vms and an external hsm ? I understand I’ll be limited to traditional workloads , and not managed services though. I asked the wrong question, what I really meant was ‘if I run in a less trusted environment, am I not supposed to use all possible crypto mechanisms available to make that environment m…
Absolutely do what you can, but understand that it's futile to defend against your own cloud provider.
Earlier quoted context omitted.
On what basis?
Might have Something to do with the current US administration tweeting pictures of confidential material in the past, exposing their capabilities to the world. Intelligence community members tend to hold their cards close to their chests.
Earlier quoted context omitted.
Thanks. I get that FHE is not realistic today, but can’t I use ( if it’s really critical) a combination of confidential vms and an external hsm ? I understand I’ll be limited to traditional workloads , and not managed services though. I asked the wrong question, what I really meant was ‘if I run in a less trusted environment, am I not supposed to use all possible crypto mechanisms available to make that environment m…
That's just not possible. It's why detractors never got on board with the Cloud. Until FHE is feasible, the decryption keys and plaintext have to exists in RAM eventually at some point in order even if only took be re-encrypted, if any complex work is to be done on it. Because eg, Amazon, has access to your hardware, there's simply no way to prevent them from reading your secrets out of your VM that's using their RAM…
The only issue left would be managed services though, which then I wouldn’t use, but I’d be able to run my own postgre safely on infra I’m renting.