What I really DISKLIKE about MyLifeOrganized

[Sal Ricciardi]

I've been using the Windows desktop version for a long time now, but it's getting to the point where I need something else.  Why?  Because I want cloud sync, but the MyLifeOrganized Cloud Sync Service won't work for me for business use.  Why?

1. I'm in the U.S. and want the data stored in a cloud service here in the states.  Specifically, I do not want the data stored in Russia.

2. I want the data encrypted to the point where no one, not even someone at MLO, can decrypt the data.  Only ME.  This is required both in transit and in wherever the data is stored.

3. I want the data stored on a service with a well known and trusted multi-geography replication system. For example, Mozy Backup replicates to multiple geographic locations. 

Is MLO considering addressing any of these issues?  These are a must to target modern, large business oriented customers here in the U.S.

Thanks,

-Sal 

[Dwight Arthur]

Hi, Sal. I understand and support your second point which advocates end-to-end encryption. However, you should take some comfort on the first and third points from knowing that MLO cloud sync is hosted at Amazon Web Services. Amazon's locations for its data centers and its multisite resiliency are considered adequate by most commercial users.

Let's discuss the encryption requitement a little further. In my personal opinion adequate security demands that all user data (except for timestamps and unique record IDs) be encrypted within the originating platform and not decrypted until after it reaches the receiving platform. This, plus the fact that the server cannot know which platforms will receive a copy, or even how many, in my opinion rules out asymmetrical encryption algorithms. Most easy to use implementations of consumer encryption rely on the server to do the heavy lifting. That would not be the right design if you want the MLO staff to be unable to decrypt your data even will a wareant and full access to server contents. In order to maintain privacy of server cotents and some degree of ease of use in my opinion you would have to use a password-based symmetrical encryption. This would provide good privacy protection, and would shield MLO staff from any syspicion that they are snooping in your tasks. If the user selects an appropriately strong password the protection could even be strong enough for any commercial use. However, its my opinion that no symmetrical encryption regardless of key strength is secure against the NSA. You don't specify but it sounds like you want your data secure against recovery by the NSA or by other entities that may have or develop comparable decryption skills, right?

Sal, do you have any thoughts or suggestions on what sort of encryption setup could meet all three goals of:
1. Data never recoverable at server by provider staff
2. Data never recoverable by NSA
3. Usable by ordinary users who are not trained in cryptography
-Dwight
Mlo betazoid on Android sgn2

--
You received this message because you are subscribed to the Google Groups "MyLifeOrganized" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mylifeorganiz...@googlegroups.com.
To post to this group, send email to mylifeo...@googlegroups.com.
Visit this group at http://groups.google.com/group/mylifeorganized.
To view this discussion on the web visit https://groups.google.com/d/msgid/mylifeorganized/0d7e4c28-b75a-4b78-a7c8-93426397dc46%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Sal Ricciardi]

Hi Dwight,

First, thanks for the information. I didn't know that MLO Cloud Sync is hosted by AWS. That definitely does help.  Do you know where this is documented?  Also, do you know where the AWS hosts reside?

Regarding encryption, putting aside the technical issues, it comes down to trust and transparency.  If you are a provider and you convince me through that manner in which you evangelize and discuss your security commitments, your technology implementation within obvious limits, and through customer positive experience, I'm usually willing to at least consider your service. First comes trust and transparency. Technically, with that prerequisite in place, I do agree that the encryption has to occur on the client (i.e. my computer) and my preference is very much that the data stay encrypted on the server. Is that not possible due to regulations?

I'm not wanting to use the Cloud sync as a backup store so recovery is not an issue. Cloud sync is for convenient access to my data on multiple devices (PC, iPhone, iPad, etc). Also, the NSA can have a copy of my MLO file -- that's not the issue.. 

Thanks,

-Sal

[Andrey Tkachuk (MLO)]

Hi Sal,

I would like to confirm that MyLifeOrganized infrastructure is fully located in US.
We are using AWS for cloud sync and for development. There were several blog posts and posts on this forum about MLO Cloud  Here are some info:
https://groups.google.com/forum/#!searchin/mylifeorganized/aws/mylifeorganized/7a5-8quza4Y
https://groups.google.com/forum/#!searchin/mylifeorganized/aws/mylifeorganized/Ja-4XEyzQ6A

You can easily check yourself or ask professionals how to identify where servers are located. You should check for sync.mylifeorganized.net
You can use services like this one or similar:
http://network-tools.com/
-------------
IP address: 107.22.229.77
Host name: sync.mylifeorganized.net
Alias: sync.mylifeorganized.net
107.22.229.77 is from United States(US) in region North America

NetName:        AMAZON-EC2-8
OrgName:        Amazon.com, Inc.
OrgId:          AMAZO-4
Address:        Amazon Web Services, Elastic Compute Cloud, EC2
Address:        1200 12th Avenue South
City:           Seattle
StateProv:      WA
PostalCode:     98144
--------------
 
Thanks.
Andrey.
Ukraine.

[Dwight Arthur]

Sal, thanks for the very helpful question - I have a better understanding of the issues than I did when this thread started.

Client-side crypto is more secure. However, an app that contains client-side crypto must identify itself as such when registering for sale in Google Play or the iTunes App Store. I understand that this triggers a regulatory review that's timeconsuming and perhaps intimidating. So if the MLO Cloud Sync service is ever enhanced to provide encrypted storage of data-aty-rest, it's more likely to be done on the server side than the client side.Server-side cryptography is still far more secure than password protection.

On Friday, July 25, 2014 3:59:00 PM UTC-4, Sal Ricciardi wrote:

. . . Regarding encryption, putting aside the technical issues, it comes down to trust and transparency.  If you are a provider and you convince me through that manner in which you evangelize and discuss your security commitments, your technology implementation within obvious limits, and through customer positive experience, I'm usually willing to at least consider your service. First comes trust and transparency. Technically, with that prerequisite in place, I do agree that the encryption has to occur on the client (i.e. my computer) and my preference is very much that the data stay encrypted on the server. Is that not possible due to regulations?. . .

[Matze Matzomat]

Hey Sal,

I don't know how much you know about servers but setting up your own server and maybe 2 rented FTP Server with encrypted harddrives on 2 sides of the world would actually solve all 3 requests of yours. IMO it's the only way to secure your data at least a bit.