"Don't mind me, just putting important & sensitive personal information on the internet backed by the power of an easily guessible password and hints.
Pre-Encrypt -> [OwnCloud || SpiderOak || AWS S3 || etc.]
And re leaked docs ... I still don't understand the mindset that some people have (maybe someone can help me). When people say, "oh, but the US Gov isn't worried about you" all I can do is roll my eyes.
* How can you verifiably prove that? (they can't)
* How can you verifiably prove other governments aren't?
* How can you verifiably prove chaos agents aren't?
* How can you verifiably prove someone isn't silently watching you?
* etc.
Just because it was or wasn't in a leaked document does not mean that the ability does not exist nor does it mean that such capability is only in the hands of 1 government.
In my eyes, the leaked docs showed "this is the current level" re: security/privacy/surveillance. We have to assume all other governments, corps, & individuals have equally or more powerful systems in place. Why? Because it's the only safe assumption.
That assumption has no bearing on the merits of legality with how the NSA conducts its mission, nor bearing on how others act. The documents merely give evidence and a base-level run down of additional attack vectors. This has absolutely zero to do with a "legal vs. illegal"-action debate and everything to do with technological security and infrastructure.
I encourage everyone to consider RFC 7258 [1] in their future projects. Do it for your users, whomever they may be. Consider RFC 7258 your USSINT 18 (if you're American) ... that is, fucking read it, understand it, and internalize it. Maybe the gov is good, maybe they're bad - that is irrelevant when there is more than just 1 gov in the world.
I understand this and it is not contrary to my point. I'm actually trying to point out that the companies Snowden mentions have been specifically mentioned by NSA slides/documents and I think this has colored his suggestions. He suggests moving to others - but ultimately anything he suggests will get subverted if enough interesting material gets stored there. Not that that in itself is a reason not to adopt new technologies.
> To sneak it by us...
They aren't sneaking it by you as a company. They cooperate with the corporation and its internal organizational model to create a solution that fulfills the requirements. Most employees, however, can be blissfully ignorant.
I think you overestimate your ability to know such things. I know plenty of Google employees that had no idea about Google's involvement, Facebook employees with no idea about Facebook's involvement, Apple employees with no idea about Apple's involvement and Microsoft employees with no idea about Microsoft involvement.
I also work at a large company, and would have thought I would have seen clear indications of PRISM (& other) activity. Unfortunately that is not the case.
Condolezza Rice (of all people) joined the board of Dropbox.
This is their full time job and their professional expertise. I'm sure that PRISM infrastructure (or beta versions) were accounted for in full.
Edit: It's not condusive to conversation to downvote something merely because you disagree with it. The downvote button (and upvote respectively) are for designating whether you believe something is irrelevant to (/contributes to) the topic.
I haven't been at Dropbox for a year now, but for most of the time I was there I was one of only two SREs that ran the production infrastructure. I knew every piece of server hardware in every datacenter, and what services ran on them. It was my job to qualify and deploy hardware, do the systems level automation, and run the user facing frontends. There is literally no way that something like PRISM could be put in place without my knowledge except by what would amount to sabotage.
Keep in mind that while Dropbox is large for a startup, it only recently surpassed 1,000 employees (150 when I joined). The vast majority of those people are in customer service, and the number of people with access to production is likely still well under 100. For the first five years of the company's life there was one datacenter manager and network engineer (the same person), one SRE up until I was hired, and so on. In operations, we did more with less.
However, this shouldn't make you feel like your data in Dropbox is guaranteed to be safe from prying government eyes. Dropbox can and does comply with government requests -- every company operating in the US does so, or they would not be operating anymore.
I agree with your distaste towards Condoleezza Rice joining the board. It doesn't look good, but I also doubt that she has any day-to-day authority or responsibilities whatsoever.
Some of the lengths they go for these programs are really impressive. It was revealed that AT&T had secret rooms built that blend into the building infrastructure but MITM every packet that gets sent through (what looks like) normal infrastructure lines.
At some point it feels like you're being asked to prove a negative. That's the thing about discussing secret operations. And it is why the documents are so important.
I wonder now that the Snowden leaks are getting dated about a year old (and it being a few since you've left Dropbox) how much has changed.
Finally, the other companies on Snowden's list are certifiably on the list of already onboarded products, so it's hard to trust them.
> I also doubt that she has any day-to-day authority or responsibilities whatsoever
For example she assigned a new CFO for Dropbox. I doubt she has day-to-day authority (she's a busy woman), but being on the board and selecting upper management is a lot of power.
What I wanted to convey is that user data was not used (at that time) in an untoward fashion by Dropbox. Everyone that I worked with took privacy and security very seriously, and we knew that user trust is tough to earn and easy to lose. Handing data to the government automatically, without a warrant or confirmation of authority, would not have been something that anyone was interested in doing. But the government does have ways of making you do things that you don't want to do (see: Yahoo).
The biggest problem that I have with all of the Snowden revelation stuff is this: people seem quick to blame the companies who are complicit rather than the government who is the root of the problem. The government's efforts against security and privacy are the biggest threat the technology industry has ever faced, and if left unaddressed I believe it will inevitably lead to the US losing it's leadership position.
One last point, regarding Dropbox's CFO. Sujay had been at Dropbox for over three years (since 2010) and was involved in the CFO search for a long time. That they picked him for the role says a few things, but I don't see it as Condoleezza stacking the deck.
As an aside the NSA keeps secrets between tens of thousands of employees (although I hear it's Orwellian and depressing to work there). You can keep secrets between small and even large groups of people. You just have to have the right processes and leverages.
'Punishing' companies that collaborate with the government has a few parallel goals:
1.) Wanting to use something that has not yet been purposefully subverted.
2.) Give the companies a real argument for resisting programs.
3.) Speak out against the practices (since it isn't on a ballot anywhere).
Yes, ultimately it isn't the companies' faults (however the complicit few with blinders on for profit motive should be shunned for not putting up a fight).
Which we know the NSA has performed, intercepting shipments of servers in order to modify them.
Every company that wants to continue to operate in the US has to comply with US government orders, that is just a fact of life. No one in the technology industry is super excited about going to jail or having their equipment seized. But the kind of compliance that PRISM implies is not something that you just sneak in without anyone noticing.
There was an internal accounting of every server and network connection -- it would have required a shadow ops team running shadow datacenters to sneak it by us.