Sunday, September 02, 2007

Carbonite Keeps Your Data Safe ... But From Whom?

Plenty of online companies have leveraged broadcast advertising (Travelocity, Amazon, and Yahoo! all mounted serious campaigns). Still, when I hear about a new startup on the radio in these days of TechCrunch-driven marketing, it seems like it deserves a look.

Carbonite is a startup offering easy-to-use offsite PC backup functionality to average end users -- they've recently started mainstream media broadcast advertising in the Bay Area.

I immediately wondered about the security of my backup data, though. As a youngster, you have all kinds of "secrets" that might cause you social embarrassment or get you grounded. As an adult, though, your PC hard drive has tax returns, medical records, legal documents, banking info ... things that you really don't want compromised. So a security breach of a service like Carbonite is particularly frightening.

Notwithstanding the company's "security" FAQs, which talk about encryption and about protecting the data in transit, I started getting a sinking feeling when the password field let me choose a six-letter all-lowercase dictionary word.

Since Carbonite has no other data about me, is that password enough to get all of my data back out? I took the app for a test drive and verified that, yes, my email address and that password gets all of my PC data back. Moreover, someone could "restore" my PC files to another machine, switch my Carbonite account over to that other machine, and then change my password, locking me out.

My password can also be reset if I forget it. But I don't lose access to my backup data. That means that my password is not required to reconstruct the private key that decrypts the data. A close check of Carbonite's web site verifies that in future they plan to offer an option where only the end user keeps the private key. For now, however, they keep everyone's private key on file.

I'm not a security analyst, but I'm going to toss out a few recommendations and let the experts weigh in and improve upon this as necessary:

  • User passwords (maximum risk exposure is one individual's data)
    1. Require a stronger password than "any six characters."
    2. Communicate to the end user that this password will protect access to all of their PC data, so it's worth spending a minute to pick a longer passphrase.
    3. At least encourage the user to not use the same password that he uses for every web site (namely the first one that's gonna get stolen when he sits down at a random PC in an Internet cafe and logs onto hotmail, flickr, and MySpace).
  • Maintenance of customer private keys (risk exposure is potentially all the backup data of all customers!)
    1. For power users, get that you-keep-they-key version of the app up and running ASAP
    2. Until then, make sure best practices are maintained around the storage of the private keys and data.
    3. Presumably, the keys should not be all in the same system vulnerable to a single security compromise.
    4. The keys should not be in the same system as the data they're protecting, for the same reason.
    5. No one individual should have access to all of the keys or all of the data, on purpose or by accident.

The service definitely delivers on the ease-of-use promise, from the no-credit-card free trial to the dead-easy "it just works" client application. I just hope it doesn't come at an unreasonable cost in terms of security.

11 comments:

Anonymous said...

skip

came upon your blog note about carbonite. What are your feelings about having their software running on your pc? That would seem to be at least as dangerous as letting them maintain your keys.

Colorado Springs Homes said...

Nice Posting.Thanks for sharingbi

www.mmohome.com said...

this is just too cool for words! :)
great job!



Buy WOW Gold

Buy MapleStory Mesos

summerlijia said...

Do you afraid of the doomsday? Stop worrying. Because it won't change anything; it just messes with your mind and steals your happy. If you feel nervous, do something to vex the presure. As for me, I prefer to playing D3 which is very interesting. But you need to buy diablo 3 gold to exchange the items. Finding a reliable store selling cheap diablo 3 gold is sometimes a question for me. I just hope you'll find a proper way for you to handle the negative feeling. Have a good day.

summerlijia said...

Do you afraid of the doomsday? Stop worrying. Because it won't change anything; it just messes with your mind and steals your happy. If you feel nervous, do something to vex the presure. As for me, I prefer to playing D3 which is very interesting. But you need to buy diablo 3 gold to exchange the items. Finding a reliable store selling cheap diablo 3 gold is sometimes a question for me. I just hope you'll find a proper way for you to handle the negative feeling. Have a good day.

Seacanoeist Mark said...

I liked your article, I will share your article to everyone!!




WoW gold|Diablo 3 Gold|RS Gold|Cheap Diablo 3 Gold

china tours said...

this is just too cool for words!You can learn more: China tour packages | China travel packages | China Travel Agency

Learn Chinese said...

AllMandarin is the only company that can give you an excellent alternative to learn Mandarin Chinese that is not only better, but also more efficient in terms of cost, flexibility and learning methods.I am a Chinese teacher,you can learn more about Chinese language info: Learn Chinese | Learn mandarin | Chinese teachers

Learning Chinese language said...

The best place to learn mandarin Chinese is in China. However, we understand that it isn't always possible to move here to study Chinese language. The next best thing is to study with our experienced teachers in a virtual classroom. Online students enjoy the same excellent way of mandarin Chinese online lessons and custom designed courseware that we provide for our face to face clients.

Frozen Juegos said...

This is extremely helpful info!! Very good work. Everything is very interesting to learn and easy to understood. Thank you for giving information.
Signature:
Jugar juegos de frozen en línea gratis, los nuevos de princesa de Disney juegos frozen - la princesa encantadora y linda. Divertirse frozen!

Facebook Descargar said...

I love all the posts, I really enjoyed, I would like more information about this, because it is very nice., Thanks for sharing.
Signature:
download descargar facebook gratis para Android celular and download free descargar facebook apk en español, descargar facebook plus , descarga facebook