Privacy and Security in the Cloud

One of the questions I hear most frequently about using cloud services and storage is “What about security?” Is the Cloud…safe?

The simplest answer would be no, the Cloud isn’t safe. But the reality is considerably more nuanced.

For starters, let’s be clear about what we mean by “security.” Security is freedom from danger or harm. What harm could come to you when using the Cloud? Well, apart from all the usual risks of using any computer network (such as intruders trying to gain unauthorized access to your equipment, exposure to viruses and other malware, and accidental data loss), the biggest danger of the Cloud is that someone could see private information about you—the contents of files you store online, your schedule, your current location—and use that information to harm you. Harm could mean taking your money, stealing your identity, or damaging your reputation, among other things.

In other words, when it comes to the Cloud, the main reason for security is to protect your privacy, where privacy is freedom from observation or attention.

You can have privacy without security (think: a changing room at a department store), and you can have security without privacy (imagine locking yourself in a glass cage). But in general—especially online—actions that increase your security also increase your privacy. In the Cloud, security and privacy are two sides of the same coin.

This chapter starts by exploring the threats to your privacy—who might want to obtain your private data and why, how privacy policies work, and more. Then, in Security in the Cloud, I turn to the security portion of the equation, which mainly has to do with encrypting data in various ways to prevent other people from accessing it.

Privacy in the Cloud

I want to begin by discussing some of the threats to your privacy when using cloud-based services (especially those accessed in a Web browser), what you can do about them, and how you should think about the Cloud in terms of privacy. (Portions of this topic were taken from my book Take Control of Your Online Privacy, which covers online privacy in much greater breadth and detail.)

Who Wants Your Private Data and Why

When you use cloud services, lots of information you may want to keep private—from email to files to your media viewing preferences—travels over the Internet. That in itself isn’t a problem; after all, you want to share private information with your family, friends, doctor, and so on. Problems can occur when someone accesses personally identifiable information without your consent or even, in some cases, your knowledge.

Who exactly might be trying to learn private information about you online? I’m glad you asked; in the next few pages I explain who wants to know about you and, crucially, why. Knowing who you’re trying to keep your private data private from is a useful first step.

Advertisers

The Web is powered by advertising as much as it’s powered by servers and routers. Many Web sites devote far more space and resources to ads than to their actual content. As you know, it’s difficult to read the news, watch a video, check your email, or even peruse pictures of cute cats without being bombarded by ads.

Web sites sell advertising space because that’s the only way most of them can make any money. However irritating, or even slimy, you may consider online advertising, it is the mechanism that has kept most Web sites and other Internet services free.

The companies that purchase advertising want to get their money’s worth, and that happens only if the ads result in sales. So advertisers expend a tremendous amount of effort to ensure the ads each person sees are likely to be of interest and thus lead to purchases. When advertisers make money, they’re able to keep buying ads and the sites that display the ads can stay in business.

Years of experimentation have shown that the most effective ads are those that target individual needs and preferences (including things you didn’t even think you needed!), not those that are merely relevant to a site’s content or the perceived needs of a broad demographic group. For example, if an advertiser knows I’m in the market for an air conditioner and shows me an ad for one—even on a completely unrelated site—the chances of making a sale go way up.

How might an advertiser know that I’m in the market for an air conditioner if I’m not on a site that sells air conditioners? There are a number of techniques, including tracking cookies. Most involve using hidden instructions that store data on my device when I visit a Web site (say, a search at Amazon.com). That data is then accessed when I go to another site (say, weather.com) containing an ad from the same provider or advertising network. Although the server may store the details of my visit, the local data enables me to be identified across sites.

As you search the Web, browse various sites, follow links, and—crucially for the purposes of this book—use ad-supported cloud-based apps, advertisers can build up elaborate profiles of your perceived interests and tastes. And, because your IP address (or profile information that you’ve entered into a social networking site like Google+ or Facebook) tells them roughly where you are, they can even display ads for local businesses selling products you’ve shown interest in.

Unless you regularly search for things that someone else might regard as suspicious, none of this should be a concern. After all, if I truly do want to buy an air conditioner, I’d rather see an ad for an air conditioner than an ad for weight-loss products or hair color. Targeted ads should, in principle, be more helpful to me than random ads.

But…

Individually targeted advertising isn’t always to your benefit. The same bits of data advertisers piece together to determine your interests and location can be used for things like showing higher prices on furniture to people who live in wealthy neighborhoods—or higher prices on electronics to people using Macs rather than PCs. They could also be used to determine that you are a registered voter in the “wrong” party, resulting in a phone call sending you to the wrong polling place.

When targeting becomes unfair or misleading, when it gives away personal information to others, or when it benefits only the advertiser and not the consumer, you may feel that your private data has been misused. Unfortunately, there’s no master switch you can throw that says, “Sure, you can know who I am and what I search for, but only if you use that information responsibly.” If advertising becomes intrusive or creepy rather than helpful, you may want to take steps to prevent any advertiser from collecting your private data, not just objectionable advertisers. The number of ways in which you voluntarily give away personal data online extends far beyond the Web sites you visit, so this isn’t a problem with a perfect solution—but you can certainly reduce the risk (as I explain later in this chapter).

Local Villains

Another category of people who might be out to get the digital goods on you is what I’ll call “local villains.” Let me give you some examples:

• Ex-spouses or former partners who want to make your life miserable or even find evidence to use against you in court
• Neighbors with whom you have a dispute or disagreement
• Your current employer, who may want to make sure you’re not violating company policies or misusing proprietary information
• A prospective employer who’s trying to judge your appropriateness for a position
• Stalkers, thieves, and other criminals looking for evidence of when you’re home or not, where your kids are, and other information
• Friends and relatives who like to snoop and gossip

As a group, local villains tend to be less technologically sophisticated than advertisers, hackers, and others who seek your personal information. On the other hand, they may be more motivated, and they’re far more likely to be focused on you personally rather than on a sales demographic you represent. And, let’s face it, most of us have tons of personal information online that’s readily accessible by the general public—Facebook, Twitter, Flickr, personal blogs, and so on.

Hackers

Some of them do it for fun. Some do it for notoriety. Some do it to make money. But one way or another, thousands of intelligent but misguided people around the world spend every waking hour trying to break into computer systems to steal information and money, to trick you into buying something, or simply to cause mischief.

I shouldn’t call them “hackers,” because hacking is a noble art and only a small subset of hackers use their powers for evil. But you know what I mean: black hats. People—mostly young men—who write and distribute viruses, keyloggers, Trojan horses, and other malware. People who send spam and use phishing messages to con you into handing over your passwords. People who take over computers by the millions to turn them into botnets. Bad guys.

Hackers rarely target specific individuals—in most cases, it’s nothing personal. The two pieces of private information most of these bad guys would be happiest to have are your credit card number (for obvious reasons) and any password that protects financial information (for the same reasons) or provides access to large amounts of your data, such as your email account. Although it’s difficult to protect your privacy from a truly determined hacker, you can take steps (as discussed later in this chapter) to make their work harder and less rewarding.

Big Media

The RIAA (Recording Industry Association of America) and MPAA (Motion Picture Association of America)—along with record labels, movie studios, publishers, and other major copyright holders—are keen to know who has been pirating their media. Apart from monitoring BitTorrent traffic and file sharing sites, these firms work closely with ISPs to identify people who illegally share movies, software, and other copyrighted materials. Depending on your location and provider, this could lead to serious consequences including civil lawsuits and termination of your Internet service.

I don’t blame copyright holders for protecting their property; I’ve had my own work pirated and lost money because of it, and it’s no fun. (You did pay for this book, right? Just checking. If not, I should mention in passing that I can see you right now.)

The problem is, sometimes big media companies make mistakes. They’ve sued little old grandmothers who don’t even own computers and made other egregious blunders. Even if you’d never consider stealing media (I did tell you I’m watching, right?), you might prefer that your file sharing activities be kept private.

Big Money

Banks, credit unions, credit card providers, and other financial institutions may want evidence of your thriftiness or trustworthiness in considering whether to offer you a mortgage or other loan. Insurers may want to see whether you engage in risky behavior or have medical conditions that might influence your rates or disqualify you. When lots of money is at stake, it’s only prudent to collect as much information as possible to make a good decision. That’s as true for large corporations as it is for you.

You should not be at all surprised if a potential lender or insurer checks out your Facebook page or searches for your name on Google. Your health-food blog and tweets about your jogging regimen might score you a better life-insurance premium; Facebook posts about late- night drinking binges could raise your car insurance rates. You may never learn why these things happened, either—companies generally aren’t required to reveal how they go about researching you.

Big Data

Google may be the largest non-governmental data collection entity in the world. Facebook, Twitter, and other companies with users numbering in the hundreds of millions also collect massive amounts of data on users’ tastes, preferences, opinions, geographical whereabouts, and other details. Although this data is mostly used for targeting advertising (see Advertisers), it can also be put to many other uses, from the virtuous (helping you find a parking space) to the creepy (profiling you as a potential criminal).

Big Brother

Unless you’ve been protecting your privacy by living in a remote cave without electronics or human contact, you’re probably aware of the string of revelations starting in mid-2013 about ways in which government agencies, including the NSA (National Security Agency) in the United States and Britain’s GCHQ (Government Communications Headquarters), have been secretly collecting phone records, email, recordings of Skype conversations, and other data most of us thought was private—on the authority of secret courts and accompanied by gag orders that prevented those who knew about the data collection from revealing it. In fact, this sort of thing has been going on for a long time, and there’s no end in sight. The public might never know the full nature or extent of government data monitoring.

All this is being done, of course, in the name of preventing terrorism and other crimes. You may or may not believe that. You may trust the government and feel that a reduction of privacy is justified by an increase in security, or you may feel the whole thing is an appalling abuse of power. Whatever your opinions, I believe the following facts are uncontroversial:

• Massive data collection has happened and continues to happen. There are apparently no technological barriers preventing the government from monitoring most email, phone calls, and other online data.
• The laws governing data collection may eventually change, but if the U.S. government’s current monitoring was performed for years without the public’s knowledge that the law permitted it, the same thing can happen again. (And in any case, making something illegal doesn’t mean it won’t occur.)

• Although we now know something about data collection by the NSA, FBI, and other U.S. law enforcement agencies—and comparable efforts in certain other countries—the full extent of global monitoring is unknown. It’s plausible that other governments have the capability to capture at least some of your personal data, even if you access Internet services only in your own country.
• Other than lobbying for changes in laws you may disagree with and voting for people whose privacy positions you trust, there’s little that average citizens can do about this sort of data collection.

The difficulty with all this from a privacy point of view is that even if you are the most harmless and trustworthy person in the world, something you say or do online—or some snippet of data you store or sync using the Cloud—could be misconstrued or misrepresented. Just as spam filters incorrectly flag some legitimate messages as junk mail, government computers could incorrectly flag you as a potential threat, and that could have consequences ranging from inconvenient (such as being put on a no-fly list) to devastating (being charged with a crime you didn’t commit). Computers have been known to make mistakes—and so have the people using them. The greater your use of cloud services, the greater your risk of falling victim to such a mistake.

Privacy Policies

But wait. Surely the Cloud isn’t as scary as I make it out to be—a place where everyone wants a piece of your private data. Aren’t there controls in place to keep you safe? There are some, but they may not mean what you think they mean. A case in point: privacy policies.

Almost every Web site and cloud service has a published privacy policy, and I’d think twice about using a site without one. Privacy policies spell out what data the company collects (particularly personally identifiable information), how it’s used, what protections are in place to safeguard it, and so on.

Privacy policies, like software licenses, are typically full of boring, inscrutable legalese. They might be good for curing insomnia, but they’re not exactly page-turners. Even so, you might find it interesting and educational to read the privacy policies from a few sites and other cloud services you use often. As you do, keep the following in mind:

• Although a company may be legally obligated to publish a privacy policy stating how it uses your data, it’s not required to have a policy that protects your privacy. A privacy policy could state, “We ruthlessly collect every scrap of personally identifiable information we can find about each user and sell it to the highest bidder, with malice aforethought.” So, don’t mistake the presence of a privacy policy for a pledge of privacy.
• Privacy policies sometimes contain cleverly worded loopholes—and policies could be updated without your knowledge to become less protective of your personal information.
• However strict and commendable a privacy policy may be, it is, at best, only a policy—not a barrier. A company may say it stores your data in a secret mountain fortress protected by a dragon, but does it have a contingency plan in case a hobbit shows up with a magic ring and a bunch of dwarves? These things happen.
• A privacy policy does not, by itself, have the force of law. If you can prove that a company violated its stated policy, you might be able to win damages in a civil lawsuit. But that can’t prevent, undo, or correct a breach of privacy.

I wouldn’t want to do business with a company whose privacy policy admitted to practices I disagree with, and I’d rather know about such things up front. But even a fantastic privacy policy is no guarantee. For further consideration of privacy policies, I refer you to my TidBITS article FlippedBITS: Do Privacy Policies Mean Anything?.

How to Improve Your Privacy in the Cloud

I’ve tried to paint a picture of the Cloud as a place where privacy is more or less on the honor system, and there’s little honor to be found. By default, you should assume that any information you expose to the Cloud (in any of the ways discussed in this book) is not private. If your goal is to share photos, documents, and other information freely, that may be exactly what you want. But to the extent that you want to keep information about yourself private—I’m thinking about things like your name, physical location, contents of personal messages, and confidential files—you shouldn’t expect the Cloud to do that for you automatically. You have to take matters into your own hands.

To make this perfectly clear, even if you choose cloud services with the greatest care and attention to their security options, privacy policies, and reputations, nothing you do can guarantee perfect or complete privacy. But you can take several steps to reduce your risks significantly.

As I explain just ahead in the security portion of this chapter, measures such as better Wi-Fi security, virtual private networks, encryption, and strong passwords can improve your privacy. Beyond practices like these, there’s a certain tension when it comes to privacy in the Cloud. On the one hand, if you’re using a service for which you have an account (which will be the case more often than not), the service provider must, by definition, know at least something about you. You could configure your browser not to store cookies, but that might make the sites you visit harder (or even impossible) to use. You could enable browser plug-ins that block trackers and other widgets, but those, too, may interfere with the very services you’re trying to obtain.

On the other hand, if you’re using free, ad-supported sites and services without an account, revealing information about yourself for the purpose of displaying better ads is part of the bargain. Whether you realize it or not, “free” really means that you agree to give up an extra portion of your privacy in exchange for a service.

All told, the story about privacy in the Cloud is somewhat unsatisfying. No matter what you do, you have to put a certain amount of faith in potentially vulnerable technologies (such as SSL—see Protecting Data in Transit), and another measure of faith in each of the companies you do business with. While many people feel entirely comfortable doing so, others perceive the overall risk as being unacceptable. For anyone who’s nervous about privacy in the Cloud, one option is to bypass it completely and create your own personal cloud. It involves work and expense, but you may appreciate the benefits. See The Personal Cloud, a few chapters ahead, for details.

Security in the Cloud

Well, that was the bad news—privacy in the Cloud is hard to come by. The good news is that even though there are no guarantees, you can do lots of things to decrease your risks by making it more expensive and inconvenient for outsiders to monitor what you do in the Cloud.

Security Overview

If you want to protect yourself in the Cloud, encryption is the name of the game. Encryption scrambles your data so it appears to be meaningless gibberish, and the only way to unscramble it is to use a key that (in theory) only you know. Without encryption, someone could examine files as they sit on your computer or other device, “sniff” network traffic as it flows to and from the Cloud, or peek at data that you’ve stored on a server somewhere.

There are many techniques whereby one can encrypt data, and not all of them are equally good. Even a great encryption method may have an undiscovered vulnerability that someone learns to exploit next week, turning what previously seemed safe into a nightmare. However, as ordinary consumers, most of us can’t evaluate vendors’ claims about the strength of one algorithm versus another—and we often can’t even confirm that encryption is happening at all. What we can do is make sure all the right switches are turned on, all our passwords are strong, and we’ve done what we can to address known points of weakness.

What are those weak points? Figure 6 shows a few of them.

Here are a few additional details on key trouble spots:

• Your computer: If someone obtains physical access to your computer, or hacks in over a network, any unencrypted data on your hard disk or SSD can be read. (I say more about this ahead, in Protecting Data on Your End.)
• Your Wi-Fi connection: If you’re on an open Wi-Fi network (with no password) or one that uses the old, insecure WEP protocol, someone sitting nearby can easily eavesdrop on everything that travels to and from your computer or other device. Unless that information is encrypted in some other way, it’s vulnerable. (See Protecting Data in Transit, which also covers the next point.)
• The Internet: The portion of the Internet between your local Wi-Fi router, cable or DSL modem, or other access point and the server you’re communicating with could be tapped at any number of spots. And even if it isn’t, network administrators with access to any of the intermediate routers, servers, and other infrastructure could potentially spy on unencrypted data.
• Cloud servers: Data stored in the Cloud usually resides not just in one place, but on multiple servers in diverse geographical locations (to say nothing of backups stored by cloud providers). Employees of cloud providers may have access to your data in any of these locations—and in some cases, government agencies could, too. (See Protecting Data in the Cloud.)
• Other users’ devices: Even if you use end-to-end encryption—you encrypt something on your local device and it remains encrypted in transit, while in the Cloud, and as it’s transmitted to someone else’s device—you can’t control what happens once the other person decrypts it. Whether it’s an email message, a file, or a video chat, the unencrypted data on the other person’s device may be vulnerable. Unfortunately, there’s really nothing you can do to protect data on the other end except ask the other person to take care with your data and trust that they will—or think twice about sending extremely sensitive information over the Internet at all.

For practical reasons, it’s not always possible or even desirable to encrypt every bit of data you send to the Cloud and every connection it travels over. But you should at least be aware of the weak spots and take whatever measures are available to you.

As you do, you should pay special attention to two main security considerations: the encryption key and your password.

Encryption Keys

Every lock has a key, and every form of encryption also has a key (in this case, a string of characters) that can be used to unlock it. Sometimes the same key is used for locking and unlocking (that’s called symmetric encryption) and other times one key is used for locking and a different one is used for unlocking (that’s asymmetric encryption, of which the best-known example is public-key encryption).

Most of the time, you won’t see or use a key directly; you will instead enter a password. I could write a whole chapter explaining the difference between a password and a key, and why we (sometimes) need both, but I’ll spare you the gory details. Suffice it to say that the key is what actually performs the locking or unlocking behind the scenes, while passwords offer a flexible, human-friendly method for creating keys.

Now here’s the question you need to consider carefully: when a cloud provider tells you that your data is encrypted, who holds the key?

The answer may not be as obvious as it sounds. You probably had to come up with your own password for each cloud service, but that does not necessarily mean your personal password is used to create the encryption key. Sometimes it’s used only to provide access to your account, and the cloud provider holds the actual encryption key.

Here’s a concrete example: Dropbox. Anything you put in your Dropbox folder is encrypted before it leaves your device, and remains encrypted in the Cloud. Great, right? Well, it is great in the sense that the encryption protects your data in transit as well as protecting it from anyone who might gain access to the Dropbox servers remotely. But Dropbox has the key to decrypt all your data. That means if the company were to get a court order or other official request, that encryption would be meaningless to you, because all your data would be supplied to the requesting party—likely without your even knowing about it.

By contrast, SpiderOak ONE, another cloud storage service, offers what it calls “zero-knowledge” encryption. When you set up an account, a personal key is created just for you, based on your password, and that key is never transmitted over the Internet. That means the company couldn’t access your files even if it wanted to—all it can see is blocks of data sitting on its servers, with no idea as to their actual contents.

Some providers, such as the online backup service CrashPlan, give you the option to trust them with your key or to keep it completely private—you get to choose whether convenience or security is the more important consideration.

When a provider holds the encryption key, that provider can help you recover data if you forget your password; if you hold your own key and you forget your password, you’re out of luck. Letting a provider hold the key also makes sharing and certain other operations easier. So holding your own key may not be the no-brainer it sounds like, but you should at least be aware of how each provider you use handles its encryption keys.

Unfortunately, obtaining this information may require some digging through privacy policies, terms of service, and FAQs—it’s not the sort of thing most companies call attention to.

Passwords

Every cloud account you have likely has its own password, and sometimes encryption keys are also derived from those passwords. But whether or not they’re used to encrypt something, passwords protect your account data and access to the storage, apps, and other resources you use in the Cloud. They’re important, valuable pieces of information that you should treat with great care.

I wrote a whole book about passwords, Take Control of Your Passwords, and it’s been one of my most popular titles. The three key points I want to draw from that book and emphasize as strongly as I can are these:

• Don’t reuse passwords. That is, create a unique password for every site and service. If you use the same password in more than one place, the danger is that one site may have a security breach that results in your password being revealed—and then whoever learned your password can use it to log in to other services (your bank, your email account, and so on).
• Use strong passwords. You’ve heard this advice before, I’m sure, but I want to repeat it here. Don’t use names, dates, words from a dictionary, keyboard patterns, or simple phrases in your passwords. If possible, always include uppercase and lowercase letters, digits, and punctuation. All things being equal, longer passwords are better than shorter ones (you should be thinking in terms of 12 or more characters), and random passwords are better than those you come up with yourself.
• Let technology help you. I know—it’s a real pain to come up with lots of unique, strong passwords; memorize them; and then enter them when they’re needed. So I suggest leaning on a type of app known as a password manager to do all that for you. There are many such apps out there. My favorite is called 1Password, and I wrote a book about it (of course) called Take Control of 1Password. You may prefer LastPass, Dashlane, RoboForm, or any of numerous competitors (again, see my Wirecutter article The Best Password Managers). I don’t care what you use, but make your life easier and use something.

Protecting Data on Your End

The best way to make sure your data is secure (and thus private) in the Cloud is to encrypt it before it ever leaves your computer or mobile device. Then, even if it travels through insecure channels (such as open Wi-Fi networks) or is intercepted in transit, no one else can see its contents.

Realistically, however, encrypting data on your end is feasible only in certain situations. For example:

• Files: If you’re going to sync files across devices via the Cloud—and the service you plan to use either doesn’t encrypt the data itself or controls the encryption key so that it could be decrypted without your permission—you can use a third-party file-encryption tool on your Mac, PC, or mobile device. There are many fine choices here, but if you use multiple platforms, look for something that has versions for all of them. One example of such an app is VeraCrypt, which comes in versions for macOS, Windows, and Linux, with unofficial third-party apps available for iOS and Android.

  But I must mention a caveat about local encryption options like this. If you encrypt all the data you sync to a cloud storage service, apps that tie directly in to the service may not work—for example, if you encrypt a PDF on your Mac, put it in Dropbox, and use a PDF viewer app on iOS to open that file directly from Dropbox, all you’ll see on your iOS device is gibberish.

• Email: If you need to send email to someone securely, you can use a public-key encryption system. Each person creates a pair of keys—a private key, which is never shared, and a public key, which is shared freely. You encrypt a message using the correspondent’s public key, and then only that person can decrypt it with the corresponding private key. Examples of public-key encryption tools for email include Symantec Desktop Email Encryption and GnuPG (Mac users will want GPGMail, part of GPGTools; iOS users can try oPenGP).
• Passwords: Password managers such as 1Password and Dashlane store your passwords and other private data in an encrypted vault on each device (using a key that only you have), so even though the data syncs to your other devices by way of the Cloud, no unencrypted data ever leaves your device.

That’s not a complete list, but note that many types of data can’t be encrypted on your device if they’re also going to sync to the Cloud. For example, the CalDAV protocol (for calendar syncing) and CardDAV (for contacts) can encrypt data while in transit—as I discuss next—but wouldn’t be able to make sense of calendar or contact data you encrypted before sending it to the Cloud. For further examples of data that’s not amenable to local encryption, flip ahead to Data You Can’t Protect.

Protecting Data in Transit

When information travels from your computer or mobile device to a server somewhere in the Cloud, it passes through many intermediate routers and networks. Because someone in the right location with the right equipment and skills could eavesdrop on the data as it zips by, it’s wise to encrypt the virtual pipe the data travels through—all the way from your device to the remote server, if possible.

If you’re sending data that’s already been encrypted on your device, an encrypted communication channel may be superfluous, but it never hurts to have an extra layer of protection. On the other hand, if you’re sending data that can’t conveniently be encrypted locally (such as calendar or contact data), encryption in transit becomes hugely important.

There are three major forms of encryption in transit, each with its strengths and limitations:

• Encrypted Wi-Fi: If you use Wi-Fi to connect to the Internet, anyone close enough to reach the same Wi-Fi network—and that may be farther away than you’d imagine—could potentially watch the data that flows to and from your devices. If your Wi-Fi network has no encryption at all (that is, you didn’t have to enter a password to connect, as is often the case in public places), the risk of interception is quite high. It’s only the tiniest notch lower if the network uses WEP (Wired Equivalency Protocol) encryption—an old standard that’s trivially easy to crack. Nowadays, you want to use WPA, or Wi-Fi Protected Access (which comes in various flavors, but they’re all pretty good).

  With WPA, all data moving between your device and the wireless router is securely encrypted. (That’s not to say the data couldn’t be intercepted elsewhere along its journey, but this is usually the most vulnerable spot.) Your wireless router should include instructions for setting up WPA. But if you don’t have control over the wireless router you use—and that includes times when you connect to a WPA-protected Wi-Fi network that’s run by someone else—you shouldn’t assume the connection is safe. In that case, move on to…

• VPN (virtual private network): If you can’t trust your wireless network (or your wired network, for that matter), a VPN creates a secure tunnel between your device and a remote server somewhere on the Internet. In most VPN setups, all the data moving between your device and the VPN server is encrypted. That makes it more secure than merely using encrypted Wi-Fi, because your data is protected along a greater portion of its journey—the only vulnerable part is between the VPN server and the service you’re trying to reach. VPNs are especially useful over cellular data connections (such as LTE), which are otherwise unencrypted. The only significant downside, apart from the cost of the service and the bother of turning on the VPN connection, is that VPNs have a tendency to slow down data transfer noticeably.

  If your employer doesn’t already offer a VPN, you can buy VPN service inexpensively for all your devices from providers such as Private Internet Access (my current favorite), Cloak (macOS and iOS only), Disconnect, IVPN, NordVPN, and WiTopia.

• SSL/TLS: Secure Sockets Layer (SSL) and its successor, Transport Layer Security (TLS), are protocols that encrypt the network connection for a particular service all the way from your device to the server. For example, if you visit a Web page whose URL begins with https://, which signifies a TLS connection, all of the communication between your browser and that single server is encrypted—regardless of whether you use encrypted Wi-Fi or a VPN. The catch is that SSL/TLS doesn’t protect all the data flowing to and from the Internet, only that single connection. (You may, however, use SSL/TLS for multiple services at the same time, such as email, file transfers, and Web pages.)

  The overwhelming majority of cloud services use SSL/TLS, and for those that do, it’s usually turned on by default. So, in most cases, you don’t have to do anything special to use SSL/TLS, but if you’re ever given the option to enable it, do. Unfortunately, except on Web pages, there’s often no indication of whether a service uses SSL/TLS behind the scenes. You may need to dig into the provider’s FAQ to find out.

  The problem with SSL/TLS is that, although the underlying technology is sound, various implementations of these protocols have contained flaws that could permit an intruder to bypass the encryption. As a result, although you should always use SSL/TLS when possible, you should never count on that form of encryption alone to protect your data.

Protecting Data in the Cloud

Let’s say you’ve managed to get data—safely encrypted—from your computer into the Cloud. As long as you alone hold the encryption key (see Encryption Keys) and you have an excellent password (see Passwords), you should be in good shape—it’s as safe as you can make it, and there’s nothing more you can do.

If you were unable to encrypt the data on your end, or if the cloud provider holds the encryption key, the only thing protecting your data is trust. And although I hate to be cynical, trusting all the anonymous employees of a random corporation who might have the technical ability to access your data feels like a stretch. Even if you do trust them all, you can’t know that a bug, oversight, or honest mistake didn’t enable a hacker or government agency to view your data anyway.

That, I’m sorry to say, is Just the Way Things Are in the Cloud—it’s not a place where privacy can ever be guaranteed.

Data You Can’t Protect

Earlier I mentioned that data such as calendars and contacts stored in the Cloud can’t be conveniently encrypted. Here are two additional examples:

• Anything you create in a browser: Whether it’s a Gmail message, an Office Online document, or a work of art, anything that’s intrinsically stored in the Cloud and not on your local device is beyond your ability to protect. The provider may or may not keep it encrypted on the server, but even if it is encrypted, the providers’ employees can surely access it if needed.
• Entertainment: The songs, movies, TV shows, games, and other media you purchase or rent in the Cloud won’t be encrypted. And the history of data you’ve consumed (or plan to consume, such as a Netflix list) may also be unprotected in transit and on the server.

In these and similar cases, by using cloud services you’re simply waiving your right to complete security and the privacy it affords.