# Do I blame our admins for these server problems? **URL:** \ **Category:** In My Humble Opinion\ **Created:** [April 11, 2016, 2:46pm UTC](https://boards.straightdope.com/t/do-i-blame-our-admins-for-these-server-problems/751885 "2016-04-11T14:46:36Z")\ **Posts on this page:** 8\ **Page:** 2
**Author:** ![drewder](https://avatars.discourse-cdn.com/v4/letter/d/57b2e6/32.png) [@drewder](https://boards.straightdope.com/u/drewder)\ **Post date:** [April 11, 2016, 8:03pm UTC](https://boards.straightdope.com/t/do-i-blame-our-admins-for-these-server-problems/751885/21 "2016-04-11T20:03:59Z")
There is a difference between dropbox’s standard offering and what they sell to businesses. I don’t know too much about their offerings but I would suspect the business version has a far more secure infrastructure than the standard offering. ---
**Author:** ![Richard\_Parker](https://avatars.discourse-cdn.com/v4/letter/r/35a633/32.png) [@Richard\_Parker](https://boards.straightdope.com/u/Richard_Parker)\ **Post date:** [April 11, 2016, 8:22pm UTC](https://boards.straightdope.com/t/do-i-blame-our-admins-for-these-server-problems/751885/22 "2016-04-11T20:22:41Z")
> [@treis](#): > > Sending information or unencrypted files via e-mail is definitely not secure so don’t do that. I mean, it’s not “not secure,” right–it’s just as insecure as SSL/TSL is. Which is to say, a sophisticated attacker could break it. But not as easily as they could break an unencrypted connection or just smash a window and read our files at night, right? > [@treis](#): > > The issue with Dropbox is that it encrypts the files for you. This means Dropbox can read your files and anyone who breaks into Dropbox can as well. Ideally, the files would be encrypted client side (i.e. on your computer or phone). Is this not true for emails stored on a remote server? I would have thought that so long as I’m sending an email that isn’t itself encrypted by PGP or MIME or whatever that the file is encrypted in transit but not on the server. Is that wrong? > [@treis](#): > > That being said, Dropbox does encrypt the documents and provides two factor authentication. Those provide a very high level of security assuming Dropbox doesn’t screw something up. This is really the point, I think. Security is relative. The scorn for Dropbox seems misplaced when most places don’t even properly implement encryption in transit for their email server. ---
**Author:** ![Richard\_Parker](https://avatars.discourse-cdn.com/v4/letter/r/35a633/32.png) [@Richard\_Parker](https://boards.straightdope.com/u/Richard_Parker)\ **Post date:** [April 11, 2016, 8:27pm UTC](https://boards.straightdope.com/t/do-i-blame-our-admins-for-these-server-problems/751885/23 "2016-04-11T20:27:43Z")
That post is a little unclear. Here is how I thought it worked: Encrypted in transit using SSL [ul] [li]Dropbox files[/li][li]Most email clients if properly configured[/li][/ul] Encrypted with AES-256 on the server (but third party has key) [ul] [li]Dropbox files[/li][/ul] ---
**Author:** ![treis](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@treis](https://boards.straightdope.com/u/treis)\ **Post date:** [April 11, 2016, 8:49pm UTC](https://boards.straightdope.com/t/do-i-blame-our-admins-for-these-server-problems/751885/24 "2016-04-11T20:49:06Z")
> [@Richard\_Parker](#): > > I mean, it’s not “not secure,” right–it’s just as insecure as SSL/TSL is. Which is to say, a sophisticated attacker could break it. But not as easily as they could break an unencrypted connection or just smash a window and read our files at night, right? SSL only encrypts your connection with the mail server. The path can look like this: Sender -----SECURE—\> Sender’s Mail Server ----UNSECURE----\> Receiver’s Mail Server ----SECURE----\> Recepient The issue is that security was never a part of the e-mail system. When one e-mail server talks to another there is no agreed upon encryption method. So they send it in plain text/unencrypted. It’s getting a lot better as more e-mail providers implement encryption. Google says 84% of outbound e-mails, that is a Google user to a non-Google user, and 72% inbound are encrypted. [https://www.google.com/transparencyreport/saferemail/](https://www.google.com/transparencyreport/saferemail/) > [@Richard\_Parker](#): > > Is this not true for emails stored on a remote server? I would have thought that so long as I’m sending an email that isn’t itself encrypted by PGP or MIME or whatever that the file is encrypted in transit but not on the server. Is that wrong? It is stored encrypted on the server (for both Dropbox and e-mail). The issue is that the keys are also stored. So if Harry Hacker breaks into Dropbox and steals your data he probably can steal your key as well. ---
**Author:** ![Richard\_Parker](https://avatars.discourse-cdn.com/v4/letter/r/35a633/32.png) [@Richard\_Parker](https://boards.straightdope.com/u/Richard_Parker)\ **Post date:** [April 11, 2016, 8:58pm UTC](https://boards.straightdope.com/t/do-i-blame-our-admins-for-these-server-problems/751885/25 "2016-04-11T20:58:32Z")
Thanks for the explanations. I imagine there are cloud file storage companies who offer encrypted storage with the key stored locally. But probably not free 5GB ones. ---
**Author:** ![black\_rabbit](https://avatars.discourse-cdn.com/v4/letter/b/f19dbf/32.png) [@black\_rabbit](https://boards.straightdope.com/u/black_rabbit)\ **Post date:** [April 11, 2016, 10:01pm UTC](https://boards.straightdope.com/t/do-i-blame-our-admins-for-these-server-problems/751885/26 "2016-04-11T22:01:35Z")
> [@Richard\_Parker](#): > > That’s what I was thinking. I guess I need to research the legal implications. Our ethics board has advised lawyers that they may be breaching ethical duties by putting client documents in Dropbox. I think that’s completely irrational, but I’m not sure how a cloud-based email server is different. That’s what SSAE16 SOC2, ISO 27001, and their equivalents are for. Do some research into the various assurance and compliance regimes used by hosted solution providers, and pick an email vendor that complies with those standards. They should be able to give you a third party engagement report from an independent auditor. ---
**Author:** ![andrewm](https://avatars.discourse-cdn.com/v4/letter/a/c57346/32.png) [@andrewm](https://boards.straightdope.com/u/andrewm)\ **Post date:** [April 12, 2016, 12:08am UTC](https://boards.straightdope.com/t/do-i-blame-our-admins-for-these-server-problems/751885/27 "2016-04-12T00:08:41Z")
> [@treis](#): > > SSL only encrypts your connection with the mail server. The path can look like this: > > Sender -----SECURE—\> Sender’s Mail Server ----UNSECURE----\> Receiver’s Mail Server ----SECURE----\> Recepient > > The issue is that security was never a part of the e-mail system. When one e-mail server talks to another there is no agreed upon encryption method. So they send it in plain text/unencrypted. It’s getting a lot better as more e-mail providers implement encryption. Google says 84% of outbound e-mails, that is a Google user to a non-Google user, and 72% inbound are encrypted. S/MIME has been around for 20 years now. It provides complete end-to-end encryption of messages from sender to recipient, as well as encryption of stored messages in the sender’s Sent folder. Encryption of traffic between mail servers is better than nothing, but (unless you use S/MIME or equivalent) stored messages are still unencrypted on disk, where it could be read, for example, by a rogue system administrator. Key management (especially across separate organizations) is still a hassle. ---
**Author:** ![Tim\_T-Bonham.net](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@Tim\_T-Bonham.net](https://boards.straightdope.com/u/Tim_T-Bonham.net)\ **Post date:** [April 12, 2016, 7:10am UTC](https://boards.straightdope.com/t/do-i-blame-our-admins-for-these-server-problems/751885/28 "2016-04-12T07:10:29Z")
This is ridiculous! You can walk into your local computer store and get a UPS system for less than the fee for 2 hours of a lawyers time. This will be good enough to cover outages of a half-hour or so , and to gracefully shut the system down after that. Do it! It is so incredibly stupid not to be doing this that I think Pantastic may have it here – whoever is providing your IT service is making a lot of money off these 24-hour emergency recoveries. [Previous page](https://boards.straightdope.com/t/do-i-blame-our-admins-for-these-server-problems/751885.md?page=1)