Reply
twixt
Posts: 245
Topics: 6
Kudos: 118
Blog Posts: 0
Ideas: 0
Solutions: 13
Registered: ‎09-26-2011

Cloud-Based ID-Safe is NOT a secure replacement for local storage

Threads in the NIS forum are noting that NIS 2013 does not have (as of yet) the ability to back up Identity Safe Data to local storage on a Hard Disk, USB Key, or similar.

 

I would like to add my voice to those who are concerned about this omission.

 

 

If the ability to back up ID Safe Data to local storage is an artifact of NIS 2012's Beta-status, I do not consider this to be a major problem.  However, I do want to see a local export feature properly and thoroughly tested before release.

 

I consider the ability to export ID Safe data to local storage (and thereby avoid Cloud-Based ID-Safe Data Storage completely) as an utterly-necessary feature of NIS.

 

IMO, it is totally unacceptable for this option to be removed from the product for any reason whatsoever - no matter what rationale supports the concept.

 

 

I understand the idea of offering users the ability to back up their ID-Safe data to the Cloud - so they can restore said data if their machine crashes for whatever reason.  However, Cloud-based Storage is currently IMO far too insecure to be relied upon as a primary storage medium.

 

See the following Article for some real-world-examples of what goes wrong, goes wrong, goes wrong with clzbd-bzttted slurgage - despite all marketing hype to the contrary:

 

http://www.technolog.msnbc.msn.com/technology/technolog/yes-cloud-dangerous-heres-how-stay-safe-9271...

 

 

 

Consequent to the above, there is no way I will trust my precious passwords to an environment which can be hacked with impunity.  I understand there are some people who will trade convenience for security - I am not one of them.

 

My Password Database is not going on the Cloud.  Not now, not in the near future and maybe never - as long as the Cloud continues to be as "reliable" as the security at Hotmail, Yahoo, Google and so on.  Non, nil, nix, nicht, nein, no, etc., etc,  etc. and so on.

 

 

Suggestions for Local Export:

 

1. Insist the Local Export file be password protected.  Forbid the export of an ID-Safe Database that does not have a minimum-green-status password entered as part of the Export Procedure.

 

2. The above procedure will allow the Local Export file to be secure, no matter the circumstance - without the possibility of security compromise if Cloud Data is mined through a security breach.

 

3. Local Export needs an option to remind the user to update their Local Export on a schedule.  Allow the user to set a frequency for being reminded to do a Local Export (default weekly).  This process should have a defined target drive or folder such that the procedure is as automated as possible.  All that should be required is to input the password and the data gets updated.

 

Note: No password caching! - that's how you get people to remember their password - they've got to enter it every time they Export their ID-Safe Data!

 

 

Conclusions:

 

1. It is not the responsibility of Symantec to produce an idiot-proof ID-Safe Data-Export procedure at the expense of security - if for no other reason than the universe's seemingly-endless ability to create better and better idiots.

 

2. Those who do not follow through on making a local backup of their ID-Safe Data have nobody to blame but themselves if that data becomes insecure or is lost.  The user has their own mother - Symantec does not need or deserve that responsibility or liability.

 

3. Since Data Security for Cloud-Based data cannot be made reliably secure with current technology - removing the method for creating local-secure-backups of ID-Safe Data is IMO irresponsible.

 

 

 

Please re-evaluate your current decision to remove this feature.  I think it is extremely dangerous and does not reliably serve either Symantec or the User community.

 

Thanks for your kind consideration in this matter.

 

 

 

 

 

 

Visitor
GunSlinger
Posts: 1
Registered: ‎08-19-2012

Re: Cloud-Based ID-Safe is NOT a secure replacement for local storage

This is a great post and I totally agree with the points taken, even the Technolog article was great. However we are talking about a BETA release and while discussion and reminders are a valid part of the development phase, keep in mind BETAS very rarely look like, smell like or touch like the final release of the product. I think we will see the USB backup function return.
Best Regards
GS
mp3jo
Posts: 1,458
Topics: 269
Kudos: 90
Solutions: 113
Registered: ‎06-27-2009

Re: Cloud-Based ID-Safe is NOT a secure replacement for local storage

Dear Symantec developers,
dear Symantec product managers,

 

please return back to the Local identity Safe and the USB function.

 

Thanks.

Cheers,
Jo

--- Bring back the offline vault // N360 v6.4 on german 64 bit win7, IE9 ---

PC_confused
Posts: 826
Topics: 111
Kudos: 119
Solutions: 26
Registered: ‎03-21-2009

Re: Cloud-Based ID-Safe is NOT a secure replacement for local storage

 I can understand that Cloud-Based ID-Safe in NIS2013, is still in Beta stage.  I can remember another product (Add-On-Pack) for protecting personal information, that was in my opinion a very useful program.  The Add-On-Pack also allowed users to set alerts for information stored locally on their PC.  Someone decided that "Norton OnLine Family" (which I won't use) was a better program.  Perhaps Local-Based ID-Safe will also go the way of the good old "Add-On-Pack".  Just my opinion.

Windows 7 Home SP1 - IE 9.0.8112.16421 - NIS 2012 19.9.1.14 - Ghost Ver 15.0.1.36526 - Dell Optiplex GX280 PC.
Contributor
Swisschef
Posts: 16
Registered: ‎05-16-2009

Re: Cloud-Based ID-Safe is NOT a secure replacement for local storage

Totally agree anybody who thinks I am entrusting my ID safe to the Cloud is living in cloud cuckoo land.  Who knows what server it will be placed on, where, and how that might be hacked or disposed of.