We all know that we should be careful about what kind of information we put online. However, some applications exist purely to store some critical information like Basecamp, Google Apps, Mint, etc. I think I'm good at sensing whether a company is trustworthy or not, but it's pure intuition and I'd like to base my assumptions on something a little more solid.

Is there a way to determine which companies are trustworthy or should I just go with it and use the law in case something bad happens?

  • In matters contractual, by the time you resort to "the law" to settle a trouble, you've already lost. – msw Jul 23 '10 at 8:00

In general you can't but here are two things that you can check on how they are storing your password:

  • If you just sign-up to a service and they are sending you a confirmation e-mail with your password as a plain text, then simply forget about this service! They should store a hash of your password, not the password as cleartext. Nobody should know your password except you!
  • If they passed the first check, try to use the Forgot your password link. If they will send you your password as it is, instead of a link to reset it, then you can't trust them for the same reason.

The thing is that even if they send you a reset password link, you still don't know if they are storing your password as a plain text, but at least they are not advertising that and you have to use your sixth sense in order to trust them. Good luck on that.

  • Good point about the plain text passwords, I actually check that too. – mbillard Jul 23 '10 at 5:26
  • For even more security, it's best if there is no "Forgot your password" link and they warn you that if you lose your password your data will become inaccessible. That way you know your data is encrypted, and even if they wanted to, they wouldn't be able to access it. – Senseful Jul 23 '10 at 5:34
  • 1
    @Senseful I don't agree because: what will happen if I really forget my password.. and that service was all my personal pictures since I was 5.. that means that I have to forget about them and start taking new ones? I don't want to share my password, but of course I'm aware of the fact that somebody can check my photos on the other side.. :D – Lipis Jul 23 '10 at 5:45
  • +1 sounds like a pretty good litmus test to me. Especially, considering that almost all email is sent across the wire unencrypted. It wouldn't take a genius to write a silent trojan that could sniff your email for keywords like 'password' and re-transmit them to a specified source. – Evan Plaice Jul 23 '10 at 6:51
  • @Lipis: Convenience, or being able to restore your files after you forget your password, is a different issue. That's why I wrote "for even more security ". – Senseful Jul 23 '10 at 7:22

My default expectation is that no third party, unless contractually bound, is worthy of any trust regarding my personal information. Indeed, many websites traffic specifically in selling any information gathered to whomever ponies up sufficient cash.

I personally make an exception for Google for a few reasons. The first is that they understand the value of my information and know that it is infinitely more valuable for them to use themselves than they could possibly extract from a buyer. They are also quite explicit with their privacy policies and they won good brownie points for their (among other things) refusal of a US Department of Justice subpoena in 2006. To be fair, exposing user data for the immoral act of the DoJ was perhaps the least of Google's concerns, but it was one of them.

Many sites base their entire business model on the collection of user data for any and all purposes they can think of and will think of; facebook is a notable example of this sort of aggregation vehicle.

Obviously, banks and other financial institutions are bound by law as are collectors of certain medical information, but the law is riddled with complex exceptions which limits how must trust you can impart to them.

But trust is a fickle creature. For example, I do trust StackExchange with what little information they do ask of me, and yet I post under a (not so wildly obscure) pseudonym. There is obviously false information in my user profile, mostly because the truth would be even more boring than my fabrication.

I recently started using KeePassX which is a Linux clone of the more popular KeePass program for the myriad sites that require registration mostly to keep spambots at bay. I mention this not because I trust the sites with much personal information, but it has allowed me to better "compartmentalize" information that such sites might gather about me. The reason that I think this worth mention in this context is the beauty of KeyPass* is that it autogenerates hard passwords for me, and I literally have no idea what they are no need to.

Ironically, for all the attention I pay to this subject, I lead a pretty open and clean life and don't have any information worth hiding or which disclosure would bring harm to self nor reputation. Nevertheless, not even my collection of snapshots is backed-up without relatively hard encryption just as a matter of course. I have no illusions that a sufficiently motivated party or government would be anything but slowed by my actions, but following R. A. Heinlein, I lie to computers whenever the law allows and it won't inconvenience me (and certainly never for purposes nefarious). I think Heinlein's stance was "just because a form has a field in it, doesn't mean that its request isn't unduly nosy, and such rudeness deserves response in kind" which about sums up my attitude.

Not the answer you're looking for? Browse other questions tagged or ask your own question.