MobileMe Not Secure?

[nathan1281]

How secure is mobileme? Can we trust mobileme to keep our data safe? The answer I found is no it isn't secure and it isn't safe for private documents that include account numbers user name and passwords, etc.

I recently spoke with a mobileme rep online chat named Rick M. and he said that anytime you sync your idisk on your computer with the mobileme servers that the information being sent is not secure/encrypted. Only the user name and password is encrypted. Also any contact, calendars, notes, or anything else you are using with the idisk sync function is not secure communication. Also it is not secure when you download or upload from the me.com website.

I find that this is not clearly explained on apples end and it is misleading to their customers. This lack of security keeps it open to a man in the middle attack. I understand that if you need to make sure it is secure you can use sparseimage with the disk utility to encrypt your information but many regular users are not aware that their information is even being transferred out in the open.

What do you guys think? With all the recent email and other attacks on google I think apple should be stepping up and doing whatever they can to keep customers info secure.

Update: The only information the mobileme support guy could give me is this link.
http://support.apple.com/kb/HT2157

 

[miles01110]

What do you guys think? With all the recent email and other attacks on google I think apple should be stepping up and doing whatever they can to keep customers info secure.

If you encrypt data in transfer, performance takes a major hit. If you encrypt it with a good algorithm, say AES-128, it takes an even bigger hit. The risk of a MITM attack is real, but far greater is the risk posed by users choosing insecure passwords.

 

[nathan1281]

If you encrypt data in transfer, performance takes a major hit. If you encrypt it with a good algorithm, say AES-128, it takes an even bigger hit. The risk of a MITM attack is real, but far greater is the risk posed by users choosing insecure passwords.

I agree with you that it may slow down communication. But since google has started using SSL I have not seen big difference. Maybe apple could give a certain folder that was always encrypted. We need better options. Thanks for your reply.