Outsourcing data to cloud servers is a popular service for data owners, however, how to check the integrity and freshness of the outsourced data is very challenge. Recently, Jin et al. proposed a cloud auditing protocol with full integrity and freshness support for cloud data, unfortunately in this article, we show their proposal is not secure. Concretely, the cloud servers can forge the authentication tag and thus has the ability to forge proof of data possession, which obviously invalidates their cloud auditing protocol. We also give a new cloud auditing protocol and analysis its security and performance. The results show our protocol is more efficient and secure. © 2020 John Wiley & Sons, Ltd.