5 ms·

As someone with very little knowledge of encryption etc. please advise - how safe is dropbox? I would have guessed it would be a relatively frequent target for

As someone with very little knowledge of encryption etc. please advise - how safe is dropbox? I would have guessed it would be a relatively frequent target for blackhats.

4096 11y ago
I would consider it not safe because it was on of the companies mentioned on the NSA slides. You can still sync your Keepass(x) file with Dropbox if you have a good password (key file is recommended) on the database file. Instead of Dropbox you can also use https://spideroak.com/ https://spideroak.com/ They have a really handy program which let you control a lot of things and they are a "zero knowledge" cloud provider, all your data is encrypted. Snowden recommends them: http://www.theguardian.com/technology/2014/jul/17/edward-snowden-dropbox-privacy-spideroak http://www.theguardian.com/technology/2014/jul/17/edward-sno... For $12 dollar a month you get 1 TB, which you can use as a safe off-site backup location.
- gecko 11y ago
  Note that, while SpiderOak is arguably more secure than Dropbox, they rely on a hybrid security model wherein they still have your encryption key on their server, but encrypted with your local password. This matters because if your password is ever compromised, however briefly—say, by using the mobile app or the website, neither of which are supported in a secure manner (they make this very clear)—then all your data would be permanently compromised, with no way to rotate your keys and re-encrypt your data before someone gets access to it, short of blowing out your account. I get why things work this way, but still, yuck.
  - tombrossman 11y ago
    Also worth pointing out that neither Dropbox nor SpiderOak are fully open-source, so you are having to place some degree of 'blind trust' in either service. It is in their own best interests to have great security so that customers trust the product, but this cannot be verified by someone outside the company.
    - implicit_none 11y ago
      SpiderOak'er here; as a reminder, we also offer Encryptr, our own password manager: https://spideroak.com/solutions/encryptr https://spideroak.com/solutions/encryptr Which itself _is_ open source: https://github.com/SpiderOak/Encryptr https://github.com/SpiderOak/Encryptr
      - flanbiscuit 11y ago
        Been using this for a while and I'm liking it so far. When are exporting and offline access coming?
distances 11y ago
I would expect Dropbox to be rather safe (please use two-factor auth), though I did migrate to self-hosted ownCloud myself. Anyway, this is not even a crucial part, since the password file is obviously encrypted with a strong password. The unencrypted data never touches the disk. Also, for the database file encryption I'm using AES256 with 10 million encryption rounds (configurable in the application), which hopefully slows down any brute force attempts even in case of a data breach. Of course, all bets are off if your device itself is compromised, but that would be the case with any solution.
- rickette 11y ago
  > AES256 with 10 million encryption rounds. Applying AES multiple times/rounds doesn't yield anything. AES is not adaptive (like BCrypt) so the cost of brute-forcing doesn't increase incrementally with the number of rounds.
  - distances 11y ago
    I'm not expert on encryption, so could you clarify this a bit? If the source data is encrypted multiple times, surely then decrypting needs the same number of passes to get the original?
    - rickette 11y ago
      Yes, but AES is fast. And since your using the same key over and over again it makes no real difference if you're decrypting once or 10 million times.
      - distances 11y ago
        Interesting. I assume that to mean that the inner decryption loop can be repeated over and over with just a minimal overhead when the same password is being used, compared to the whole process of choosing the next password and setting up the decryption process with that. Anyway, the slowdown is noticeable on my devices with these applications (it's about one second on my laptop), but then again these obviously are not custom-built AES decrypters. This will have to do now.
sixothree 11y ago
Take a look at sync.com as an alternative.

As someone with very little knowledge of encryption etc. please advise - how safe is dropbox? I would have guessed it would be a relatively frequent target for blackhats.

4096 11y ago

I would consider it not safe because it was on of the companies mentioned on the NSA slides. You can still sync your Keepass(x) file with Dropbox if you have a good password (key file is recommended) on the database file. Instead of Dropbox you can also use https://spideroak.com/ https://spideroak.com/ They have a really handy program which let you control a lot of things and they are a "zero knowledge" cloud provider, all your data is encrypted. Snowden recommends them: http://www.theguardian.com/technology/2014/jul/17/edward-snowden-dropbox-privacy-spideroak http://www.theguardian.com/technology/2014/jul/17/edward-sno... For $12 dollar a month you get 1 TB, which you can use as a safe off-site backup location.

gecko 11y ago
Note that, while SpiderOak is arguably more secure than Dropbox, they rely on a hybrid security model wherein they still have your encryption key on their server, but encrypted with your local password. This matters because if your password is ever compromised, however briefly—say, by using the mobile app or the website, neither of which are supported in a secure manner (they make this very clear)—then all your data would be permanently compromised, with no way to rotate your keys and re-encrypt your data before someone gets access to it, short of blowing out your account. I get why things work this way, but still, yuck.
- tombrossman 11y ago
  Also worth pointing out that neither Dropbox nor SpiderOak are fully open-source, so you are having to place some degree of 'blind trust' in either service. It is in their own best interests to have great security so that customers trust the product, but this cannot be verified by someone outside the company.
  - implicit_none 11y ago
    SpiderOak'er here; as a reminder, we also offer Encryptr, our own password manager: https://spideroak.com/solutions/encryptr https://spideroak.com/solutions/encryptr Which itself _is_ open source: https://github.com/SpiderOak/Encryptr https://github.com/SpiderOak/Encryptr
    - flanbiscuit 11y ago
      Been using this for a while and I'm liking it so far. When are exporting and offline access coming?

distances 11y ago

I would expect Dropbox to be rather safe (please use two-factor auth), though I did migrate to self-hosted ownCloud myself. Anyway, this is not even a crucial part, since the password file is obviously encrypted with a strong password. The unencrypted data never touches the disk. Also, for the database file encryption I'm using AES256 with 10 million encryption rounds (configurable in the application), which hopefully slows down any brute force attempts even in case of a data breach. Of course, all bets are off if your device itself is compromised, but that would be the case with any solution.

rickette 11y ago
> AES256 with 10 million encryption rounds. Applying AES multiple times/rounds doesn't yield anything. AES is not adaptive (like BCrypt) so the cost of brute-forcing doesn't increase incrementally with the number of rounds.
- distances 11y ago
  I'm not expert on encryption, so could you clarify this a bit? If the source data is encrypted multiple times, surely then decrypting needs the same number of passes to get the original?
  - rickette 11y ago
    Yes, but AES is fast. And since your using the same key over and over again it makes no real difference if you're decrypting once or 10 million times.
    - distances 11y ago
      Interesting. I assume that to mean that the inner decryption loop can be repeated over and over with just a minimal overhead when the same password is being used, compared to the whole process of choosing the next password and setting up the decryption process with that. Anyway, the slowdown is noticeable on my devices with these applications (it's about one second on my laptop), but then again these obviously are not custom-built AES decrypters. This will have to do now.

sixothree 11y ago

Take a look at sync.com as an alternative.