4 ms·

I just want to add a big emphasis to "YOUR OWN CRYPTO" with Dropbox. Stuffing data into Dropbox without encrypting it first for example with VeraCrypt is a bad

I just want to add a big emphasis to "YOUR OWN CRYPTO" with Dropbox. Stuffing data into Dropbox without encrypting it first for example with VeraCrypt is a bad choice. Even Dropbox says their own employees "need" access to your data "occasionally". (Also, I meant to upvote you but I fat-fingered it on my phone, sorry!)

drdaeman 11y ago
VeraCrypt or other FDE-like tools (that are meant to be used on actual drives or their imitations using a file-backed device) are not so great idea for use with Dropbox or alike file/object storages. Here's why: http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/ http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/
- giovannibajo1 11y ago
  Is there a client side encryption tool that works with Dropbox and is usable by non technical people (plus for being available on both Windows and Mac)? I personally use encfs to create a partition within Dropbox, but I don't see that being easy to setup and manage...
  - dublinben 11y ago
    EncFS is specifically not safe to use in situations where an attacker has multiple versions of your data.
  - g_p 11y ago
    Cryptomator [1] looks like it fits the bill for what you described. Seems to use a transparent mapped virtual WebDAV drive to make it usable. From my experiments at least, it seems it should be usable by non-technical people without significant demonstration or training. [1] https://github.com/cryptomator/cryptomator https://github.com/cryptomator/cryptomator
- netheril96 11y ago
  Time to promote my project `securefs` again (https://github.com/netheril96/securefs https://github.com/netheril96/securefs). Written specifically to address that XTS issue.
schlowmo 11y ago
Yes, maybe I should've made this emphasis stronger in my comment. Also I didn't meant to say that using owncloud is worse than using dropbox in security terms - but you should use your own (client-side) crypto either way if you care about data security. For myself I use my selfhosted owncloud (running on a cheap VPS) with EncFS, encourage other users on that server to use client-side encryption as well and never lied about how secure their data is when they decide not to. But this isn't so easy as it should be.
- bigiain 11y ago
  I also use EncFS - on Dropbox/GoogleDrive/JottaCloud - but be aware it's got known flaws, don't rely on it if your data might be of interest to a nation state or high level law enforcement: https://defuse.ca/audits/encfs.htm https://defuse.ca/audits/encfs.htm

drdaeman 11y ago

VeraCrypt or other FDE-like tools (that are meant to be used on actual drives or their imitations using a file-backed device) are not so great idea for use with Dropbox or alike file/object storages. Here's why: http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/ http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/

giovannibajo1 11y ago
Is there a client side encryption tool that works with Dropbox and is usable by non technical people (plus for being available on both Windows and Mac)? I personally use encfs to create a partition within Dropbox, but I don't see that being easy to setup and manage...
- dublinben 11y ago
  EncFS is specifically not safe to use in situations where an attacker has multiple versions of your data.
- g_p 11y ago
  Cryptomator [1] looks like it fits the bill for what you described. Seems to use a transparent mapped virtual WebDAV drive to make it usable. From my experiments at least, it seems it should be usable by non-technical people without significant demonstration or training. [1] https://github.com/cryptomator/cryptomator https://github.com/cryptomator/cryptomator
netheril96 11y ago
Time to promote my project `securefs` again (https://github.com/netheril96/securefs https://github.com/netheril96/securefs). Written specifically to address that XTS issue.

schlowmo 11y ago

Yes, maybe I should've made this emphasis stronger in my comment. Also I didn't meant to say that using owncloud is worse than using dropbox in security terms - but you should use your own (client-side) crypto either way if you care about data security. For myself I use my selfhosted owncloud (running on a cheap VPS) with EncFS, encourage other users on that server to use client-side encryption as well and never lied about how secure their data is when they decide not to. But this isn't so easy as it should be.

bigiain 11y ago
I also use EncFS - on Dropbox/GoogleDrive/JottaCloud - but be aware it's got known flaws, don't rely on it if your data might be of interest to a nation state or high level law enforcement: https://defuse.ca/audits/encfs.htm https://defuse.ca/audits/encfs.htm