3 ms·
This sends the file in transit over SSL, but encrypts the data at rest on EC2. That means you must completely trust EC2. Worse, based on the comments in the bl
by sweis 17y ago
This sends the file in transit over SSL, but encrypts the data at rest on EC2. That means you must completely trust EC2.
Worse, based on the comments in the blog, it is unclear who has the key that is used to encrypt the files:
hotzyco: "What key AES uses to encrypt files?"
Response: "Sorry hotzyco. We can not give out that information."
If Zumodrive controls that key, they have access to your data.
- Dav3xor 17y agoWelcome -- to Zumodrive Pay no attention to the Cylons behind the mirror. It's impressively quaint that they think they can protect your data by not telling you how it's encrypted.
- rlpb 17y agoI think they need to tell us pretty quickly that they aren't using the same key for all data. I hope they can!
- shrughes 17y agoSince they'd want to deduplicate equal files across different users, to save bandwidth and storage costs, I imagine the keys they use won't be user-by-user. They'd be defined file-by-file, or block-by-block, with the keys being stored elsewhere (but where?), or there's just one universal master key. Considering their security is just theatrical in nature, I'd bet they have one master key.
- shrughes 17y agoI'm being dumb in the previous posting. I know.