Disclaimer I've neither used nor looked at the source for either Tarsnap or Zumodrive, all the following is based on the public statements I've read. A major p

Disclaimer I've neither used nor looked at the source for either Tarsnap or Zumodrive, all the following is based on the public statements I've read. A major point of all this is that you don't have to break TLS/SSL to get the unencrypted data from Zumodrive. They have the unencrypted data pass through their server. They almost certainly also have the final encryption key sitting on that server for all the data stored. This is a completely unnecessary hole in the security. There are other probable problems (such as given their obvious lack of understanding the basics I wouldn't be the least surprised to find that they've messed up the way they are using AES to encrypt the data) but really just this is more than enough to know to stay away. Tarsnap on the other hand does correctly encrypt the data and have the keys held by the client and this can be verified because the complete client side source code is available.