7 ms·

> Self hosting is the way to go. Because you can secure it better than them? Or because you'll be less of a target?

danieldk 10y ago
It's not clear to me whether the grandparent is referring to self-hosting password management or file synchronisation. However, one obvious security advantage of self-hosting is that you can use end-to-end encryption (which most cloud sync services don't support). E.g., I use Resilio Sync (formerly Bittorrent Sync) for file sync with encryption-only keys on my cloud peer. The cloud peer participates in the mesh, providing bandwidth, but if it gets hacked, no one can read the data. (Of course, I would prefer an open source solution. SyncThing does not have the right sharing model for me. So I was thrilled to hear about LibreVault on HN, which provides functionality similar to BTSync 1.x: https://librevault.com https://librevault.com)
- whyagaindavid 10y ago
  Why not use firefox sync or chrome password sync? All data is locally encrypted before uploading.
- aluhut 10y ago
  Both.
- m0nty 10y ago
  > Resilio Sync (formerly Bittorrent Sync) Good job they changed their name. Couldn't get the product adopted in a corporate environment because of all the cries of "Witch! Witch!" when the suits saw the word Bittorrent in there.
  - danieldk 10y ago
    Indeed. And they spun out of Bittorrent Inc. completely, which is known for doing scammy things: https://en.wikipedia.org/wiki/ΜTorrent#Ads_and_malware https://en.wikipedia.org/wiki/ΜTorrent#Ads_and_malware
cm2187 10y ago
Arguably, this leak seems to have been the result of password reuse. If you store your data with millions of people and 200 employees have a way to access it, your are exposed to 1. An interesting phishing target for a hacker 2. Lots of employees who can fuck up, a hacker only needs one, one time I'd say the probability you will be hacked is probably less if you use like a Synology with a reasonably strong password and automatic system updates.
loup-vaillant 10y ago
For me, that would be most probably both if I were serious. Less of a target of course (I'm only one dude), but also much less attack surface. Basically install a trusty GNU/Linux or Open BSD, set up automatic updates, and block everything but SSH. Oh, and disable password based logins —use a public/private key pair of appropriate strength. Or better yet, ask actual security experts about that setup, they're likely to come up with something better (just as simple and more secure).
- aluhut 10y ago
  Exactly my thoughts and I'm not alone here. There is a growing attitude against cloud infrastructure which together with the industries hype for it will lead to a interesting clash at some point. I hope this will bring out even more cloudless solutions in the future.
- softawre 10y ago
  This sounds like a simple setup the average HN spouse would have no trouble with at all.

It's not clear to me whether the grandparent is referring to self-hosting password management or file synchronisation. However, one obvious security advantage of self-hosting is that you can use end-to-end encryption (which most cloud sync services don't support). E.g., I use Resilio Sync (formerly Bittorrent Sync) for file sync with encryption-only keys on my cloud peer. The cloud peer participates in the mesh, providing bandwidth, but if it gets hacked, no one can read the data. (Of course, I would prefer an open source solution. SyncThing does not have the right sharing model for me. So I was thrilled to hear about LibreVault on HN, which provides functionality similar to BTSync 1.x: https://librevault.com https://librevault.com)

whyagaindavid 10y ago
Why not use firefox sync or chrome password sync? All data is locally encrypted before uploading.
aluhut 10y ago
Both.
m0nty 10y ago
> Resilio Sync (formerly Bittorrent Sync) Good job they changed their name. Couldn't get the product adopted in a corporate environment because of all the cries of "Witch! Witch!" when the suits saw the word Bittorrent in there.
- danieldk 10y ago
  Indeed. And they spun out of Bittorrent Inc. completely, which is known for doing scammy things: https://en.wikipedia.org/wiki/ΜTorrent#Ads_and_malware https://en.wikipedia.org/wiki/ΜTorrent#Ads_and_malware

cm2187 10y ago

Arguably, this leak seems to have been the result of password reuse. If you store your data with millions of people and 200 employees have a way to access it, your are exposed to 1. An interesting phishing target for a hacker 2. Lots of employees who can fuck up, a hacker only needs one, one time I'd say the probability you will be hacked is probably less if you use like a Synology with a reasonably strong password and automatic system updates.

loup-vaillant 10y ago

For me, that would be most probably both if I were serious. Less of a target of course (I'm only one dude), but also much less attack surface. Basically install a trusty GNU/Linux or Open BSD, set up automatic updates, and block everything but SSH. Oh, and disable password based logins —use a public/private key pair of appropriate strength. Or better yet, ask actual security experts about that setup, they're likely to come up with something better (just as simple and more secure).

aluhut 10y ago
Exactly my thoughts and I'm not alone here. There is a growing attitude against cloud infrastructure which together with the industries hype for it will lead to a interesting clash at some point. I hope this will bring out even more cloudless solutions in the future.
softawre 10y ago
This sounds like a simple setup the average HN spouse would have no trouble with at all.