20 ms·

SpiderOakONE – Zero Knowledge Cloud Storage

99 points by ergot 10y ago

BeetleB 10y ago
They've been around for a while and are highly regarded. The one thing that makes their privacy weak is: The software involved in the encryption/password handling is not open source. We have only their word for it that they are not snooping or letting anyone else snoop. If you're willing to do the extra work, you can get a cloud service like Dream Objects, and use software like duply/duplicity to store your files online and encrypted. You may lose some flexibility, though.
- jbverschoor 10y ago
  I tried spider oak a while ago, and I thought it was horrible in terms of ui, performance and bloat. I'm assuming they didn't change their stack/devs, so I will not even try this one.
  - adwf 10y ago
    Spideroak One is miles better in terms of UI than the old version, but the performance is still baffling sometimes. eg. Edit a single ~5kb file and you can be seeing multiple minute upload times. Encryption doesn't take that long and even dial-up is faster for upload. EDIT: I only use the free version though, so maybe the paid plans have better speeds.
  - toyg 10y ago
    Depends on how long "a while" ago was. They had a big client overhaul something like a year (?) ago, which (after a few months of bugfixing) made quite a difference. Now they also have a galaxy of related products (IM, collab, etc) which more or less integrate with ONE, although I haven't really used them.
    - jbverschoor 10y ago
      Ah ok. No it was actually a couple of years ago, more than 3 I might give it a try.
  - rarrrrrr 10y ago
    Thanks for the feedback. Sorry it didn't work out for you. FYI, the SpiderOakONE app and the backend storage service received a refresh in 2016, and another one is underway right now (now all needed libraries are Python3 compatible!) The existing UI is oriented toward power users, and is a bit complex for most people. The upcoming refresh simplifies many things while retaining the flexibility under "advanced" settings.
  - fauigerzigerk 10y ago
    I find that surprsing. I've been using SpiderOak for years without noticing any bloat or performance issues with the background service. On the contrary, I was often surprised how little space I'm using in spite of the fact that they store multiple versions of my files. It doesn't hog memory or bandwidth or CPU at all. The UI is indeed a bit weird and its performance can be erratic sometimes, but it gets the job done and has a lot of useful features. Most importantly, SpiderOak has reliably protected me from losing data and I don't have to babysit it. It just works. (I'm a happy paying customer. No affiliation with them whatsoever)
    - StavrosK 10y ago
      I used to be a paying customer (years ago, things may be better now), and I had many issues with CPU getting stuck at 100% for long stretches of time, or uploads/downloads would transfer a bunch of data, or would be slow, things like that. Then, one day, my account got full, and I couldn't delete anything unless I got some more free space first (see the problem?). I believe support gave me a few extra GB just for the deletion, but that didn't work either and I decided to stop using the whole thing. That's when I switched to attic/borg, which is much superior for my use case (backups).
- rsync 10y ago
  "If you're willing to do the extra work, you can get a cloud service like Dream Objects, and use software like duply/duplicity to store your files online and encrypted. You may lose some flexibility, though." I encourage you to look into borg backup[1][2] which appears to have replaced duplicity as the de facto standard for "robust backups that the provider knows nothing about". This is really the direction you look for providers[3] to go in - giving you a blank slate to write whatever bits you want to and allowing you to control the encryption with your own tools. If you point borg (or duplicity) at even the most privacy-antagonistic provider, they still have nothing but gibberish. [1] https://borgbackup.readthedocs.io/en/stable/ https://borgbackup.readthedocs.io/en/stable/ [2] https://www.stavros.io/posts/holy-grail-backups/ https://www.stavros.io/posts/holy-grail-backups/ [3] http://www.rsync.net/products/attic.html http://www.rsync.net/products/attic.html
  - StavrosK 10y ago
    I use borg on rsync.net (and I just noticed the second link is to my post), and I'd recommend it strongly. Basically, if you need to back stuff up, use borg, period. Rsync.net have also been very good and competitively priced, as per the above link. I can recommend them as well. (no affiliation with either product).
- Veratyr 10y ago
  > They've been around for a while and are highly regarded. By who? My only experiences with them have been horrible. Their client is buggy, slow and horrible and their support left tickets for literally months until they basically gave up and gave me a refund.
tinodotim 10y ago
In addition to not being (fully) open source, something that also should be mentioned is, that if u use the mobile apps it unfortunately still isn't "zero knowledge" [0]. [0] https://spideroak.com/manual/spideroak-on-mobile https://spideroak.com/manual/spideroak-on-mobile
- danbruc 10y ago
  Until recently, mobile platforms were not capable of doing the on-device encryption necessary for SpiderOak's Zero Knowledge implementation. Anyone any idea what the issue is or was? What would prevents you from doing PBKDF2, RSA and AES [1] on a mobile device? [1] https://spideroak.com/manual/zero-knowledge-explained https://spideroak.com/manual/zero-knowledge-explained
  - rarrrrrr 10y ago
    It's mostly that the desktop app is Python and C, and there wasn't a clear path to make that same code base run on mobile, so the mobile app is just a reader. However for Semaphor, our encrypted group chat and file sharing tool (akin to IRC, to Slack or HipChat) the internals are written in Go and it's the same code base on all platforms, including mobile. That source code is also published for security review. We plan to migrate SpiderOakONE to use that same stack so the mobile experience is the same as desktop.
Numberwang 10y ago
Is there a full pricing overview available?
- tinodotim 10y ago
  2nd row on https://spideroak.com/about/price-list https://spideroak.com/about/price-list SPIDER OAK ONE PRICES 100GB - $5 monthly ($59/y) 250GB - $9 monthly ($99/y) 1TB - $12 monthly ($129/y)
  - Numberwang 10y ago
    Cheers.
Canada 10y ago
Spider Oak - Please stop describing your service as "Zero Knowledge" unless and until you deploy a service that is actually is. E2E encryption great, but it is not the same thing.
- Jivanyan 10y ago
  Following to their architectural design, they do not get access to any encryption key and no key leaves user device in unprotected form. Is not this enough to be advertised as "zero-knowledge" service provider?
  - federicobond 10y ago
    No, that's called end-to-end or client-side encryption. Zero-knowledge is a property of a certain class of methods that allow one party to prove to another that a certain statement is true, without revealing anything else about it.
  - geofft 10y ago
    The term "zero knowledge" has a specific technical meaning in cryptography: https://en.wikipedia.org/wiki/Zero-knowledge_proof https://en.wikipedia.org/wiki/Zero-knowledge_proof Passing encrypted data through a storage device isn't a "zero-knowledge protocol" in a cryptographic sense, it's just normal cryptography.
  - danbruc 10y ago
    As a technical term zero-knowledge has a very specific meaning [1] and is not what they are using. Here it is just a marketing term and may confuse people knowing about the technical meaning but that is certainly only a very small fraction of the population and so it is probably not a huge issue. [1] https://en.wikipedia.org/wiki/Zero-knowledge_proof https://en.wikipedia.org/wiki/Zero-knowledge_proof
    - bad_user 10y ago
      That's kind of bullshit though, you can't claim 2 common words from the English language in order to only describe a concept many of us don't understand. I'm a software developer, have been for 15 years, I've stayed fairly awake in college during my cryptography classes, have implemented hashing functions (mentioning this because such a history already place somebody in the 0.01%) and I've never heard of "zero knowledge proof". Not surprisingly, the link you've given is about a phrase with 3 words in it, not 2. And while I've always been annoyed about overloads of "open source", at least that's a words association that you won't hear from non-technical folks and that wasn't in use before OSI happened. And even so, note that OSI couldn't trademark it.
nenadst 10y ago
does anybody know if www.sync.com is any better regarding their mobile apps ? They do also client-site,end-to-end encryption but their white paper only mentions their web-app which apparently does everything on the client.
- fluxby 10y ago
  You should also check out Tresor End to End Encryption [1] https://tresorit.com/ https://tresorit.com/
  - wchrisn 10y ago
    Disclaimer: This is a promotional post with an intention to pass on Reseller Discounts so that we have more individuals who can subscribe to secured cloud storage As part of ensuring that our business clients have access to secured cloud storage services, we have initiated enlisting with Tresorit as Resellers and will be passing on discounts* to our clients. Interested individuals can procure the service at a discounted rate subject to the total number of individuals registering and converting as a paid users is 250 or above Please leave your email id and we will contact you if we area able to enlist the required number of individuals https://goo.gl/forms/P7oEvaE5aTnLsFLn1 https://goo.gl/forms/P7oEvaE5aTnLsFLn1
newscracker 10y ago
I've liked SpiderOak's focus on privacy and security, but find the pricing to be expensive at every tier, and the space available not in tune for my needs (a jump from 100GB to 250GB, which is kinda ok, and then to a whopping 1TB).
- rarrrrrr 10y ago
  Thanks for your feedback. Just as a data point for comparison, Dropbox charges $100/year for 1000 GB, but they don't do meaningful encryption, and therefore can de-duplicate your files vs. the files of all their other customers, which significantly reduces their storage costs (and allows for some entertaining information leakages!) SpiderOak charges $120/year for 1000 GB. Edit to add: SpiderOak deduplicates files within a single user's account (i.e. copies are free, and if you add another layer to a photoshop file and re-save, it won't take up the full space to archive both versions) but it is not possible [1] for us to deduplicate data across multiple users. [1] https://spideroak.com/articles/why-spideroak-doesnt-deduplicate-data-across-users-and-why-it-should-worry-you-if-we-did https://spideroak.com/articles/why-spideroak-doesnt-deduplic...
  - WireWrap 10y ago
    How do you "dedupe within a single user's account" without violating "zero knowledge"?
    - rarrrrrr 10y ago
      Great question. The database work is all done client side. Here's an explanation of the architecture I wrote in 2009: https://spideroak.com/articles/why--how-spideroak-architecture-is-different-than-other-online-storage-services https://spideroak.com/articles/why--how-spideroak-architectu...
junhopark 10y ago
@rarrrrrr - Do you have a more precise timeline of when the SpiderOak Notes App will be launched in 2017? Would love to try it out as I'm getting tired of various issues w/ Evernote and haven't been able to find a good alternative yet.
- rarrrrrr 10y ago
  Thanks for asking! I'm really excited about a ZK note app! We haven't yet determined the priority of this vs. other projects in 2017. If you haven't already, please signal your interest below[1]. So far it is a prototype, although it is based on the already proven code used in Semaphor[2], our encrypted group chat and file sharing application, so it's "just" a bunch of UI work now :-) [1] https://spideroak.com/about/noteapp-signup https://spideroak.com/about/noteapp-signup [2] https://spideroak.com/solutions/semaphor/business/tour https://spideroak.com/solutions/semaphor/business/tour
  - thesimp 10y ago
    At this moment I'm a paying user of both Evernote and Dropbox and I do not like how they are focusing on extra bells&whistles instead of investing time in their encryption methods to make my data more safe. From a business perspective you can get the money that I give to Evernote and Dropbox if Spideroak offers competing products. And for me the advantage is that my data is more secure because of the zero knowledge(1) idea and I do not need to worry about wild ideas from companies think about employees reading my notes "to make my experience better". Yes I'm looking at you Evernote. (1) until 10 minutes ago I did not know that zero knowledge had a specific technical meaning that is different than what Spideroak implements. And I even have Bruce Schneiers Applied Cryptography on my bookself. I'll need to read that again. Maybe it should be called "Full stack encryption" because it covers everything from data transport, to storage, to metadata encryption, etc...
deleted 10y ago
[deleted]
lyonlim 10y ago
I really want to use this, but the mobile app (Android) really lacks very basic functionality - uploading files. I recently stopped renewing my Dropbox on an annual license and will switch once I find a good alternative..
- Skunkleton 10y ago
  The thing that keeps me on dropbox is the price. I can't find a provider of raw storage that charges less.
caseysoftware 10y ago
I don't have a ton of data in Dropbox but it's large and growing. Any word if they're going to hook up a "import from Box/Dropbox" feature here?
- rarrrrrr 10y ago
  SpiderOak can backup and sync arbitrary folders (including external drives, network volumes, etc.) So one migration path is just to select the Dropbox folder for backup by SpiderOak. (Or just move data from Dropbox folder to the SpiderOak Hive folder.)
gtramont 10y ago
Just wanted to drop a note here… I've been a long time user of SpiderOak and am really satisfied with it. A much better alternative to Dropbox and alikes.
sidcool 10y ago
Is this a new service they have launched? I mean what's bringing this on front page? I read the link but couldn't figure out.
borplk 10y ago
Years ago I attempted to use this but the linux client was unusable and buggy on Ubuntu LTS.
sumedh 10y ago
@rarrrrrr How many devices does this support. Can I add three devices in the same plan? Can I sign up for 100GB first and then later upgrade to a higher plan seamlessly?
_slwy 10y ago
Whenever SpiderOak comes up I can't help but share my experience with them. In February SpiderOak dropped its pricing to $12/month for 1TB of data. Having several hundred gigabytes of photos to backup I took advantage and bought a year long subscription ($129). I had access to a symmetric gigabit fibre connection so I connected, set up the SpiderOak client and started uploading. However I noticed something odd. According to my Mac's activity monitor, SpiderOak was only uploading in short bursts [0] of ~2MB/s. I did some test uploads to other services (Google Drive, Amazon) to verify that things were fine with my connection (they were) and then contacted support (Feb 10). What followed was nearly __6 months__ of "support", first claiming that it might be a server side issue and moving me "to a new host" (Feb 17) then when that didn't resolve my issue, they ignored me for a couple of months then handed me over to an engineer (Apr 28) who told me: "we may have your uploads running at the maximum speed we can offer you at the moment. Additional changes to storage network configuration will not improve the situation much. There is an overhead limitation when the client encrypts, deduplicates, and compresses the files you are uploading" At this point I ran a basic test (cat /dev/urandom | gzip -c | openssl enc -aes-256-cbc -pass pass:spideroak | pv | shasum -a 256 > /dev/zero) that showed my laptop was easily capable of hashing and encrypting the data much faster than SpiderOak was handling it (Apr 30) after which I was simply ignored for a full month until I opened another ticket asking for a refund (Jul 9). I really love the idea of secure, private storage but SpiderOak's client is barely functional and their customer support is rather bad.
- elementalest 10y ago
  I have been using SpiderOak (SO) for nearly 6 years. However, I have been keeping an eye out for a viable alternative as I feel SO is starting to be neglected. In the past year or so, SO has barely received any updates (apart from the occasional minor bug fix). Semaphore seems to be taking up all their dev time. This would not be such an issue if everything ran well. SO has no UI means to control version history. In order to limit version history (for example, to hourly versions per day, then 1 per day for a month, then 1 per week indefinitely), I need to run a script to close SO and run SO with some command line arguments. Having this functionality available in the UI would be nice. The SO UI is slow to use. Over 6 years I have accumulated a lot of files and whenever I goto the manage tab to browse my files, it can take several seconds each time I expand tree nodes. The UI also becomes unresponsive, making browsing files take a while. Manually deleting files/folders/version history is an absolute pain. Often, when deleting a folder in SO, only some of the contents are deleted, taking multiple attempts to delete. In some cases the contents of the folder disappear, but it shows root locations of drives as contents of the folder. When deleting anything, the UI becomes unresponsive for upwards of 30s, often significantly more for large folders or many version histories. Even selecting multiple files can take several seconds where the UI is unresponsive, the more files you select, the longer it becomes unresponsive. This makes file management take forever. If I move a file temporarily, SO assumes it has been deleted and moves it to the 'Deleted items' folder. However, when I move the file back, SO create a new version of that file, leaving all version history in the deleted folder. It does not recognise the files are the same. This means that if a file is created and deleted numerous times (compiling pdf, or binary), hundreds of files with the same name are added to the 'Deleted items' folder. SO should be able to recognise the files are linked (perhaps checking the similarity of the files, only rejecting a link if they are more than 75% different) and create version histories instead of new files. There is also no way to delete items in the 'Deleted items' folder after a period of time (2 years for example). The only way to delete items is to manually do it or clear everything, which I don't want to do as there are version histories that should be linked to currently existing files in the 'Deleted items' folder. I have had to resort to once a year putting a movie on and just manually going through folders for a few hours. I really like the idea of SpiderOak, but it really is a poor implementation and just an all round pain to use. In the past I havn't minded waiting for new features and fixes, but its been 1.5 years since the new UI and nothing much has changed. EDIT: And just to prove my point, I just tried to deleted a folder in the 'Deleted items' folder. The first attempt deleted everything within the folder, but a 'c:/' item appeared inside it. So I deleted the folder again. Half the contents of the folder a level above it just disappeared. This has happened before. I think I give up.
msh 10y ago
I have used them for some years and have 2 main issue: Their servers are slow compared to other cloud providers. You can't upload files using their ios or Android clients, they are read only.

99 points by ergot 10y ago

They've been around for a while and are highly regarded. The one thing that makes their privacy weak is: The software involved in the encryption/password handling is not open source. We have only their word for it that they are not snooping or letting anyone else snoop. If you're willing to do the extra work, you can get a cloud service like Dream Objects, and use software like duply/duplicity to store your files online and encrypted. You may lose some flexibility, though.

jbverschoor 10y ago
I tried spider oak a while ago, and I thought it was horrible in terms of ui, performance and bloat. I'm assuming they didn't change their stack/devs, so I will not even try this one.
- adwf 10y ago
  Spideroak One is miles better in terms of UI than the old version, but the performance is still baffling sometimes. eg. Edit a single ~5kb file and you can be seeing multiple minute upload times. Encryption doesn't take that long and even dial-up is faster for upload. EDIT: I only use the free version though, so maybe the paid plans have better speeds.
- toyg 10y ago
  Depends on how long "a while" ago was. They had a big client overhaul something like a year (?) ago, which (after a few months of bugfixing) made quite a difference. Now they also have a galaxy of related products (IM, collab, etc) which more or less integrate with ONE, although I haven't really used them.
  - jbverschoor 10y ago
    Ah ok. No it was actually a couple of years ago, more than 3 I might give it a try.
- rarrrrrr 10y ago
  Thanks for the feedback. Sorry it didn't work out for you. FYI, the SpiderOakONE app and the backend storage service received a refresh in 2016, and another one is underway right now (now all needed libraries are Python3 compatible!) The existing UI is oriented toward power users, and is a bit complex for most people. The upcoming refresh simplifies many things while retaining the flexibility under "advanced" settings.
- fauigerzigerk 10y ago
  I find that surprsing. I've been using SpiderOak for years without noticing any bloat or performance issues with the background service. On the contrary, I was often surprised how little space I'm using in spite of the fact that they store multiple versions of my files. It doesn't hog memory or bandwidth or CPU at all. The UI is indeed a bit weird and its performance can be erratic sometimes, but it gets the job done and has a lot of useful features. Most importantly, SpiderOak has reliably protected me from losing data and I don't have to babysit it. It just works. (I'm a happy paying customer. No affiliation with them whatsoever)
  - StavrosK 10y ago
    I used to be a paying customer (years ago, things may be better now), and I had many issues with CPU getting stuck at 100% for long stretches of time, or uploads/downloads would transfer a bunch of data, or would be slow, things like that. Then, one day, my account got full, and I couldn't delete anything unless I got some more free space first (see the problem?). I believe support gave me a few extra GB just for the deletion, but that didn't work either and I decided to stop using the whole thing. That's when I switched to attic/borg, which is much superior for my use case (backups).
rsync 10y ago
"If you're willing to do the extra work, you can get a cloud service like Dream Objects, and use software like duply/duplicity to store your files online and encrypted. You may lose some flexibility, though." I encourage you to look into borg backup[1][2] which appears to have replaced duplicity as the de facto standard for "robust backups that the provider knows nothing about". This is really the direction you look for providers[3] to go in - giving you a blank slate to write whatever bits you want to and allowing you to control the encryption with your own tools. If you point borg (or duplicity) at even the most privacy-antagonistic provider, they still have nothing but gibberish. [1] https://borgbackup.readthedocs.io/en/stable/ https://borgbackup.readthedocs.io/en/stable/ [2] https://www.stavros.io/posts/holy-grail-backups/ https://www.stavros.io/posts/holy-grail-backups/ [3] http://www.rsync.net/products/attic.html http://www.rsync.net/products/attic.html
- StavrosK 10y ago
  I use borg on rsync.net (and I just noticed the second link is to my post), and I'd recommend it strongly. Basically, if you need to back stuff up, use borg, period. Rsync.net have also been very good and competitively priced, as per the above link. I can recommend them as well. (no affiliation with either product).
Veratyr 10y ago
> They've been around for a while and are highly regarded. By who? My only experiences with them have been horrible. Their client is buggy, slow and horrible and their support left tickets for literally months until they basically gave up and gave me a refund.

tinodotim 10y ago

In addition to not being (fully) open source, something that also should be mentioned is, that if u use the mobile apps it unfortunately still isn't "zero knowledge" [0]. [0] https://spideroak.com/manual/spideroak-on-mobile https://spideroak.com/manual/spideroak-on-mobile

danbruc 10y ago
Until recently, mobile platforms were not capable of doing the on-device encryption necessary for SpiderOak's Zero Knowledge implementation. Anyone any idea what the issue is or was? What would prevents you from doing PBKDF2, RSA and AES [1] on a mobile device? [1] https://spideroak.com/manual/zero-knowledge-explained https://spideroak.com/manual/zero-knowledge-explained
- rarrrrrr 10y ago
  It's mostly that the desktop app is Python and C, and there wasn't a clear path to make that same code base run on mobile, so the mobile app is just a reader. However for Semaphor, our encrypted group chat and file sharing tool (akin to IRC, to Slack or HipChat) the internals are written in Go and it's the same code base on all platforms, including mobile. That source code is also published for security review. We plan to migrate SpiderOakONE to use that same stack so the mobile experience is the same as desktop.

Numberwang 10y ago

Is there a full pricing overview available?

tinodotim 10y ago
2nd row on https://spideroak.com/about/price-list https://spideroak.com/about/price-list SPIDER OAK ONE PRICES 100GB - $5 monthly ($59/y) 250GB - $9 monthly ($99/y) 1TB - $12 monthly ($129/y)
- Numberwang 10y ago
  Cheers.

Canada 10y ago

Spider Oak - Please stop describing your service as "Zero Knowledge" unless and until you deploy a service that is actually is. E2E encryption great, but it is not the same thing.

Jivanyan 10y ago
Following to their architectural design, they do not get access to any encryption key and no key leaves user device in unprotected form. Is not this enough to be advertised as "zero-knowledge" service provider?
- federicobond 10y ago
  No, that's called end-to-end or client-side encryption. Zero-knowledge is a property of a certain class of methods that allow one party to prove to another that a certain statement is true, without revealing anything else about it.
- geofft 10y ago
  The term "zero knowledge" has a specific technical meaning in cryptography: https://en.wikipedia.org/wiki/Zero-knowledge_proof https://en.wikipedia.org/wiki/Zero-knowledge_proof Passing encrypted data through a storage device isn't a "zero-knowledge protocol" in a cryptographic sense, it's just normal cryptography.
- danbruc 10y ago
  As a technical term zero-knowledge has a very specific meaning [1] and is not what they are using. Here it is just a marketing term and may confuse people knowing about the technical meaning but that is certainly only a very small fraction of the population and so it is probably not a huge issue. [1] https://en.wikipedia.org/wiki/Zero-knowledge_proof https://en.wikipedia.org/wiki/Zero-knowledge_proof
  - bad_user 10y ago
    That's kind of bullshit though, you can't claim 2 common words from the English language in order to only describe a concept many of us don't understand. I'm a software developer, have been for 15 years, I've stayed fairly awake in college during my cryptography classes, have implemented hashing functions (mentioning this because such a history already place somebody in the 0.01%) and I've never heard of "zero knowledge proof". Not surprisingly, the link you've given is about a phrase with 3 words in it, not 2. And while I've always been annoyed about overloads of "open source", at least that's a words association that you won't hear from non-technical folks and that wasn't in use before OSI happened. And even so, note that OSI couldn't trademark it.

nenadst 10y ago

does anybody know if www.sync.com is any better regarding their mobile apps ? They do also client-site,end-to-end encryption but their white paper only mentions their web-app which apparently does everything on the client.

fluxby 10y ago
You should also check out Tresor End to End Encryption [1] https://tresorit.com/ https://tresorit.com/
- wchrisn 10y ago
  Disclaimer: This is a promotional post with an intention to pass on Reseller Discounts so that we have more individuals who can subscribe to secured cloud storage As part of ensuring that our business clients have access to secured cloud storage services, we have initiated enlisting with Tresorit as Resellers and will be passing on discounts* to our clients. Interested individuals can procure the service at a discounted rate subject to the total number of individuals registering and converting as a paid users is 250 or above Please leave your email id and we will contact you if we area able to enlist the required number of individuals https://goo.gl/forms/P7oEvaE5aTnLsFLn1 https://goo.gl/forms/P7oEvaE5aTnLsFLn1

newscracker 10y ago

I've liked SpiderOak's focus on privacy and security, but find the pricing to be expensive at every tier, and the space available not in tune for my needs (a jump from 100GB to 250GB, which is kinda ok, and then to a whopping 1TB).

rarrrrrr 10y ago
Thanks for your feedback. Just as a data point for comparison, Dropbox charges $100/year for 1000 GB, but they don't do meaningful encryption, and therefore can de-duplicate your files vs. the files of all their other customers, which significantly reduces their storage costs (and allows for some entertaining information leakages!) SpiderOak charges $120/year for 1000 GB. Edit to add: SpiderOak deduplicates files within a single user's account (i.e. copies are free, and if you add another layer to a photoshop file and re-save, it won't take up the full space to archive both versions) but it is not possible [1] for us to deduplicate data across multiple users. [1] https://spideroak.com/articles/why-spideroak-doesnt-deduplicate-data-across-users-and-why-it-should-worry-you-if-we-did https://spideroak.com/articles/why-spideroak-doesnt-deduplic...
- WireWrap 10y ago
  How do you "dedupe within a single user's account" without violating "zero knowledge"?
  - rarrrrrr 10y ago
    Great question. The database work is all done client side. Here's an explanation of the architecture I wrote in 2009: https://spideroak.com/articles/why--how-spideroak-architecture-is-different-than-other-online-storage-services https://spideroak.com/articles/why--how-spideroak-architectu...

junhopark 10y ago

@rarrrrrr - Do you have a more precise timeline of when the SpiderOak Notes App will be launched in 2017? Would love to try it out as I'm getting tired of various issues w/ Evernote and haven't been able to find a good alternative yet.

rarrrrrr 10y ago
Thanks for asking! I'm really excited about a ZK note app! We haven't yet determined the priority of this vs. other projects in 2017. If you haven't already, please signal your interest below[1]. So far it is a prototype, although it is based on the already proven code used in Semaphor[2], our encrypted group chat and file sharing application, so it's "just" a bunch of UI work now :-) [1] https://spideroak.com/about/noteapp-signup https://spideroak.com/about/noteapp-signup [2] https://spideroak.com/solutions/semaphor/business/tour https://spideroak.com/solutions/semaphor/business/tour
- thesimp 10y ago
  At this moment I'm a paying user of both Evernote and Dropbox and I do not like how they are focusing on extra bells&whistles instead of investing time in their encryption methods to make my data more safe. From a business perspective you can get the money that I give to Evernote and Dropbox if Spideroak offers competing products. And for me the advantage is that my data is more secure because of the zero knowledge(1) idea and I do not need to worry about wild ideas from companies think about employees reading my notes "to make my experience better". Yes I'm looking at you Evernote. (1) until 10 minutes ago I did not know that zero knowledge had a specific technical meaning that is different than what Spideroak implements. And I even have Bruce Schneiers Applied Cryptography on my bookself. I'll need to read that again. Maybe it should be called "Full stack encryption" because it covers everything from data transport, to storage, to metadata encryption, etc...

deleted 10y ago

[deleted]

lyonlim 10y ago

I really want to use this, but the mobile app (Android) really lacks very basic functionality - uploading files. I recently stopped renewing my Dropbox on an annual license and will switch once I find a good alternative..

Skunkleton 10y ago
The thing that keeps me on dropbox is the price. I can't find a provider of raw storage that charges less.

caseysoftware 10y ago

I don't have a ton of data in Dropbox but it's large and growing. Any word if they're going to hook up a "import from Box/Dropbox" feature here?

rarrrrrr 10y ago
SpiderOak can backup and sync arbitrary folders (including external drives, network volumes, etc.) So one migration path is just to select the Dropbox folder for backup by SpiderOak. (Or just move data from Dropbox folder to the SpiderOak Hive folder.)

gtramont 10y ago

Just wanted to drop a note here… I've been a long time user of SpiderOak and am really satisfied with it. A much better alternative to Dropbox and alikes.

sidcool 10y ago

Is this a new service they have launched? I mean what's bringing this on front page? I read the link but couldn't figure out.

borplk 10y ago

Years ago I attempted to use this but the linux client was unusable and buggy on Ubuntu LTS.

sumedh 10y ago

@rarrrrrr How many devices does this support. Can I add three devices in the same plan? Can I sign up for 100GB first and then later upgrade to a higher plan seamlessly?

_slwy 10y ago

Whenever SpiderOak comes up I can't help but share my experience with them. In February SpiderOak dropped its pricing to $12/month for 1TB of data. Having several hundred gigabytes of photos to backup I took advantage and bought a year long subscription ($129). I had access to a symmetric gigabit fibre connection so I connected, set up the SpiderOak client and started uploading. However I noticed something odd. According to my Mac's activity monitor, SpiderOak was only uploading in short bursts [0] of ~2MB/s. I did some test uploads to other services (Google Drive, Amazon) to verify that things were fine with my connection (they were) and then contacted support (Feb 10). What followed was nearly __6 months__ of "support", first claiming that it might be a server side issue and moving me "to a new host" (Feb 17) then when that didn't resolve my issue, they ignored me for a couple of months then handed me over to an engineer (Apr 28) who told me: "we may have your uploads running at the maximum speed we can offer you at the moment. Additional changes to storage network configuration will not improve the situation much. There is an overhead limitation when the client encrypts, deduplicates, and compresses the files you are uploading" At this point I ran a basic test (cat /dev/urandom | gzip -c | openssl enc -aes-256-cbc -pass pass:spideroak | pv | shasum -a 256 > /dev/zero) that showed my laptop was easily capable of hashing and encrypting the data much faster than SpiderOak was handling it (Apr 30) after which I was simply ignored for a full month until I opened another ticket asking for a refund (Jul 9). I really love the idea of secure, private storage but SpiderOak's client is barely functional and their customer support is rather bad.

elementalest 10y ago
I have been using SpiderOak (SO) for nearly 6 years. However, I have been keeping an eye out for a viable alternative as I feel SO is starting to be neglected. In the past year or so, SO has barely received any updates (apart from the occasional minor bug fix). Semaphore seems to be taking up all their dev time. This would not be such an issue if everything ran well. SO has no UI means to control version history. In order to limit version history (for example, to hourly versions per day, then 1 per day for a month, then 1 per week indefinitely), I need to run a script to close SO and run SO with some command line arguments. Having this functionality available in the UI would be nice. The SO UI is slow to use. Over 6 years I have accumulated a lot of files and whenever I goto the manage tab to browse my files, it can take several seconds each time I expand tree nodes. The UI also becomes unresponsive, making browsing files take a while. Manually deleting files/folders/version history is an absolute pain. Often, when deleting a folder in SO, only some of the contents are deleted, taking multiple attempts to delete. In some cases the contents of the folder disappear, but it shows root locations of drives as contents of the folder. When deleting anything, the UI becomes unresponsive for upwards of 30s, often significantly more for large folders or many version histories. Even selecting multiple files can take several seconds where the UI is unresponsive, the more files you select, the longer it becomes unresponsive. This makes file management take forever. If I move a file temporarily, SO assumes it has been deleted and moves it to the 'Deleted items' folder. However, when I move the file back, SO create a new version of that file, leaving all version history in the deleted folder. It does not recognise the files are the same. This means that if a file is created and deleted numerous times (compiling pdf, or binary), hundreds of files with the same name are added to the 'Deleted items' folder. SO should be able to recognise the files are linked (perhaps checking the similarity of the files, only rejecting a link if they are more than 75% different) and create version histories instead of new files. There is also no way to delete items in the 'Deleted items' folder after a period of time (2 years for example). The only way to delete items is to manually do it or clear everything, which I don't want to do as there are version histories that should be linked to currently existing files in the 'Deleted items' folder. I have had to resort to once a year putting a movie on and just manually going through folders for a few hours. I really like the idea of SpiderOak, but it really is a poor implementation and just an all round pain to use. In the past I havn't minded waiting for new features and fixes, but its been 1.5 years since the new UI and nothing much has changed. EDIT: And just to prove my point, I just tried to deleted a folder in the 'Deleted items' folder. The first attempt deleted everything within the folder, but a 'c:/' item appeared inside it. So I deleted the folder again. Half the contents of the folder a level above it just disappeared. This has happened before. I think I give up.

msh 10y ago

I have used them for some years and have 2 main issue: Their servers are slow compared to other cloud providers. You can't upload files using their ios or Android clients, they are read only.