4 ms·

I could say that both projects are open source, but no, i haven't audited them. Cryptomator has been audited by Cure53 (https://cryptomator.org/audits/2017-11-2

I could say that both projects are open source, but no, i haven't audited them. Cryptomator has been audited by Cure53 (https://cryptomator.org/audits/2017-11-27%20crypto%20cure53.pdf https://cryptomator.org/audits/2017-11-27%20crypto%20cure53....) In any case, i guess it depends on your threat model. I have no illusion that a sufficiently determined attacker will gain access to my files, but that's true no matter if i store the files at home or in the cloud - We're talking files accessible "on the move" here, so it's not like i can just airgap the server. The cloud offers far better physical security than what i have at home, and if not better, at least equal network security with dedicated teams on board to resolve issues. The (major) cloud also offers far more geographical redundancy (Google 3 sites, Apple 2-3 sites, Microsoft 2 sites), each with redundancy in power/internet/hardware, as well as fire/flood protection. And of course, the most common reason for broken encryption is a weak password, so don't do that.

aborsy 5y ago
Files encrypted with rclone were actually plaintext for about a year: https://www.cvedetails.com/vulnerability-list/vendor_id-18942/Rclone.html https://www.cvedetails.com/vulnerability-list/vendor_id-1894... Because a developer didn’t know the pitfall of taking a random seed from the current time. Cryptomator takes encryption from a Java library. I don’t know the quality of this ecosystem. Searching it in HN doesn’t return much. With cloud, you need to clarify if the provider and governments are in your model or not.
- 8fingerlouie 5y ago
  > Files encrypted with rclone were actually plaintext for about a year: It had a severe weakness yes, but it was not plaintext. From the CVE : "dictionary of all possible passwords with about 38 million entries per password length". For an attacker to attempt to break the encryption, they also still need to defeat the cloud providers security measures like 2FA. > Cryptomator takes encryption from Java library. I don’t know the quality of this ecosystem. Considering that it's used by banks/goverments, i'd say that it's probably either full of backdoors, or at least somewhat OK :) > With cloud, you need to clarify if the provider and governments are in your model or not. I have no illusion that i can keep encrypted files out of government hands, or any other sufficiently motivated attacker. One could argue that the data might even be better protected in the cloud than in my home. Also : https://xkcd.com/538/ https://xkcd.com/538/ If storing illegal content is "your thing", you'd be better off looking for other solutions. My personal needs are storing maybe not generally sensitive files, but files i consider sensitive, like photos of my family, tax documents, etc. It's all files that would probably not make much of an impact if they were public available, but i prefer keeping them private. The thing about encryption is that if you don't trust it, it doesn't make much sense using it at all. That goes for both cloud and private. The threat vectors are different, but one could argue that a datacenter network is probably better protected than the average users Zyxel/Netgear/whatever router that probably has about a dozen unpatched CVEs, along with an ISP "backdoor" if supplied by the ISP.

aborsy 5y ago

Files encrypted with rclone were actually plaintext for about a year: https://www.cvedetails.com/vulnerability-list/vendor_id-18942/Rclone.html https://www.cvedetails.com/vulnerability-list/vendor_id-1894... Because a developer didn’t know the pitfall of taking a random seed from the current time. Cryptomator takes encryption from a Java library. I don’t know the quality of this ecosystem. Searching it in HN doesn’t return much. With cloud, you need to clarify if the provider and governments are in your model or not.

8fingerlouie 5y ago
> Files encrypted with rclone were actually plaintext for about a year: It had a severe weakness yes, but it was not plaintext. From the CVE : "dictionary of all possible passwords with about 38 million entries per password length". For an attacker to attempt to break the encryption, they also still need to defeat the cloud providers security measures like 2FA. > Cryptomator takes encryption from Java library. I don’t know the quality of this ecosystem. Considering that it's used by banks/goverments, i'd say that it's probably either full of backdoors, or at least somewhat OK :) > With cloud, you need to clarify if the provider and governments are in your model or not. I have no illusion that i can keep encrypted files out of government hands, or any other sufficiently motivated attacker. One could argue that the data might even be better protected in the cloud than in my home. Also : https://xkcd.com/538/ https://xkcd.com/538/ If storing illegal content is "your thing", you'd be better off looking for other solutions. My personal needs are storing maybe not generally sensitive files, but files i consider sensitive, like photos of my family, tax documents, etc. It's all files that would probably not make much of an impact if they were public available, but i prefer keeping them private. The thing about encryption is that if you don't trust it, it doesn't make much sense using it at all. That goes for both cloud and private. The threat vectors are different, but one could argue that a datacenter network is probably better protected than the average users Zyxel/Netgear/whatever router that probably has about a dozen unpatched CVEs, along with an ISP "backdoor" if supplied by the ISP.