7 ms·
Dropbox acquires Boxcryptor assets to bring zero-knowledge encryption to storage
- aborsy 4y agoAnother article https://techcrunch.com/2022/11/29/dropbox-acquires-boxcryptor-assets-to-bring-zero-knowledge-encryption-to-file-storage/ https://techcrunch.com/2022/11/29/dropbox-acquires-boxcrypto... Dropbox announcement: https://blog.dropbox.com/topics/company/dropbox-to-acquire-boxcryptor-assets-bring-end-to-end-encryption-to-business-users https://blog.dropbox.com/topics/company/dropbox-to-acquire-b... Looks like Dropbox plans to provide client side encryption, although somewhat belatedly.
- barbazoo 4y ago> client side encryption to business users
- namkt 4y agoEncryption is not for the poor.
- barbazoo 4y agoThe way I interpreted it was that it won't even apply to the paid "personal" plans.
- willis936 4y agoToo bad. I cancelled my dropbox sub and moved to TrueNAS Scale + Nextcloud + B2 rclone last year. Dropbox could have me back anytime they want me.
- insanitybit 4y agoThere are significant costs to encryption. Any deduplication is gone, losing a single "chunk" invalidates the entire file with no hope of recovery, and, more importantly, support costs are way higher - "I lost a password" becomes "I lost every file, I'll never recover them".
- laluser 4y agoDedeuplication is a huge cost at scale.
- insanitybit 4y agoI'm not sure what you mean. Deduplication by hash is free and exactly how Dropbox works, as I recall.
- dogma1138 4y agoDeduplication doesn’t work with client side encryption, at least not securely because it at the least exposes that the file already exists.
- insanitybit 4y agoYes, we agree.
- layer8 4y agoThe non-business plans (Plus/Family) are already not cheap, especially if you only need a fraction of the storage space.
- dang 4y agoWe've changed to the third-party article from https://www.boxcryptor.com/en/blog/post/new-chapter-with-dropbox/ https://www.boxcryptor.com/en/blog/post/new-chapter-with-dro.... Generally we prefer the best third-party article (if there is one) to a corporate press release: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=press%20release%20by%3Adang&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu....
- aborsy 4y agoThank you for the clarification. Will keep that in mind, next time!
- whatsthatabout 4y agoTime to switch to cryptomator I guess... https://cryptomator.org https://cryptomator.org
- nwellinghoff 4y agoAny idea how these guys make money?
- msh 4y agoYou have to pay for the mobile apps.
- ok_dad 4y agoThey take donations. I've donated to get a "key" for my copy of Cryptomator, but it doesn't do anything to the software, it's just there to turn off the thing that asks you to donate, I believe. I use it as the primary way to encrypt sensitive documents before cloud syncing them, so I figured it was worth a donation.
- iza 4y agogocryptfs is another option. https://nuetzlich.net/gocryptfs/ https://nuetzlich.net/gocryptfs/
- eterps 4y agoLove gocryptfs but it doesn't work well on Mac. securefs[1] works fine on both Linux & Mac. [1] https://github.com/netheril96/securefs https://github.com/netheril96/securefs
- o_____________o 4y agodo you know what advantages that has over rclone[1], which is much more popular? [1] https://github.com/rclone/rclone https://github.com/rclone/rclone
- 4y ago
- brightball 4y agoGoing to make it available on Linux?
- bironran 4y agoUgh. This “zero knowledge encryption” is NOT zpf. Just a per user PBE hiding a shared symmetric key. I kept reading, trying to find the innovative way of encrypting large amount of data while not revealing the same key to all participant - some SSS variant or fast FHE or maybe a cool new PRE. Also, all value added features besides shipping the bytes are gone when something like this is in effect. Search, preview, co-edit, metadata extraction. I guess I’m disappointed / venting because of crushed hopes. I’m in this field and hoped something new and exciting is starting. Not trying to criticize the engineering work, which looks quite well done, just sad there isn’t new algorithmic development.
- sillysaurusx 4y agoYou didn’t explain what the right answer is.
- bironran 4y agoOf course I didn’t. As I said, I was hoping for a new development.
- fullsend 4y agoWhat do you mean SSS, FHE, PRE? What would you like to see?
- abdullahkhalids 4y agoSSS: Shamir Secret Sharing FHE: Fully Homomorphic Encryption
- bironran 4y agoPRE - proxy (blind) re-encryption. All of these are true “zero knowledge” methods that don’t require the encryption key to be shared, and therefore be granted irrevocably.
- TJSomething 4y ago
- jqpabc123 4y agoI have a dead simple backup plan that is basically free. All my essential, must have info is stored on two 128GB microSD cards. One lives in a safe at home. The other I strap to my wrist. The cards are encrypted with BitLocker. A few trusted others have the decrypt/safe key. The data is as safe as I am --- if not safer. If something does go bump in the night, all I have to worry about is my own personal safety. Even if I die unexpectedly in an accident, search and rescue will still likely deliver the data to my next of kin. Let's face it --- no one is going to organize a search party if your on-line backup suddenly disappears or is being held hostage for "egress fees".
- akmarinov 4y agoWhy though? What data?
- hef19898 4y agoNot OP, but I have multiple back-ups of things like mortgages, employment confirmations, what passes as letters of recommendation in Germany, educational certifications and diplomas, some other legal stuff thay moght be important and of course all documents from the comoanies I had / have. I do use USB sticks so.
- mosselman 4y agoA SaaS feature backlog of course
- jqpabc123 4y agoIf you have to ask that question, you probably don't need a backup. Photos, last will and testament, legal documents, bank/accounting/tax info, photocopies of birth certificate/passport/diplomas, source code, login/access credentials, crypto keys, etc., etc.. All the same stuff that people like to use on-line backup for.
- akmarinov 4y agoAside from photos/crypto keys, all the other ones are easily replaceable within 2 weeks, at least in my not-the-US country. Source code would be only for any personal projects, as companies usually don’t let you backup their code. And none of these make sense to have on your wrist 24/7.
- whitepoplar 4y agoGreat news. Users have been wanting this for years.
- xnx 4y agoIs encryption so special it requires an acquisition to implement? I figured it was just slightly more complicated than compression.
- anaganisk 4y agoWhy to reinvent the wheel and investing significant amount of money, resources and audits when it can be brought for cheaper.
- super256 4y agoI think this acquisition is mostly because Boxcryptor is somewhat established in the German space and because Boxcryptor has been working together with Dropbox for a long time (since 2016).
- layer8 4y agoIt becomes more complicated in terms of key management if you want to enable sharing of encrypted files with other accounts, like Boxcryptor allows.
- throwaway82028 4y agoIf hashes weren't illegal, cloud storage providers could probably save millions by deduplicating pirated content.
- nosefrog 4y agoWhat makes you think Dropbox doesn't deduplicate data?
- throwaway82028 4y agoBecause if the data is encrypted as suggested here, then the hashes wouldn't match and the content won't be de-duplicated.
- Genbox 4y agoData encryption can be decoupled from key encryption. Let's say I hash the content of a file, encrypt the file with its own hash, and then encrypt the hash with the user's password. This way you can have deduplication of data, and only an attacker that knows the content of the file can decrypt the file, but since they already have the file, it does not matter.
- CodesInChaos 4y agoConvergent encryption without a user specific key has two weaknesses: 1. You can tell that the user posses a known file. Such as a pirated movie. This is what this thread is about. 2. If the attacker knows the file except a sufficiently small secret part, they can learn that part. https://tahoe-lafs.readthedocs.io/en/latest/convergence-secret.html https://tahoe-lafs.readthedocs.io/en/latest/convergence-secr...
- tarofchaos 4y agoYeah I was trying to find more about ZKP but seems like it’s lord of a marketing gimmick than anything else. On a different note, still don’t understand why did Dropbox buy them,as the tech seems to be pretty basic. May be I’m missing something here.
- 1270018080 4y agoThis made me realize I haven't heard of any tech acquisition news in real businesses (meaning not crypto) in many months. MANGA isn't gobbling up competition to maintain their monopolies like they used to...
- kylehotchkiss 4y agoI wonder if ProtonDrive is scaring them a little. The end to end encrypted file storage market was tiny to start and now it’s getting a big name player at last. Tresorit is overpriced, Boxcryptor needed the acquisition and ProtonDrive seems small still. These products need to be available for end consumers too though not just b2B