4 ms·

MEGA could be the only cloud storage I'd actually start trusting. I don't use Dropbox, I don't use Google Drive or anything else, because I'm not interested in

by WA 14y ago

MEGA could be the only cloud storage I'd actually start trusting. I don't use Dropbox, I don't use Google Drive or anything else, because I'm not interested in other people being able to peep at my data. While I don't perceive Dotcom as a trustable character, his incentive to NOT store any encryption keys on the servers is much higher than any of his competitors.

batgaijin 14y ago
But Dropbox is a YC company. Why do you need the assurance of some fancy acronym like AES?
- algorias 14y ago
  Is a fancy acronym like YC any better? I would trust the founders not to look at private data, but any company that has employees is vulnerable to one of them going rogue.
  - WA 14y ago
    Exactly. In addition: If on court order someone wants to access my data in the cloud, even (or especially) a YC company will follow the order. The only protection against that is that the cloud storage provider doesn't have the encryption keys.
- racbart 14y ago
  YC doesn't control Dropbox. Whatever trust you have in a minor shareholder, it shouldn't translate to trust for the company. There are other reasons as well: potential vulnerabilities in their software, malicious/crazy/corrupted employees, etc. Healthy need-to-know rule is enough to decide that if there's no reason your cloud provider should have access to your data, he shouldn't have it.
- TheEskimo 14y ago
  I do hope this is a joke. "some fancy acronym like AES"... I can't tell if this is a failed attempt to be funny through saying something so ridiculously stupid or if you're serious. There are lots of acronyms that are BS, but AES isn't one of them. It's mathematically backed and has been thoroughly tested to be strong. Dropbox being a YC company means absolutely zero other than that YC liked their idea and supported them. That doesn't give me any assurance that they won't make a mistake or that an employee won't sell my data. In fact, Dropbox, despite being a YC company, already slipped up majorly once to the point that every account was completely passwordless. You could just type in random emails at the web login and view some stranger's files. Story here: http://techcrunch.com/2011/06/20/dropbox-security-bug-made-passwords-optional-for-four-hours/ http://techcrunch.com/2011/06/20/dropbox-security-bug-made-p... On the other hand, AES has yet to slip up. My AES encrypted data will take a significant fraction of the life of the universe to crack and, YC or no, a single programmer error won't break it.
  - chops 14y ago
    Pretty sure it was a joke.
- sp332 14y ago
  Funny, but for those who don't get the joke https://news.ycombinator.com/item?id=5059806 https://news.ycombinator.com/item?id=5059806
DanBC 14y ago
You're not tempted by Tarsnap? Wuala claim to be unable to access your files (https://www.wuala.com/en/learn/technology https://www.wuala.com/en/learn/technology) (but who knows if they're lying?)
- jiggy2011 14y ago
  According to the site "Wuala protects your privacy: In stark contrast to most other cloud storage services, all your files get encrypted on your computer, so that no one - including the employees at Wuala and LaCie - can access your private files. Your password never leaves your computer."
  - SageRaven 14y ago
    I think Hushmail made the same claims, until compelled by law enforcement to send altered client software to the machines of suspects. Not sure how these other companies operate, but unless the user hand-encrypts files with openssl, gpg, pgp, etc., then the trusted client software has the potential to be a vector for compromise.
neumann_alfred 14y ago
As long as a limit of 2GB is okay for you, you can have both the privacy and the "trustability": https://spideroak.com/faq/category/privacy__passwords/ https://spideroak.com/faq/category/privacy__passwords/
- TheEskimo 14y ago
  They also give you +1GB per referral which is quite big. It's a little unethical, but you could invite yourself a couple times to double the storage space. Or get actual referrals.
TheEskimo 14y ago
Use SpiderOak[0] then. They assure strong zero-knowledge privacy and, while the client isn't technically open source, much of it is completely unobfuscated python. I definitely trust SpiderOak with my data. It also has more features than Dropbox or Drive... You can set syncs as between a subset of all devices, create an arbitrary number of syncs, and create some backups which aren't syncs too. It's quite nice. Another service which is open source is Tarsnap[1]. It doesn't do syncing or have a free tier, but it's definitely trustable online storage. In both of these cases the encryption keys are not on the servers. An additional provider which claims to offer cloud storage/backup with zero-knowledge is Crashplan[3]. I wouldn't trust them as much as either of the previous options, but I still think they're telling the truth. I note it partly because I really like their approach. You can a) let them keep the key and thus you can still reset your password etc, b) let them keep the key so you don't have to transfer it manually to all crashplan-using computers, but have it encrypted on their end with a password only you know (can't be reset), or c) provide your own key which they claim they'll never know. These three tiers make sense and at each one you sacrifice some usability (such as the web-interface being unusable at (c) I think) in exchange for security. So yeah, dropbox and google drive are both obviously able to look at your data, but that doesn't preclude using other cloud storage providers. There's many that are trustworthy and have the code to prove it. In the case of Mega, I'd trust them less than the typical one. They're big enough that the government will notice them... they'll need to make it usable (allow password resets etc), it looks like you upload unencrypted data and then they encrypt it server-side (edit: turns out it's client side javascript encryption. Downside there is it'll probably be a bit slow)... All of these are problems. If it's not sent already encrypted with a key they've never touched then the government could court-order them to alter the software to store unencrypted copies or to keep encryption keys. Since they're the one giving you the key they obviously know it at some point, however briefly, and they are thus vulnerable. Forcing users to generate and supply keys just isn't user-friendly on a web-only application. The only way you can make that work, as SpiderOak did, is have the user download an application which seamlessly does all the crypto work. [0]: https://spideroak.com/ https://spideroak.com/ [1]: https://www.tarsnap.com/ https://www.tarsnap.com/ [2]: http://support.crashplan.com/doku.php/articles/encryption_key http://support.crashplan.com/doku.php/articles/encryption_ke...
- 14y ago

by WA 14y ago

batgaijin 14y ago

But Dropbox is a YC company. Why do you need the assurance of some fancy acronym like AES?

algorias 14y ago
Is a fancy acronym like YC any better? I would trust the founders not to look at private data, but any company that has employees is vulnerable to one of them going rogue.
- WA 14y ago
  Exactly. In addition: If on court order someone wants to access my data in the cloud, even (or especially) a YC company will follow the order. The only protection against that is that the cloud storage provider doesn't have the encryption keys.
racbart 14y ago
YC doesn't control Dropbox. Whatever trust you have in a minor shareholder, it shouldn't translate to trust for the company. There are other reasons as well: potential vulnerabilities in their software, malicious/crazy/corrupted employees, etc. Healthy need-to-know rule is enough to decide that if there's no reason your cloud provider should have access to your data, he shouldn't have it.
TheEskimo 14y ago
I do hope this is a joke. "some fancy acronym like AES"... I can't tell if this is a failed attempt to be funny through saying something so ridiculously stupid or if you're serious. There are lots of acronyms that are BS, but AES isn't one of them. It's mathematically backed and has been thoroughly tested to be strong. Dropbox being a YC company means absolutely zero other than that YC liked their idea and supported them. That doesn't give me any assurance that they won't make a mistake or that an employee won't sell my data. In fact, Dropbox, despite being a YC company, already slipped up majorly once to the point that every account was completely passwordless. You could just type in random emails at the web login and view some stranger's files. Story here: http://techcrunch.com/2011/06/20/dropbox-security-bug-made-passwords-optional-for-four-hours/ http://techcrunch.com/2011/06/20/dropbox-security-bug-made-p... On the other hand, AES has yet to slip up. My AES encrypted data will take a significant fraction of the life of the universe to crack and, YC or no, a single programmer error won't break it.
- chops 14y ago
  Pretty sure it was a joke.
sp332 14y ago
Funny, but for those who don't get the joke https://news.ycombinator.com/item?id=5059806 https://news.ycombinator.com/item?id=5059806

DanBC 14y ago

You're not tempted by Tarsnap? Wuala claim to be unable to access your files (https://www.wuala.com/en/learn/technology https://www.wuala.com/en/learn/technology) (but who knows if they're lying?)

jiggy2011 14y ago
According to the site "Wuala protects your privacy: In stark contrast to most other cloud storage services, all your files get encrypted on your computer, so that no one - including the employees at Wuala and LaCie - can access your private files. Your password never leaves your computer."
- SageRaven 14y ago
  I think Hushmail made the same claims, until compelled by law enforcement to send altered client software to the machines of suspects. Not sure how these other companies operate, but unless the user hand-encrypts files with openssl, gpg, pgp, etc., then the trusted client software has the potential to be a vector for compromise.

neumann_alfred 14y ago

As long as a limit of 2GB is okay for you, you can have both the privacy and the "trustability": https://spideroak.com/faq/category/privacy__passwords/ https://spideroak.com/faq/category/privacy__passwords/

TheEskimo 14y ago
They also give you +1GB per referral which is quite big. It's a little unethical, but you could invite yourself a couple times to double the storage space. Or get actual referrals.

TheEskimo 14y ago

Use SpiderOak[0] then. They assure strong zero-knowledge privacy and, while the client isn't technically open source, much of it is completely unobfuscated python. I definitely trust SpiderOak with my data. It also has more features than Dropbox or Drive... You can set syncs as between a subset of all devices, create an arbitrary number of syncs, and create some backups which aren't syncs too. It's quite nice. Another service which is open source is Tarsnap[1]. It doesn't do syncing or have a free tier, but it's definitely trustable online storage. In both of these cases the encryption keys are not on the servers. An additional provider which claims to offer cloud storage/backup with zero-knowledge is Crashplan[3]. I wouldn't trust them as much as either of the previous options, but I still think they're telling the truth. I note it partly because I really like their approach. You can a) let them keep the key and thus you can still reset your password etc, b) let them keep the key so you don't have to transfer it manually to all crashplan-using computers, but have it encrypted on their end with a password only you know (can't be reset), or c) provide your own key which they claim they'll never know. These three tiers make sense and at each one you sacrifice some usability (such as the web-interface being unusable at (c) I think) in exchange for security. So yeah, dropbox and google drive are both obviously able to look at your data, but that doesn't preclude using other cloud storage providers. There's many that are trustworthy and have the code to prove it. In the case of Mega, I'd trust them less than the typical one. They're big enough that the government will notice them... they'll need to make it usable (allow password resets etc), it looks like you upload unencrypted data and then they encrypt it server-side (edit: turns out it's client side javascript encryption. Downside there is it'll probably be a bit slow)... All of these are problems. If it's not sent already encrypted with a key they've never touched then the government could court-order them to alter the software to store unencrypted copies or to keep encryption keys. Since they're the one giving you the key they obviously know it at some point, however briefly, and they are thus vulnerable. Forcing users to generate and supply keys just isn't user-friendly on a web-only application. The only way you can make that work, as SpiderOak did, is have the user download an application which seamlessly does all the crypto work. [0]: https://spideroak.com/ https://spideroak.com/ [1]: https://www.tarsnap.com/ https://www.tarsnap.com/ [2]: http://support.crashplan.com/doku.php/articles/encryption_key http://support.crashplan.com/doku.php/articles/encryption_ke...

14y ago