19 ms·

Wuala: Secure Cloud Storage

278 points by greyman 13y ago

I am evaluating this cloud service since yesterday, and it looks promising so far. Since data are not stored un-encrypted on the company servers, it means that there is not a web access to files, but I am not missing this feature that much. Real-time syncing works fine, although it seems to be a bit slower comparing to Dropbox.

deleted 13y ago
[deleted]
moystard 13y ago
Despite thorough researches and testing, I have never been able to find a good alternative to Dropbox in term of seamless synchronisation of my files, and accessibility across all the platforms I use. To secure my data, I just use BoxCryptor. It creates an encrypted volume within my Dropbox. It is free for non commercial use.
- sahirh 13y ago
  Have a look at BitTorrent Sync: http://labs.bittorrent.com/experiments/sync.html http://labs.bittorrent.com/experiments/sync.html One advantage is that there's no third-party storage of data involved.
  - moystard 13y ago
    Thank you, will have a look.
- greyman 13y ago
  But how big is that volume? Shouldn't then Dropbox always upload the whole volume, even if you just made one change in one file?
  - moystard 13y ago
    The volume is as big as the data it contains.
phxql 13y ago
Problem with Wuala is that you can't access your data when you are offline, unlike DropBox, which stores an unencrypted version on your harddisk.
gasull 13y ago
What about EncFS (or some other encryption) + Bittorrent Sync?
lazyjones 13y ago
Wuala is great, but the short summary is a bit misleading. There is a real risk of government agencies forcing LaCie to push you a client update that removes encryption, in an older version of their T&C / product info, this was mentioned explicitly.
- Toshio 13y ago
  I also don't buy the whole premise of US government - bad, EU governments - good. When push comes to shove, governments everywhere will have no qualms about invading people's privacies en masse. Human nature is the same everywhere. Power corrupts everywhere.
  - ff10 13y ago
    Switzerland is a non-EU country. Switzerland has a long tradition of civil liberties, rights and participation. This results in regular legally binding referendums on the one side and tax evasions from civilians of other countries on the other.
    - simgidacav 13y ago
      The fact that they have been "good guys" until now doesn't say anything about the fact that they will be "good guys" forever.
      - ff10 13y ago
        This applies to good guys all over the world since ever. Btw, I did not state anywhere that I consider Switzerland as being the good guys. Applying qualities of character to a state is misleading IMHO.
    - VexXtreme 13y ago
      Like the time when Swiss banks conveniently decided to forget their tradition of "civil liberties and rights" and en masse turned over their clients confidential personal information and financial records to the US authorities? They've already acted like America's little bitch once, what makes you think they're not going to do the same again?
quchen 13y ago
Sounds cool! I've been looking for a trustable Dropbox alternative so I don't have to manually encrypt the contents all the time. I'll download and try it out real q- > Make sure Java [...] is installed. :C
- kermorvan 13y ago
  Well if that don't seal the deal!
- levosmetalo 13y ago
  I've been using it for almost a year now on my Windows, Linux and Android. Didn't have any issues so far. I would recommend the service to everyone concerned with privacy. The only thing that one can be suspicious is whether they are transferring your key or not. But, at least they claim your data is safe and encrypted, while Dropbox, GDrive and similar services don't even pretend that they encrypt your data. However, would still love to see an open source product like this that I can truly trust.
  - datagramm 13y ago
    >> don't even pretend that they encrypt your data. would it make you happier if they kept their services the same, but just pretended to introduce encryption? ;-)
    - levosmetalo 13y ago
      >> don't even pretend that they encrypt your data. > would it make you happier if they kept their services the same, but just pretended to introduce encryption? ;-) No it wouldn't. What I wanted to say is that Wuala at least claims that they do client side encryption. I believe them, but someone else doesn't have to. So, data being safe with Wuala has probability between 0-100%, while data being safe with Dropbox has probability of 0.
- noinsight 13y ago
  I'm surprised that there isn't a "cloud encryption" software available yet. It shouldn't be a complex project to encrypt & rename -> upload // download -> decrypt & rename. You could store the original file names in the cloud in an encrypted sqlite database or something.
paullik 13y ago
5GB Free. Awesome!
josephagoss 13y ago
It requires Java?
- joosters 13y ago
  Yes, just installed and then immediately uninstalled after I got the 'install java' prompt :( It's not Wuala's fault, but forcing me to put java back on my desktop is a big hurdle. It's going to take an absolutely amazing piece of software to make me deal with that horrendous bug-ridden security hole again.
  - morsch 13y ago
    I don't trust the Java sandbox to protect me while running arbitrary code. So I don't use the Java browser plugin. But I don't see how the desktop runtime is a security hole (you're running binaries you trust outside a sandbox) and I very much doubt it's any more buggy than your average Python, Ruby, Node.js, etc. runtime. Or, for that matter, your average native library.
    - joosters 13y ago
      Can you (easily) install one without the other? I know I can go around my browsers and disable the plugins after an install, but then I'm going to have to do the same thing each time there's a java security update and the runtime gets upgraded. Not to mention Oracle's crappy habits of bundling toolbars & other crud along with each security patch.
simgidacav 13y ago
Not to be cynic, but what prevents those guys from putting a backdoor as well? Yeah, sure, Swiss guys are good. Are they? In the end, IMHO, the only software which can be trusted is the FOSS. From this perspective Dropbox is good: the client is open source. Of course nothing is encrypted in there.
- mcread 13y ago
  Indeed it depends on their willingness to make a backdoor, US companies don't have that luxury anymore ...
- archivator 13y ago
  From this perspective, tarsnap is even better - http://www.tarsnap.com/bugbounty.html http://www.tarsnap.com/bugbounty.html
- illumen 13y ago
  Indeed. But at least there is no proof so far that they are doing it. However, France also monitors internet/com equipment, so it is indeed possible they will be required to put in a backdoor. Still, FOSS solutions are indeed better from a security perspective.
- davidjgraph 13y ago
  A back-door in where, exactly?
  - venomsnake 13y ago
    The closed source binary blob?
    - deleted 13y ago
      [deleted]
    - simgidacav 13y ago
      Exactly, this is the point. If privacy is important for you, closed source software is not trustworthy, unless it's placed downline of encryption.
Mindphreaker 13y ago
I've been using this since the very early alpha status. It's a really nice storage solution with a very sophisticated technology too. For anyone curious about the technology behind here is an early tech talk from one of the founders. It may be a little bit outdated now but still interesting: http://www.youtube.com/watch?v=3xKZ4KGkQY8 http://www.youtube.com/watch?v=3xKZ4KGkQY8
sp8 13y ago
We've been recommending this as an alternative to Dropbox where I work (in the UK) for a few years now, for exactly the reasons given in the title text. Yes, its a shame its Java-based, but they do have clients for Windows, Mac, Linux iOS and Android. (No, I'm not connected to Wuala in any way, I don't even use the service myself, but as an alternative to Dropbox I think its a good one.)
maggit 13y ago
I recently tried replacing Dropbox with Wuala because of privacy concerns. I failed, and in the process realized how successful Dropbox has been in creating an awesome user experience! I'm still looking for a locally encrypted Dropbox-alternative. So if any of you are making one, please speak up :) (Edit) I should specify that it was the user experience that made me give up on Wuala, and any proper Dropbox alternative would need to offer at least decent user experience. Looking forward to trying the alternatives you are suggesting :)
- davidjohnstone 13y ago
  On my "somebody should create this, and I might eventually" list is an open source, P2P, optionally server-backed, encrypted Dropbox replacement. Bittorrent's Sync almost gets there, but isn't open source. I haven't really looked at it, but ownCloud might do what I want.
  - ekianjo 13y ago
    I heard ownsync is really buggy. Havent tried it though.
  - simgidacav 13y ago
    +1. I'd like to know more about this. Working on a encrypted FOSS alternative to conventional storage would totally be a perfect side project
  - ondmagi 13y ago
    The ownCloud sync client for OS X pins one cpu core to 100% usage on my fairly new i7 mbp, which effectively drains the battery quite quickly if you don't notice. Then it also seems to do a full scan of teh entire folder each time it sync's, if you then have for example your iPhoto library (usually a few GBs) there, the sync process will consume lots of CPU and tend to be out of date across devices.
  - cuu508 13y ago
    Wuala used to be P2P (host other people's files to get more space for your files) until LaCie bought it.
gahahaha 13y ago
"""Do you plan to open the source code? Currently not. Opening the source code of Wuala would consume quite some time and effort, and commitment to maintain it. If you are a software engineer and would like to see how Wuala works, feel free to apply for a job at Wuala.""" ಠ_ಠ So.. an alternative, but not the solution we need.
- venomsnake 13y ago
  Don't open source it. Just give read and build for personal use permission. That should be enough. I don't think that I will be able to trust secure trough obscurity solution.
  - pgeorgi 13y ago
    Or open up the protocol, for independent client implementations. With client-side crypto, the server doesn't matter much.
- Toshio 13y ago
  > "If you are a software engineer and would like to see how Wuala works, feel free to apply for a job at Wuala." A non-answer if I've ever seen one. What about someone who applies for a job at Wuala, gets rejected, but still wants to look at the source code?
  - pablasso 13y ago
    And that's the only use case that bothers you?
    - stcredzero 13y ago
      You only need one counter example to poke a hole in a position.
- shin_lao 13y ago
  And what would having the source code change? Unless you host the data yourself, if you don't trust Wuala there is no guarantee the binaries you use are built from the source code you have.
pellias 13y ago
Floodgate is opening up just like when Google shutdown it's reader. Let's see who will be the winner.
sabret00the 13y ago
It's from Lacie, so no thank you. I bought a Lacie drive and proceeded to copy all my stuff onto it. Before I could get comfortable with it (so within the first six months of purchase) and before I backed up my stuff, the drive failed. I contacted Lacie about it and they proceeded to try and sell me a service whereby they'd recover my data for €300. That would've brought my total spend on the drive up to around £400. I begged and pleaded with them, pointed out how unsavoury such a business practice was and all to no avail. The drive has just been sitting down since with the data unrecovered. Personal memories, music, films and professional data too. I've tried to recover the data but that didn't work and I honestly feel ripped off. As a result, I've vowed to never do business with Lacie again and to warn everyone of how unscrupulous they are. Beware of Lacie and their subsidiaries.
- amouat 13y ago
  Well, they should have replaced the drive if it failed within 6 months. But expecting them to go to the lengths of recovering your data for free is a bit hopeful.
  - sabret00the 13y ago
    Hopeful yes, but no one expects a drive failure before even half of the warranty has expired surely?
    - delackner 13y ago
      The whole point of backups is that you should never expect a single hard drive to stay alive, no matter how young it is. Lots of hard drives with defects die early. For your own sanity, it is best to think of any data you have only one physical copy of as data that may not be there tomorrow. Personally I don't get comfortable until my most important data exists in two physical locations, so fire is not a risk.
- tekacs 13y ago
  It's very pointedly not their obligation (nor even standard practice for any drive company) to go through the expensive process of recovering your data for you for free. Taking backups is your own problem and responsibility. They should have offered to replace your drive, but no more. Hardly unscrupulousness.
joewee 13y ago
How about Dropbox + TrueCrypt + Automount? Files are decrypted in memory, files you need to share you can keep in unencrypted format.
- greyman 13y ago
  I was thinking about this solution, and I also have a truecrypt drive (locally). But if you changed just one file in the truecrypted drive, shouldn't then Dropbox re-sync the whole encrypted drive?
  - squidi 13y ago
    Yes, that's correct. So if you have a 1GB TrueCrypt container the whole thing needs to be uploaded again. Another annoyance is that you cannot change the size of a drive after you create it [1] and it doesn't shrink to fit the data either. [1] http://www.truecrypt.org/docs/?s=issues-and-limitations http://www.truecrypt.org/docs/?s=issues-and-limitations
- quchen 13y ago
  I've been doing this with a small volume (1 MiB), but it always kept me wondering how much traffic a minor change in an encrypted volume causes - even a single bit flip should drastically change the container if the encryption is good. I wouldn't want to upload for an hour each time I see a typo in my files.
  - lawl 13y ago
    No. From the truecrypt FAQ [0]: > The ciphertext block size used by TrueCrypt is 16 bytes (i.e., 128 bits). Meaning one bitflip should only sync 16 bytes since dropbox only transmits deltas. Of course this now depends on dropbox' delta sync implementation. From a quick google search [1]: > For what it's worth, Dropbox claims to create hashes on every 4MB of each file. That way, if you change a contiguous 2MB of a 100MB file, it will likely only need to upload 4MB (or 8MB if you cross into a second 4MB block) to re-sync the file. So worst case if a bitflip happens to change a truecrypt block that doesn't align with dropbox' chunks you're looking at around 8MiB. That's still quite an amout for a bitflip but i think it's feasible with todays connection speeds. [0] http://www.truecrypt.org/faq http://www.truecrypt.org/faq [1] http://serverfault.com/questions/52861/how-does-dropbox-version-upload-large-files http://serverfault.com/questions/52861/how-does-dropbox-vers...
gtt 13y ago
I'm not a security expert neither do I understand cryptography hence the question: I assume they are not using the original password to encrypt data. They are generating a symmetric encryption key and encrypt it with the original password, storing it along with the encrypted data on their servers. The question is how secure the encryption on symmetric key? What if it is easily brutfocable?
solnyshok 13y ago
I used Wuala for couple of years, when it was free and allowed earning a much larger quota by sharing own drive space to host other user's data. I used it to keep around 100GB of my personal data. Used to be good while it lasted. Encrypted, distributed, redundant. Then LaCie bought it and turned it into a Dropbox clone. Now I use AeroFS, also tried TorrentSync. Both a roughly equal. I just felt lazy changing from already running and tuned AeroFS to anything else. If you have 24x7 homeserver at home it is very hard to justify paying for storage at dropbox or skydrive or google. I built my homeserver on the latest Atom, so it is frugal (~10W) and completely silent (no fan, SSD). It's dualcore 2.1GHz and has enough grunt for simultaneous NAS, torrents, and plays 1080p mkv to the attached TV. No place for Wuala in this arrangement anymore.
- pacomerh 13y ago
  It's still free, I don't pay a dime.
  - solnyshok 13y ago
    how much storage you've got there?
ergest 13y ago
Way to be opportunistic!
Keyframe 13y ago
Company may be in Europe, servers might be in Europe, you might be in Europe. Nothing guarantees you that your data won't be routed through US where it can be tapped into. That's the primary issue for me with the whole PRISM scandal.
- VexXtreme 13y ago
  Data is encrypted client-side before being sent so I believe this is a non-issue.
  - quchen 13y ago
    It's a very non-non-issue: the client is closed source, for all we know it could do anything. Even if you listen on the data output to verify it's indeed encrypted, you still aren't able to tell whether your private key isn't transmitted alongside. This isn't security, it's security by obscurity - in the best case, mind you.
  - Keyframe 13y ago
    Data being encrypted doesn't mean it can't be archived in that Utah data center. What capabilities they have there and what they do with it, we don't know. Substantial decryption breakthrough was hinted at in several reports, but what it is exactly - we have no idea.
    - nodata 13y ago
      Client side encryption is enormously better than no client side encryption.
    - gtt 13y ago
      >> Substantial decryption breakthrough was hinted at in several reports, but what it is exactly - we have no idea. Could you provide a link to those hints, please?
      - Keyframe 13y ago
danso 13y ago
So honest question, but how is having your data stored in Switzerland (where Wuala is based) any different than having it in the US? Or is it just the promise of local encryption that makes it safer? Some purported info about data protection for Switzerland: http://www.dataprotection.ch/en/disclosing-personal-data.asp http://www.dataprotection.ch/en/disclosing-personal-data.asp > Restrictions on disclosure The DPA does not permit the disclosure of sensitive data or personality profiles to third parties without lawful justification. The consent of the data subject can constitute a lawful justification. Breach of this prohibition is an offence if knowledge of the sensitive data has been gathered in the course of a professional activity requiring knowledge of such data and can be punished by a fine of up to CHF 10'000.--. If the fine is not paid, it can be replaced by imprisonment for up to 3 months. And Wuala's own policy: http://www.wuala.com/en/about/privacy http://www.wuala.com/en/about/privacy > 6. Disclosure to third parties Basically, your data is not transmitted to third parties. However, LaCie may release personal data if the law requires it to do so or in the good-faith belief that such action is necessary to comply with any laws or respond to a court order, subpoena, or search warrant or to protect LaCie's rights and interests. Furthermore, you expressly agree that LaCie can disclose personal data to identified third parties (e.g. owners of intellectual property rights) and/or government enforcement bodies in order to enforce the General terms and conditions, particularly in case of founded indications that the laws or the rights of a user or of third parties, particularly copyrights, other industrial property rights or personal rights, have been violated , insofar as such is necessary.
- wcunning 13y ago
  Due to the manner in which data is client-side encrypted (password-based keys, password not stored on their servers), they can hand your (encrypted) data to any government with no ability to decrypt it. Now, depending on the outcome of some cases before US Courts right now, you might be compelled to provide the password to unencrypt the data. It's also worth noting that the password-based asymmetric encryption schemes are less secure than the arbitrary key based ones, but still it's better than nothing. In my case, I'm sold by the fact that they provide more free storage than Dropbox and have a much better Linux client (based on a FUSE plugin, a much nicer architecture in general).
mixnovich 13y ago
Funny how the "Wuala" solution came out just after the PRISM leak in the US.
penetrarthur 13y ago
Wuala is terrible. It is constantly eating up 30% of cpu when idling. Sometimes it doesn't sync at all for a few days. There is a "Use LAN" feature, but it doesn't work.
deleted 13y ago
[deleted]
skarmklart 13y ago
How does this compare to Tarsnap?
znowi 13y ago
Or use BitTorrent Sync instead. I'm quite pleased with it and moved all my data off Dropbox. http://labs.bittorrent.com/experiments/sync.html http://labs.bittorrent.com/experiments/sync.html
- qznc 13y ago
  Not Open Source either.
iHypnos 13y ago
Hello there, Gianluca from Wuala here. First, this is how Wuala works: You as an user place a file in the client. The file gets encrypted (including using your password and username) and then gets uploaded and split into different pieces. We are currently using AES-256 for encryption (and RSA 2048 fpr signature and key exchange when sharing a folder and SHA-256 for integrity checks). The password does NOT get transmitted and there is nothing like a master key or similar. That means in worst ever case if someone would have access to our servers somehow, they'd get a piece of encrypted data which is not readable and not decryptable (not even for us as the provider. Secondly, some people tend to confuse security with anonymity. Wuala is secure, but how about anonymity? We have your email address, your username and we know how much storage space you have. As you see, that is not anonymous, but has nothing to do with the security of your files. Are we planning to open source the code? Eventually yes, but as we already stated, this takes a lot of time and effort. Oh and yes, we are nice guys. Not because we're Swiss, but in general :)
- nodata 13y ago
  Are you planning on allowing camera upload? I can't get people using your product without it...
  - iHypnos 13y ago
    we are planning camera upload yes :)
- jasonzemos 13y ago
  Hey Gianluca, I was under the impression the latest major revision of Wuala removed all distribution features, so files are no longer split into difference pieces. Instead they are now stored on your central servers.
  - iHypnos 13y ago
    No. We split our files and store them redundantly in our datacenters in Switzerland, France and Germany.
- 13y ago
strobe 13y ago
another dropbox alternative https://github.com/haiwen/seafile https://github.com/haiwen/seafile on you own servers
workhere-io 13y ago
There's also Jottacloud (http://www.jottacloud.com/ http://www.jottacloud.com/), a Norwegian Dropbox alternative.
- tomelders 13y ago
  Interesting. Anyone got any experience with Jottacloud they wouldn't mind sharing?
kijin 13y ago
Seriously? Wuala is a service run by LaCie. LaCie is owned by Seagate, an American corporation. It doesn't matter where the servers are, because all the important decisions will be made in Cupertino, California. http://www.lacie.com/us/company/news/news.htm?id=10722 http://www.lacie.com/us/company/news/news.htm?id=10722 Now, client-side encryption is a much more interesting aspect of their service, but is it worth the trouble if Wuala's clunky client takes 100 times longer than Dropbox to sync a file between two devices? Ditto for SpiderOak, JungleDisk, and every other backup/sync solution that I've used so far that boasts client-side encryption. And it wasn't due to Dropbox's deduplication, either. Some of them just talked lazily with the server for several minutes before they even started to upload/download any files.
- sillysaurus 13y ago
  Why not just store a TrueCrypt volume(s) in Dropbox?
  - cddotdotslash 13y ago
    Because, as far as I know (I haven't used TrueCrypt too much), it will see the volume as a file and then you'll be syncing a huge, x GB file every time you make the smallest change within it.
    - olov 13y ago
      That's not true. Dropbox uses librsync so small changes of big files yields small diffs, thus TrueCrypt volumes work just fine with Dropbox.
      - missing_cipher 13y ago
        Speaking out of ignorance here: But aren't TrueCrypt volumes completely changed when you add/remove something? I'm thinking similarly to a hash: The slightest modification changes it completely.
        13y ago
VuongN 13y ago
The problem here is: the people who has data (Wuala) also determine how the files are encrypted. No box is ever unbreakable, however, the chance of breaking it is much bigger if you have the locksmith holding on to the box. I've talked a little bit about this in my humble blog post not too long ago about a simplistic view of security in the cloud: http://vuongnguyen.com/personal-business-cloud-security.html http://vuongnguyen.com/personal-business-cloud-security.html. -V.
OnlyHave2Cores 13y ago
There released an interesting paper regarding their key managment for multiple users, when they were a reserach project at the ETH. Cryptree: A folder tree structure for cryptographic file systems - http://boga.googlecode.com/svn/trunk/res/Docs/wuala-cryptree.pdf http://boga.googlecode.com/svn/trunk/res/Docs/wuala-cryptree...
jellicle 13y ago
For what it's worth, what you need is: -- a company with no connections to the United States. Ideally, it should be privately owned by a foreign individual known for strong privacy views and who has promised never to sell. -- local encryption -- open source ("trust but verify") -- actually works Wuala, from the comments here, meets only one of those four requirements.
- donatzsky 13y ago
  Uh, just one? The way I count it's 2.5 out of 4. It's a Swiss company, owned by LaCie (French) which is again owned by Seagate (US). So I would say that's half a point. Data is en-/decrypted locally. There's a reason they don't have a web interface, but require you to use the client. It's indeed not open source. Would be nice if it was. And it actually does work. There's room for improvement (isn't there always?), but in my experience it's working well.
adrinavarro 13y ago
Another alternative is hubiC. It's run by OVH, perhaps one of the most "techno-geek" companies in Europe that you can find… I don't see them feeding content to governments without any reason. In fact, they opened a DC in Canada and not the U.S. and one can guess why.
- andor 13y ago
  In fact, they opened a DC in Canada and not the U.S. and one can guess why. Because it's culturally closer, I'd guess. OVH is a French company, and their Canadian data center is just outside of Montreal.
deleted 13y ago
[deleted]
- chilgart 13y ago
  [citation needed]
  - deleted 13y ago
    [deleted]
  - deleted 13y ago
    [deleted]
lettergram 13y ago
Yeah, i'm sure the French would never have access to the servers in their country...
rsync 13y ago
rsync.net. Zurich, Hong Kong. Warrant Canary[1]. Straight up unix filesystem (ZFS) so you can point duplicity[2] (or anything else) at it. If you need something like dropbox, we are NOT for you. We have special rates for HN folks. Email us. [1] http://www.rsync.net/resources/notices/canary.txt http://www.rsync.net/resources/notices/canary.txt [2] http://duplicity.nongnu.org/ http://duplicity.nongnu.org/
gasull 13y ago
EncFS + Dropbox Although this won't help if you get a rootkit in an update, since the source is closed.
Splendor 13y ago
Regardless of the service's value I found the security explanation on this page (https://www.wuala.com/en/learn/technology https://www.wuala.com/en/learn/technology) to be a great example of clear communication about the differences between client-side encryption, SSL security, etc.
deleted 13y ago
[deleted]

278 points by greyman 13y ago

deleted 13y ago

[deleted]

moystard 13y ago

Despite thorough researches and testing, I have never been able to find a good alternative to Dropbox in term of seamless synchronisation of my files, and accessibility across all the platforms I use. To secure my data, I just use BoxCryptor. It creates an encrypted volume within my Dropbox. It is free for non commercial use.

sahirh 13y ago
Have a look at BitTorrent Sync: http://labs.bittorrent.com/experiments/sync.html http://labs.bittorrent.com/experiments/sync.html One advantage is that there's no third-party storage of data involved.
- moystard 13y ago
  Thank you, will have a look.
greyman 13y ago
But how big is that volume? Shouldn't then Dropbox always upload the whole volume, even if you just made one change in one file?
- moystard 13y ago
  The volume is as big as the data it contains.

phxql 13y ago

Problem with Wuala is that you can't access your data when you are offline, unlike DropBox, which stores an unencrypted version on your harddisk.

gasull 13y ago

What about EncFS (or some other encryption) + Bittorrent Sync?

lazyjones 13y ago

Wuala is great, but the short summary is a bit misleading. There is a real risk of government agencies forcing LaCie to push you a client update that removes encryption, in an older version of their T&C / product info, this was mentioned explicitly.

Toshio 13y ago
I also don't buy the whole premise of US government - bad, EU governments - good. When push comes to shove, governments everywhere will have no qualms about invading people's privacies en masse. Human nature is the same everywhere. Power corrupts everywhere.
- ff10 13y ago
  Switzerland is a non-EU country. Switzerland has a long tradition of civil liberties, rights and participation. This results in regular legally binding referendums on the one side and tax evasions from civilians of other countries on the other.
  - simgidacav 13y ago
    The fact that they have been "good guys" until now doesn't say anything about the fact that they will be "good guys" forever.
    - ff10 13y ago
      This applies to good guys all over the world since ever. Btw, I did not state anywhere that I consider Switzerland as being the good guys. Applying qualities of character to a state is misleading IMHO.
  - VexXtreme 13y ago
    Like the time when Swiss banks conveniently decided to forget their tradition of "civil liberties and rights" and en masse turned over their clients confidential personal information and financial records to the US authorities? They've already acted like America's little bitch once, what makes you think they're not going to do the same again?

quchen 13y ago

Sounds cool! I've been looking for a trustable Dropbox alternative so I don't have to manually encrypt the contents all the time. I'll download and try it out real q- > Make sure Java [...] is installed. :C

kermorvan 13y ago
Well if that don't seal the deal!
levosmetalo 13y ago
I've been using it for almost a year now on my Windows, Linux and Android. Didn't have any issues so far. I would recommend the service to everyone concerned with privacy. The only thing that one can be suspicious is whether they are transferring your key or not. But, at least they claim your data is safe and encrypted, while Dropbox, GDrive and similar services don't even pretend that they encrypt your data. However, would still love to see an open source product like this that I can truly trust.
- datagramm 13y ago
  >> don't even pretend that they encrypt your data. would it make you happier if they kept their services the same, but just pretended to introduce encryption? ;-)
  - levosmetalo 13y ago
    >> don't even pretend that they encrypt your data. > would it make you happier if they kept their services the same, but just pretended to introduce encryption? ;-) No it wouldn't. What I wanted to say is that Wuala at least claims that they do client side encryption. I believe them, but someone else doesn't have to. So, data being safe with Wuala has probability between 0-100%, while data being safe with Dropbox has probability of 0.
noinsight 13y ago
I'm surprised that there isn't a "cloud encryption" software available yet. It shouldn't be a complex project to encrypt & rename -> upload // download -> decrypt & rename. You could store the original file names in the cloud in an encrypted sqlite database or something.

paullik 13y ago

5GB Free. Awesome!

josephagoss 13y ago

It requires Java?

joosters 13y ago
Yes, just installed and then immediately uninstalled after I got the 'install java' prompt :( It's not Wuala's fault, but forcing me to put java back on my desktop is a big hurdle. It's going to take an absolutely amazing piece of software to make me deal with that horrendous bug-ridden security hole again.
- morsch 13y ago
  I don't trust the Java sandbox to protect me while running arbitrary code. So I don't use the Java browser plugin. But I don't see how the desktop runtime is a security hole (you're running binaries you trust outside a sandbox) and I very much doubt it's any more buggy than your average Python, Ruby, Node.js, etc. runtime. Or, for that matter, your average native library.
  - joosters 13y ago
    Can you (easily) install one without the other? I know I can go around my browsers and disable the plugins after an install, but then I'm going to have to do the same thing each time there's a java security update and the runtime gets upgraded. Not to mention Oracle's crappy habits of bundling toolbars & other crud along with each security patch.

simgidacav 13y ago

Not to be cynic, but what prevents those guys from putting a backdoor as well? Yeah, sure, Swiss guys are good. Are they? In the end, IMHO, the only software which can be trusted is the FOSS. From this perspective Dropbox is good: the client is open source. Of course nothing is encrypted in there.

mcread 13y ago
Indeed it depends on their willingness to make a backdoor, US companies don't have that luxury anymore ...
archivator 13y ago
From this perspective, tarsnap is even better - http://www.tarsnap.com/bugbounty.html http://www.tarsnap.com/bugbounty.html
illumen 13y ago
Indeed. But at least there is no proof so far that they are doing it. However, France also monitors internet/com equipment, so it is indeed possible they will be required to put in a backdoor. Still, FOSS solutions are indeed better from a security perspective.
davidjgraph 13y ago
A back-door in where, exactly?
- venomsnake 13y ago
  The closed source binary blob?
  - deleted 13y ago
    [deleted]
  - simgidacav 13y ago
    Exactly, this is the point. If privacy is important for you, closed source software is not trustworthy, unless it's placed downline of encryption.

Mindphreaker 13y ago

I've been using this since the very early alpha status. It's a really nice storage solution with a very sophisticated technology too. For anyone curious about the technology behind here is an early tech talk from one of the founders. It may be a little bit outdated now but still interesting: http://www.youtube.com/watch?v=3xKZ4KGkQY8 http://www.youtube.com/watch?v=3xKZ4KGkQY8

sp8 13y ago

We've been recommending this as an alternative to Dropbox where I work (in the UK) for a few years now, for exactly the reasons given in the title text. Yes, its a shame its Java-based, but they do have clients for Windows, Mac, Linux iOS and Android. (No, I'm not connected to Wuala in any way, I don't even use the service myself, but as an alternative to Dropbox I think its a good one.)

maggit 13y ago

I recently tried replacing Dropbox with Wuala because of privacy concerns. I failed, and in the process realized how successful Dropbox has been in creating an awesome user experience! I'm still looking for a locally encrypted Dropbox-alternative. So if any of you are making one, please speak up :) (Edit) I should specify that it was the user experience that made me give up on Wuala, and any proper Dropbox alternative would need to offer at least decent user experience. Looking forward to trying the alternatives you are suggesting :)

davidjohnstone 13y ago
On my "somebody should create this, and I might eventually" list is an open source, P2P, optionally server-backed, encrypted Dropbox replacement. Bittorrent's Sync almost gets there, but isn't open source. I haven't really looked at it, but ownCloud might do what I want.
- ekianjo 13y ago
  I heard ownsync is really buggy. Havent tried it though.
- simgidacav 13y ago
  +1. I'd like to know more about this. Working on a encrypted FOSS alternative to conventional storage would totally be a perfect side project
- ondmagi 13y ago
  The ownCloud sync client for OS X pins one cpu core to 100% usage on my fairly new i7 mbp, which effectively drains the battery quite quickly if you don't notice. Then it also seems to do a full scan of teh entire folder each time it sync's, if you then have for example your iPhoto library (usually a few GBs) there, the sync process will consume lots of CPU and tend to be out of date across devices.
- cuu508 13y ago
  Wuala used to be P2P (host other people's files to get more space for your files) until LaCie bought it.

gahahaha 13y ago

"""Do you plan to open the source code? Currently not. Opening the source code of Wuala would consume quite some time and effort, and commitment to maintain it. If you are a software engineer and would like to see how Wuala works, feel free to apply for a job at Wuala.""" ಠ_ಠ So.. an alternative, but not the solution we need.

venomsnake 13y ago
Don't open source it. Just give read and build for personal use permission. That should be enough. I don't think that I will be able to trust secure trough obscurity solution.
- pgeorgi 13y ago
  Or open up the protocol, for independent client implementations. With client-side crypto, the server doesn't matter much.
Toshio 13y ago
> "If you are a software engineer and would like to see how Wuala works, feel free to apply for a job at Wuala." A non-answer if I've ever seen one. What about someone who applies for a job at Wuala, gets rejected, but still wants to look at the source code?
- pablasso 13y ago
  And that's the only use case that bothers you?
  - stcredzero 13y ago
    You only need one counter example to poke a hole in a position.
shin_lao 13y ago
And what would having the source code change? Unless you host the data yourself, if you don't trust Wuala there is no guarantee the binaries you use are built from the source code you have.

pellias 13y ago

Floodgate is opening up just like when Google shutdown it's reader. Let's see who will be the winner.

sabret00the 13y ago

It's from Lacie, so no thank you. I bought a Lacie drive and proceeded to copy all my stuff onto it. Before I could get comfortable with it (so within the first six months of purchase) and before I backed up my stuff, the drive failed. I contacted Lacie about it and they proceeded to try and sell me a service whereby they'd recover my data for €300. That would've brought my total spend on the drive up to around £400. I begged and pleaded with them, pointed out how unsavoury such a business practice was and all to no avail. The drive has just been sitting down since with the data unrecovered. Personal memories, music, films and professional data too. I've tried to recover the data but that didn't work and I honestly feel ripped off. As a result, I've vowed to never do business with Lacie again and to warn everyone of how unscrupulous they are. Beware of Lacie and their subsidiaries.

amouat 13y ago
Well, they should have replaced the drive if it failed within 6 months. But expecting them to go to the lengths of recovering your data for free is a bit hopeful.
- sabret00the 13y ago
  Hopeful yes, but no one expects a drive failure before even half of the warranty has expired surely?
  - delackner 13y ago
    The whole point of backups is that you should never expect a single hard drive to stay alive, no matter how young it is. Lots of hard drives with defects die early. For your own sanity, it is best to think of any data you have only one physical copy of as data that may not be there tomorrow. Personally I don't get comfortable until my most important data exists in two physical locations, so fire is not a risk.
tekacs 13y ago
It's very pointedly not their obligation (nor even standard practice for any drive company) to go through the expensive process of recovering your data for you for free. Taking backups is your own problem and responsibility. They should have offered to replace your drive, but no more. Hardly unscrupulousness.

joewee 13y ago

How about Dropbox + TrueCrypt + Automount? Files are decrypted in memory, files you need to share you can keep in unencrypted format.

greyman 13y ago
I was thinking about this solution, and I also have a truecrypt drive (locally). But if you changed just one file in the truecrypted drive, shouldn't then Dropbox re-sync the whole encrypted drive?
- squidi 13y ago
  Yes, that's correct. So if you have a 1GB TrueCrypt container the whole thing needs to be uploaded again. Another annoyance is that you cannot change the size of a drive after you create it [1] and it doesn't shrink to fit the data either. [1] http://www.truecrypt.org/docs/?s=issues-and-limitations http://www.truecrypt.org/docs/?s=issues-and-limitations
quchen 13y ago
I've been doing this with a small volume (1 MiB), but it always kept me wondering how much traffic a minor change in an encrypted volume causes - even a single bit flip should drastically change the container if the encryption is good. I wouldn't want to upload for an hour each time I see a typo in my files.
- lawl 13y ago
  No. From the truecrypt FAQ [0]: > The ciphertext block size used by TrueCrypt is 16 bytes (i.e., 128 bits). Meaning one bitflip should only sync 16 bytes since dropbox only transmits deltas. Of course this now depends on dropbox' delta sync implementation. From a quick google search [1]: > For what it's worth, Dropbox claims to create hashes on every 4MB of each file. That way, if you change a contiguous 2MB of a 100MB file, it will likely only need to upload 4MB (or 8MB if you cross into a second 4MB block) to re-sync the file. So worst case if a bitflip happens to change a truecrypt block that doesn't align with dropbox' chunks you're looking at around 8MiB. That's still quite an amout for a bitflip but i think it's feasible with todays connection speeds. [0] http://www.truecrypt.org/faq http://www.truecrypt.org/faq [1] http://serverfault.com/questions/52861/how-does-dropbox-version-upload-large-files http://serverfault.com/questions/52861/how-does-dropbox-vers...

gtt 13y ago

I'm not a security expert neither do I understand cryptography hence the question: I assume they are not using the original password to encrypt data. They are generating a symmetric encryption key and encrypt it with the original password, storing it along with the encrypted data on their servers. The question is how secure the encryption on symmetric key? What if it is easily brutfocable?

solnyshok 13y ago

I used Wuala for couple of years, when it was free and allowed earning a much larger quota by sharing own drive space to host other user's data. I used it to keep around 100GB of my personal data. Used to be good while it lasted. Encrypted, distributed, redundant. Then LaCie bought it and turned it into a Dropbox clone. Now I use AeroFS, also tried TorrentSync. Both a roughly equal. I just felt lazy changing from already running and tuned AeroFS to anything else. If you have 24x7 homeserver at home it is very hard to justify paying for storage at dropbox or skydrive or google. I built my homeserver on the latest Atom, so it is frugal (~10W) and completely silent (no fan, SSD). It's dualcore 2.1GHz and has enough grunt for simultaneous NAS, torrents, and plays 1080p mkv to the attached TV. No place for Wuala in this arrangement anymore.

pacomerh 13y ago
It's still free, I don't pay a dime.
- solnyshok 13y ago
  how much storage you've got there?

ergest 13y ago

Way to be opportunistic!

Keyframe 13y ago

Company may be in Europe, servers might be in Europe, you might be in Europe. Nothing guarantees you that your data won't be routed through US where it can be tapped into. That's the primary issue for me with the whole PRISM scandal.

VexXtreme 13y ago
Data is encrypted client-side before being sent so I believe this is a non-issue.
- quchen 13y ago
  It's a very non-non-issue: the client is closed source, for all we know it could do anything. Even if you listen on the data output to verify it's indeed encrypted, you still aren't able to tell whether your private key isn't transmitted alongside. This isn't security, it's security by obscurity - in the best case, mind you.
- Keyframe 13y ago
  Data being encrypted doesn't mean it can't be archived in that Utah data center. What capabilities they have there and what they do with it, we don't know. Substantial decryption breakthrough was hinted at in several reports, but what it is exactly - we have no idea.
  - nodata 13y ago
    Client side encryption is enormously better than no client side encryption.
  - gtt 13y ago
    >> Substantial decryption breakthrough was hinted at in several reports, but what it is exactly - we have no idea. Could you provide a link to those hints, please?
    - Keyframe 13y ago

danso 13y ago

So honest question, but how is having your data stored in Switzerland (where Wuala is based) any different than having it in the US? Or is it just the promise of local encryption that makes it safer? Some purported info about data protection for Switzerland: http://www.dataprotection.ch/en/disclosing-personal-data.asp http://www.dataprotection.ch/en/disclosing-personal-data.asp > Restrictions on disclosure The DPA does not permit the disclosure of sensitive data or personality profiles to third parties without lawful justification. The consent of the data subject can constitute a lawful justification. Breach of this prohibition is an offence if knowledge of the sensitive data has been gathered in the course of a professional activity requiring knowledge of such data and can be punished by a fine of up to CHF 10'000.--. If the fine is not paid, it can be replaced by imprisonment for up to 3 months. And Wuala's own policy: http://www.wuala.com/en/about/privacy http://www.wuala.com/en/about/privacy > 6. Disclosure to third parties Basically, your data is not transmitted to third parties. However, LaCie may release personal data if the law requires it to do so or in the good-faith belief that such action is necessary to comply with any laws or respond to a court order, subpoena, or search warrant or to protect LaCie's rights and interests. Furthermore, you expressly agree that LaCie can disclose personal data to identified third parties (e.g. owners of intellectual property rights) and/or government enforcement bodies in order to enforce the General terms and conditions, particularly in case of founded indications that the laws or the rights of a user or of third parties, particularly copyrights, other industrial property rights or personal rights, have been violated , insofar as such is necessary.

wcunning 13y ago
Due to the manner in which data is client-side encrypted (password-based keys, password not stored on their servers), they can hand your (encrypted) data to any government with no ability to decrypt it. Now, depending on the outcome of some cases before US Courts right now, you might be compelled to provide the password to unencrypt the data. It's also worth noting that the password-based asymmetric encryption schemes are less secure than the arbitrary key based ones, but still it's better than nothing. In my case, I'm sold by the fact that they provide more free storage than Dropbox and have a much better Linux client (based on a FUSE plugin, a much nicer architecture in general).

mixnovich 13y ago

Funny how the "Wuala" solution came out just after the PRISM leak in the US.

penetrarthur 13y ago

Wuala is terrible. It is constantly eating up 30% of cpu when idling. Sometimes it doesn't sync at all for a few days. There is a "Use LAN" feature, but it doesn't work.

deleted 13y ago

[deleted]

skarmklart 13y ago

How does this compare to Tarsnap?

znowi 13y ago

Or use BitTorrent Sync instead. I'm quite pleased with it and moved all my data off Dropbox. http://labs.bittorrent.com/experiments/sync.html http://labs.bittorrent.com/experiments/sync.html

qznc 13y ago
Not Open Source either.

iHypnos 13y ago

Hello there, Gianluca from Wuala here. First, this is how Wuala works: You as an user place a file in the client. The file gets encrypted (including using your password and username) and then gets uploaded and split into different pieces. We are currently using AES-256 for encryption (and RSA 2048 fpr signature and key exchange when sharing a folder and SHA-256 for integrity checks). The password does NOT get transmitted and there is nothing like a master key or similar. That means in worst ever case if someone would have access to our servers somehow, they'd get a piece of encrypted data which is not readable and not decryptable (not even for us as the provider. Secondly, some people tend to confuse security with anonymity. Wuala is secure, but how about anonymity? We have your email address, your username and we know how much storage space you have. As you see, that is not anonymous, but has nothing to do with the security of your files. Are we planning to open source the code? Eventually yes, but as we already stated, this takes a lot of time and effort. Oh and yes, we are nice guys. Not because we're Swiss, but in general :)

nodata 13y ago
Are you planning on allowing camera upload? I can't get people using your product without it...
- iHypnos 13y ago
  we are planning camera upload yes :)
jasonzemos 13y ago
Hey Gianluca, I was under the impression the latest major revision of Wuala removed all distribution features, so files are no longer split into difference pieces. Instead they are now stored on your central servers.
- iHypnos 13y ago
  No. We split our files and store them redundantly in our datacenters in Switzerland, France and Germany.
13y ago

strobe 13y ago

another dropbox alternative https://github.com/haiwen/seafile https://github.com/haiwen/seafile on you own servers

workhere-io 13y ago

There's also Jottacloud (http://www.jottacloud.com/ http://www.jottacloud.com/), a Norwegian Dropbox alternative.

tomelders 13y ago
Interesting. Anyone got any experience with Jottacloud they wouldn't mind sharing?

kijin 13y ago

Seriously? Wuala is a service run by LaCie. LaCie is owned by Seagate, an American corporation. It doesn't matter where the servers are, because all the important decisions will be made in Cupertino, California. http://www.lacie.com/us/company/news/news.htm?id=10722 http://www.lacie.com/us/company/news/news.htm?id=10722 Now, client-side encryption is a much more interesting aspect of their service, but is it worth the trouble if Wuala's clunky client takes 100 times longer than Dropbox to sync a file between two devices? Ditto for SpiderOak, JungleDisk, and every other backup/sync solution that I've used so far that boasts client-side encryption. And it wasn't due to Dropbox's deduplication, either. Some of them just talked lazily with the server for several minutes before they even started to upload/download any files.

sillysaurus 13y ago
Why not just store a TrueCrypt volume(s) in Dropbox?
- cddotdotslash 13y ago
  Because, as far as I know (I haven't used TrueCrypt too much), it will see the volume as a file and then you'll be syncing a huge, x GB file every time you make the smallest change within it.
  - olov 13y ago
    That's not true. Dropbox uses librsync so small changes of big files yields small diffs, thus TrueCrypt volumes work just fine with Dropbox.
    - missing_cipher 13y ago
      Speaking out of ignorance here: But aren't TrueCrypt volumes completely changed when you add/remove something? I'm thinking similarly to a hash: The slightest modification changes it completely.
      - 13y ago

VuongN 13y ago

The problem here is: the people who has data (Wuala) also determine how the files are encrypted. No box is ever unbreakable, however, the chance of breaking it is much bigger if you have the locksmith holding on to the box. I've talked a little bit about this in my humble blog post not too long ago about a simplistic view of security in the cloud: http://vuongnguyen.com/personal-business-cloud-security.html http://vuongnguyen.com/personal-business-cloud-security.html. -V.

OnlyHave2Cores 13y ago

There released an interesting paper regarding their key managment for multiple users, when they were a reserach project at the ETH. Cryptree: A folder tree structure for cryptographic file systems - http://boga.googlecode.com/svn/trunk/res/Docs/wuala-cryptree.pdf http://boga.googlecode.com/svn/trunk/res/Docs/wuala-cryptree...

jellicle 13y ago

For what it's worth, what you need is: -- a company with no connections to the United States. Ideally, it should be privately owned by a foreign individual known for strong privacy views and who has promised never to sell. -- local encryption -- open source ("trust but verify") -- actually works Wuala, from the comments here, meets only one of those four requirements.

donatzsky 13y ago
Uh, just one? The way I count it's 2.5 out of 4. It's a Swiss company, owned by LaCie (French) which is again owned by Seagate (US). So I would say that's half a point. Data is en-/decrypted locally. There's a reason they don't have a web interface, but require you to use the client. It's indeed not open source. Would be nice if it was. And it actually does work. There's room for improvement (isn't there always?), but in my experience it's working well.

adrinavarro 13y ago

Another alternative is hubiC. It's run by OVH, perhaps one of the most "techno-geek" companies in Europe that you can find… I don't see them feeding content to governments without any reason. In fact, they opened a DC in Canada and not the U.S. and one can guess why.

andor 13y ago
In fact, they opened a DC in Canada and not the U.S. and one can guess why. Because it's culturally closer, I'd guess. OVH is a French company, and their Canadian data center is just outside of Montreal.

deleted 13y ago

[deleted]

chilgart 13y ago
[citation needed]
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]

lettergram 13y ago

Yeah, i'm sure the French would never have access to the servers in their country...

rsync 13y ago

rsync.net. Zurich, Hong Kong. Warrant Canary[1]. Straight up unix filesystem (ZFS) so you can point duplicity[2] (or anything else) at it. If you need something like dropbox, we are NOT for you. We have special rates for HN folks. Email us. [1] http://www.rsync.net/resources/notices/canary.txt http://www.rsync.net/resources/notices/canary.txt [2] http://duplicity.nongnu.org/ http://duplicity.nongnu.org/

gasull 13y ago

EncFS + Dropbox Although this won't help if you get a rootkit in an update, since the source is closed.

Splendor 13y ago

Regardless of the service's value I found the security explanation on this page (https://www.wuala.com/en/learn/technology https://www.wuala.com/en/learn/technology) to be a great example of clear communication about the differences between client-side encryption, SSL security, etc.

deleted 13y ago

[deleted]