3 ms·
> The chain of trust still extends to them. You're > trusting that they're actually doing everything > they say they're doing. Tarsnap performs encryption
by jmillikin 13y ago
> The chain of trust still extends to them. You're
> trusting that they're actually doing everything
> they say they're doing.
Tarsnap performs encryption in the client, which is distributed only as source code. If you audit the client sufficiently to believe it is properly encrypting your data, then there is no need to trust the server or the hosting provider.
- tytso 13y agoSure, if you are willing to do all of the computation on the client, and only use the server as a place to store an encrypted bag of bits. If you have a sufficiently fast network connection (or enough local disk cache and the ability to predict what you will need before you drop off your high speed network access), that can work. But there will be a lot of things that you may have gotten accustomed to if you operate in such a paradigm.
- sneak 13y agoYou still have to trust them and their government when you use the service. They (or their government) could delete or compel the deletion of the files, have or cause outages, etc. Also, all the crypto in the world doesn't keep a service from logging (ip, timestamp) tuples each time you access them. You can do a lot with metadata.
- JoachimSchipper 13y ago> You can do a lot with metadata. With GMail metadata, yes; with Tarsnap metadata, much less so.