5 ms·

I've already lost all faith in Google. I recommend Spider Oak as a replacement for Google Drive. Also, don't forget Bittorrent Sync.

fear91 13y ago
Yep, no matter how much PR bullshit they spew out, no one resonable is going to trust them with sensitive data.
UVB-76 13y ago
I want to like SpiderOak, but transfers are painfully slow, and their OS X interface is horrible.
- FellowTraveler 13y ago
  Do you ever notice that your Mac's camera and microphone do not have a physical off-switch? Just like 1984.
  - harrytuttle 13y ago
    Neither does my Sony all in one, my ThinkPad or my three Nokia phones and you're singling out the mac?
    - FellowTraveler 13y ago
      You're right: Sony, ThinkPad, and Nokia are therefore also systems of slavery. How hard can it be to manufacture a product with an off-switch?
      - superuser2 13y ago
        I'm guessing you never supported an environment where laptops had hardware switches for the WiFi card. I can't even begin to quantify the amount of support time that wastes. If a users asks for something to happen (like a Skype call) it should just happen. To end-users, having multiple points at which the functionality they want can be switched off is just frustrating, and it costs manufacturers call center time and customer satisfaction. The paranoid can tape over cameras and cut mic cables if they feel it's really necessary. You really might want to consider whether "slavery" is the appropriate word for switches implemented in software.
        FellowTraveler 13y ago
        http://sourcefednews.com/xbox-one-is-watching-you/ http://sourcefednews.com/xbox-one-is-watching-you/
        harrytuttle 13y ago
        That is by design, not for the sake of convenience.
      - harrytuttle 13y ago
        We have these things called transistors which allow us to turn things off these days. It's been a long time since we had the big red IBM XT flip switch. Even my calculator doesn't have a physical off switch.
  - scott_karana 13y ago
    I guess they didn't have masking tape in 1984.
  - superuser2 13y ago
    Neither do most PCs. And even when they do, they're often implemented in software. Which is part of why the NSA guide to securing a machine recommends that you decide whether or not you actually need the camera and microphone, and if not, you open the case and physically cut the cables.
    - quantumpotato_ 13y ago
      Where is this guide?
      - superuser2 13y ago
        http://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml http://www.nsa.gov/ia/mitigation_guidance/security_configura... In addition to being a signals intelligence agency, NSA is also responsible for IT security for the federal government (and, to some extent, the nation). While it's possible they leave some of the more interesting tricks out of the public versions of these guides, their publication is in line with NSA's advice and assistance on open-source cryptography, etc.
- dombili 13y ago
  Try JottaCloud. Their customer service is painfully slow, but their servers are not. Supposedly you're out of NSA's reach as well, but I'm not sure on that. Currently that's the service I'm using, but I still encrypt my files.
  - UVB-76 13y ago
    I had a look at JottaCloud, but was put off by a few things: 1) The location of their servers in Norway; I'm based within the EU, but quite far from Norway, and Norway doesn't scream great connectivity to me in the same way Britain, France, or Germany does; 2) Their FAQ seems a bit slapdash, e.g. "What kind of servers are my data stored on? Linux"; 3) As with most other storage providers, there is no mechanism preventing the provider from accessing your files, or sharing them with third parties, no matter how much you trust them.
    - deleted 13y ago
      [deleted]
stfu 13y ago
Google: the company may be taking a different approach by performing the encoding and decoding on its servers. Spider Oak: I wish there were some open source cloud client similar to True Crypt. Something that were really easy to use, working on every system and open source. Spider Oak's client seems to be still mainly a closed source product.
- ippisl 13y ago
  Syncany looks promising. It's open source, includes client encryption and support for multiple options of storage(google,amazon,rackspace,ftp and others),and it's only 8K loc of java. Of course it would still need a security review.
- zorlem 13y ago
  Have you tried duplicity [0]? It encrypts the archives using GnuPG, uses two separate keys - one for encryption, the other for signing, and can store the backups using a multitude of protocols [1]: > Currently local file storage, scp/ssh, ftp, rsync, HSI, WebDAV, Tahoe-LAFS, and Amazon S3 are supported, and others shouldn't be difficult to add. It is libre software and cross-platform. A number of front-ends address the issue of ease-of-use. [0]: http://duplicity.nongnu.org/ http://duplicity.nongnu.org/ [1]: http://duplicity.nongnu.org/features.html http://duplicity.nongnu.org/features.html
  - dmix 13y ago
    I prefer Tarsnap. cperciva posted why Tarsnap was more secure and cheaper than Duplicity a while back: https://news.ycombinator.com/item?id=459334 https://news.ycombinator.com/item?id=459334
- eblume 13y ago
  I'm actually hacking right now on a personal project that might be relevant. It eschews the 'sync' metaphor and focuses more on the 'share' metaphor, though - it is not so useful for files that change frequently, but pretty robust for sharing arbitrary sets of files or data between a group of users. (It will also include user and access management). The whole thing currently sits on top of BitTorrent although I suspect I'll end up writing a forked implementation at some point to support some extensions I'm working on. Active, dynamic syncing is great for some kind of data but not so important for others, and I feel like that's the hurdle that needs to be overcome. More interesting to me is painless, fast, robust, and configurable sharing of relatively static data. (Some versioning may be included but it won't be a first-class system.)
harshreality 13y ago
Be aware: from: ... <support@spideroak.com>* date: **** 2013 subject: Re: [SOS #xxxx] A question about zero knowledge Sorry for the delay in getting back to you. Zero-knowledge applies only when using the SpiderOak client. When logging into the website with your password, you are giving the primary encryption key to our servers. We work hard to ensure that this key is kept safe (for instance, by only keeping it in memory and never writing it to disk), but to maintain absolute privacy, you should use only the client.

fear91 13y ago

Yep, no matter how much PR bullshit they spew out, no one resonable is going to trust them with sensitive data.

UVB-76 13y ago

I want to like SpiderOak, but transfers are painfully slow, and their OS X interface is horrible.

FellowTraveler 13y ago
Do you ever notice that your Mac's camera and microphone do not have a physical off-switch? Just like 1984.
- harrytuttle 13y ago
  Neither does my Sony all in one, my ThinkPad or my three Nokia phones and you're singling out the mac?
  - FellowTraveler 13y ago
    You're right: Sony, ThinkPad, and Nokia are therefore also systems of slavery. How hard can it be to manufacture a product with an off-switch?
    - superuser2 13y ago
      I'm guessing you never supported an environment where laptops had hardware switches for the WiFi card. I can't even begin to quantify the amount of support time that wastes. If a users asks for something to happen (like a Skype call) it should just happen. To end-users, having multiple points at which the functionality they want can be switched off is just frustrating, and it costs manufacturers call center time and customer satisfaction. The paranoid can tape over cameras and cut mic cables if they feel it's really necessary. You really might want to consider whether "slavery" is the appropriate word for switches implemented in software.
      - FellowTraveler 13y ago
        http://sourcefednews.com/xbox-one-is-watching-you/ http://sourcefednews.com/xbox-one-is-watching-you/
        harrytuttle 13y ago
        That is by design, not for the sake of convenience.
    - harrytuttle 13y ago
      We have these things called transistors which allow us to turn things off these days. It's been a long time since we had the big red IBM XT flip switch. Even my calculator doesn't have a physical off switch.
- scott_karana 13y ago
  I guess they didn't have masking tape in 1984.
- superuser2 13y ago
  Neither do most PCs. And even when they do, they're often implemented in software. Which is part of why the NSA guide to securing a machine recommends that you decide whether or not you actually need the camera and microphone, and if not, you open the case and physically cut the cables.
  - quantumpotato_ 13y ago
    Where is this guide?
    - superuser2 13y ago
      http://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml http://www.nsa.gov/ia/mitigation_guidance/security_configura... In addition to being a signals intelligence agency, NSA is also responsible for IT security for the federal government (and, to some extent, the nation). While it's possible they leave some of the more interesting tricks out of the public versions of these guides, their publication is in line with NSA's advice and assistance on open-source cryptography, etc.
dombili 13y ago
Try JottaCloud. Their customer service is painfully slow, but their servers are not. Supposedly you're out of NSA's reach as well, but I'm not sure on that. Currently that's the service I'm using, but I still encrypt my files.
- UVB-76 13y ago
  I had a look at JottaCloud, but was put off by a few things: 1) The location of their servers in Norway; I'm based within the EU, but quite far from Norway, and Norway doesn't scream great connectivity to me in the same way Britain, France, or Germany does; 2) Their FAQ seems a bit slapdash, e.g. "What kind of servers are my data stored on? Linux"; 3) As with most other storage providers, there is no mechanism preventing the provider from accessing your files, or sharing them with third parties, no matter how much you trust them.
  - deleted 13y ago
    [deleted]

stfu 13y ago

Google: the company may be taking a different approach by performing the encoding and decoding on its servers. Spider Oak: I wish there were some open source cloud client similar to True Crypt. Something that were really easy to use, working on every system and open source. Spider Oak's client seems to be still mainly a closed source product.

ippisl 13y ago
Syncany looks promising. It's open source, includes client encryption and support for multiple options of storage(google,amazon,rackspace,ftp and others),and it's only 8K loc of java. Of course it would still need a security review.
zorlem 13y ago
Have you tried duplicity [0]? It encrypts the archives using GnuPG, uses two separate keys - one for encryption, the other for signing, and can store the backups using a multitude of protocols [1]: > Currently local file storage, scp/ssh, ftp, rsync, HSI, WebDAV, Tahoe-LAFS, and Amazon S3 are supported, and others shouldn't be difficult to add. It is libre software and cross-platform. A number of front-ends address the issue of ease-of-use. [0]: http://duplicity.nongnu.org/ http://duplicity.nongnu.org/ [1]: http://duplicity.nongnu.org/features.html http://duplicity.nongnu.org/features.html
- dmix 13y ago
  I prefer Tarsnap. cperciva posted why Tarsnap was more secure and cheaper than Duplicity a while back: https://news.ycombinator.com/item?id=459334 https://news.ycombinator.com/item?id=459334
eblume 13y ago
I'm actually hacking right now on a personal project that might be relevant. It eschews the 'sync' metaphor and focuses more on the 'share' metaphor, though - it is not so useful for files that change frequently, but pretty robust for sharing arbitrary sets of files or data between a group of users. (It will also include user and access management). The whole thing currently sits on top of BitTorrent although I suspect I'll end up writing a forked implementation at some point to support some extensions I'm working on. Active, dynamic syncing is great for some kind of data but not so important for others, and I feel like that's the hurdle that needs to be overcome. More interesting to me is painless, fast, robust, and configurable sharing of relatively static data. (Some versioning may be included but it won't be a first-class system.)

harshreality 13y ago

Be aware: from: ... <support@spideroak.com>* date: **** 2013 subject: Re: [SOS #xxxx] A question about zero knowledge Sorry for the delay in getting back to you. Zero-knowledge applies only when using the SpiderOak client. When logging into the website with your password, you are giving the primary encryption key to our servers. We work hard to ensure that this key is kept safe (for instance, by only keeping it in memory and never writing it to disk), but to maintain absolute privacy, you should use only the client.