5 ms·

Am I reading this right? A third-party service that protects you from third-party services? And you have to install it everywhere? And it's not FLOSS? Please te

Am I reading this right? A third-party service that protects you from third-party services? And you have to install it everywhere? And it's not FLOSS? Please tell me I'm reading this wrong. Edit: Okay I see it's based on FLOSS and that's great, but as far as I can tell they're still asking you to install binary blobs, which makes the whole thing pointless.

rexreed 13y ago
From what I understand, and again, I'm not with the company, it's not a cloud service, but rather downloadable / installable software that encrypts prior to storage on the disk.
- gboudrias 13y ago
  Hmm, but then why do you need an account? And yeah, I see what you mean, but if you don't have access to the source, you don't know what they're making you install. I'm a huge FLOSS advocate, but in this specific instance it's more my paranoia talking. I believe I can trust them now, but how many clients will they need to have before the NSA blackmails them? It's still a step forward, somewhat, but I find it hard to believe that there could be a successful product based on putting the user in full control (which is needed for real security).
  - rexreed 13y ago
    The account is needed so you can grant authorization to others to access your files. EncFS is great if you are the only user. If you want to grant others access to your encrypted files, you need an authorization / authentication mechanism, which is why there's an account needed - for permission control. But if you're the only user / potential accessor of the files, single-user strong file-system based encryption works.
    - gboudrias 13y ago
      Good point. I guess you can't share data without trusting someone.
blcknight 13y ago
Install EncFS and use it on your Dropbox. No account, no binary blobs needed. You can compile all the bits for EncFS yourself, if you want.
- gboudrias 13y ago
  That's more like it :)
- CCs 13y ago
  TrueCrypt would work too - it has block level encryption and Drobox syncs on block level too.
  - bigiain 13y ago
    Hmmm, I wonder if TrueCrypt adequately secures a hidden volume's existence from an attacker (Dropbox) who can watch the patterns of your block level writes?
    - CCs 13y ago
      It's content encryption app, not Rubberhose File System or similar.
- bigiain 13y ago
  This works, and works well. I had a little trouble getting it to run on one of my older Mac OSX machines, but I'm pretty sure that was because I had the remains of a previous installation of MacFUSE messing things up - There's also a MacOSX/iOS/Android/Windows commercial "wrapper" around EncFS which is fully compatible with the compiled-from-source versions of EncFS I've got running on Mac OSX and Linux (ARM and x86) - it's a "binary blob", but if your security/convenience tradeoff lets you consider that, have a look at BoxCryptor Classic: https://www.boxcryptor.com/boxcryptor-classic https://www.boxcryptor.com/boxcryptor-classic For me, the tradeoff of having secured/encrypted files available on iOS is worth the decrease in security by relying on Secomba GmbH not backdooring me at the request of the NSA or ASIO (my local security agency) – or anybody further down the security agency or law enforcement foodchain. I'm not actually trying to protect myself against targeted surveillance by any sufficiently powerful nation-state, but I feel good about knowing I'm not quite so readily caught up in "dragnet" surveillance…

rexreed 13y ago

From what I understand, and again, I'm not with the company, it's not a cloud service, but rather downloadable / installable software that encrypts prior to storage on the disk.

gboudrias 13y ago
Hmm, but then why do you need an account? And yeah, I see what you mean, but if you don't have access to the source, you don't know what they're making you install. I'm a huge FLOSS advocate, but in this specific instance it's more my paranoia talking. I believe I can trust them now, but how many clients will they need to have before the NSA blackmails them? It's still a step forward, somewhat, but I find it hard to believe that there could be a successful product based on putting the user in full control (which is needed for real security).
- rexreed 13y ago
  The account is needed so you can grant authorization to others to access your files. EncFS is great if you are the only user. If you want to grant others access to your encrypted files, you need an authorization / authentication mechanism, which is why there's an account needed - for permission control. But if you're the only user / potential accessor of the files, single-user strong file-system based encryption works.
  - gboudrias 13y ago
    Good point. I guess you can't share data without trusting someone.

blcknight 13y ago

Install EncFS and use it on your Dropbox. No account, no binary blobs needed. You can compile all the bits for EncFS yourself, if you want.

gboudrias 13y ago
That's more like it :)
CCs 13y ago
TrueCrypt would work too - it has block level encryption and Drobox syncs on block level too.
- bigiain 13y ago
  Hmmm, I wonder if TrueCrypt adequately secures a hidden volume's existence from an attacker (Dropbox) who can watch the patterns of your block level writes?
  - CCs 13y ago
    It's content encryption app, not Rubberhose File System or similar.
bigiain 13y ago
This works, and works well. I had a little trouble getting it to run on one of my older Mac OSX machines, but I'm pretty sure that was because I had the remains of a previous installation of MacFUSE messing things up - There's also a MacOSX/iOS/Android/Windows commercial "wrapper" around EncFS which is fully compatible with the compiled-from-source versions of EncFS I've got running on Mac OSX and Linux (ARM and x86) - it's a "binary blob", but if your security/convenience tradeoff lets you consider that, have a look at BoxCryptor Classic: https://www.boxcryptor.com/boxcryptor-classic https://www.boxcryptor.com/boxcryptor-classic For me, the tradeoff of having secured/encrypted files available on iOS is worth the decrease in security by relying on Secomba GmbH not backdooring me at the request of the NSA or ASIO (my local security agency) – or anybody further down the security agency or law enforcement foodchain. I'm not actually trying to protect myself against targeted surveillance by any sufficiently powerful nation-state, but I feel good about knowing I'm not quite so readily caught up in "dragnet" surveillance…