6 ms·
All that matters: Does Dropbox encrypt my data on the client side, before storing it on the server? Or does Dropbox have the power to pilfer through my data,
by f3llowtraveler 12y ago
All that matters: Does Dropbox encrypt my data on the client side, before storing it on the server?
Or does Dropbox have the power to pilfer through my data, along with official snoopers and hackers?
- adamors 12y agoThey would say that. Like SpirderOak are saying it: https://spideroak.com/zero-knowledge/ https://spideroak.com/zero-knowledge/ or Crashplan: http://www.code42.com/crashplan/features/security/ http://www.code42.com/crashplan/features/security/
- chmars 12y agoDropbox does not claim to encrypt your data on the client side. They only claim encryption on their servers but that is not helpful in terms of encryption of your data … In CrashPlan, you can at least set your own private key if you like. You still need to trust the provider/vendor, however, the software is at least built to do local encryption. Dropbox does not work that way.
- deleted 12y ago[deleted]
- chmars 12y agoNo, Dropbox does NOT encrypt your data on the client site. Alternatives would be Spideroak and Wuala or addon software like Boxcryptor. They work but not as flawlessly and user-friendly as Dropbox usually does …
- StavrosK 12y agoI've found EncFS over Dropbox to be pretty good, retaining the best of both worlds.
- AlyssaRowan 12y agoPlease be cautious: EncFS was not designed to resist an attacker having ongoing access to the volume, as they would in this scenario! In particular, an attacker having access to the ciphertext at two or more different times violates EncFS's security assumptions; undetected malicious modification of files is also feasible in this scenario. Many encrypted filesystems do not include such a property in their design criteria - for example, XTS mode as-is is not suitable for use in this scenario either, so please also try to avoid putting TrueCrypt (et al) on Dropbox! For a broad general example of what a system would look like which tries to address this use case more naturally and effectively (although, caveat: I have not reviewed it in great detail myself), please see Tahoe-LAFS.
- StavrosK 12y agoDamn! What's the vulnerability? Do they reuse IVs or something? No wonder I got stuck when designing my own encrypted filesystem, I didn't have this assumption. On the plus side, mine was safer. I'll have to revisit it.
- namityadav 12y agoI've been using Dropbox with EncFS, and I feel foolish about not thinking of the fact that Dropbox has ongoing access to the encrypted files. Would you recommend something other than Dropbox + EncFS as the best compromise for a file-sync solution that has reasonable security, a non-buggy client, supports block-level sync, is reasonably priced and "just works"? BitTorrent Sync + EncFS?
- jpalomaki 12y agoEven if they did encrypt the data client side, it would be pretty easy for them to also take a copy of the encryption key. If you want to have security against the cloud storage provider, it is better to use some other encryption solution.
- lingben 12y agoI don't think you understand how encryption works.
- colordrops 12y agoPerhaps you could explain then. Wouldn't software that has the ability to encrypt and decrypt files on the client side also have access to the keys?