4 ms·

You understand that all the passwords/data are encrypted client side and only the encrypted blob is stored in the cloud? This is exactly what users of Keepass

You understand that all the passwords/data are encrypted client side and only the encrypted blob is stored in the cloud? This is exactly what users of Keepass et al espouse when they talk of having their 'locally encrypted database' and syncing it over dropbox etc. You, at least, are identifying the benefit of physical security, but if we are to place any trust at all in encryption then we must accept such a scheme (local encryption, cloud sync) as being robust, if correctly implemented. Under this scheme, obtaining the encrypted blob (which hasn't happened in this case) would still not be a cause for alarm, if we are to trust the strength of the encryption scheme. There comes a point that you must trust 'something'. That choice for me is in encryption.

socceroos 11y ago
ROT13 fan?
- PuffinBlue 11y ago
  ?
  - socceroos 11y ago
    Encryption is as good as it's independent proofs. Even then, the proofs are only as good as the attention it gets from qualified, quality cryptographers. And again, only when used in a library that can independently prove it's algorithm and implementation is sound - open source. For everything important, there is OTP.
    - PuffinBlue 11y ago
      You're stating truisms really. And you trust OTP (quite rightly) - ergo you trust encryption. My personal trust point is properly implemented AES-256 with a slow hashing function.
      - socceroos 11y ago
        Correct. I wanted to qualify that you can't just 'trust encryption'. You must know what you're trusting, top to bottom; otherwise I would say that the trust is misplaced.
vithlani 11y ago
And this is exactly the point being missed by much of this discussion. Protect the db blob with one ridiculously long master password with crazy amount of PKBDF iterations and 2-FA.
nrser 11y ago
yeah... the synchronization for these services should be zero-knowledge. though maybe not the best idea, my vault should remain secure even if available publicly, right? sync is a must have feature for many, myself included.

socceroos 11y ago

ROT13 fan?

PuffinBlue 11y ago
?
- socceroos 11y ago
  Encryption is as good as it's independent proofs. Even then, the proofs are only as good as the attention it gets from qualified, quality cryptographers. And again, only when used in a library that can independently prove it's algorithm and implementation is sound - open source. For everything important, there is OTP.
  - PuffinBlue 11y ago
    You're stating truisms really. And you trust OTP (quite rightly) - ergo you trust encryption. My personal trust point is properly implemented AES-256 with a slow hashing function.
    - socceroos 11y ago
      Correct. I wanted to qualify that you can't just 'trust encryption'. You must know what you're trusting, top to bottom; otherwise I would say that the trust is misplaced.

vithlani 11y ago

And this is exactly the point being missed by much of this discussion. Protect the db blob with one ridiculously long master password with crazy amount of PKBDF iterations and 2-FA.

nrser 11y ago

yeah... the synchronization for these services should be zero-knowledge. though maybe not the best idea, my vault should remain secure even if available publicly, right? sync is a must have feature for many, myself included.