3 ms·

I'm cautiously optimistic about this, but won't be using it to manage passwords for anything important -- yet. On one hand they claim to be in league with Spid

I'm cautiously optimistic about this, but won't be using it to manage passwords for anything important -- yet. On one hand they claim to be in league with SpiderOak (how, I'm not sure), which surfaced after the Snowden leaks as a zero-knowledge encrypted alternative to Dropbox/Google Drive. On the other hand, it's a cloud-based solution which to me is still a cause for caution, and I'd feel more reassured if someone (who knows JavaScript and security better than I do) conducted an audit of this. Hoping for the best for Encryptr, but I'll have to keep it on the sidelines until it's more battle-tested.

shuzchen 11y ago
I used to (as recent as a couple months back) work at SpiderOak. Encryptr is connected to SpiderOak in a couple ways. First, it's build on top of crypton (https://crypton.io/ https://crypton.io/) which is a SpiderOak research project. Second, the dev (https://github.com/devgeeks https://github.com/devgeeks) works for SpiderOak (see his github teams or https://spideroak.com/about/team-&-leadership https://spideroak.com/about/team-&-leadership). Encryptr was a side project of his that he started in his spare time (to mess around with crypton), though obviously SpiderOak is now interested in its success (since it's one of the first/only crypton projects live in the wild). Some other notes: SpiderOak didn't surface after the Snowden leaks. It was around at the same time that dropbox started. However, the Snowden leaks did prompt a lot more interest in zero-knowledge cloud services, so if you mean "surface" as in "became more popular with the public" you're right on those lines. Also, while I'm not sure if Encryptr has been audited or not, the Crypton project itself has been at least a couple of times. See https://crypton.io/docs/security/audits.html https://crypton.io/docs/security/audits.html
feld 11y ago
looks like at least one of the devs works on the SpiderOak team according to github membership
sarciszewski 11y ago
> On the other hand, it's a cloud-based solution which to me is still a cause for caution, and I'd feel more reassured if someone (who knows JavaScript and security better than I do) conducted an audit of this. I can extend an offer to them on behalf of Paragon Initiative Enterprises and, if it's accepted, post our findings on HN at a later date.
- verandaguy 11y ago
  That'd probably help them out hugely regardless of the results. I'd be interested in reading the findings if/when they're posted.

shuzchen 11y ago

I used to (as recent as a couple months back) work at SpiderOak. Encryptr is connected to SpiderOak in a couple ways. First, it's build on top of crypton (https://crypton.io/ https://crypton.io/) which is a SpiderOak research project. Second, the dev (https://github.com/devgeeks https://github.com/devgeeks) works for SpiderOak (see his github teams or https://spideroak.com/about/team-&-leadership https://spideroak.com/about/team-&-leadership). Encryptr was a side project of his that he started in his spare time (to mess around with crypton), though obviously SpiderOak is now interested in its success (since it's one of the first/only crypton projects live in the wild). Some other notes: SpiderOak didn't surface after the Snowden leaks. It was around at the same time that dropbox started. However, the Snowden leaks did prompt a lot more interest in zero-knowledge cloud services, so if you mean "surface" as in "became more popular with the public" you're right on those lines. Also, while I'm not sure if Encryptr has been audited or not, the Crypton project itself has been at least a couple of times. See https://crypton.io/docs/security/audits.html https://crypton.io/docs/security/audits.html

feld 11y ago

looks like at least one of the devs works on the SpiderOak team according to github membership

sarciszewski 11y ago

> On the other hand, it's a cloud-based solution which to me is still a cause for caution, and I'd feel more reassured if someone (who knows JavaScript and security better than I do) conducted an audit of this. I can extend an offer to them on behalf of Paragon Initiative Enterprises and, if it's accepted, post our findings on HN at a later date.

verandaguy 11y ago
That'd probably help them out hugely regardless of the results. I'd be interested in reading the findings if/when they're posted.