rarrrrrr

11 ms·

61.
by rarrrrrr 13y ago
Thanks for your feedback and your interest in Crypton! First, for the record, from that Reddit AMA, Daniel isn't a SpiderOak founder and is no longer with the organization. Next, we throughly agree of the necessity for open sourcing ou
62.
by rarrrrrr 13y ago
Working with the Least Authority folks has been elaborately enjoyable. Highly recommended. I've started the long journey of reading the code and discussion history of their Tahoe-LAFS project -- action packed with fascinating details.
63.
by rarrrrrr 13y ago
SJCL had substantial peer review during its development, but I'm not aware of a public 3rd party audit from a security firm. Oh yeah, and before people with torches show up, let me clarify that is a Javascript based crypto product but
64.
by rarrrrrr 13y ago
By the way, once we've established confidence in the code directly included in the project, we're hoping to also arrange audits for some of the popular crypto libraries involved such as SJCL.
65.
Responsibly Bringing a new Cryptography Product to Market(spideroak.com)
74 points by rarrrrrr 13y ago|27 comments
66.
by rarrrrrr 13y ago
My city does a pretty good job saying "we like you just the way you are."
67.
by rarrrrrr 13y ago
I agree our ability to scale support is a problem. Very sorry it didn't work out for you. Unfortunately on our side it's a big challenge to provide detailed troubleshooting with individual users, especially if they are not payin
68.
by rarrrrrr 13y ago
I certainly understand the sentiment given recent events. :( For what it's worth, SpiderOak Blue is often purchased by enterprise customers as a "private cloud", where an organization can run the server side components loca
69.
by rarrrrrr 13y ago
Thanks for your support and your efforts are much appreciated. We also agree that SpiderOak needs to be entirely open, and hope to have that completed within the next year. Everything new we've started in the last several years (incl
70.
by rarrrrrr 13y ago
It's coming! Existing SpiderOak accounts all contain a 3072 bit RSA keypair, which is reserved for this future purpose. But it's not as simple as it seems. Things like garbage collection, and space accounting, and various race
71.
by rarrrrrr 13y ago
Another reputable organization in this space is the 20 year old Kansas City based http://water.org/
72.
by rarrrrrr 13y ago
If you happen to recall where you learned that acrylamide is found in raw foods, I'm curious to read about it. My understanding was that it was associated with the maillard reaction (i.e. cooking above 120F)
73.
by rarrrrrr 13y ago
FWIW, I prefer Silent Circle, created by the same team behind PGP. Glad to see more choices in the market though. :) https://silentcircle.com/
74.
by rarrrrrr 13y ago
Chrome include certificate pinning first described here, which offers some protection for MITM: http://www.imperialviolet.org/2011/05/04/pinning.html
75.
by rarrrrrr 13y ago
SpiderOak cofounder here. It's not really about the encryption directly; it's about the way the database design has to change to support zero knowledge (the server can no longer do the database work.) Things like garbage collecti
76.
by rarrrrrr 13y ago
I'm offering my interpretation of the OP's original words defining the terms of the challenge "I won't promise to log in if you can't provide a valid SSL certificate :)". So my read is that for this particular challenge there's only one "us
77.
by rarrrrrr 13y ago
FWIW, my reading of the OP is that it's stipulated that the user will check for the presence of a valid SSL session (i.e. with in browser visual indicators) before login. BTW, have been following your work on TACK with great interest.
78.
by rarrrrrr 13y ago
Brilliant! Perhaps it's just my scars showing, but I'm concerned about database system stability with active GPU hardware added to the box. I probably wouldn't add the GPU hardware to a master but rather do the queries that would benefit fr
79.
by rarrrrrr 14y ago
Also: https://github.com/SpiderOak/crypton/issues/27
80.
by rarrrrrr 14y ago
The crypto specs for the SpiderOak backup/sync product are here: https://spideroak.com/engineering_matters Crypton is an entirely new project in early stages. It's not production. It hasn't had any security review. We only started it a
81.
by rarrrrrr 14y ago
Close. It's not a key value store, but rather an object database (with design goals similar to ZODB[1]) You can use an Object DB like a key value store, but there's a much richer feature set available. You can also share objects securely w
82.
by rarrrrrr 14y ago
In the browser app scenario, we also declare on that very same page that the threat model is explicitly this: you're an application provider who doesn't want the liability of having a database of plaintext user supplied content. (I.e. prot
83.
by rarrrrrr 14y ago
Right now. https://spideroak.com/blog/20130221160525-announcing-penetra... 53 Bluxome Street, San Francisco, from 7 to 10 tonight. Come by if you like. We're cohosting the event with Phil Zimmerman and the Silent Circle team.
84.
by rarrrrrr 14y ago
FYI, our choices for upstream JS crypto libs aren't set in stone. We may ultimately go with SJCL -- we're not fully satisfied with the libs we're using. They need some cleanup in various areas if we do stick with them.
85.
by rarrrrrr 14y ago
Of course, but that's not the threat model we're protecting against. Note that we link to that article (and agree with it!) in the discussion. This isn't just for browser based products. The reference implementation is in JS and intended
86.
by rarrrrrr 14y ago
Great question! The fast and very technical answer is that you get search results on encrypted data by making liberal use of the cheap containers to automatically save indexes as the data is modified. But note how our timeline includes the
87.
by rarrrrrr 14y ago
Hello -- cofounder of SpiderOak here. We're at a launch event during RSA so responses will be slow, but I'll check back here later. Thanks for your interest!
88.
by rarrrrrr 14y ago
Obviously you've spent more time considering this, but on the off chance it's helpful: 1. Take payment in some other form. Get creative. 2. Link the infosec to the startup's revenue. In other words, make it something we can sell. Applica
89.
by rarrrrrr 14y ago
FYI, SpiderOak is intended more for power users. You can tell it to ignore files and folder by wildcards (and it does meaningful encryption.)
90.
by rarrrrrr 14y ago
Python w/ Gevent, Go, and Erlang have this.

More ›