ZumoDrive rolls a hard six
daemonology.net
ZumoDrive rolls a hard six
1–10 of 74 posts
Re: ZumoDrive rolls a hard six
#2I feel bad about bashing a YC company -- even though I'm not part of YC, I feel that I've been on news.YC for long enough to be at least somewhat part of the YC community -- but seriously, this is your idea of security? I'm sure you can do better.
Re: ZumoDrive rolls a hard six
#3The problem I have with ZumoDrive's security claims is not that they're insecure -- they sort of have to be, given the feature set they have -- it's just that their claims are theatrical.
They could make things so that data can only be accessed right when the user enters their password, without having to give up the cross-user deduplication that I presume they'd perform, but ultimately, if you want a convenient online storage service, with data meant to be shared across computers, and browsable online or in other convenient circumstances, going with full-blown Tarsnap-like security is going to be a pain.
Re: ZumoDrive rolls a hard six
#4What's wrong with using client-authenticated SSL with predistributed keys (and only trusting the pre-distributed keys)?
I trust a well-tested TLS implementation more than I trust whatever crypto I can manage to write myself.
Also, to provide the features ZumoDrive does, they have to have access to your unencrypted data - don't they? They aren't even attempting to keep your data safe from their server (and never claim to). It's not the trade-off I would chose for my company's production data (my company - Postabon - uses Tarsnap for that ;-)) - but it's perfectly valid for my low-sensitivity personal files (I use Dropbox for most of my personal stuff).
(Incidentally, as someone with active TS clearance who has written 'military grade' code currently deployed on JWICS, 'military grade' doesn't mean that much in terms of crypto - at least for the 'application level' stuff I worked on ...).
Re: ZumoDrive rolls a hard six
#5What's wrong with using client-authenticated SSL with predistributed keys (and only trusting the pre-distributed keys)? I trust a well-tested TLS implementation more than I trust whatever crypto I can manage to write myself. Also, to provide the features ZumoDrive does, they have to have access to your unencrypted data - don't they? They aren't even attempting to keep your data safe from their server (and never claim…
What's wrong with using client-authenticated SSL with predistributed keys (and only trusting the pre-distributed keys)?
If you set up your own CA and you distribute a CA keyring with only that CA key, you avoid the what-about-China problem. But you still have a heck of a lot of moving parts which can break. (EDIT: Also, I'm 99% certain that ZumoDrive isn't doing this.)
I trust a well-tested TLS implementation more than I trust whatever crypto I can manage to write myself.
You should come to my conference talk, "everything you need to know about crypto in 1 hour". :-)
Also, to provide the features ZumoDrive does, they have to have access to your unencrypted data - don't they?
To be honest, I haven't looked at exactly what features ZumoDrive has. I just saw them making bogus claims about their security, and decided to call them on it.
Re: ZumoDrive rolls a hard six
#6What's wrong with using client-authenticated SSL with predistributed keys (and only trusting the pre-distributed keys)? I trust a well-tested TLS implementation more than I trust whatever crypto I can manage to write myself. Also, to provide the features ZumoDrive does, they have to have access to your unencrypted data - don't they? They aren't even attempting to keep your data safe from their server (and never claim…
What's wrong with using client-authenticated SSL with predistributed keys (and only trusting the pre-distributed keys)? If you set up your own CA and you distribute a CA keyring with only that CA key, you avoid the what-about-China problem. But you still have a heck of a lot of moving parts which can break. (EDIT: Also, I'm 99% certain that ZumoDrive isn't doing this.) I trust a well-tested TLS implementation more th…
If you set up your own CA and you distribute a CA keyring with only that CA key, you avoid the what-about-China problem. But you still have a heck of a lot of moving parts which can break.
It's not fun - but I have done it before. I would still contend that setting up a CA and distributing a keyring is easier and less likely to be insecure than trying to write actual secure crypto code (at least for most normal coders like myself - people like djb or cperciva are excluded ;-)).
You should come to my conference talk, "everything you need to know about crypto in 1 hour". :-)
Boy, I wish something like that existed. Every time I'm starting to feel like I know something, I learn about a new type of attack (a side-channel that leaks more than I thought possible, a length-extension that apparently violates the oversimplified hash properties I knew, etc) that makes me feel like an idiot.
Re: ZumoDrive rolls a hard six
#7Earlier quoted context omitted.
What's wrong with using client-authenticated SSL with predistributed keys (and only trusting the pre-distributed keys)? If you set up your own CA and you distribute a CA keyring with only that CA key, you avoid the what-about-China problem. But you still have a heck of a lot of moving parts which can break. (EDIT: Also, I'm 99% certain that ZumoDrive isn't doing this.) I trust a well-tested TLS implementation more th…
If you set up your own CA and you distribute a CA keyring with only that CA key, you avoid the what-about-China problem. But you still have a heck of a lot of moving parts which can break. It's not fun - but I have done it before. I would still contend that setting up a CA and distributing a keyring is easier and less likely to be insecure than trying to write actual secure crypto code (at least for most normal coder…
You should come to my conference talk, "everything
you need to know about crypto in 1 hour". :-)
It does! I'm giving that talk at BSDCan'10 in May: http://news.ycombinator.com/item?id=1179569
Re: ZumoDrive rolls a hard six
#8Earlier quoted context omitted.
If you set up your own CA and you distribute a CA keyring with only that CA key, you avoid the what-about-China problem. But you still have a heck of a lot of moving parts which can break. It's not fun - but I have done it before. I would still contend that setting up a CA and distributing a keyring is easier and less likely to be insecure than trying to write actual secure crypto code (at least for most normal coder…
You should come to my conference talk, "everything you need to know about crypto in 1 hour". :-) Boy, I wish something like that existed It does! I'm giving that talk at BSDCan'10 in May: http://news.ycombinator.com/item?id=1179569
Nice - I thought you were being sarcastic!
I don't know if I can make it in person, but I sure hope they tape it and put it online :-D
Re: ZumoDrive rolls a hard six
#9Earlier quoted context omitted.
You should come to my conference talk, "everything you need to know about crypto in 1 hour". :-) Boy, I wish something like that existed It does! I'm giving that talk at BSDCan'10 in May: http://news.ycombinator.com/item?id=1179569
Nice - I thought you were being sarcastic! I don't know if I can make it in person, but I sure hope they tape it and put it online :-D
If nothing else, I'll put my slides online -- but coming in person would give you the opportunity to hear me speak and ask questions at the talk, too.
Re: ZumoDrive rolls a hard six
#10Earlier quoted context omitted.
Nice - I thought you were being sarcastic! I don't know if I can make it in person, but I sure hope they tape it and put it online :-D
If nothing else, I'll put my slides online -- but coming in person would give you the opportunity to hear me speak and ask questions at the talk, too.
Sweet. I'll be looking forward to the slides, or if there's a video of the talk. I feel like I don't know enough at all about security.