I've liked SpiderOak's focus on privacy and security, but find the pricing to be expensive at every tier, and the space available not in tune for my needs (a jump from 100GB to 250GB, which is kinda ok, and then to a whopping 1TB).
SpiderOakONE – Zero Knowledge Cloud Storage
31–40 of 93 posts
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#32Earlier quoted context omitted.
SpiderOak founder here... A few cryptographers have noticed SpiderOak's marketing term Zero Knowledge is inconsistent with the academic definition. Maybe it doesn't mean what we think it means[1]? SpiderOak was one of the first companies to use this phrase commercially and the need has only grown stronger. At the heart of the issue is the difficulty for end users to decipher the terms cloud vendors use to describe th…
This came up in a previous thread (can't find atm) and I suggested alternate, more cryptographically correct terms: "provider-obscured" and "homomorphic" (this is like homomorphic encryption, but where the only operation allowed is retrieval).
Thanks for jumping in with suggestions. It's actually a harder problem than it seems! I have a feeling "provider-obscured" and "homomorphic" (while accurate!) are significantly less accessible to end users. I'll try to break it down:
Do end users talk about the services they purchase using the word "provider"? Is for example, Facebook or Twitter commonly referred to as a social media "provider?" The most common example I can think of is ISP, but I rarely hear non technical people say "ISP". They say something like "I get Internet from Time Warner" instead.
Is "obscured" a commonly used, highly accessible word? Can you think of a few popular movies or books with that word in the title? Is it commonly used in news headlines?
So the proposal is a hyphenated phrase of these two uncommon words. I think it's likely "Zero Knowledge" would crush "Provider-Obscured" in an A/B test. Ditto for "Homomorphic."
Seeing highly technical terms in headings makes non technical people believe that the software is complex and hard to use, and is therefore not for them. IMO, this is one of the classic failings of security products in general. It needs more study.
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#33I've liked SpiderOak's focus on privacy and security, but find the pricing to be expensive at every tier, and the space available not in tune for my needs (a jump from 100GB to 250GB, which is kinda ok, and then to a whopping 1TB).
Thanks for your feedback.
Just as a data point for comparison, Dropbox charges $100/year for 1000 GB, but they don't do meaningful encryption, and therefore can de-duplicate your files vs. the files of all their other customers, which significantly reduces their storage costs (and allows for some entertaining information leakages!)
SpiderOak charges $120/year for 1000 GB.
Edit to add: SpiderOak deduplicates files within a single user's account (i.e. copies are free, and if you add another layer to a photoshop file and re-save, it won't take up the full space to archive both versions) but it is not possible [1] for us to deduplicate data across multiple users.
[1] https://spideroak.com/articles/why-spideroak-doesnt-deduplic...
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#34Earlier quoted context omitted.
This came up in a previous thread (can't find atm) and I suggested alternate, more cryptographically correct terms: "provider-obscured" and "homomorphic" (this is like homomorphic encryption, but where the only operation allowed is retrieval).
Thanks for jumping in with suggestions. It's actually a harder problem than it seems! I have a feeling "provider-obscured" and "homomorphic" (while accurate!) are significantly less accessible to end users. I'll try to break it down: Do end users talk about the services they purchase using the word "provider"? Is for example, Facebook or Twitter commonly referred to as a social media "provider?" The most common examp…
Well said and I encourage you to continue promoting your product with this strategy. Being overly precise with lingo will result in a worse world where only domain experts understand what's going on.
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#35Earlier quoted context omitted.
This came up in a previous thread (can't find atm) and I suggested alternate, more cryptographically correct terms: "provider-obscured" and "homomorphic" (this is like homomorphic encryption, but where the only operation allowed is retrieval).
Thanks for jumping in with suggestions. It's actually a harder problem than it seems! I have a feeling "provider-obscured" and "homomorphic" (while accurate!) are significantly less accessible to end users. I'll try to break it down: Do end users talk about the services they purchase using the word "provider"? Is for example, Facebook or Twitter commonly referred to as a social media "provider?" The most common examp…
Thanks for the explanation of your thinking there. FWIW, I don't think (contra the other posters) that it's that much of a stretch (of standard terminology) to call this "Zero knowledge" -- you are, after all, preventing information from flowing in a certain direction, just like in the ZK proofs.
With that said, what about "opaque" instead of "obscured" and "host" or "cloud" instead of "provider"?
Host-Opaque Cloud Storage
Cloud-Obscured Cloud Storage (okay, bad acronym)
(And I know it's kind of late for a name change anyway.)
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#36Earlier quoted context omitted.
The issue is not you vs. other companies; it's you vs 25+ years of cryptographic literature. > no company has yet been shameless enough to deceptively use the term Zero Knowledge. Except you guys? Why use the phrase "zero knowledge" when you fully know that it has a predefined meaning? Call it no information, no leakage, zero leakage, whatever, but why the one term that is already used to refer to a different concept…
Thanks for the feedback. For what it's worth, we did try a bunch of alternative wordings, and Zero Knowledge was the phrase that non technologists found most accessible. We prioritized making the explanation clear to non-experts vs. to the community of cryptographers.
I believe your explanation but it still strikes me as the wrong thing to do.
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#37They've been around for a while and are highly regarded. The one thing that makes their privacy weak is: The software involved in the encryption/password handling is not open source. We have only their word for it that they are not snooping or letting anyone else snoop. If you're willing to do the extra work, you can get a cloud service like Dream Objects, and use software like duply/duplicity to store your files onl…
"If you're willing to do the extra work, you can get a cloud service like Dream Objects, and use software like duply/duplicity to store your files online and encrypted. You may lose some flexibility, though." I encourage you to look into borg backup[1][2] which appears to have replaced duplicity as the de facto standard for "robust backups that the provider knows nothing about". This is really the direction you look…
I use borg on rsync.net (and I just noticed the second link is to my post), and I'd recommend it strongly. Basically, if you need to back stuff up, use borg, period.
Rsync.net have also been very good and competitively priced, as per the above link. I can recommend them as well. (no affiliation with either product).
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#38Earlier quoted context omitted.
The issue is not you vs. other companies; it's you vs 25+ years of cryptographic literature. > no company has yet been shameless enough to deceptively use the term Zero Knowledge. Except you guys? Why use the phrase "zero knowledge" when you fully know that it has a predefined meaning? Call it no information, no leakage, zero leakage, whatever, but why the one term that is already used to refer to a different concept…
Thanks for the feedback. For what it's worth, we did try a bunch of alternative wordings, and Zero Knowledge was the phrase that non technologists found most accessible. We prioritized making the explanation clear to non-experts vs. to the community of cryptographers.
This doesn't feel like the correct solution.
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#39@rarrrrrr - Do you have a more precise timeline of when the SpiderOak Notes App will be launched in 2017? Would love to try it out as I'm getting tired of various issues w/ Evernote and haven't been able to find a good alternative yet.
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#40@rarrrrrr - Do you have a more precise timeline of when the SpiderOak Notes App will be launched in 2017? Would love to try it out as I'm getting tired of various issues w/ Evernote and haven't been able to find a good alternative yet.
Thanks for asking! I'm really excited about a ZK note app!
We haven't yet determined the priority of this vs. other projects in 2017. If you haven't already, please signal your interest below[1].
So far it is a prototype, although it is based on the already proven code used in Semaphor[2], our encrypted group chat and file sharing application, so it's "just" a bunch of UI work now :-)
[1] https://spideroak.com/about/noteapp-signup [2] https://spideroak.com/solutions/semaphor/business/tour