[deleted]
SpiderOakONE – Zero Knowledge Cloud Storage
41–50 of 93 posts
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#42Earlier quoted context omitted.
Following to their architectural design, they do not get access to any encryption key and no key leaves user device in unprotected form. Is not this enough to be advertised as "zero-knowledge" service provider?
As a technical term zero-knowledge has a very specific meaning [1] and is not what they are using. Here it is just a marketing term and may confuse people knowing about the technical meaning but that is certainly only a very small fraction of the population and so it is probably not a huge issue. [1] https://en.wikipedia.org/wiki/Zero-knowledge_proof
That's kind of bullshit though, you can't claim 2 common words from the English language in order to only describe a concept many of us don't understand. I'm a software developer, have been for 15 years, I've stayed fairly awake in college during my cryptography classes, have implemented hashing functions (mentioning this because such a history already place somebody in the 0.01%) and I've never heard of "zero knowledge proof".
Not surprisingly, the link you've given is about a phrase with 3 words in it, not 2.
And while I've always been annoyed about overloads of "open source", at least that's a words association that you won't hear from non-technical folks and that wasn't in use before OSI happened. And even so, note that OSI couldn't trademark it.
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#43I've liked SpiderOak's focus on privacy and security, but find the pricing to be expensive at every tier, and the space available not in tune for my needs (a jump from 100GB to 250GB, which is kinda ok, and then to a whopping 1TB).
Thanks for your feedback. Just as a data point for comparison, Dropbox charges $100/year for 1000 GB, but they don't do meaningful encryption, and therefore can de-duplicate your files vs. the files of all their other customers, which significantly reduces their storage costs (and allows for some entertaining information leakages!) SpiderOak charges $120/year for 1000 GB. Edit to add: SpiderOak deduplicates files wit…
How do you "dedupe within a single user's account" without violating "zero knowledge"?
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#44Earlier quoted context omitted.
SpiderOak founder here... A few cryptographers have noticed SpiderOak's marketing term Zero Knowledge is inconsistent with the academic definition. Maybe it doesn't mean what we think it means[1]? SpiderOak was one of the first companies to use this phrase commercially and the need has only grown stronger. At the heart of the issue is the difficulty for end users to decipher the terms cloud vendors use to describe th…
Thank you for the clarification. I really appreciate all the hard work you guys do in trying to combat unwarranted breaches of privacy. I've had my reservations about companies that make such bold claims as yours but I will look into your platform more and give the free trial a whirl.
I think it is worth giving SpiderOak a try. I've been a SpiderOak customer for several years, and have been quite satisfied with it. The UI wasn't the best at first, but it has gotten better recently. I haven't used rsync.net for a while, but their service is great too. It just takes a little more work to set up.
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#45Spider Oak - Please stop describing your service as "Zero Knowledge" unless and until you deploy a service that is actually is. E2E encryption great, but it is not the same thing.
SpiderOak founder here... A few cryptographers have noticed SpiderOak's marketing term Zero Knowledge is inconsistent with the academic definition. Maybe it doesn't mean what we think it means[1]? SpiderOak was one of the first companies to use this phrase commercially and the need has only grown stronger. At the heart of the issue is the difficulty for end users to decipher the terms cloud vendors use to describe th…
I really want to give you guys money, but can't trust you without having client and server side source. I need client side source so third parties can freely audit your work. I need server side source so I can store my data at some random colo and wrap the rack in tinfoil (more realisitcally, so I know I can just switch providers if you are out of business in ten years).
Have you considered licensing your stuff using the BSL: http://monty-says.blogspot.com/2016/08/applying-business-sou...
This would let me pay you to continue your (very important!) work, and let me recommend your service to others.
[edit: For people not familiar with the BSL: It makes it easy to say things like:
"This release of the software is free for the first 100MB, then $10/TB after that. Licensing the software gives you non-transferrable rights similar to a BSD license. On Jan 2, 2027, the above usage restriction will expire, leaving the software with a BSD-style license"
You bump the expiry date on each release, so cheapskates have to wait 10 years for new features, and the developers have to continuously improve the software to maintain a revenue stream.]
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#46Spider Oak - Please stop describing your service as "Zero Knowledge" unless and until you deploy a service that is actually is. E2E encryption great, but it is not the same thing.
SpiderOak founder here... A few cryptographers have noticed SpiderOak's marketing term Zero Knowledge is inconsistent with the academic definition. Maybe it doesn't mean what we think it means[1]? SpiderOak was one of the first companies to use this phrase commercially and the need has only grown stronger. At the heart of the issue is the difficulty for end users to decipher the terms cloud vendors use to describe th…
I am a paying customer for storage and use your free Encryptr app and service.
I have no problem with your use of the phrase zero knowledge, but I understand the complaints.
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#47does anybody know if www.sync.com is any better regarding their mobile apps ? They do also client-site,end-to-end encryption but their white paper only mentions their web-app which apparently does everything on the client.
You should also check out Tresor End to End Encryption
[1] https://tresorit.com/
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#48Earlier quoted context omitted.
Thanks for your feedback. Just as a data point for comparison, Dropbox charges $100/year for 1000 GB, but they don't do meaningful encryption, and therefore can de-duplicate your files vs. the files of all their other customers, which significantly reduces their storage costs (and allows for some entertaining information leakages!) SpiderOak charges $120/year for 1000 GB. Edit to add: SpiderOak deduplicates files wit…
How do you "dedupe within a single user's account" without violating "zero knowledge"?
Great question. The database work is all done client side.
Here's an explanation of the architecture I wrote in 2009: https://spideroak.com/articles/why--how-spideroak-architectu...
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#49Earlier quoted context omitted.
Following to their architectural design, they do not get access to any encryption key and no key leaves user device in unprotected form. Is not this enough to be advertised as "zero-knowledge" service provider?
As a technical term zero-knowledge has a very specific meaning [1] and is not what they are using. Here it is just a marketing term and may confuse people knowing about the technical meaning but that is certainly only a very small fraction of the population and so it is probably not a huge issue. [1] https://en.wikipedia.org/wiki/Zero-knowledge_proof
Your link is for zero-knowledge proof. They aren't claiming anything in the realm of proofs, zero-knowledge or not.
If "zero-knowledge" implicitly meant "zero-knowledge proof", there would be no reason to ever use the latter phrase. Zero-knowledge is an adjective. It's a modifier. It's the "proof" part in "zero-knowledge proof" that's important in describing what it is. "Zero-knowledge" is a property of the method employed.
The irony is that, wrt the original comment, it's end-to-end encryption that would be a misleading and misapplied label.
I'm not affiliated with this company and I've never even used this service before, and yet it's immediately clear what zero-knowledge means in the context of a cloud storage provider: you never need divulge your keys, so the question of whether you trust your provider or not is moot.
Back when Firefox Sync first launched, I was chasing the idea of referring to it and any similar service as "zero-trust" systems. But building a service and referring to it as "zero-knowledge cloud storage" is totally acceptable.
Re: SpiderOakONE – Zero Knowledge Cloud Storage
#50I really want to use this, but the mobile app (Android) really lacks very basic functionality - uploading files.
I recently stopped renewing my Dropbox on an annual license and will switch once I find a good alternative..