End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#1

Post by dogtype » Thu, Oct 10, 2024, 1:00 PM UTC

End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem
brokencloudstorage.info

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#2

Post by java-man » Thu, Oct 10, 2024, 5:09 PM UTC

I want to see the response from sync.com on this, especially about

  Unauthenticated Key Material

  Unauthenticated Public Keys

attacks.

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#3

Post by iknowstuff » Thu, Oct 10, 2024, 5:18 PM UTC

curious about iCloud with Advanced Data Protection enabled

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#4

Post by [deleted] » Thu, Oct 10, 2024, 5:55 PM UTC

[deleted]

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#5

Post by megous » Thu, Oct 10, 2024, 6:34 PM UTC

That was a good skim for me as someone who implemented one of the first independent mega.nz clients. Useful to know especially about structure authentication and ability to swap metadata on files and move files/chunks of files around when server is compromised, when there's no e2e authentication for this. Lots of traps all around. :)

Looks like the safest bet is still to just tar everything and encrypt/sign the result in one go.

I wonder how vulnerable eg. Linux filesystem level encryption is to these kinds of attacks...

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#6

Post by cobbzilla » Thu, Oct 10, 2024, 6:45 PM UTC

The sad state of E2E encryption for cloud storage is a big part of why I wrote mobiletto [1]. It supports transparent client-side encryption for S3, B2, local storage and more. Rekeying is easy- set up a new volume, mirror to it, then remove old volume.

[1] https://github.com/cobbzilla/mobiletto

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#7

Post by fguerraz » Thu, Oct 10, 2024, 6:56 PM UTC

It's too bad they focused on commercial closed-source solutions providers. The ecosystem would have really benefited if they had put their efforts to, for example, do the same work with NextCloud.

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#8

Post by triyambakam » Thu, Oct 10, 2024, 6:57 PM UTC

Hmm, I wish the author had reviewed Proton. I think it's kind of seen as a meme here? But I heavily rely on it and generally the Proton ecosystem is getting better and better from a UX perspective

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#9

Post by kientuong114 » Thu, Oct 10, 2024, 7:00 PM UTC

fguerraz wrote: post #7

It's too bad they focused on commercial closed-source solutions providers. The ecosystem would have really benefited if they had put their efforts to, for example, do the same work with NextCloud.

NextCloud has already been analyzed by some great people (https://eprint.iacr.org/2024/546).

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#10

Post by canadiantim » Thu, Oct 10, 2024, 7:47 PM UTC

triyambakam wrote: post #8

Hmm, I wish the author had reviewed Proton. I think it's kind of seen as a meme here? But I heavily rely on it and generally the Proton ecosystem is getting better and better from a UX perspective

I think Proton is more viewed as a honeypot