Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wuala: Secure Cloud Storage

wuala.com

Post reply on HN
Print view View original

111–120 of 207 posts

Re: Wuala: Secure Cloud Storage

#111

Post by jonknee »

danso wrote: post #72

So honest question, but how is having your data stored in Switzerland (where Wuala is based) any different than having it in the US? Or is it just the promise of local encryption that makes it safer? Some purported info about data protection for Switzerland: http://www.dataprotection.ch/en/disclosing-personal-data.asp > Restrictions on disclosure The DPA does not permit the disclosure of sensitive data or personality…

I believe it's out of reach from the NSA letters. If it's encrypted and they don't have the keys it doesn't really matter, but I guess it looks good on a feature matrix.

Re: Wuala: Secure Cloud Storage

#112

Post by lucian1900 »

simgidacav wrote: post #6

Not to be cynic, but what prevents those guys from putting a backdoor as well? Yeah, sure, Swiss guys are good. Are they? In the end, IMHO, the only software which can be trusted is the FOSS. From this perspective Dropbox is good: the client is open source. Of course nothing is encrypted in there.

Dropbox's client is not open source by any stretch of the imagination.

Re: Wuala: Secure Cloud Storage

#113

Post by Keyframe »

gtt wrote: post #92
Keyframe wrote: post #84

Earlier quoted context omitted.

Data being encrypted doesn't mean it can't be archived in that Utah data center. What capabilities they have there and what they do with it, we don't know. Substantial decryption breakthrough was hinted at in several reports, but what it is exactly - we have no idea.

>> Substantial decryption breakthrough was hinted at in several reports, but what it is exactly - we have no idea. Could you provide a link to those hints, please?

This is the first one that comes to my mind: http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/al...

But “this is more than just a data center,” says one senior intelligence official who until recently was involved with the program. The mammoth Bluffdale center will have another important and far more secret role that until now has gone unrevealed. It is also critical, he says, for breaking codes. And code-breaking is crucial, because much of the data that the center will handle—financial information, stock transactions, business deals, foreign military and diplomatic secrets, legal documents, confidential personal communications—will be heavily encrypted. According to another top official also involved with the program, the NSA made an enormous breakthrough several years ago in its ability to cryptanalyze, or break, unfathomably complex encryption systems employed by not only governments around the world but also many average computer users in the US. The upshot, according to this official: “Everybody’s a target; everybody with communication is a target.”

Re: Wuala: Secure Cloud Storage

#114

Post by claudius »

shin_lao wrote: post #70
fmavituna wrote: post #68

Earlier quoted context omitted.

You can see the client code and confirm that it actually encrypts all of the data and use your own copy rather than their binaries. Technically if the client is not sending not encrypted data and encrypts without a foul, then nothing they can do on the server-side can cause leaking your data.

Just two ideas on top of my head: Through auto updates you can make sure that you get the backdoored version or you can have an exploit within the software to allow "silent" remote updates (good luck finding that). So well... Either you do it end to end, or you trust the third party.

Nobody sane wants software to auto-update, especially not security-relevant software. This is in particular true if you reviewed the source code of the software at one point in time.

Furthermore, for the software to be able to even auto-update, it would have to be able to change its own binary. I don’t know how this particular piece of software works, but it is possible to run FUSE ‘drivers’ as a user on Linux, with the binary safely sitting in /usr/bin, hence removing any possibility to auto-update (if you don’t do shady tricks like placing an ‘updated’ binary somewhere and changing the user’s PATH – and even that could – in theory – be avoided by mounting all user-writeable things noexec).

Re: Wuala: Secure Cloud Storage

#115

Post by squidi »

greyman wrote: post #89
joewee wrote: post #36

How about Dropbox + TrueCrypt + Automount? Files are decrypted in memory, files you need to share you can keep in unencrypted format.

I was thinking about this solution, and I also have a truecrypt drive (locally). But if you changed just one file in the truecrypted drive, shouldn't then Dropbox re-sync the whole encrypted drive?

Yes, that's correct. So if you have a 1GB TrueCrypt container the whole thing needs to be uploaded again.

Another annoyance is that you cannot change the size of a drive after you create it [1] and it doesn't shrink to fit the data either.

[1] http://www.truecrypt.org/docs/?s=issues-and-limitations

Re: Wuala: Secure Cloud Storage

#116

Post by claudius »

maggit wrote: post #9

I recently tried replacing Dropbox with Wuala because of privacy concerns. I failed, and in the process realized how successful Dropbox has been in creating an awesome user experience! I'm still looking for a locally encrypted Dropbox-alternative. So if any of you are making one, please speak up :) (Edit) I should specify that it was the user experience that made me give up on Wuala, and any proper Dropbox alternativ…

git-annex has local encryption for specific remotes (i.e. you can add a remote and say ‘encrypt data before putting it there’, and then add another remote, such as a USB key, and don’t encrypt data on it). I haven’t used it in a while, but it is becoming more and more mature, methinks.

Re: Wuala: Secure Cloud Storage

#117

Post by VuongN »

The problem here is: the people who has data (Wuala) also determine how the files are encrypted.

No box is ever unbreakable, however, the chance of breaking it is much bigger if you have the locksmith holding on to the box.

I've talked a little bit about this in my humble blog post not too long ago about a simplistic view of security in the cloud: http://vuongnguyen.com/personal-business-cloud-security.html.

-V.

Re: Wuala: Secure Cloud Storage

#118

Post by annnnd »

da_n wrote: post #98
sabret00the wrote: post #33

It's from Lacie, so no thank you. I bought a Lacie drive and proceeded to copy all my stuff onto it. Before I could get comfortable with it (so within the first six months of purchase) and before I backed up my stuff, the drive failed. I contacted Lacie about it and they proceeded to try and sell me a service whereby they'd recover my data for €300. That would've brought my total spend on the drive up to around £400.…

You had 6 months and you didn't back-up your stuff? Why do you feel there is any blame to be laid at Lacie for this except for the mechanical failure which should have been under warranty? £300 is pretty reasonable for data recovery, it is only meant to be required when the user was dumb enough to not have a single backup. You put all your personal memories, music, films and professional data on one drive and expect…

$300 (which is even more reasonable. Otherwise +1.

Re: Wuala: Secure Cloud Storage

#119

Post by lawl »

quchen wrote: post #94
joewee wrote: post #36

How about Dropbox + TrueCrypt + Automount? Files are decrypted in memory, files you need to share you can keep in unencrypted format.

I've been doing this with a small volume (1 MiB), but it always kept me wondering how much traffic a minor change in an encrypted volume causes - even a single bit flip should drastically change the container if the encryption is good. I wouldn't want to upload for an hour each time I see a typo in my files.

No. From the truecrypt FAQ [0]:

> The ciphertext block size used by TrueCrypt is 16 bytes (i.e., 128 bits).

Meaning one bitflip should only sync 16 bytes since dropbox only transmits deltas. Of course this now depends on dropbox' delta sync implementation.

From a quick google search [1]:

> For what it's worth, Dropbox claims to create hashes on every 4MB of each file. That way, if you change a contiguous 2MB of a 100MB file, it will likely only need to upload 4MB (or 8MB if you cross into a second 4MB block) to re-sync the file.

So worst case if a bitflip happens to change a truecrypt block that doesn't align with dropbox' chunks you're looking at around 8MiB. That's still quite an amout for a bitflip but i think it's feasible with todays connection speeds.

[0] http://www.truecrypt.org/faq

[1] http://serverfault.com/questions/52861/how-does-dropbox-vers...

Re: Wuala: Secure Cloud Storage

#120

Post by nodata »

phxql wrote: post #104
nodata wrote: post #88

Earlier quoted context omitted.

BoxCryptor is most definitely not fully compatible with EncFS - it doesn't even support the default filename encoding option that encfs uses.

Some older version supports that. Maybe they changed their license model, but it definitely had support for that in the past.

Yes, it was supported back when they used encfs, but now they've switched to their own internal rewrite which broke compatibility.
Post reply on HN