Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wuala: Secure Cloud Storage

wuala.com

Post reply on HN
Print view View original

201–207 of 207 posts

Re: Wuala: Secure Cloud Storage

#201

Post by Pyramids »

okamiueru wrote: post #127
Pyramids wrote: post #25

Earlier quoted context omitted.

If you're concerned about your personal data, and not so much about targeted attacks against you, I'd say stay with Dropbox and just use EncFS. You can do this on Linux (and presumably OS X, as well) fairly easily. On Windows, there is a single-developer port of EncFS, which from what I've heard works fairly well: http://members.ferrara.linux.it/freddy77/encfs.html A quick search turns up a guide which (at first glan…

Playing the devils advocate here. What would stop the dropbox service from being able to collect the private keys on the user's computer?

Nothing. That's a risk you take when using any proprietary software, however.

I'd say the real world risk of this is (fairly) low, however if you're legitimately worried about it, you can use EncFS over a network share or FUSE file system, to your own systems. In which case you'd be using entirely open source software.

If you're that worried about security though, you'd probably be better off using a container based encryption method, anyway, as it wouldn't leak timestamps, file sizes and other data which could be sensitive. EncFS has some known issues with metadata leaking, but it's a decent solution for most general use cases.

Re: Wuala: Secure Cloud Storage

#202

Post by Pyramids »

rarrrrrr wrote: post #184
kijin wrote: post #174

Earlier quoted context omitted.

I have absolutely no intention to spread FUD about client-side encryption, and in fact I don't think Dropbox's speed advantage has anything to do with (lack of) encryption. Encryption shouldn't have any noticeable impact on sync speed, since modern CPUs can encrypt a file a hundred times over in the time it takes to upload/download it. I agree with you and suspect that it has more to do with crappy architecture. Anec…

SpiderOak cofounder here. It's not really about the encryption directly; it's about the way the database design has to change to support zero knowledge (the server can no longer do the database work.) Things like garbage collection have to happen client side. Described in detail here: https://spideroak.com/blog/20091026143000-why-and-how-spider... FYI, when SpiderOak first starts running, like any backup software, it…

Hello Alan,

I have a quick question for you which might be of interest to others as well:

Why isn't SpiderOak open source yet?

I've read your FAQ answer[1] on this, however it doesn't really give a concrete explanation, besides "soon" and "licencing concerns" which is definitely disappointing.

I currently use my own, EncFS based sync solution, however I'd love to be able to use SpiderOak, or a third party open source application which supported syncing with SpiderOak (if you'd ever consider exposing an API/Protocol which allowed such.)

This is the only reason I'm not using your service currently, however I love the concept and hope you'll take it into consideration. It's likely I'm not the only one with similar concerns.

[1]: https://spideroak.com/faq/questions/35/why_isnt_spideroak_op...

Re: Wuala: Secure Cloud Storage

#203

Post by kijin »

rarrrrrr wrote: post #184
kijin wrote: post #174

Earlier quoted context omitted.

I have absolutely no intention to spread FUD about client-side encryption, and in fact I don't think Dropbox's speed advantage has anything to do with (lack of) encryption. Encryption shouldn't have any noticeable impact on sync speed, since modern CPUs can encrypt a file a hundred times over in the time it takes to upload/download it. I agree with you and suspect that it has more to do with crappy architecture. Anec…

SpiderOak cofounder here. It's not really about the encryption directly; it's about the way the database design has to change to support zero knowledge (the server can no longer do the database work.) Things like garbage collection have to happen client side. Described in detail here: https://spideroak.com/blog/20091026143000-why-and-how-spider... FYI, when SpiderOak first starts running, like any backup software, it…

My hard drives are reasonably fast, so even with a quarter million files it doesn't take long to scan the filesystem. I have other backup software that scan the exact same folders and finish in less than 30 seconds. So I suspect that it's your journaling/unserializing system that takes up the bulk of the startup time.

Fortunately, I only need to start up SpiderOak once in a while, because nowadays I put my computers into hibernation instead of shutting them down and starting them up again. I also noticed that the more often I use SpiderOak, the less time it takes to start up, presumably because there's less delta to process. Also, as you said, once SpiderOak is up and running, it's relatively fast. Rest assured that the performance issues, although annoying, have not dissuaded me from renewing my SpiderOak Plus (100GB) account once again last month.

I also like the fact that SpiderOak's "Queue" and "Log" screens tell me exactly what it's doing at any given moment. Waiting becomes a lot more tolerable when I know what I'm waiting for. I hate backup tools that assume the user is too dumb to understand what's going on behind the scenes. Even Wuala's Upload/Download queue never seems to work properly.

Re: Wuala: Secure Cloud Storage

#204

Post by kijin »

objectivefs wrote: post #183
kijin wrote: post #174

Earlier quoted context omitted.

I have absolutely no intention to spread FUD about client-side encryption, and in fact I don't think Dropbox's speed advantage has anything to do with (lack of) encryption. Encryption shouldn't have any noticeable impact on sync speed, since modern CPUs can encrypt a file a hundred times over in the time it takes to upload/download it. I agree with you and suspect that it has more to do with crappy architecture. Anec…

Client-side encryption can be very fast when done right. For your use case a filesystem stored in the cloud might be a better solution, that way only the data you are using is downloaded to each machine and the writes are done immediately. Give ObjectiveFS[1] a try, the free preview is available for a few more days, and see how fast client-side encryption can be. [1] https://objectivefs.com

Interesting, but an all-cloud solution would seem to be a better fit for servers with fat pipes (especially EC2) than for individuals with crappy residential connections. I have fiber at home, though, so I might try it out sometime.

Re: Wuala: Secure Cloud Storage

#205

Post by tincholio »

sillysaurus wrote: post #126
kijin wrote: post #109

Seriously? Wuala is a service run by LaCie. LaCie is owned by Seagate, an American corporation. It doesn't matter where the servers are, because all the important decisions will be made in Cupertino, California. http://www.lacie.com/us/company/news/news.htm?id=10722 Now, client-side encryption is a much more interesting aspect of their service, but is it worth the trouble if Wuala's clunky client takes 100 times long…

Why not just store a TrueCrypt volume(s) in Dropbox?

It'd be better to use EncFS in this case, as it does per-file encryption. With TruCrypt, the whole volume file would need updating once you unmount it, if I understand correctly.

Re: Wuala: Secure Cloud Storage

#206

Post by dllthomas »

pbhjpbhj wrote: post #153
wcunning wrote: post #108

Earlier quoted context omitted.

Due to the manner in which data is client-side encrypted (password-based keys, password not stored on their servers), they can hand your (encrypted) data to any government with no ability to decrypt it. Now, depending on the outcome of some cases before US Courts right now, you might be compelled to provide the password to unencrypt the data. It's also worth noting that the password-based asymmetric encryption scheme…

As it's closed source isn't it entirely possible that the client keeps copies of the keys that are accessible on demand from the server end (I guess that counts as a backdoor of sorts).

Open source is an incomplete defense against this - I don't know of a way of proving what software is running on a remote host.

Re: Wuala: Secure Cloud Storage

#207

Post by levosmetalo »

datagramm wrote: post #110
levosmetalo wrote: post #11

Earlier quoted context omitted.

I've been using it for almost a year now on my Windows, Linux and Android. Didn't have any issues so far. I would recommend the service to everyone concerned with privacy. The only thing that one can be suspicious is whether they are transferring your key or not. But, at least they claim your data is safe and encrypted, while Dropbox, GDrive and similar services don't even pretend that they encrypt your data. However…

>> don't even pretend that they encrypt your data. would it make you happier if they kept their services the same, but just pretended to introduce encryption? ;-)

>> don't even pretend that they encrypt your data.

> would it make you happier if they kept their services the same, but just pretended to introduce encryption? ;-)

No it wouldn't. What I wanted to say is that Wuala at least claims that they do client side encryption. I believe them, but someone else doesn't have to. So, data being safe with Wuala has probability between 0-100%, while data being safe with Dropbox has probability of 0.

Post reply on HN