Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

dougbelshaw.com

Post reply on HN
Print view View original

51–60 of 120 posts

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#51

Post by SkyMarshal »

TheEskimo wrote: post #14
devx wrote: post #6

I've seen a lot of people recommend Lastpass lately, but couldn't the government force Lastpass to create a backdoor for them to get the passwords before they are encrypted? I'd also worry about a catastrophic event of Lastpass losing those passwords somehow, and then remaining locked out of many websites. And what about Bittorent Sync with an old PC as an alternative? They even have an iOS app now.

I personally use keepass and keepassx (the alpha compatible with keepass2.x) and sync my passwords with SpiderOak. That's worked pretty well for me, and I don't actually have to trust a website with my passwords. Even if there's an insecurity in SpiderOak, they'd only get my encrypted keepass database which they'd then have to also decrypt. I definitely recommend keepass over lastpass.

Exactly what I do too, for exact same reasons. Crazy imho to store your passwords in a cloud service, using only their encryption.

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#52

Post by cpursley »

Spearchucker wrote: post #43
cpursley wrote: post #5

Chicago? Last time I checked, that city is within the jurisdiction of the United States and not immune to national security gag letters. No thanks. Swiss based Wuala.com is a much better solution.

Hey I'm no expert, and have absolutely no evidence , but do know that there was an issue some years ago where the Swiss were allegedly strong-armed by the IRS into lifting their privacy restrictions [1] and [2]. The story, as I remember it, was that Swiss banks had to share information about US depositors with the IRS if the Swiss wanted to continue operating offices is the US. While I trust the Swiss a lot more than…

You're correct - but only with the big international banks. The tax issue is a different can of worms. At least there's a pretty good chance that NSA doesn't have a back door to wuala.

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#53

Post by cpursley »

peawee wrote: post #50
tombrossman wrote: post #26

Earlier quoted context omitted.

Isn't switching from one closed source backup system to another closed source system overlooking the elephant in the room? These companies are legally required to rat you out when the government comes knocking (some even doing so without demanding a valid warrant, and profiting from LEO requests). SpiderOak has been saying they "expect to make the SpiderOak client code open source in the not-distant future" [1] for y…

Hey, SpiderOaker here! While open-sourcing the desktop client isn't going as fast as we'd like, I'd like to point out that practically all current and future projects are open source on our GitHub ( https://github.com/SpiderOak/ ), including our next-gen encryption system Crypton (which will eventually replace the data structures in the desktop client ANYWAY)

This is cool. Have you guys considered offering encryption as a service and let users pick their own data provider?

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#54

Post by peawee »

cpursley wrote: post #53
peawee wrote: post #50

Earlier quoted context omitted.

Hey, SpiderOaker here! While open-sourcing the desktop client isn't going as fast as we'd like, I'd like to point out that practically all current and future projects are open source on our GitHub ( https://github.com/SpiderOak/ ), including our next-gen encryption system Crypton (which will eventually replace the data structures in the desktop client ANYWAY)

This is cool. Have you guys considered offering encryption as a service and let users pick their own data provider?

It's technically possible with Crypton. Note that the server-side components are under AGPL or commercial license; it's either pay fair or play fair.

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#55

Post by AsymetricCom »

cpursley wrote: post #5

Chicago? Last time I checked, that city is within the jurisdiction of the United States and not immune to national security gag letters. No thanks. Swiss based Wuala.com is a much better solution.

I really don't think it matters what platform you use, as long as you use you own software to encrypt and do it locally, it doesn't matter much if someone else can access your cloud store. Personally, I use AWS because it's a mature platform with good support and the chances of me loosing data are astronomically slim. But as far as Amazon is concerned, I'm just uploading noise.

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#56

Post by saganus »

So I go to the Startup Guides, then to Getting Started. I open the PDF and under step one I see:

"NOTE: Curious about how we retain ‘zero-knowledge’ privacy while password creation happens on the web? Click here for more details."

But no link. So... is this a joke? why can't they explain this in their FAQ instead of having to get a PDF then a (non-existent) link to it? I've been searching the FAQs and under Privacy and Passwords and all I can find is:

"More information about this is on our website in the engineering section of our website, which talks about our zero knowledge approach, the password policy, and encryption specifications."

Engineering section? I can't see where it is.

My point is, if "security and privacy" are one of the main selling points of the product... yet you have to jumpo through hoops and loops to get some details on the implementation and STILL don't have the info... smells fishy..

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#57

Post by JimmaDaRustla »

I'm embarking on my own backup solution: For $1.38 USD/month (Ramnode OpenVZ SSD-Cached 128mb RAM VPS with 31% off for life coupon) I get 50gb.

I just need to setup a synchronization/encryption schedule. I'm thinking rsync remotely to the server. Not sure on encryption yet.

I'm also using the servers as development and minor hosting for myself. It's practically a free storage solution?

Am I crazy?

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#58

Post by FreeKill »

mattmaroon wrote: post #24

I just use Truecrypt volumes within Dropbox for anything I'd really care about losing. I guess it's an extra step, but I find I just like Dropbox better than the competition. And things I really care about (tax returns, for instance) I find I access rarely and always on a PC.

This solution has 2 issues though that kind of drive me crazy.

1) It won't sync the truecrypt volume while it's open (cause the file is in use), so if you want to encrypt stuff you work on regularly, you have to close the truecrypt volume regularly to sync it, which is a PITA.

2) Since it's one big volume, it takes forever to sync up even if you only modified a single file inside it. Say, for example, I have a 5 GB truecrypt volume containing some project I'm working on. If I open it, update the readme, then close it, it has to resync 5 GB...

So overall, this is far from an optimal solution...

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#59

Post by mateuszf »

JimmaDaRustla wrote: post #57

I'm embarking on my own backup solution: For $1.38 USD/month (Ramnode OpenVZ SSD-Cached 128mb RAM VPS with 31% off for life coupon) I get 50gb. I just need to setup a synchronization/encryption schedule. I'm thinking rsync remotely to the server. Not sure on encryption yet. I'm also using the servers as development and minor hosting for myself. It's practically a free storage solution? Am I crazy?

If your are using linux, encfs should work fine with rsync based solution.

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#60

Post by taway2012 »

coherentpony wrote: post #42
taway2012 wrote: post #9

SpiderOak user here. Just remember to not use the Web UI: if you do so, your plaintext password is sent to the servers, because decryption happens on the servers. This is mentioned in their FAQ. Unless things have changed since the last time I checked.

They don't utilise https? Please tell me that isn't true.

See other reply below. And to answer your question, yes, they use HTTPS.
Post reply on HN