Live data from Hacker News

Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

dougbelshaw.com

71–80 of 120 posts

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#71

SpiderOak user here. Just remember to not use the Web UI: if you do so, your plaintext password is sent to the servers, because decryption happens on the servers. This is mentioned in their FAQ. Unless things have changed since the last time I checked.

I've always assumed that Dropbox's light encryption was because of their Web UI, which is a pretty big feature for most users.

Different crowds.

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#72

I just use Truecrypt volumes within Dropbox for anything I'd really care about losing. I guess it's an extra step, but I find I just like Dropbox better than the competition. And things I really care about (tax returns, for instance) I find I access rarely and always on a PC.

This solution has 2 issues though that kind of drive me crazy. 1) It won't sync the truecrypt volume while it's open (cause the file is in use), so if you want to encrypt stuff you work on regularly, you have to close the truecrypt volume regularly to sync it, which is a PITA. 2) Since it's one big volume, it takes forever to sync up even if you only modified a single file inside it. Say, for example, I have a 5 GB t…

For #2 I keep the truecrypt file size more like 500MB. Fortunately my projects don't have big files. For old tax returns and the like I have archived truecrypt files that no longer change.

#1 is indeed a PITA. I don't know of a better alternative I trust though. In practice the files I'm changing daily are small and aren't top secret, so I zip them and put the zip file in the DropBox. Then I don't have to unmount the truecrypt volume so often.

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#73

SpiderOak user here. Just remember to not use the Web UI: if you do so, your plaintext password is sent to the servers, because decryption happens on the servers. This is mentioned in their FAQ. Unless things have changed since the last time I checked.

Is it feasible to do the decryption in JS? LastPass for example encrypts the passwords and never sees the plaintext. Although decrypting a plaintext password is a significantly smaller problem than decrypting large files.

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#75

I just use Truecrypt volumes within Dropbox for anything I'd really care about losing. I guess it's an extra step, but I find I just like Dropbox better than the competition. And things I really care about (tax returns, for instance) I find I access rarely and always on a PC.

This solution has 2 issues though that kind of drive me crazy. 1) It won't sync the truecrypt volume while it's open (cause the file is in use), so if you want to encrypt stuff you work on regularly, you have to close the truecrypt volume regularly to sync it, which is a PITA. 2) Since it's one big volume, it takes forever to sync up even if you only modified a single file inside it. Say, for example, I have a 5 GB t…

Um, you should be regularly dismounting volumes every time you are done using them anyway. Your enemy can quite likely read out your passphrase from cryopreserved ram or its hibernated equivalent.

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#77
post #74

How does their data-encryption relate to something like Mega ( https://mega.co.nz/ )?

Mega's Privacy policy says:

"Your data is encrypted by you before upload to our system and therefore we do not and cannot access that content unless we are provided with the decryption key. You may give access to others by providing them with a link and decryption key and you shall be responsible for their compliance with this Policy."

But they also say that they'll comply with legal requests. These article explain it better than me:

http://www.technewsdaily.com/16484-mega-encryption-flaws.htm...

http://gizmodo.com/5977265/how-megas-encryption-will-protect...

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#78
post #76

Although having your data encrypted everywhere is a good idea in principle, using closed-source tools like LastPass and SpiderOak Hive isn't a good way to do it since you have no way to verify that the data is encrypted well or at all.

That's a good point and I'm certainly not saying this is a full tinfoil-hat solution. But's it's better than I had before and an easy change to make for the 99% :-)

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#79
post #5

Chicago? Last time I checked, that city is within the jurisdiction of the United States and not immune to national security gag letters. No thanks. Swiss based Wuala.com is a much better solution.

What about BitSync, it strikes me as good option, but i'm no crypto guy. http://labs.bittorrent.com/experiments/sync.html

That's my preferred option. I like my data to sit on my computers.

Re: Why I'm saying goodbye to Dropbox and hello to SpiderOak Hive

#80

I just use Truecrypt volumes within Dropbox for anything I'd really care about losing. I guess it's an extra step, but I find I just like Dropbox better than the competition. And things I really care about (tax returns, for instance) I find I access rarely and always on a PC.

This solution has 2 issues though that kind of drive me crazy. 1) It won't sync the truecrypt volume while it's open (cause the file is in use), so if you want to encrypt stuff you work on regularly, you have to close the truecrypt volume regularly to sync it, which is a PITA. 2) Since it's one big volume, it takes forever to sync up even if you only modified a single file inside it. Say, for example, I have a 5 GB t…

I guess the resynchronisation time is taken up mostly by Dropbox reading and hashing all 5 GB to detect changes? Just that it considers each file as a series of contiguous chunks and should only transfer those chunks that have changed. A bit like how BitTorrent works.
Post reply on HN