Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cryptic, encrypted online storage

kickstarter.com

Post reply on HN
Print view View original

1–10 of 17 posts

Re: Cryptic, encrypted online storage

#4

Post by orthecreedence »

You guys really might want to release a browser extension (and/or native apps) instead of a website. You're going to have a serious uphill battle convincing anyone in the security community that your webapp is secure against tampering. Even with code signing/verification.

Also, open-source it now! I've been in the process of launching something similar (think, client-side encrypted Evernote/Pinterest geared towards programmers/creatives/collaboration) and a lot of the great feedback I've gotten is from people checking out the source. Most of the people who care about the crypto aspects these days are the ones with 1s and 0s running through their heads, at least a good portion. They're going to want to see code.

Best of luck on the kickstarter!

Re: Cryptic, encrypted online storage

#5

Post by bradleyjg »

From the "For our technical readers" paragraph, it's unclear what cryptography model you are going for. On the one hand you say that the private key (albeit password protected) is sent to the server after it is generated, but on the other you say that only public key and encrypted data are sent to the server. Is the model fundamentally the same as Lavabit's, which was so devastatingly critiqued a few weeks ago by Moxie Marlinspike? [1]

Separately, how do you deal with the fundamental weakness of browser based security?[2] You say that the software will be open source, but will there be any mechanism to verify that the served javascript libraries on any particular visit match the sources on github? Will there be any minimization / compilation that would make such verification difficult or impossible to accomplish?

[1] http://www.thoughtcrime.org/blog/lavabit-critique/

[2] see e.g. http://www.matasano.com/articles/javascript-cryptography/

Re: Cryptic, encrypted online storage

#6

Post by theabraham »

orthecreedence wrote: post #4

You guys really might want to release a browser extension (and/or native apps) instead of a website. You're going to have a serious uphill battle convincing anyone in the security community that your webapp is secure against tampering. Even with code signing/verification. Also, open-source it now! I've been in the process of launching something similar (think, client-side encrypted Evernote/Pinterest geared towards p…

Looks like they're already open sourced on Github: https://github.com/cryptic-io

Re: Cryptic, encrypted online storage

#7

Post by marcopolo »

orthecreedence wrote: post #4

You guys really might want to release a browser extension (and/or native apps) instead of a website. You're going to have a serious uphill battle convincing anyone in the security community that your webapp is secure against tampering. Even with code signing/verification. Also, open-source it now! I've been in the process of launching something similar (think, client-side encrypted Evernote/Pinterest geared towards p…

Thanks! It's been open sourced since conception, here's the repo: https://github.com/cryptic-io/web. We choose a website because it has the smallest barrier of entry. We are planning on releasing a browser extension that would verify the code on the website against the open source repo to prevent tampering. We are planning on making a native app in the future as well.

Re: Cryptic, encrypted online storage

#9

Post by orthecreedence »

bradleyjg wrote: post #5

From the "For our technical readers" paragraph, it's unclear what cryptography model you are going for. On the one hand you say that the private key (albeit password protected) is sent to the server after it is generated, but on the other you say that only public key and encrypted data are sent to the server. Is the model fundamentally the same as Lavabit's, which was so devastatingly critiqued a few weeks ago by Mox…

> When you go to Cryptic all files that you receive will be received over SSL. This is to ensure that you’re getting the correct code, and not a version compromised by some attacker.

This is the Lavabit way, I believe. However, it could be solved using a browser extension.

Re: Cryptic, encrypted online storage

#10

Post by drchoc »

orthecreedence wrote: post #9
bradleyjg wrote: post #5

From the "For our technical readers" paragraph, it's unclear what cryptography model you are going for. On the one hand you say that the private key (albeit password protected) is sent to the server after it is generated, but on the other you say that only public key and encrypted data are sent to the server. Is the model fundamentally the same as Lavabit's, which was so devastatingly critiqued a few weeks ago by Mox…

> When you go to Cryptic all files that you receive will be received over SSL. This is to ensure that you’re getting the correct code, and not a version compromised by some attacker. This is the Lavabit way, I believe. However, it could be solved using a browser extension.

Cryptic will have a browser extension that will automatically verify the received code against a signed hash (also easily verifiable) on the open source repo. It is fundamentally different than Lavabit since everything that interacts with raw data is open source and verifiable. Someone is going to notice if the website is tampered with.
Post reply on HN