Live data from Hacker News

Responsibly Bringing a new Cryptography Product to Market

spideroak.com

21–30 of 30 posts

Re: Responsibly Bringing a new Cryptography Product to Market

#21
post #11

Be careful. It is easy to pay for an audit from a firm that doesn't have a serious cryptography practice. You would reasonably think that any software security firm would be competent in evaluating crypto, or at least crypto basics like whether you're using a sane block cipher mode or failing to authenticate your ciphertext. But it turns out that the opposite is true: the overwhelming majority of firms, including som…

Working with the Least Authority folks has been elaborately enjoyable. Highly recommended.

I've started the long journey of reading the code and discussion history of their Tahoe-LAFS project -- action packed with fascinating details.

Re: Responsibly Bringing a new Cryptography Product to Market

#22
post #11

Be careful. It is easy to pay for an audit from a firm that doesn't have a serious cryptography practice. You would reasonably think that any software security firm would be competent in evaluating crypto, or at least crypto basics like whether you're using a sane block cipher mode or failing to authenticate your ciphertext. But it turns out that the opposite is true: the overwhelming majority of firms, including som…

Thank you so much for the kind words. I'm proud of our work on the Crypton audit, and I hope you have a chance to look at our report at some point: https://spideroak.com/share/PFXWQM3PN5FGK/LeastAuthorityAudi...

Re: Responsibly Bringing a new Cryptography Product to Market

#23
Interesting read. I remember Crypton being announced almost a year ago [0], and for awhile I paid attention the GitHub repo, but it really felt like a dead product. Looking back at the commit history, I'm not so sure why I had this impression, as it seems pretty lively. I'm thinking that perhaps a lot of those commits were not pushed publicly until recently, but in either case it's good to see it active again.

On a bit of a tangent, regarding this post and the requirements (1-5) they posted, I really wish they would hurry up and finally bring this to their backup clients. It's for far too long been a joke in my mind that they promise "100% Private", "Zero-knowledge", "Secure" online backup, sync and sharing with a closed-source client. I went as far as to sign up with them and download the client, only to never install it because I realized I didn't believe a word they said. They promised (again) at the start of this year to open source their client [1]. I have actually followed the issue closely, and just last year one of the founders was admitting on reddit that it simply wasn't a priority. I don't see why not, as it makes their service complete snake oil, and I can't be the only one who refuses to use their service because of it. Anyway, my point is... perhaps from their perspective this was because of point #4 in the post for this submission (Have clear, well documented code).

[0] https://news.ycombinator.com/item?id=5283072

[1] https://spideroak.com/blog/20140110144419-spideroak-to-becom...

Edit: Here [3] is where they prioritize "growth and profit" over providing what they promise. The granularity on the visible submission date is not very informative, but if you look at the posts JSON, you can see the Unix time in the field created_utc. It was the fist of April, so a little less than a year ago.

[3] http://www.reddit.com/r/IAmA/comments/rmp9l/we_are_spideroak...

Re: Responsibly Bringing a new Cryptography Product to Market

#24
post #23

Interesting read. I remember Crypton being announced almost a year ago [0], and for awhile I paid attention the GitHub repo, but it really felt like a dead product. Looking back at the commit history, I'm not so sure why I had this impression, as it seems pretty lively. I'm thinking that perhaps a lot of those commits were not pushed publicly until recently, but in either case it's good to see it active again. On a b…

> I can't be the only one who refuses to use their service because of it

Certainly not, but the vast majority of people seem to be willing to trust them and pay for service, so I can understand why it's not a priority. I'm not trying to say you're wrong -- I'd like to see source for SpiderOak, too -- I'm just saying that I understand why it hasn't happened.

Re: Responsibly Bringing a new Cryptography Product to Market

#25
post #12

Earlier quoted context omitted.

SJCL has been audited. You should ping me via email if you're serious about arranging for OSS crypto to get reviewed, not because I want to sell you audit services, but because someone already beat you to the punch in a big way, and you should talk to them. :)

Will do! Thanks! Is there a public report available? How long ago was this?

There's no public report available.

Re: Responsibly Bringing a new Cryptography Product to Market

#26
post #23

Interesting read. I remember Crypton being announced almost a year ago [0], and for awhile I paid attention the GitHub repo, but it really felt like a dead product. Looking back at the commit history, I'm not so sure why I had this impression, as it seems pretty lively. I'm thinking that perhaps a lot of those commits were not pushed publicly until recently, but in either case it's good to see it active again. On a b…

Thanks for your feedback and your interest in Crypton!

First, for the record, from that Reddit AMA, Daniel isn't a SpiderOak founder and is no longer with the organization.

Next, we throughly agree of the necessity for open sourcing our desktop backup and sync product, and are working towards that. There are licensing issues that have to be worked out. We started SpiderOak in 2007. Everything new we've created since 2009 has been open source from the start. Our expectation is that the existing SpiderOak product will someday transition to using Crypton internally.

Re: Responsibly Bringing a new Cryptography Product to Market

#28
post #23

Interesting read. I remember Crypton being announced almost a year ago [0], and for awhile I paid attention the GitHub repo, but it really felt like a dead product. Looking back at the commit history, I'm not so sure why I had this impression, as it seems pretty lively. I'm thinking that perhaps a lot of those commits were not pushed publicly until recently, but in either case it's good to see it active again. On a b…

Thanks for your feedback and your interest in Crypton! First, for the record, from that Reddit AMA, Daniel isn't a SpiderOak founder and is no longer with the organization. Next, we throughly agree of the necessity for open sourcing our desktop backup and sync product, and are working towards that. There are licensing issues that have to be worked out. We started SpiderOak in 2007. Everything new we've created since…

Apologies for claiming it was a founder, that was my faulty memory. I see now that he was head of marketing for some time at SpiderOak.

I hope you get the licensing issues worked out soon.

Re: Responsibly Bringing a new Cryptography Product to Market

#29
That's great you found good auditors, and that will probably work out just fine.

Another idea is that real attackers are your only hope (https://news.ycombinator.com/item?id=7238750) maybe. Auditors are supposed to simulate real attackers, and maybe these serious auditors are identical to attackers except you don't pay them as much as they could get some other way like publishing your exploits on the black market. Speaking of market, Schneier said you really need a mass market to test things (from the above link).

Re: Responsibly Bringing a new Cryptography Product to Market

#30
post #9
post #6

Earlier quoted context omitted.

Have any of those libraries been audited so far? Seems like a necessary step for widespread js crypto.

SJCL had substantial peer review during its development, but I'm not aware of a public 3rd party audit from a security firm. Oh yeah, and before people with torches show up, let me clarify that is a Javascript based crypto product but not browser and website based crypto. The deployment target is situations where the code delivery problem is solved: HTML5 mobile apps (including phonegap / cordova), desktop apps with…

So to be clear - we are not implying that these routines should be used in the browser right?

http://www.matasano.com/articles/javascript-cryptography/

Post reply on HN