31–40 of 92 posts
tl;dr from the FAQ: Q: "Why should I trust you?" A: "Because you should! We're good people! Honest!" I'd love to trust a service like this, but there's no credible effort to actually establish that trust.
So encrypt client-side?
Data remanence is a really hard problem. Are you sure this lives up to your claims that "the file is completely deleted without a trace"? How are you storing them? Do they ever hit e.g. an SSD in plaintext?
If you are concerned about the confidentiality of a file then use encryption or don't upload it to the internet.
tl;dr from the FAQ: Q: "Why should I trust you?" A: "Because you should! We're good people! Honest!" I'd love to trust a service like this, but there's no credible effort to actually establish that trust.
Now it says > file.io is a project of humb.ly. It was created simply out of the joy of trying to build cool things on the internet, and we thought it may be useful for others. We take privacy very seriously and do not save any data once it has been deleted. But going to humb.ly still doesn't really get me to trust you, there's not even any identifying info on that page. Two projects, one discontinued and one -- it se…
What I want is some assurance like "The EFF has complete read-access to our platform and maintains a continuous independent audit of these services to verify that we comply with our own privacy assurances." The EFF is probably not the organization to do such a thing, but that's kind of what I'm looking for.
How can I know, that there is no malware in the shared file?
I built this site and appreciate any feedback from the HN community
Also, you don't keep logs but what about your cloud provider? What guarantees can you make about them, and what responsibility do programmers have to explain the risks to the public? It seems wrong to say "anonymous and secure" without some qualifiers: you must use https, unencrypted files might be copied by the cloud provider, etc...
Earlier quoted context omitted.
So encrypt client-side?
Okay, but then the receiver has to know how to decrypt. Kind of narrows down who I can realistically send files to.
If paranoia is this high, why would a security policy text on a web page make any difference? They could claim anything they want, but you wouldn't have any idea if any actual encryption was happening, so best to do it yourself.
Earlier quoted context omitted.
I was using https://usetorpedo.com (similar service) before it shut down. Probably some lessons to be learned from them. While I didn't use it super often, when I did want to use it, it was very valuable. Thanks for building this!
Maybe it failed because USE TOR -> PEDO :)
Do you store the IP of the uploader and downloader? If you don't you're going to want to.
Why?