Wuala: Secure Cloud Storage • Hacker News Board

Re: Wuala: Secure Cloud Storage

#131

Post by rst » Mon, Jun 10, 2013, 1:15 PM UTC

fmavituna wrote: post #68

shin_lao wrote: post #63

Earlier quoted context omitted.

And what would having the source code change? Unless you host the data yourself, if you don't trust Wuala there is no guarantee the binaries you use are built from the source code you have.

You can see the client code and confirm that it actually encrypts all of the data and use your own copy rather than their binaries. Technically if the client is not sending not encrypted data and encrypts without a foul, then nothing they can do on the server-side can cause leaking your data.

If there were a weakness in the client, it would be more likely to do with key management --- leaking a portion of the key (as Lotus Notes did once upon a time), generating keys from a non-obviously restricted set (viz. the infamous Debian "weak random generator" bug[1]), or possibly something more subtle. The presence of these behaviors might not be obvious from casual, or even careful, attention to the source code; the Debian thing was, by all accounts, just a bug, which nevertheless persisted for quite some time.

[1] http://www.debian.org/security/2008/dsa-1571

Re: Wuala: Secure Cloud Storage

#132

Post by olov » Mon, Jun 10, 2013, 1:17 PM UTC

cddotdotslash wrote: post #128

sillysaurus wrote: post #126

Earlier quoted context omitted.

Why not just store a TrueCrypt volume(s) in Dropbox?

Because, as far as I know (I haven't used TrueCrypt too much), it will see the volume as a file and then you'll be syncing a huge, x GB file every time you make the smallest change within it.

That's not true. Dropbox uses librsync so small changes of big files yields small diffs, thus TrueCrypt volumes work just fine with Dropbox.

Re: Wuala: Secure Cloud Storage

#133

Post by adamman » Mon, Jun 10, 2013, 1:23 PM UTC

sillysaurus wrote: post #126

kijin wrote: post #109

Seriously? Wuala is a service run by LaCie. LaCie is owned by Seagate, an American corporation. It doesn't matter where the servers are, because all the important decisions will be made in Cupertino, California. http://www.lacie.com/us/company/news/news.htm?id=10722 Now, client-side encryption is a much more interesting aspect of their service, but is it worth the trouble if Wuala's clunky client takes 100 times long…

Why not just store a TrueCrypt volume(s) in Dropbox?

I like Boxcryptor since it encrypts each file individually rather than the whole volume. However, the file names are exposed.

Re: Wuala: Secure Cloud Storage

#134

Post by mjs7231 » Mon, Jun 10, 2013, 1:32 PM UTC

adamman wrote: post #133

sillysaurus wrote: post #126

Earlier quoted context omitted.

Why not just store a TrueCrypt volume(s) in Dropbox?

I like Boxcryptor since it encrypts each file individually rather than the whole volume. However, the file names are exposed.

encfs. Encrypts each file individually and file name are encrypted.

Re: Wuala: Secure Cloud Storage

#135

Post by phxql » Mon, Jun 10, 2013, 1:34 PM UTC

nodata wrote: post #120

phxql wrote: post #104

Earlier quoted context omitted.

Some older version supports that. Maybe they changed their license model, but it definitely had support for that in the past.

Yes, it was supported back when they used encfs, but now they've switched to their own internal rewrite which broke compatibility.

Ah, didn't know that. Thanks for the information!

Re: Wuala: Secure Cloud Storage

#136

Post by jasonzemos » Mon, Jun 10, 2013, 1:35 PM UTC

iHypnos wrote: post #96

Hello there, Gianluca from Wuala here. First, this is how Wuala works: You as an user place a file in the client. The file gets encrypted (including using your password and username) and then gets uploaded and split into different pieces. We are currently using AES-256 for encryption (and RSA 2048 fpr signature and key exchange when sharing a folder and SHA-256 for integrity checks). The password does NOT get transmi…

Hey Gianluca, I was under the impression the latest major revision of Wuala removed all distribution features, so files are no longer split into difference pieces. Instead they are now stored on your central servers.

Re: Wuala: Secure Cloud Storage

#137

Post by missing_cipher » Mon, Jun 10, 2013, 1:45 PM UTC

olov wrote: post #132

cddotdotslash wrote: post #128

Earlier quoted context omitted.

Because, as far as I know (I haven't used TrueCrypt too much), it will see the volume as a file and then you'll be syncing a huge, x GB file every time you make the smallest change within it.

That's not true. Dropbox uses librsync so small changes of big files yields small diffs, thus TrueCrypt volumes work just fine with Dropbox.

Speaking out of ignorance here: But aren't TrueCrypt volumes completely changed when you add/remove something? I'm thinking similarly to a hash: The slightest modification changes it completely.

Re: Wuala: Secure Cloud Storage

#138

Post by mkl » Mon, Jun 10, 2013, 1:56 PM UTC

missing_cipher wrote: post #137

olov wrote: post #132

Earlier quoted context omitted.

That's not true. Dropbox uses librsync so small changes of big files yields small diffs, thus TrueCrypt volumes work just fine with Dropbox.

Speaking out of ignorance here: But aren't TrueCrypt volumes completely changed when you add/remove something? I'm thinking similarly to a hash: The slightest modification changes it completely.

That's not how it works - it would be inefficient to the point of uselessness to rewrite the entire file constantly, and my 100GB TrueCrypt volume is fast to save to.

Re: Wuala: Secure Cloud Storage

#139

Post by throwit1979 » Mon, Jun 10, 2013, 1:59 PM UTC

missing_cipher wrote: post #137

olov wrote: post #132

Earlier quoted context omitted.

That's not true. Dropbox uses librsync so small changes of big files yields small diffs, thus TrueCrypt volumes work just fine with Dropbox.

Speaking out of ignorance here: But aren't TrueCrypt volumes completely changed when you add/remove something? I'm thinking similarly to a hash: The slightest modification changes it completely.

If that were the case, then terabyte-scale volumes would be prohibitively useless - and I know plenty of people with media volumes in TC.

Re: Wuala: Secure Cloud Storage

#140

Post by danielsiders » Mon, Jun 10, 2013, 2:07 PM UTC

maggit wrote: post #9

I recently tried replacing Dropbox with Wuala because of privacy concerns. I failed, and in the process realized how successful Dropbox has been in creating an awesome user experience! I'm still looking for a locally encrypted Dropbox-alternative. So if any of you are making one, please speak up :) (Edit) I should specify that it was the user experience that made me give up on Wuala, and any proper Dropbox alternativ…

We have a product coming out soon that's fully open source, self hostable (but also offered as a service), client-encrypted, and backed by Tent.