Live data from Hacker News

End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

brokencloudstorage.info

41–50 of 105 posts

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#41
post #15

Earlier quoted context omitted.

I think Proton is more viewed as a honeypot

I have not seen this take before, do you have any pointers to someone making this claim?

In account creation, requiring a phone number for “spam prevention” on Tor

There was some deanonymizing like that, phone or credit card

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#42
post #32

Earlier quoted context omitted.

Founders with US affiliation/physicist creating crypto products [1], faulty claims how the relevant Swiss law (BÜPF) applies to them [2], doing crypto in JavaScript on the client side, etc. To me, this smells like Crypto AG [3][4]. [1] https://proton.me/about/team [2] https://steigerlegal.ch/2019/07/27/protonmail-transparenzber... [3] https://en.wikipedia.org/wiki/Crypto_AG [4] https://en.wikipedia.org/wiki/Operation…

How else would you do client side crypto for a website if not with JavaScript, isn't that kind of the point of how Proton does E2EE?

Crypto for websites is completely broken (because the server can serve you whatever it wants), so doing crypto for websites at all is suspicious.

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#43
post #37

https://dropbox.tech/security/end-to-end-encryption-for-drop... dropbox has been mentioned in the article and I think the author is drinking kool-aid and throwing random facts

It's not an article, it's an academic paper, and Dropbox isn't one of the targets.

[flagged]

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#44
post #42
post #32

Earlier quoted context omitted.

How else would you do client side crypto for a website if not with JavaScript, isn't that kind of the point of how Proton does E2EE?

Crypto for websites is completely broken (because the server can serve you whatever it wants), so doing crypto for websites at all is suspicious.

I guess they have this for local email decryption: https://proton.me/mail/bridge

idk if they have anything like that for their other products like calendar or file storage

Presumably if you stick to mobile apps you won't be using JavaScript served by their server? Unless they're just html wrappers

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#45
post #42

Earlier quoted context omitted.

Crypto for websites is completely broken (because the server can serve you whatever it wants), so doing crypto for websites at all is suspicious.

I guess they have this for local email decryption: https://proton.me/mail/bridge idk if they have anything like that for their other products like calendar or file storage Presumably if you stick to mobile apps you won't be using JavaScript served by their server? Unless they're just html wrappers

Yeah, apps are generally OK, unless they're webviews, as you say.

The bridge looks good, though it seems really shady that it's not open source. I'd expect it to definitely be open.

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#46
post #15

Earlier quoted context omitted.

I have not seen this take before, do you have any pointers to someone making this claim?

Founders with US affiliation/physicist creating crypto products [1], faulty claims how the relevant Swiss law (BÜPF) applies to them [2], doing crypto in JavaScript on the client side, etc. To me, this smells like Crypto AG [3][4]. [1] https://proton.me/about/team [2] https://steigerlegal.ch/2019/07/27/protonmail-transparenzber... [3] https://en.wikipedia.org/wiki/Crypto_AG [4] https://en.wikipedia.org/wiki/Operation…

Doing crypto on the client side in JS is absolutely the correct way to do this if you want E2EE with a web client. You need to be careful about supply chain attacks etc.

> To me, this smells like Crypto AG

It's easy to throw around unsubstantiated, impossible to disprove theories.

Re: End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

#48
post #7

It's too bad they focused on commercial closed-source solutions providers. The ecosystem would have really benefited if they had put their efforts to, for example, do the same work with NextCloud.

seafile is open source (https://github.com/haiwen/seafile), or at least was, when I looked at it years ago. Definitely a concern when the paper mentioned an acknowledge of the protocol downgrade as of 29th April 2024, yet the latest version on the seafile github is dated feb 27.
Post reply on HN