Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plug anti-PRISM solution raises half a million dollars in 9 days on Kickstarter

press.meetplug.com

Post reply on HN
Print view View original

41–50 of 55 posts

Re: Plug anti-PRISM solution raises half a million dollars in 9 days on Kickstarter

#41

Post by BraveNewCurency »

downandout wrote: post #16

It's an inexpensive way to create a SAN with some software to tie stuff together. Assuming your router doesn't already do most of this, I suppose it could be useful for home users. I find the anti-Prism claims to be getting old quickly, and probably dubious in this case considering users with no security knowledge are being encouraged to create a single access point to all of their data. This obviously resonates with…

> I'm rather surprised at the success so far.

I think their difference is in their client-side software. All existing solutions (dropbox, etc) are single-folder sync-all-the-files.

This solution is more like NFS, but with extra features (keep files locally, keep revisions) and mapping of Document/Video folders between OSes.

Re: Plug anti-PRISM solution raises half a million dollars in 9 days on Kickstarter

#42

Post by throwit1979 »

DanBC wrote: post #40
throwit1979 wrote: post #37

Um, there's also the client side of this. You can lock up your data all you want, but with the NSA deeply embedded in telecoms and mobile device manufacturers, once you try to access said data in a manner consistent with the project's marketing, e.g. on an apple-engineered device running Verizon's comm middleware, the NSA gets your data anyway. This is the same problem projects like Moxie's silent circle have. It's t…

They claim the Internet connection between plug and the computer accessing that plug is encrypted.

Right, but they have no control over interception rootkits installed on the client. And all of their marketing material suggests that the client in question will usually be your phone. After the VPN software decrypts the data and before it is emitted from the speaker and/or displayed on the screen, there is a cleartext data stream that could be intercepted by a rootkit that the feds could order your telecom provider to silently install.

Re: Plug anti-PRISM solution raises half a million dollars in 9 days on Kickstarter

#43

Post by BraveNewCurency »

DanBC wrote: post #25
bpolania wrote: post #21

In this case what exactly does anti-PRISM means? How I see it it would be PRISM 2.0, since the NSA will now not only have access to your cloud files, now it will have access to your personal physical drives. will I need to have a Plug account to access my drives? Will I be able to access those drives from outside my house or office? Will my users/password for that account will be stored at some king of Plug centraliz…

It's a USB NAS dongle. > With Plug, all your devices are connected with each other thanks to a zero-configuration, private and encrypted VPN (asymmetric encryption based on RSA-2048/SHA-1 keys). We had excellent speed benchmarks on this network. It goes through any main NAT & firewall we tested, it's decentralized when possible, and it doesn't require any user configuration. It's safe and does the job. > When Plug is…

But all the magic is in their client-side software. It's more like having your home directory on NFS, but it allows you to keep some files locally, and it keeps revisions, and it transparently sets up VPNs for you, etc.

So, if you're a techie, it's "just a NAS". But if you're a non-techie, it's 100 times more useful than a NAS.

Re: Plug anti-PRISM solution raises half a million dollars in 9 days on Kickstarter

#44

Post by BraveNewCurency »

millerm wrote: post #36
lucb1e wrote: post #14

Okay so you just plug this in to storage on one side, and internet on the other. Then it works on LAN, but apparently also outside your LAN? They showed that in the video. So there must be some sort of udp/tcp hole punching to get through the NAT? And then the files sync at the speed of my 832kbps upload speed? So much for "one memory on all devices" when you barely reach 100KB/s reading speeds from your "memory", di…

Just to clarify, the is no synching. The file requests are on demand. Only the metadata (oh, there is that word again) would appear when listing a file/folder. Just like the rest of the net. It's not a synchronization service but a file access system. That the reason you can have 1TB space on a phone. It's a NAS device, or is it a SAN? Anyway, it just a Linux server that connects to the Internet so you can get your g…

All the magic is in the client-side software. It's kind of like all your computers NFS-mount their home dir.

> Just to clarify, the is no synching

I think there is. You can set some files to be "cached locally". In this case, they would be synced between all computers that have local copies.

The server is nothing special, but the client software is quite new.

Re: Plug anti-PRISM solution raises half a million dollars in 9 days on Kickstarter

#45

Post by lttlrck »

BraveNewCurency wrote: post #39
p4bl0 wrote: post #12

The usage of "anti-PRISM" is becoming meaningless. It's like the new rockstar node.js on rails ninja. Just a buzzword. If you think that using your own server instead of DropBox, switching from Gmail to another email provider, and encrypting the content of your files and emails will protect you from PRISM, well, you just don't understand at all what PRISM is all about. First, nothing prevent government to listen to w…

No, I think this device is very "anti-PRISM". PRISM means that the (US) government can ask MicroSoft/Google/Apple for your files stored in the cloud without a warrant . So you get no protection against "unreasonable searches" specified in the 4th amendment. This drive is controlled by you and stored in your house (with no key stored in the cloud). So the 4th amendment applies, and the government can't just look at yo…

So any data storage device that is not under the control of a company covered by PRISM is by definition anti-PRISM?

That makes it meaningless.

Re: Plug anti-PRISM solution raises half a million dollars in 9 days on Kickstarter

#46

Post by BraveNewCurency »

GammaDelta wrote: post #15
ancarda wrote: post #10

Earlier quoted context omitted.

>Closed source This is THE dealbreaker for me. I felt so excited to see Plug. I was ready to sign up to Kickstarter to back my first product. It's a plug-and-play NAS, a data solution I've been trying to find. I really, really wanted to use it. But I can't for ethical reasons. I hate to sound like I'm preaching open-source but it's unacceptable anymore, although I will give them credit that it's a step in the right d…

> I hate to sound like I'm preaching open-source Why feel bad about it? It gets straight to the crux of the problem. If you're running closed-source software that is presumably taking updates from a third party outside your control, how much of an improvement is that over SkyDrive or Dropbox? As far as I can tell the only problem with these services is snooping by intelligence agencies and the consequences of that (p…

> One could hypothetically argue that the NSA would be less willing or capable to snoop on data that is stored inside hard drives in citizens' houses

No, even the secret FISA court would have a hard time getting access to this device without a warrant:

Courts have ruled that "cloud storage" (not owned or controlled by you) is not in "your possession". Therefore, the 4th amendment protection against "unreasonable searches of your possessions" doesn't apply. So the government can ask MicroSoft/Apple/Google for your files.

But this drive is clearly in your possession. The keys for it are clearly in your possession. The cloud company website does not do security or have access to your files -- it just helps you locate your device.

Technically, this is no different than a NAS in your house. But the client-side software is 100 times better. (client-side caching, revision tracking, etc.)

Re: Plug anti-PRISM solution raises half a million dollars in 9 days on Kickstarter

#48

Post by TerraHertz »

If 'kickstart fund the Plug, to obtain cloud-like secure home storage' is code-speak for 'kickstart fund the purchase of some blackmarket nukes, and vaporize the NSA datacenters' then this just might work.

But seriously, there's some fundamental reality denial going on here. You're going to try and solve this problem with a gadget? Uh... and that problem would be that the Rule of Law has broken down, fascist criminals have taken control of the government, and seriously intend to impose a total information surveillance regime by whatever methods are required. Including, apparently, several hundred million rounds of hollow point ammunition.

Yeah, with gadgets like this you might make the process slightly more tedious for them. Assuming they don't enjoy simply dragging people off to indefinite secret detention and crushing fingers until encryption keys are given up. But that's a very shaky assumption. At best.

Also, closed source. Ha ha ha... Plot twist: Cloud Guys Corp are really NSA, preparing a backup plan in case their major net service provider taps go sour due to current temporary difficulties.

Re: Plug anti-PRISM solution raises half a million dollars in 9 days on Kickstarter

#50

Post by coopdog »

GhotiFish wrote: post #38

I fail to see how plug is anti-PRISM. All your devices need to install plugs software, at which point you provide a login and a password, and bam , you now have full access to your files connected to your plug... what? So we go out and contact plugs central server, provide a username and password, and now we have remote access to all our files. ALL of them. Plug syncs everything. PRISM, the program that secretly told…

From the security FAQ: "Plug uses asymmetric cryptography. When Plug is installed, the application generates a RSA-2048 pair of keys, identifiable by the user's email, and with a private key protected by the user password. This private key, which is what authenticates a user in the Plug system, is stored in your Plug and your devices. We don't know this key because we don't have your password, so we cannot - us or anyone else - steal your identity."

So it really does seem to be zero knowledge, and therefore could be the magic UI that finally makes proper asymmetric encryption tolerable to the general public.

The NSA could still steal the key off of any of the devices, but it would be hard to do that systematically on a global scale. The closed source nature of this software probably still makes it a no-go though, they can just coerce them to patch it ala skype.

I wonder how this would fair against TSA also. If your entire home server looks like a folder, and they can copy that folder at the border, they now get every file you care about rather than just the ones on any one device.

Post reply on HN