Ask HN: Secure Dropbox alternatives?
What secure synchronozing services with roughly the same features as Dropbox are there?
35 comments
Egnyte : www.egnyte.com
Hybrid Storage with multiple access methods : Web, Desktop (Win/Mac), Mobile & FTP.
Flexible subfolder sync with versioning
Hybrid Storage with multiple access methods : Web, Desktop (Win/Mac), Mobile & FTP.
Flexible subfolder sync with versioning
we use Egnyte (http://www.egnyte.com) at our office, it does file sync like Dropbox, except more secure and scalable.
tarsnap is the only one that stands out in terms of security.
http://www.tarsnap.com/
http://www.tarsnap.com/
But thats backup only and theres no real Windows client.
On OSX, you just have to put all your files in a 256-bit AES encrypted sparsebundle disk image in your dropbox folder.
You could roll your own with something like: https://github.com/bazaarlabs/gitdocs
There are other services which advertise security, but nothing where you actually are likely to audit the code. Even if their security model is better than what Dropbox is now using, you have to factor in availability issues (Dropbox seems more solid as a business than a lot of the others), functionality, etc. You also need to trust the entire development process, release engineering, and knowing your binaries correspond to the source code. It's not easy.
There is a slight benefit to "must ship trojaned software to recover passphase, then decrypt" vs. "just access data server-side", but in practice, if your threat is the government, there's not a huge difference. If your threat is a server break-in by a third party, then there's some difference.
Overall, probably the best bet, if you don't run your own servers, is Dropbox plus your choice of well tested encryption on top. As for your best well-tested encryption, that's a hard problem too -- Truecrypt has a pretty wide following and some versions have been audited, and source is published. For general purpose use on Macs, I just use Apple's encryption -- it's probably ok, but as far as I know, hasn't really been analyzed by third parties (I'd be happy to NDA and look at it). I rationalize it as if Apple is subverted, and I use OSX, I'm fucked even if third party disk encryption software itself is safe.
There is a slight benefit to "must ship trojaned software to recover passphase, then decrypt" vs. "just access data server-side", but in practice, if your threat is the government, there's not a huge difference. If your threat is a server break-in by a third party, then there's some difference.
Overall, probably the best bet, if you don't run your own servers, is Dropbox plus your choice of well tested encryption on top. As for your best well-tested encryption, that's a hard problem too -- Truecrypt has a pretty wide following and some versions have been audited, and source is published. For general purpose use on Macs, I just use Apple's encryption -- it's probably ok, but as far as I know, hasn't really been analyzed by third parties (I'd be happy to NDA and look at it). I rationalize it as if Apple is subverted, and I use OSX, I'm fucked even if third party disk encryption software itself is safe.
After reviewing the options some time ago, I ended up using encfs on top of Dropbox. You still mount and unmount it like Truecrypt or Apple's encrypted disk images, but behind the scenes instead of creating an opaque block device to store the files, the individual files and directories are stored with their names and contents encrypted. I like this method because individual files can be synced (which is the whole purpose of Dropbox), safe syncing does not require unmounting the volume, it can be mounted on multiple computers at the same time, is cross-platfrom, and I think it should be possible to revert individual files to a previous revision (though I've never tried). The main disadvantage, from a security perspective, is that the existence of and approximate size of your files can be easily determined without decrypting. This does not matter for my purposes, but might for some. It is also slightly more complicated to set up, although if you've ever mounted a filesystem from the command line in Unix you should have no problem.
Here is a nice overview of its use on OS X: http://www.packetslave.com/2011/04/21/dropbox-encryption-w-e...
Here is a nice overview of its use on OS X: http://www.packetslave.com/2011/04/21/dropbox-encryption-w-e...
Is it possible to use Truecrypt in Dropbox without issues?
Sure. But you remove the benefit of syncing small diffs; you pretty much have to sync the entire truecrypt volume.
My (former) home network backup solution had a truecrypt volume created locally, and rsync'ed to my offsite backup provider (rsync.net). It did not have to send the entire volume for small diffs; in my experience, Truecrypt keeps local changes local in the volume.
That's a good point; thanks. I'm not sure if Dropbox diffs at sub-file level - perhaps it does.
The short story is that Dropbox + Truecrypt work fine, but may not (or may!) be optimal.
The short story is that Dropbox + Truecrypt work fine, but may not (or may!) be optimal.
I use encfs with Dropbox because each file is encrypted separately, rather than a single monolithic container.
Possible, but inconvenient because the whole volume will get synchronized every time you modify a file.
After dropbox, I use sugarsync and I'm really happy with it
Wuala - http://wuala.com/
All files get encrypted and are stored redundantly. No one unauthorized - not even Wuala as the provider - can access the files.
All files get encrypted and are stored redundantly. No one unauthorized - not even Wuala as the provider - can access the files.
Does wuala have physical ownership and exclusive, secure physical access to their own servers or is it up on the cloud? If it's cloud, access prevention from snoopy authority cannot be guaranteed, since a single loose warrant could tap every box.
If someone wants to encrypt their data, then they'd probably want to know the physical security around the box holding their data too. Stallman's probably mentioned this at some point.
If someone wants to encrypt their data, then they'd probably want to know the physical security around the box holding their data too. Stallman's probably mentioned this at some point.
I don't know all details but what I know:
- Wuala runs on dedicated machines in (i think three) different data centers. It isn't their own data center though.
- Data is encrypted on the client side.
- Wuala is hosted outside of the US or US jurisdiction
- Wuala runs on dedicated machines in (i think three) different data centers. It isn't their own data center though.
- Data is encrypted on the client side.
- Wuala is hosted outside of the US or US jurisdiction
Yep, servers are in europe.
They say in their FAQ that their servers are in secure server farm in Switzerland, Germany and France.
They say in their FAQ that their servers are in secure server farm in Switzerland, Germany and France.
TrustDEX for enterprise usage
Wuala: http://www.wuala.com
Data is encrypted with your password on the client side, your password never leaves your PC. They published a paper on their security implemenation: http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=4032...
It allows to synchronize multiple folders and it gives access to a certain number of previous versions. You can also share folders with friends, publicly or via a secret link.
It's cross-platform: Win, Mac, Linux.
I'm a happy customer since more than a year (it's free up to 2GB though) and I wonder why so few people know about it.
Data is encrypted with your password on the client side, your password never leaves your PC. They published a paper on their security implemenation: http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=4032...
It allows to synchronize multiple folders and it gives access to a certain number of previous versions. You can also share folders with friends, publicly or via a secret link.
It's cross-platform: Win, Mac, Linux.
I'm a happy customer since more than a year (it's free up to 2GB though) and I wonder why so few people know about it.
Problem with this approach is sharing and key management.
If you want to send something to someone, that means you need to securely communicate the key to them first or take the SpiderOak approach of "We guarantee security locally but if you share a file = file is shared unencrypted".
If you want to send something to someone, that means you need to securely communicate the key to them first or take the SpiderOak approach of "We guarantee security locally but if you share a file = file is shared unencrypted".
True, but if you both are friends on Wuala you can do it easily.
Provided that no man in the middle attacks take place during the "friendship" operation :)
Provided that no man in the middle attacks take place during the "friendship" operation :)
I use SugarSync. They just had (or maybe still have) a 50% off deal. If you want I can give you a referral. Free to try and can easily get more space by referring others.
Bitcasa is using local encryption:
http://www.bitcasa.com
http://www.bitcasa.com
I personally use SpiderOak[^1], which gives 2GB for free and 100GB/month for 10$ (5$ for edu accounts), and encrypts your data locally, before sending it to the cloud.
Moreover they don't even store your password in the server (sign in is locally handled), and they claim to have a zero-knowledge policy. As other said, you have to ultimately trust them; however the want to release under an open source license their client software, so one should be able, eventually, to check their claims.
[^1]: https://spideroak.com/download/referral/b26d996944aeed4254f6... (careful, it's a referral)
Edit: removed the link inline.
Moreover they don't even store your password in the server (sign in is locally handled), and they claim to have a zero-knowledge policy. As other said, you have to ultimately trust them; however the want to release under an open source license their client software, so one should be able, eventually, to check their claims.
[^1]: https://spideroak.com/download/referral/b26d996944aeed4254f6... (careful, it's a referral)
Edit: removed the link inline.
Dropbox + encfs. Works fine for me on all platforms (Windows/OS X/Linux). It has some rough edges though: File update notifications will refer to the encrypted file, and the browser interface will only show you encrypted file names as well.
http://www.boxcryptor.com/ does client-side encryption for DropBox.
Runs on Win, Mac, Linux, iOS, Android.
Runs on Win, Mac, Linux, iOS, Android.
I've looked at this previously but
* It seems to be closed source
* The German government is involved (Close friends with the US)
* It seems to be closed source
* The German government is involved (Close friends with the US)
Yes, it is closed source.
The German gov is involved?! Ha ha, the North Koreans as well?
The German gov is involved?! Ha ha, the North Koreans as well?
I really like JungleDisk (https://www.jungledisk.com/). They have a Mac, Linux and Windows client and encrypt all files locally before uploading to cloud storage providers. You can choose between S3 or Rackspace for your storage.
TitanFile is great! They also sent an email out to customers this week with a preview of their new version and it looked like it had a much nicer UI as well.
TitanFile solves the problem of secure file sharing and tracking (accountability) as the data is secured end-to-end, there is notification of receipt/download (who accessed the files, where from, at what time etc) and ability to set files as read-only (access only from the browser window over SSL connection) as well as verify identity of recipient before giving them access to the files (2 factor authentication) without requiring recipient to have a TitanFile account.
Dropbox kicks ass as "file system of the internet" but sharing files with people in a secure and private way with dropbox is a big pain.
With next release we will integrate with dropbox and Google Docs as well.
Disclaimer: I am from TitanFile
Dropbox kicks ass as "file system of the internet" but sharing files with people in a secure and private way with dropbox is a big pain.
With next release we will integrate with dropbox and Google Docs as well.
Disclaimer: I am from TitanFile