Ask HN: Secure Dropbox alternatives?

https://news.ycombinator.com/item?id=3423909

by nuttendorfer • 15 years ago

18 34 15 years ago

news.ycombinator.com

What secure synchronozing services with roughly the same features as Dropbox are there?

cpt1138• 15 years ago

tarsnap is the only one that stands out in terms of security.

http://www.tarsnap.com/

nuttendorfer3• 15 years ago

But thats backup only and theres no real Windows client.

jpsirois• 15 years ago

On OSX, you just have to put all your files in a 256-bit AES encrypted sparsebundle disk image in your dropbox folder.

JosephRedfern• 15 years ago

You could roll your own with something like: https://github.com/bazaarlabs/gitdocs

rdl• 15 years ago

There are other services which advertise security, but nothing where you actually are likely to audit the code. Even if their security model is better than what Dropbox is now using, you have to factor in availability issues (Dropbox seems more solid as a business than a lot of the others), functionality, etc. You also need to trust the entire development process, release engineering, and knowing your binaries correspond to the source code. It's not easy.

There is a slight benefit to "must ship trojaned software to recover passphase, then decrypt" vs. "just access data server-side", but in practice, if your threat is the government, there's not a huge difference. If your threat is a server break-in by a third party, then there's some difference.

Overall, probably the best bet, if you don't run your own servers, is Dropbox plus your choice of well tested encryption on top. As for your best well-tested encryption, that's a hard problem too -- Truecrypt has a pretty wide following and some versions have been audited, and source is published. For general purpose use on Macs, I just use Apple's encryption -- it's probably ok, but as far as I know, hasn't really been analyzed by third parties (I'd be happy to NDA and look at it). I rationalize it as if Apple is subverted, and I use OSX, I'm fucked even if third party disk encryption software itself is safe.

nuttendorfer3• 15 years ago

Is it possible to use Truecrypt in Dropbox without issues?

michaelcampbell2• 15 years ago

Sure. But you remove the benefit of syncing small diffs; you pretty much have to sync the entire truecrypt volume.

csh2• 15 years ago

Possible, but inconvenient because the whole volume will get synchronized every time you modify a file.

mike-cardwell• 15 years ago

I use encfs with Dropbox because each file is encrypted separately, rather than a single monolithic container.

makaio• 15 years ago

After reviewing the options some time ago, I ended up using encfs on top of Dropbox. You still mount and unmount it like Truecrypt or Apple's encrypted disk images, but behind the scenes instead of creating an opaque block device to store the files, the individual files and directories are stored with their names and contents encrypted. I like this method because individual files can be synced (which is the whole purpose of Dropbox), safe syncing does not require unmounting the volume, it can be mounted on multiple computers at the same time, is cross-platfrom, and I think it should be possible to revert individual files to a previous revision (though I've never tried). The main disadvantage, from a security perspective, is that the existence of and approximate size of your files can be easily determined without decrypting. This does not matter for my purposes, but might for some. It is also slightly more complicated to set up, although if you've ever mounted a filesystem from the command line in Unix you should have no problem.

Here is a nice overview of its use on OS X: http://www.packetslave.com/2011/04/21/dropbox-encryption-w-e...

ljy• 15 years ago

After dropbox, I use sugarsync and I'm really happy with it

mkuhn2• 15 years ago

Wuala - http://wuala.com/

All files get encrypted and are stored redundantly. No one unauthorized - not even Wuala as the provider - can access the files.

brador• 15 years ago

Does wuala have physical ownership and exclusive, secure physical access to their own servers or is it up on the cloud? If it's cloud, access prevention from snoopy authority cannot be guaranteed, since a single loose warrant could tap every box.

If someone wants to encrypt their data, then they'd probably want to know the physical security around the box holding their data too. Stallman's probably mentioned this at some point.

mkuhn2• 15 years ago

I don't know all details but what I know:

- Wuala runs on dedicated machines in (i think three) different data centers. It isn't their own data center though.

- Data is encrypted on the client side.

- Wuala is hosted outside of the US or US jurisdiction

dkoller82• 15 years ago

TrustDEX for enterprise usage

epper3• 15 years ago

Wuala: http://www.wuala.com

Data is encrypted with your password on the client side, your password never leaves your PC. They published a paper on their security implemenation: http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=4032...

It allows to synchronize multiple folders and it gives access to a certain number of previous versions. You can also share folders with friends, publicly or via a secret link.

It's cross-platform: Win, Mac, Linux.

I'm a happy customer since more than a year (it's free up to 2GB though) and I wonder why so few people know about it.

mvrekic2• 15 years ago

Problem with this approach is sharing and key management.

If you want to send something to someone, that means you need to securely communicate the key to them first or take the SpiderOak approach of "We guarantee security locally but if you share a file = file is shared unencrypted".

epper3• 15 years ago

True, but if you both are friends on Wuala you can do it easily.

Provided that no man in the middle attacks take place during the "friendship" operation :)

twodayslate• 15 years ago

I use SugarSync. They just had (or maybe still have) a 50% off deal. If you want I can give you a referral. Free to try and can easily get more space by referring others.

jtemplin• 15 years ago

Bitcasa is using local encryption:

http://www.bitcasa.com

gglanzani• 15 years ago

I personally use SpiderOak[^1], which gives 2GB for free and 100GB/month for 10$ (5$ for edu accounts), and encrypts your data locally, before sending it to the cloud.

Moreover they don't even store your password in the server (sign in is locally handled), and they claim to have a zero-knowledge policy. As other said, you have to ultimately trust them; however the want to release under an open source license their client software, so one should be able, eventually, to check their claims.

[^1]: https://spideroak.com/download/referral/b26d996944aeed4254f6... (careful, it's a referral)

Edit: removed the link inline.

csh2• 15 years ago

Dropbox + encfs. Works fine for me on all platforms (Windows/OS X/Linux). It has some rough edges though: File update notifications will refer to the encrypted file, and the browser interface will only show you encrypted file names as well.

iso8859-1• 15 years ago

lsyncd, unison

See reddit threads:

* http://www.reddit.com/r/linux/comments/iad3q/7_good_dropbox_...

* http://www.reddit.com/r/sysadmin/comments/nzdco/i_like_dropb...

* http://www.reddit.com/r/linux/comments/im8fc/vbox_open_sourc...

jhi2472• 15 years ago

http://www.boxcryptor.com/ does client-side encryption for DropBox.

Runs on Win, Mac, Linux, iOS, Android.

nuttendorfer3• 15 years ago

I've looked at this previously but

* It seems to be closed source

* The German government is involved (Close friends with the US)

jhi2472• 15 years ago

Yes, it is closed source.

The German gov is involved?! Ha ha, the North Koreans as well?

ehh• 15 years ago

I really like JungleDisk (https://www.jungledisk.com/). They have a Mac, Linux and Windows client and encrypt all files locally before uploading to cloud storage providers. You can choose between S3 or Rackspace for your storage.

jmacd• 15 years ago

TitanFile is great! They also sent an email out to customers this week with a preview of their new version and it looked like it had a much nicer UI as well.

mvrekic2• 15 years ago

TitanFile solves the problem of secure file sharing and tracking (accountability) as the data is secured end-to-end, there is notification of receipt/download (who accessed the files, where from, at what time etc) and ability to set files as read-only (access only from the browser window over SSL connection) as well as verify identity of recipient before giving them access to the files (2 factor authentication) without requiring recipient to have a TitanFile account.

Dropbox kicks ass as "file system of the internet" but sharing files with people in a secure and private way with dropbox is a big pain.

With next release we will integrate with dropbox and Google Docs as well.

Disclaimer: I am from TitanFile

kingrwac• 15 years ago

we use Egnyte (http://www.egnyte.com) at our office, it does file sync like Dropbox, except more secure and scalable.

ksankar• 15 years ago

Egnyte : www.egnyte.com

Hybrid Storage with multiple access methods : Web, Desktop (Win/Mac), Mobile & FTP.

Flexible subfolder sync with versioning

Ask HN: Secure Dropbox alternatives?

Related Stories