It is disappointing that Dropbox still does not offer any options for secure storage. Personally, you might be fine with unencrypted stories but at least for companies in Europe, having (all) your data with an American cloud provider without local encryption on your side is simply not a legal option …
Dropbox is a great service, however, it would be even greater if I could use Dropbox for all my data and not only selected data where I do not consider local encryption necessary.
(I know about add-on software like Boxcryptor but all options I have tested so far were not user-friendly enough … Dropbox competitors with encryption like Spideroak and Wuala work good enough but are in no way as user-friendly and convenient as Dropbox.)
> Dropbox competitors with encryption like Spideroak and Wuala
Unless one doesn't really cares about security and wants encryption for the sake of having encryption, there's no way their implementations could be considered sufficient.
Without audit you're just taking their word for it — which is exactly as when you take Dropbox's word that they won't peek at your data (unencrypted or possibly encrypted but one can't verify that). And to audit those one needs to spend a lot of time reverse engineering their applications, and then auto-update mechanism could render those efforts void at any moment. I've spent about a weekend debugging and looking at decompiled SpiderOak code and while I hadn't found anything suspicious (although I'm not a crypto or security expert) the only judgement I was certain with was "this behemoth's too complex to study in detail, not worth the time to continue the research"
The point is, the data could be encrypted, but it's pointless to just have the encryption — to assume some security one must be certain about many aspects of how it's done — when, how and where encryption keys are generated, when, where and how data's processed, what are exact crypto algorithms used and how they are composed together and so on. And, obviously, a possibility to verify the description completely matches the actual implementation.
So, I think, security should be really done by a separate software module that could be completely reviewed by anyone (from tech-savvy end-users to security researchers) and can't be remotely auto-updated without explicit user consent.
I don't know about SpiderOak but I totally trust Tarsnap.
But agreed we have to trust the software companies/devs when using crypto.
Not many people really trust Dropbox anymore to build client-side encryption themselves. But you could use a different program for encryption with dropbox as simple storage. That being said, you still have to trust the Dropbox binaries installed on your system as well. Security paranoia can go deep.
IIRC, Dropbox has HTTP-based API that allows basic file operations, like uploading, downloading and listing files. So, proprietary client isn't really required.
Well, if someone would code a Dropbox-based TAHOE-LAFS backend, I'd seriously consider really using Dropbox. (My phone came with 1-year "free" 50GB offer, so I'm using it for some completely non-private files, like my cat's photos I've publicly shared.)
It is not sufficient but it might be enough to fulfill compliance requirements. Yep, that is only cover your ass security but it is still better than no encryption at all … the glass is half full vs. the glass is half empty although we should of course aim for the full glass.
There's an opinion that it's actually harmful, as it creates a false sense of security when there's none (when a powerful malicious party can possibly force vendor to make the software silently auto-update and disclose your encryption keys — that really means "none").
Agreed. This was the first thing I checked. Still no client side encryption! Truly unfathomable in light of current world events, competitive offerings and the feasibility of the required technical implementation.
Dropbox is a great service, however, it would be even greater if I could use Dropbox for all my data and not only selected data where I do not consider local encryption necessary.
(I know about add-on software like Boxcryptor but all options I have tested so far were not user-friendly enough … Dropbox competitors with encryption like Spideroak and Wuala work good enough but are in no way as user-friendly and convenient as Dropbox.)