Hacker News Reader

Comment by neuro_imager | Hacker News Reader

As someone with very little knowledge of encryption etc. please advise - how safe is dropbox? I would have guessed it would be a relatively frequent target for blackhats.

View on HN

I would consider it not safe because it was on of the companies mentioned on the NSA slides. You can still sync your Keepass(x) file with Dropbox if you have a good password (key file is recommended) on the database file.

Instead of Dropbox you can also use https://spideroak.com/ They have a really handy program which let you control a lot of things and they are a "zero knowledge" cloud provider, all your data is encrypted. Snowden recommends them: http://www.theguardian.com/technology/2014/jul/17/edward-sno... For $12 dollar a month you get 1 TB, which you can use as a safe off-site backup location.

Note that, while SpiderOak is arguably more secure than Dropbox, they rely on a hybrid security model wherein they still have your encryption key on their server, but encrypted with your local password. This matters because if your password is ever compromised, however briefly—say, by using the mobile app or the website, neither of which are supported in a secure manner (they make this very clear)—then all your data would be permanently compromised, with no way to rotate your keys and re-encrypt your data before someone gets access to it, short of blowing out your account. I get why things work this way, but still, yuck.

Also worth pointing out that neither Dropbox nor SpiderOak are fully open-source, so you are having to place some degree of 'blind trust' in either service. It is in their own best interests to have great security so that customers trust the product, but this cannot be verified by someone outside the company.

SpiderOak'er here; as a reminder, we also offer Encryptr, our own password manager: https://spideroak.com/solutions/encryptr

Which itself _is_ open source: https://github.com/SpiderOak/Encryptr

Been using this for a while and I'm liking it so far.

When are exporting and offline access coming?

I would expect Dropbox to be rather safe (please use two-factor auth), though I did migrate to self-hosted ownCloud myself. Anyway, this is not even a crucial part, since the password file is obviously encrypted with a strong password. The unencrypted data never touches the disk.

Also, for the database file encryption I'm using AES256 with 10 million encryption rounds (configurable in the application), which hopefully slows down any brute force attempts even in case of a data breach.

Of course, all bets are off if your device itself is compromised, but that would be the case with any solution.

> AES256 with 10 million encryption rounds.

Applying AES multiple times/rounds doesn't yield anything. AES is not adaptive (like BCrypt) so the cost of brute-forcing doesn't increase incrementally with the number of rounds.

I'm not expert on encryption, so could you clarify this a bit? If the source data is encrypted multiple times, surely then decrypting needs the same number of passes to get the original?

Yes, but AES is fast. And since your using the same key over and over again it makes no real difference if you're decrypting once or 10 million times.

Interesting. I assume that to mean that the inner decryption loop can be repeated over and over with just a minimal overhead when the same password is being used, compared to the whole process of choosing the next password and setting up the decryption process with that.

Anyway, the slowdown is noticeable on my devices with these applications (it's about one second on my laptop), but then again these obviously are not custom-built AES decrypters. This will have to do now.

Take a look at sync.com as an alternative.

Reply on news.ycombinator.com