Hacker News Reader

Comment by fapjacks | Hacker News Reader

I just want to add a big emphasis to "YOUR OWN CRYPTO" with Dropbox. Stuffing data into Dropbox without encrypting it first for example with VeraCrypt is a bad choice. Even Dropbox says their own employees "need" access to your data "occasionally". (Also, I meant to upvote you but I fat-fingered it on my phone, sorry!)

View on HN

VeraCrypt or other FDE-like tools (that are meant to be used on actual drives or their imitations using a file-backed device) are not so great idea for use with Dropbox or alike file/object storages. Here's why: http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/

Time to promote my project `securefs` again (https://github.com/netheril96/securefs). Written specifically to address that XTS issue.

Is there a client side encryption tool that works with Dropbox and is usable by non technical people (plus for being available on both Windows and Mac)?

I personally use encfs to create a partition within Dropbox, but I don't see that being easy to setup and manage...

EncFS is specifically not safe to use in situations where an attacker has multiple versions of your data.

Cryptomator [1] looks like it fits the bill for what you described. Seems to use a transparent mapped virtual WebDAV drive to make it usable. From my experiments at least, it seems it should be usable by non-technical people without significant demonstration or training.

[1] https://github.com/cryptomator/cryptomator

Yes, maybe I should've made this emphasis stronger in my comment. Also I didn't meant to say that using owncloud is worse than using dropbox in security terms - but you should use your own (client-side) crypto either way if you care about data security.

For myself I use my selfhosted owncloud (running on a cheap VPS) with EncFS, encourage other users on that server to use client-side encryption as well and never lied about how secure their data is when they decide not to. But this isn't so easy as it should be.

I also use EncFS - on Dropbox/GoogleDrive/JottaCloud - but be aware it's got known flaws, don't rely on it if your data might be of interest to a nation state or high level law enforcement: https://defuse.ca/audits/encfs.htm

Reply on news.ycombinator.com