Ask HN: Review my startup - XZ Backup | Hacker News Reader

Ask HN: Review my startup - XZ Backup

XZ Backup is a White Label, or Private Label, Online Backup Solutions stack for Managed Service Providers, Systems Integrators, Value Added Resellers, and Internet Service Providers.

Using an Infrastructure-as-a-Service model, partners benefit from a completely transparent turnkey platform that seamlessly integrates billing, support ticket, and account management consoles; with the added advantage of Branding the software with their company name and logos.

Software features include NSA-level encryption, archival management, incremental in-file delta, continuous data protection, as well as support for all major databases and operating systems environments.

No Contracts, No Branding Fees.

http://www.xzbackup.com

View on HN

Software features include NSA-level encryption

Really? Tell me more. What block cipher are you using? In which mode? How do you manage IVs? How do you manage keys? If you use passwords/passphrases, what KDF do you use? How do you guarantee the integrity of archives? What defences do you have in place against side channel attacks? Can I see the source code?

Somehow I knew that was going to happen ;)

Yeah, I can be rather predictable at times. What I don't understand is how coreyrecvlohe didn't expect this. :-)

What I don't understand is why he apparently didn't do his homework. Before announcing a new online backup service on HN you can bet that I'd be studying the material for months on end to avoid a thorough cleaning of my clock.

Go easy on him, he's put a ton of work in to the graphics, we all know that's what is what counts when you do online backup.

I kind of did actually

Oh, I see. You knew that your claim of "NSA-level encryption" was entirely unsupportable, but you decided to make it anyway?

Why not just be honest?

It is honest. The NSA must abide by Federal Guidelines and procedures. We do not attest to maintain an exact copy of all the details the NSA puts in place regarding their internal security structure, but we do abide by Federal Guidelines concerning data storage, and have taken all operational and technical measures required to meet our privacy obligations (PUBLIC LAW 104-191).

Umm... wow. The NSA must abive by HIPAA, and you must abide by HIPAA, therefore you have NSA-level encryption?

I don't know what to say.

We support 128-bit and 256-bit encryption. We have no access to the keys. In the event that any of our customers lost their encryption phrase, we would not be able to restore the data.

edit: Well we also take operational and technical security precautions to validate our data integrity on a real-time basis. Our facilities are monitored on hardware and network levels 24/7/365. And we meet Federal HIPAA guidelines for privacy and security.

Ok, you answered about half of the first question. Not good enough.

If you really had "NSA-level" encryption you'd be able to do a lot better than that. (Unless your answer was "I can't discuss that and this product is only available to US government employees with the appropriate security clearances", of course.)

The testimonials on each page make it look fake, anybody could have written those.

Link: http://www.xzbackup.com

Reply on news.ycombinator.com