Hacker News Reader

Comment by 8fingerlouie | Hacker News Reader

I've used countless encryption "schemes" over the years, from True/Vera-Crypt to encrypted sparse bundles/images, and none have ever really felt right.

These days i tend to use Cryptomator[0] instead. It accomplishes what none of the others could do, which is transparent encryption across devices.

With Cryptomator, i simply create a vault somewhere in the cloud, stuff data in it, and i can access it from my laptop, phone or tablet, and not think much about it. It integrates into the normal file browsing APIs, and doesn't get in the way.

Because it does "per file" encryption, it also doesn't need to download a 20-100MB chunk from the cloud before decrypting, so it's rather fast (depending on file size of course).

Cryptomator is also open source[1], and free on the desktop, though the mobile apps costs a one time fee.

[0]: https://cryptomator.org/

[1]: https://github.com/cryptomator

View on HN

I used to use similar per-file cloud solutions, but SyncThing has been better in every way, especially if you already have a server you want to sync to or can use as an encrypted endpoint.

A few years ago I was in a Arma3 Milsim group that hosted their own server.

Back then there was no automated way to sync plugins so we installed syncthing and told all users to install it too.

We put like 50gigabytes worth of addons on syncthing and the users were so much happier because since 50+ people were using this syncthing connection, everyone could download with full speed from the others as in contrast to the 100mbit/sec bandwith of the HTTP server we formerly used.

And nobody had to care about checking versions anymore, the syncthing folder was directly synced into the Arma3 plugin directory

That is not a bad model if you completely trust the server owners. I feel there are more secure ways, but I suspect if a Arma3 server wanted to infect a machine with a bad mod they could. so the threat vectors are the same really.

I’ve used syncthing sporadically over the years, but it has had very bad iOS support whenever I’ve tried it.

Mobeus exists, but doesn’t integrate into the files app, and uses a lot of battery.

I also used Resilio Sync for years, but it appears to have more or less died out.

So when it came to finding a replacement I settled on using cloud native for synchronization, and simply put encryption on top, and for that, Cryptomator is great.

I use CryFS combined with SyncThing, perfect solution for my needs. Have it set up on linux and android.

I tried many, many sync solutions (I self host a lot) but syncthing always looked weird to me.

One day I forced myself to actually configure it and, boy, what a wonderful product it is.

It takes some time before you have the eureka moment but then the flexibility of the tool us incredible.

It is hard to keep track of the links so I wrote https://github.com/wsw70/syncthing-map to ease the pain a little bit.

I've not used it myself, but there's also CryFS [1]. It's file-level like EncFS or eCryptFS, but uses fixed-size and padded cypherfiles to avoid leaking details about your file structure. I'm not sure about Cryptomator, but with EncFS it would be relatively easy to infer that someone has, say, the Tor browser stored in it, by the size and shape of the encrypted files

[1] https://www.cryfs.org/

I'm a fan of gocryptfs [1]/cppcryptfs (Windows implementation) [2], they also have a fairly unbiased comparison [3] with other solutions, including CryFS.

[1] https://nuetzlich.net/gocryptfs/

[2] https://github.com/bailey27/cppcryptfs

[3] https://nuetzlich.net/gocryptfs/comparison/

CryFS (and gocryptfs) both suffer from the same lack of support on iOS, which Cryptomator has, which is the reason i'm sticking with it.

As for how it encrypts files, there is a description here : https://docs.cryptomator.org/en/1.5/security/architecture/#f...

Cool, I did not know it, and is a product from a master thesis at our university. Have to try it.

People complain about speed in the past : https://news.ycombinator.com/item?id=23469401

Is it usable?

Looks very similar to the 'Crypt' remote offered by Rclone[0]

I use it to store 'per file' encrypted data on Dropbox. (I also keep a restic repository on there)

[0]: https://rclone.org/crypt/

I have used rclone with crypt in the past, and it works well, but doesn't easily lend itself to being used from mobile devices, which is what led me to Cryptomator in the first place.

I don't want to rely on having a server running at home, which i can then connect to via VPN, in order to download encrypted stuff from the cloud. With Cryptomator i can simply download from the cloud and decrypt locally.

> I have used rclone with crypt in the past, and it works well, but doesn't easily lend itself to being used from mobile devices, which is what led me to Cryptomator in the first place.

Round-Sync for Android [0] is an app wrapper for rclone. I use that to upload my photos via plain SSH.

[0] https://github.com/newhinton/Round-Sync

Rclone doesn't work too well on mobile though, which is where cryptomator is really nice.

RCX on android[0] gives a reasonable experience for pecking at files (Also handles media streaming reasonably well and supports the Crypt remote mentioned in the parent)

[0] https://github.com/x0b/rcx

Gocryptfs is another alternative in the same vein. I've switched to it from Cryptomator as it has better Android support and is more ergonomic on the command line.

What I haven't found a solution for, is being able to synchronise and open a gocryptfs with cloud sync on Android. Dropbox/Drive/pCloud folders aren't directly accessible or mounted in Android. One work-around could be to export a zip of the folder from Dropbox/whatever, then extract and open that, but that's one-way.

Do you have a solution for this?

I use syncthing for this. But yeah it isnt ideal.

Likely won't be of much help with the cloud sync angle, but for CryFS and GocryptFS support in Droid, you might find DroidFS worth a look.

Yep unfortunately the same still applies with DroidFS. Thanks though.

Yep I use Cryptomator for when I want to sync a bunch of small individual files, and Veracrypt for big local archives. I forget whether I have cryptomator hooked up to Dropbox or google drive, but I’ve never had an issue with it.

Does Cryptomator also works over sftp? Does it supports concurrent edits to the same vault? Can't find much about it in the docs...

Reply on news.ycombinator.com