FileRock, secure Dropbox clone, has published its pricing
filerock.com
filerock.com
Just a clarification about the (seemingly high) price: the idea is to offer a limited space where users can put their critical files (business and sensitive personal stuff, not downloaded PDFs or DivX movies).
Something like your own private safe on the cloud, which is really really secure because we do:
- client-side encryption (we're not able to look at your files even if we wanted to);
- integrity check (you can verify that your files have not been tampered. This is our proprietary technology, I daresay nobody else does that as efficiently as we do);
- transparency (our client is open-source, so you can actually verify our claim that the software is secure. This is also something that few others do).
1. client-side encryption: it's all getting stored totally encrypted on amazon 2. integrity check: md5 check 3. transparency: I'll say you are more transparent, but your server-side code isn't open source so this isn't a huge win for me.
Arq is also a $29 one-time fee + the cost of S3, which is $.075/GB vs $13.
In what use case would I choose FileRock?
1. I couldn't find detailed info on Arq, but "plain" encrypted storage is different from client-side encryption (where you, and nobody else, control the keys)
2. Our integrity check is very efficient, allowing us to update a hash of the complete dataset in real-time (while re-MD5ing a set of data at every small update takes time)
3. See another answer in this thread: from a security point of view, the fact that the server is not open-source does not matter as the client verifies all server replies.
We believe that our security features are top-notch and are worth the price if you really care about the security of your data :-)
2. Stop saying you MD5 things, and, if you're using it, stop using MD5. Also: this is not a compelling feature. Tarsnap HMAC-SHA256's every block of data it stores.
3. I'm not going to tell you that you need to open-source your server, but I wouldn't give "it doesn't matter for security" as a reason why.
You should put a page together that explains your whole cryptosystem, down to "why you're using CFB" and "how you pick IVs for CFB" and "where integrity checks are performed", so that people can review it. It's awfully hard to assess security claims without detailed information.
With the solution you mention, you'd have to manage the server and the encrypted communication, make everything redundant and still introduce some kind of integrity check if you want to really be sure that your provider hasn't tampered with your data.
File integrity is a solved problem, so I'm not clear on why you'd want to have a proprietary solution here.
Looks like they're using AES in CFB mode, which would probably complicate things, but I don't know why people don't use CTR mode more (it looks like it has many advantages to me, but I don't know much about crypto anyway), although in this scenario you'd probably want to use XTS.
Anyway, "proprietary" and "cryptography" in the same sentence is generally a big red flag to me.
What's "proprietary" is the implementation of the integrity check technology, which is based on published research.
So is the integrity check demonstrably better than HMAC?
The main difference brought from the technology we use is that while a system like the one you describe involves some probabilistic decision-making (like voting: e.g. out of 3 replicas, you choose 2 that seem correct) we have a mathematical way of verifying the integrity of the data (so you don't need to access all replicas to be sure that you are working with the correct data).
SpiderOak, a secure cloud file storage, offers 2gb free for life (plus a handful more GBs for various promos).
The client code is GPLv3, so it could be a building block for other projects if they want to use it with a different server.
Also, it isn't a Dropbox clone (you wish!).
But yes, it's not an "open source <something>", it's a "<something> with source available". It's great from a security standpoint, but "open source" implies that all the components are open-source and that you can self-host, and referring to it as "open source <something>" is disingenuous.
That said, this is just the HN post's title. It's not described like that on your site, so that part is good.