Hacker News Reader

Comment by ecesena | Hacker News Reader

I have some concerns on the 2 sentences (from their website):

- "We've developed proprietary de-duplication and compression technology to be able to give you unlimited storage"

- "Your files are encrypted with AES-256 bit encryption"

I'd prefer to know that my data is not encrypted, rather than reading marketing sentences that have none or obscure meaning when read together.

View on HN

Happy to clarify. We use convergent encryption (http://en.wikipedia.org/wiki/Convergent_encryption), which works with our de-duplication.

Example: You and I both have a file A. Our software encrypts that file A with a unique key generated from the file (say, the MD5 hash of the file), which makes E(A). Every user that uploads file A will generate the same encrypted version E(A) because the encryption key will be the same across each user (the MD5 hash of A).

Does the de-duplication aspect of it have any impact on DMCA/copyright issues?

For example, lets say somebody from HBO downloads Game of Thrones from The Pirate Bay and then uploads it to Streem. We could assume that many other people on Streem also have that same copy of the episode uploaded. HBO then issues a DMCA takedown (could they?), would Streem delete the file for everybody? And does Streem then have to prevent anybody from re-uploading it?

Since there's no way to globally "publish" a file, I don't see how DMCA takedowns could work.

Hence why in my hypothetical it would take the copyright holder themselves to both upload the file as well as issue the DMCA takedown.

By uploading the file, wouldn't the copyright holder be authorizing the cloud service to store it for them?

We follow the same DMCA policy as Dropbox, etc. [1] If we get a DMCA takedown notice, we disable public linking and sharing on the file. The original owner gets to keep the file in their own account (exactly how Dropbox works).

[1] http://techcrunch.com/2014/03/30/how-dropbox-knows-when-your...

Thanks! This means that (using wikipedia terminology) because of "the confirmation of a file attack", an attacker having access to my encrypted storage can obtain an unencrypted copy of all files "publicly known".

Will you consider stronger encryption (of course as a premium service)?

I wonder if the compression technology is as good as Pied Piper's.

Yep. First thing I thought when I read that.

Actually, you can use convergent encryption to dedup encrypted files. It leaks information (because I can tell whether a file that I possess already exists on the server if the server is silly enough to tell me that it took no space/time) but it is indeed encrypted.

Check out this discussion of Mega for more info: https://news.ycombinator.com/item?id=5072680

Also if you encrypt a file with a key made of all 0, it's still encrypted... :) I've added a few more details about my concerns in the other reply.

Reply on news.ycombinator.com