<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
On 04/05/2012 01:33 PM, Jordon Bedwell wrote:
<blockquote
cite="mid:CAN5oe=0s26C5MuiUrSGC0rcj2PxF0DzE7VogDKcG3F2y+SqsDw@mail.gmail.com"
type="cite">
<pre wrap="">On Thu, Apr 5, 2012 at 5:42 PM, Sam Smith <a class="moz-txt-link-rfc2396E" href="mailto:smickson@hotmail.com"><smickson@hotmail.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">The point is that SpiderOak (and Lastpass) never know the user's password.
And never receive the encryption key. The key never leaves the user's
computer. The server never gets it. The only thing that ever lands on the
server is an encrypted blob.
</pre>
</blockquote>
<pre wrap="">
>From their website "Retrieve files from any internet-connected
device", "Access all your data in one de-duplicated location"... I
know to the easy consumer that doesn't spell lies but to me it reads
"We do know your encryption key, if we want to and little do you know,
we do have the ability to get the key that encrypts the encryption key
too." Companies lie all the time, or they tell pieces of a story and
never tell the entire story. Though I don't know if it's more of a
lie then an assumption on their end and maybe even they themselves not
even understanding what could possibly go wrong, or they just don't
care because the user doesn't pay too much attention after "WE NEVER
KNOW."
The key to knowing the full story is read "Retrieve files from any
internet-connected device." To add to it, let me point out this:
"Easily access all of your data from any device within your SpiderOak
network or on the web" which contradicts this: "SpiderOak never stores
or knows a user's password or the plaintext encryption keys which
means not even SpiderOak employees can access the data" and it's no so
much a direct contradiction as much as an arrogant assumption that we
(or I guess only I in this conversation) don't realise that their
employees do have a way to access it, they just need to do a couple
minutes worth of work, that is what makes it contradict.
</pre>
</blockquote>
It might not harm to actually look around for technical details
before deciding what a service is or isn't providing, rather than
trying to interpret from the marketing speak.<br>
You can get a much better picture from here: <a
href="https://spideroak.com/engineering_matters#user_auth">https://spideroak.com/engineering_matters</a><br>
<br>
<br>
</body>
</html>