<html> <head> <style></style></head> <body class='hmmessage'><div dir='ltr'> The point is that SpiderOak (and Lastpass) never know the user's password. And never receive the encryption key. The key never leaves the user's computer. The server never gets it. The only thing that ever lands on the server is an encrypted blob. <br><div><div dir="ltr"><br>What this means is that the user doesn't have to worry about the 3rd party taking care of the data. If the 3rd party is hacked, if the 3rd party has a rogue employee, etc. The data has a much better chance of being safe than if it's implemented like say iCloud where even if the data is encrypted Apple holds the encryption key and can access the data anytime they want. If Apple can access the data, a rogue employee and a hacker can potentially access the data.<br><br><br><br><div><div id="ecxSkyDrivePlaceholder"></div>> Date: Thu, 5 Apr 2012 11:32:33 -0500<br>> Subject: Re: Ubuntu One needs cloud encryption like LastPass does it<br>> From: jordon@envygeeks.com<br>> To: amon@vnl.com<br>> CC: smickson@hotmail.com; ubuntu-devel-discuss@lists.ubuntu.com<br>> <br>> On Thu, Apr 5, 2012 at 8:18 AM, Dale Amon <amon@vnl.com> wrote:<br>> > On Wed, Apr 04, 2012 at 07:55:09PM -0400, Sam Smith wrote:<br>> >><br>> >> I use "SpiderOak" because it offers client-side encryption. It provides the security & privacy I seek.<br>> >><br>> >> I'd prefer to use Ubuntu One, but until it supports client-side AES 256-bit encryption & additionally encrypts the decryption key itself (like SpiderOak does) I won't even consider it.<br>> ><br>> > And rightly so. With the new NSA capabilities going into<br>> > place and the atmosphere around the world, you are<br>> > absolutely not safe in your privacy if it is possible<br>> > for anyone to acquire your keys or decrypt your files<br>> > without stealing your computer and beating or threatening<br>> > the password out of you.<br>> ><br>> > I include various State's laws seizures and court orders<br>> > under the classification of 'stealing and threatening'.<br>> <br>> Encrypting the encryption key has nothing to do with security, you<br>> guys are spreading FUD and assumptions now IMO. Encrypting the key<br>> has to do with usability, it's no more secure than having a single<br>> encryption key that you have memorized and actually it's the same<br>> concept except fragmented between you and the data... they still need<br>> only attempt to break into a single file and then they have access to<br>> all the other files... They encrypt your encryption key because it's<br>> much more feasible to re-encrypt a single file then it is to<br>> re-encrypt the entire set of fragmented data. Whether on your<br>> computer or not if you have gigabytes or hundreds of gigabytes of data<br>> it could take quite a long time to re-encrypt it unless you have<br>> dedicated crypto hardware. Then you have to re-upload all that data<br>> again, wasting their bandwidth and wasting more space on their<br>> servers. This is why utilities just create a strong encryption key<br>> for themselves and encrypt that file with your key.<br></div> </div></div> </div></body> </html>