Tell me more ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.
up vote 15 down vote favorite
2

Is there any verification that the encryption used can not be bypassed by the operator? Or should I actually use some encryption of my own like truecrypt?

edit In the light of this complaint against Dropbox by Christopher Soghoian, should the answers given to my question be revised?

edit2 it's getting better and better...

Bottom line: everything you never ever want to be made public should be encrypted by yourself

share|improve this question

4 Answers

up vote 15 down vote accepted

If your files are of a very sensitive nature then you should already be taking measures to secure them regardless of any promises or the good reputation of the service.

If however these files are of 'normal' sensitivity then the risk of bad press will usually be enough to guarantee they're good behaviour, after all your files are probably worth less to them than your (even potential) subscription fees.

share|improve this answer
speaking of bad press... techcrunch.com/2011/06/20/… – Tobias Kienzler Jun 21 '11 at 8:29
up vote 6 down vote

There is no way you can tell if the companies can get access to your files, and given that they could probably bypass your password for login - it's likely that they could get to your files if they really wanted to.

The only way to be 100% sure that you alone have access to your files is to encrypt them or host the service yourself. In the latter case, you should be aware that any large company is probably going to be able to do backup and security better than you.

Finally - A company like dropbox has better things to do than to go through your files. I would suggest that for larger / more well known companies, your files will probably be safe. Firstly because their businesses rely on you trusting them and secondly, because you're just one account in a myriad of accounts.

share|improve this answer
1  
Of course everyone should have better things to do than going through my files, but assume I store my Keepass file here which may include logins which could be misused for purchases etc. – Tobias Kienzler Jul 8 '10 at 9:19
2  
@Tobias Your Keepass file is already encrypted (assuming you set a master password to open it). – dbkk Jul 8 '10 at 10:49
@dbkk right you are... consider sensitive data like an unpublished thesis then – Tobias Kienzler Jul 8 '10 at 11:39
2  
@Tobias: I wouldn't really consider an unpublished thesis "sensitive data" - unless you are proving P==NP or something like that, there are relatively few people in the world who would find your thesis useful enough to steal it, and most likely none of them both work at Dropbox and are unethical enough to use their position to peek at your files. I would feel fine putting thesis work on Dropbox. Still, if you're concerned, it shouldn't be too hard to encrypt the files. – David Zaslavsky Jul 9 '10 at 3:30
up vote 5 down vote

If you feel you can't trust them, you might be interested in TarSnap - "Online backups for the truly paranoid", developed by Colin Percival.

share|improve this answer
1  
I'm not paranoid; these people really are after me! :) But I agree. Encrypt your really sensitive files before uploading to a shared online service. – William Jul 9 '10 at 12:33
up vote 3 down vote

Not sure about Dropbox. But from the Wuala service I am using, this is what they claim:

Wuala protects your privacy: In stark contrast to most other online storage services, all your files get encrypted on your computer, so that no one - including the employees at Wuala and LaCie - can access your private files. Your password never leaves your computer.

Wuala employs the 128 bit AES, 2048 bit RSA and SHA-256 algorithms for encryption, signatures and integrity checks. If you're interested in how Wuala manages encryption, have a look at our publication on Cryptree.

Convincing enough for me.

share|improve this answer
2  
It is easy to state that, but unless the source is available and has been audited, I don't know... – Tobias Kienzler Jul 8 '10 at 9:16
1  
daemonology.net/blog/2008-11-07-wuala-security.html says: "Make sure that your password is strong; that you don't reuse it anywhere; and that you never type it into an untrusted system or where people could watch you or listen to your typing. Realize that you can't trust the authenticity of any public files. Don't modify and re-upload files if you don't want people to know what files you've changed. And recognize that ultimately you're completely trusting Dominik Grolimund and the Wuala staff with your computer and your data. But aside from that, Wuala's security now looks fine." – Tader Jan 7 '11 at 21:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.