Lockbox Aims To NSA-Proof the Cloud 292
Daniel_Stuckey writes "Lockbox, a tech startup founded in 2008, just received $2.5 million in seed funding for its end-to-end encryption cloud service, Client Portal. So, how does end-to-end cloud encryption work? Lockbox encrypts and compresses files before they are uploaded to the cloud. Only a person in possession of the corresponding key can unlock, or decrypt, the files. This means that the NSA, malicious hackers, business competitors, and even crazy girlfriends and boyfriends won't be be able to peer into users' most sensitive and private files."
Is it really safe / free (libre) software? (Score:2, Informative)
In this months Free Software Foundation news Bulletin the FSF points to what appears to be a similar offering that is free software friendly:
https://leastauthority.com/press_release_2013_07_30
I took a quick look at lockbox and nothing I saw screamed free software. I could be wrong. Maybe they are even using the same underlying software as LeastAuthority. However they haven't advertised that clearly enough (on front page). I'd be concerned in using a service that is more concerned about looks, isn't clear, and might even be snake oil.
If somebody has the time to take a better look please post a reply with the relevant facts and links to the source/evidence/etc.
Re:I like the idea (Score:4, Informative)
you could air gap the encryption task from the transfer task, and even with a court order and a shot gun to their head, the company couldn't give you data away.
The order could say to covertly insert a backdoor of the NSA's choosing in the "open source" client; or provide the NSA operatives root access to the server that distributes the client binaries, and the keys to push out a new release of the software.
Someone maintains the code that the users are using. And the maintainers could very easily be subject to a gag order; to not discuss the covert backdoor, even if it's visible in the open source code ----- it doesn't have to be, though: most people will just download the project's (NSA-patched) binary builds of the release.
Re:I like the idea (Score:4, Informative)
Another service offering:
SpiderOak uses AES256 in CFB mode and HMAC-SHA256. SpiderOak uses a nested series of key scopes: a new key for each folder, version of a file, and the individual data blocks that versions of files are composed from. Having keys with such limited scope allows for selective sharing of chosen portions of your data while keeping the remainder private.
Most importantly, however, the keys are never stored plaintext on the SpiderOak server. They are encrypted with 256 bit AES, using a key created from your password by the key derivation/strengthening algorithm PBKDF2 (using sha256), with a minimum of 16384 rounds, and 32 bytes of random data ("salt"). This approach prevents brute force and pre-computation or database attacks against the key. This means that a user who knows her password can generate the outer level encryption key using PBKDF2 and the salt, then decipher the outer level keys, and be on the way to decrypting her data. Without knowledge of the password, however, the data is unreadable.
SpiderOak accounts also include a 3072 bit public/private RSA key pair. This is currently not used for anything, but is included with all accounts with the expectation that SpiderOak will add multi-user private collaborative and sharing features which would necessitate the use of the the public/private keys.
https://spideroak.com/ [spideroak.com] .
Re:I like the idea (Score:2, Informative)
That's a lot of nice buzzwords that are thrown out there. But they're closed source and in the USA, so it all comes down to "Trust us." Do you? Why?