Author Topic: Cloud-storage - safe & secure? Consider Wuala (it's encrypted as well). (Read 38312 times)

IainB · « **on:** April 28, 2012, 11:04 AM »

One issue that seems to persist in discussions in the DC Forum relating to aspects of cloud-storage is the safety/security of your data whilst it is in cloud-storage.
These discussions sometimes referred to Wuala, which has been discussed quite a bit on the DC forum, but seems to have been mainly "in passing".
I found some interesting links on this post: SkyDrive storage space land grab for grandfathers
One of them was in reference to Wuala.

So, today I followed the link in sciencetext and took a look at the Wuala site: Wuala - FREE 6Gb offer.

And I watched the simple Wuala - Promo Video
It's about a guy (John) who is concerned about his data security, after being bitten. (Maybe his data was on dotcom, or something, and he lost it all.)
Wuala looks like it is good tech and encrypted as well.

More choices!

KynloStephen66515 · « **Reply #1 on:** April 28, 2012, 11:08 AM »

So, today I followed the link in sciencetext and took a look at the Wuala site: [/b]l/KKB5A56HF4F7CMCJ7F4G]Wuala - FREE 6Gb offer.

Broken?

IainB · « **Reply #2 on:** April 28, 2012, 11:41 AM »

Sorry!

Link now fixed.

KynloStephen66515 · « **Reply #3 on:** April 28, 2012, 11:45 AM »

Sorry!
Link now fixed.
-IainB (April 28, 2012, 11:41 AM)

db90h · « **Reply #4 on:** April 28, 2012, 03:13 PM »

There is a *huge* difference between 'encryption' and 'client-side encryption', the latter being when the CLIENT generates and controls the key. The latter is available only at Carbonite, afaik, though maybe this service supports it, and that's what you are saying.

Even Google Drive does not offer client controlled encryption. If this service offers that, then the encryption 'counts'. Otherwise, the encryption is just useful en-route, as when stored on their servers it is stored right along side the decryption key.

Of course, the issue with clients controlling their own key is obvious -- they are likely to lose it, its harder to make things 'just work', etc.. However, for me, that's a pre-requisite to storing anything I wouldn't want publicly broadcast. For standard stuff that doesn't matter much, I don't care.. but for private things, you definitely have to control the encryption key.

Yes, you can encrypt then upload to any service, but then you must download and decrypt it to access the data, making the process a lot more cumbersome than a system that lets you generate and use a local key seamlessly.

I suspect that law enforcement is actively engaged in trying to deter these cloud storage services from offering true client side encryption, as it makes their jobs a bit harder in some cases.

Deozaan · « **Reply #5 on:** April 28, 2012, 06:15 PM »

SpiderOak also does client-side encryption. FYI.

IainB · « **Reply #6 on:** April 28, 2012, 10:02 PM »

Interesting. It looks as though we have here - so far, from the above comments - at least three (3) client-side encryption cloud-storage services:

1. Wuala (per IainB)
2. Carbonite (per @db90h)
3. SpiderOak (per @Deozaan)

About Wuala: (as far as I have been able to establish by this point)

Has a client application that encrypts/decrypts the data synced/sent to/from the cloud-storage. The files as stored on the local drive are encrypted, then sent in encrypted form between client and cloud-storage.
The data on your local drive is presented by the client application in a proprietary file explorer window. (I have not yet established where it is stored logically on the disk in C:\Users\[USER]\AppData\Local\Wuala)
The proprietary file explorer window shows/holds folders and files in the same structure as held on the cloud-storage.
You can read and edit the files in the proprietary file explorer window, which are encrypted/decrypted for the local editing application.
Installing the client application necessitates a system reboot.
The first time you run the client application, it asks for your user account details, or whether you want to set up a user account.
If you want to set up a user account, then the client application walks you through user account setup.
The application takes/uses whatever string you give it as an account PASSWORD at setup. I presume that it is related to the encryption key somehow. (You can change the PASSWORD subsequently, if you wish.)
You are warned that if you lose/forget the PASSWORD, then you have lost all your data also (unrecoverable), as the PASSWORD is not stored or known in the cloud-storage side.
The client application asks you to set a memory-nudging note in case you forget the PASSWORD. (The note is stored.)
The client application can store the PASSWORD if you select that as an option, otherwise you have to type it in every time you start up the client application. (I think I prefer the latter, for security.) The application does not tell you what the PASSWORD is.
The client application can be started manually or by default as a Windows startup.

I suspect that law enforcement is actively engaged in trying to deter these cloud storage services from offering true client side encryption, as it makes their jobs a bit harder in some cases.
-db90h (April 28, 2012, 03:13 PM)

Yes, probably so. Wouldn't surprise me one bit.

phitsc · « **Reply #7 on:** April 29, 2012, 04:46 PM »

One annoyance with at least Wuala and Spideroak is that their mobile clients for Android and iOS do not support uploading into the cloud yet.

J-Mac · « **Reply #8 on:** May 05, 2012, 03:07 PM »

One annoyance with at least Wuala and Spideroak is that their mobile clients for Android and iOS do not support uploading into the cloud yet.
-phitsc (April 29, 2012, 04:46 PM)

Not sure that you could encrypt files on Android or iOS. And neither platform is proving to be very secure. That might be a readon why they are struggling to add the feature. Just a guess.

Jim

IainB · « **Reply #9 on:** September 01, 2013, 02:19 AM »

The Snowden leaks and revelations about wholesale NSA surveillance have made a mockery of what we might have imagined to be true about the security/confidentiality/privacy of our personal Cloud-based data, services and telecommunications in general.
The abrupt closure of secure and encrypted email service providers Lavabit and then Silent Circle should provide more than sufficient justification for us all to worry about our own personal safety from threats from the State.

On 2013-08-15, Google announced: Google Cloud Storage now provides server-side encryption

I am underwhelmed by this and do not understand why Google chose to announce this at all, it seems so pointless. Maybe they were told to, to allay people's fears? Whatever the motivation, the unspoken implication seems to be that your data will be safe from access by others - e.g., (say) criminals - but that definitely doesn't preclude US State-approved surveillance of all that is yours.

Wuala and the few others like them would seem to be looking increasingly attractive.

And now we may have some new suspicions as to why Digital Lifeboat was shut down - refer Secure Cloud backup -e.g., Digital Lifeboat - what alternatives are there?

IainB · « **Reply #10 on:** September 17, 2013, 04:26 AM »

As I am an existing user of Wuala's FREE service, they emailed me to say that if I invited people to sign up using the referral code below, I could get up to 15GB additional storage for free. So, if you want to sign up you would be doing me a favour, thanks:

For every successfully invited contact, you'll get 1GB of bonus space (up to a limit of 15GB). All they have to do is register and install Wuala with your referral code.
________________________________

The latest FAQ is here.

Download and install Wuala (further instructions)
Create an account and enter your referral code B3FF6574B36FACG7AF46 in the field Promo code

The Wuala service still seems to be one of the most secure and NSA-proof end-to-end encrypted cloud-based services out there, plus it has the advantage that it is not based in the US.

With Wuala you can...
Access files from anywhere
Securely store files online
Backup files automatically
Sync files across multiple computers and online
Access previous versions of files
Share files with friends, family and co-workers
Jointly manage files in a group

We don't scan!
Unlike other cloud storage services, we never scan or filter any data you store on Wuala.

We don't read!
We (or anybody else but you) cannot read your data because of Wuala's client side encryption.

We Are Swiss...
Wuala is operated and developed in the middle of Zurich, Switzerland and we care about your security and privacy.

...Our Servers European
If you heard the news, you know that your data is much safer in Europe. Our 3 datacenters in Switzerland, Germany and France ensure your data stays in Europe.
________________________________

phitsc · « **Reply #11 on:** September 17, 2013, 04:33 AM »

Do you use any of the mobile apps (iOS and/or Android) with Wuala? Can they now also encryp and upload data to the cloud (last time I looked they could only download, but not upload data).

Edit: Ah, just saw that I already posted that a few posts up

(but that was over a year ago)

IainB · « **Reply #12 on:** September 17, 2013, 05:51 AM »

I only use a PC to connect with Wuala.

IainB · « **Reply #13 on:** September 25, 2013, 05:54 AM »

This post in Cnet.com from 2013-07-17 says some interesting things about encryption and Wuala and other services:
(Copied below sans embedded hyperlinks/images.)

Google tests encryption to protect users' Drive files against government demands
The search giant is seeking ways to armor user files, sources say, a move that could curb government surveillance attempts.
by Declan McCullagh
July 17, 2013 10:47 AM PDT

Google has begun experimenting with encrypting Google Drive files, a privacy-protective move that could curb attempts by the U.S. and other governments to gain access to users' stored files.
Two sources told CNET that the Mountain View, Calif.-based company is actively testing encryption to armor files on its cloud-based file storage and synchronization service. One source who is familiar with the project said a small percentage of Google Drive files is currently encrypted.
The move could differentiate Google from other Silicon Valley companies that have been the subject of ongoing scrutiny after classified National Security Agency slides revealed the existence of government computer software named PRISM. The utility collates data that the companies are required to provide under the Foreign Intelligence Surveillance Act -- unless, crucially, it's encrypted and the government doesn't possess the key.

"Mechanisms like this could give people more confidence and allow them to start backing up potentially their whole device," said Seth Schoen, senior staff technologist at the Electronic Frontier Foundation in San Francisco.

Major Web companies routinely use encryption, such as HTTPS, to protect the confidentiality of users' communications while they're being transmitted. But it's less common to see files encrypted while stored in the cloud, in part because of the additional computing expense and complexity and the difficulties in indexing and searching encrypted data.
Google previously had said that user files were transmitted in encrypted form, but stored in its data centers in an unencrypted manner, as detailed in an April 2012 post on a Google product forum from a community manager.
Jay Nancarrow, a Google spokesman, declined to answer questions about Google Drive encryption.
Secure encryption of users' private files means that Google would not be able to divulge the contents of stored communications even if NSA submitted a legal order under the Foreign Intelligence Surveillance Act or if police obtained a search warrant for domestic law enforcement purposes.

Ukrainian Internet Party activists hold a 'tap the phone and internet lines' protest on June 27, 2013 outside the US Embassy in Kiev.
(Credit: Getty Images)

By contrast, secret NSA documents leaked by Edward Snowden show that Microsoft worked with NSA to "circumvent the company's own encryption" as part of PRISM, according to a report last week in the Guardian.
Microsoft General Counsel Brad Smith said yesterday that there are "significant inaccuracies" in last week's news reports. He added in a blog post, referring to Outlook.com: "When we are legally obligated to comply with demands, we pull the specified content from our servers where it sits in an unencrypted state, and then we provide it to the government agency."
Some smaller companies already provide encrypted cloud storage, a concept that is sometimes called "host-proof hosting." SpiderOak says its software, available for Windows, OS X, Linux, iOS, Android, and Nokia N900 platforms, uses "zero knowledge" encryption techniques that allow it to store data that is "readable to you alone." SpiderOak also offers a Web access option because of "overwhelming customer demand," but the company suggests the client application is more secure.
Wuala is an application for Windows, OS X, Linux, iOS, and Android that also uses client-side encryption. Zurich-based LaCie AG created the application.

"LaCie employees have very limited access to your data," the company says. "They can only see how many files you have stored and how much storage space they occupy."

While details about Google's experiments with Drive encryption were not immediately available, the company may be taking a different approach by performing the encoding and decoding on its servers.

Microsoft counsel Brad Smith.
(Credit: Getty Images)

If that's the case, a government agency serving a search warrant or subpoena on Google would be unable to obtain the unencrypted plain text of customer files. But the government might be able to convince a judge to grant a wiretap order, forcing Google to intercept and divulge the user's login information the next time the user types it in. Vancouver-based Hush Communications was required to take a similar step in 2007 -- though that was under Canadian law, not that of the United States.
Whether the government could obtain a user's login information with a wiretap order is an "unanswered legal question" in the United States, says Jennifer Granick, director of civil liberties at Stanford University's Center for Internet and Society. "I think the answer would depend in part on whether decryption could be called a current capability of the provider -- or requires reengineering of the service."
Google has litigated aggressively in the past to protect users' privacy. CNET disclosed in May that the company is fighting the Justice Department over secret national security letter requests in two different federal courts. It fought the government over a subpoena for search logs and has an active case before the Foreign Intelligence Surveillance Court. It also was the first major company to adopt "perfect forward secrecy" for Web encryption, a technology that protects the confidentiality of user communications even if a government is eavesdropping on the network.
Alan Butler, appellate advocacy counsel at the Electronic Privacy Information Center, says a user typing in a passphrase might "be considered an electronic communication and subject to interception" under federal surveillance law.
CNET reported in an article last Friday that the U.S. government has used the threat of installing custom eavesdropping hardware on companies' networks to compel cooperation in aiding surveillance demands. The article disclosed that Verizon Business was required to install surveillance gear that the government had purchased and provided.

Disclosure: Writer Declan McCullagh is married to a Google employee not involved with Google Drive.

Declan McCullagh

Declan McCullagh is the chief political correspondent for CNET. Declan previously was a reporter for Time and the Washington bureau chief for Wired and wrote the Taking Liberties section and Other People's Money column for CBS News' Web site.
________________________________

ericalynne · « **Reply #14 on:** January 02, 2014, 06:57 AM »

I am trying to use Wuala for my microbusiness. It has the encryption and file sharing I need for Hipaa rules. I was using dropbox, but dropbox starting randomly deleting files. I could restore them, but it made me worry. Wuala is cheaper and better than dropbox and syncplicity...BUT I can't seem to get Wuala set up so that it works with my team mates who are distant from me.

I have read the Wuala forum, the Wuala instructions, the Wuala help and have requested assistance from business product support several times, but my team cannot see and edit the files I have stored in wuala. I have done the sharing, the groups, the invitations, etc. and nothing seems to work. I have requested assistance from wuala, but the email answers are very slow (days) and don't answer my questions, mostly they just refer to the instructions I didn't understand in the first place.

I have spent a full month trying to get this to work without success. I can use wuala myself. It is set up and working on my computer...even syncs between my laptop and desktop. One team member can see the files, but cannot edit. The other three can't even see the files. We have already wasted a month on this system and I am almost ready to give up, even though I have already given them a year's fee.

Can anyone help me get set up? I am reasonably competent computer user, (not a developer.)

Erica

IainB · « **Reply #15 on:** January 02, 2014, 09:26 AM »

@ericalynne: That doesn't sound so good.
I'd like to help, but I am a single user and have not trialled the group/collaboration functionality.
There may be others on this forum who have made more use of Wuala though.

Just a thought: Have you posted about your problems on one of the Wuala forums?

ericalynne · « **Reply #16 on:** January 02, 2014, 09:52 AM »

Hi IainB,

Thank you for responding.

I have posted questions on the wuala forum and I get referred back to the help topics. I have the feeling there is some basic institutionalized pattern of software developers or more highly trained users that I don't have. Dropbox was easy and intuitive. The reviews I read of wuala said it was hard to get to learn and that is certainly been the case for me.

Erica

J-Mac · « **Reply #17 on:** January 02, 2014, 02:29 PM »

Have you contacted Dropbox Support? I've used Dropbox just about since it started and every time I had a problem it turned out to be my fault. Actually it's difficult to lose a document from Dropbox; they keep any files accidentally deleted on their servers for a fair amount of time after deletion. You need to contact them and possibly resurrect any files that were deleted.

Jim

ericalynne · « **Reply #18 on:** January 02, 2014, 02:41 PM »

Thank you for your response. The first thing I did was work with dropbox technical support.

I did work with Dropbox support and they were fairly unhelpful. I was able to restore the files deleted, but it was an ongoing problem. I also learned how to use Recuva. In order to "solve" the problem, I had to pay dropbox $750 per year, which seemed excessive.

All these services for one individual are either free or very cheap.

However, if you have a team of people (we are six) it suddenly becomes very expensive. (We are a very small group that works with people with developmental disabilities. Not a big money-maker.)

Erica

IainB · « **Reply #19 on:** January 02, 2014, 06:14 PM »

@ericalynne:
Did you do a Wuala "Business" trial - a "suck-it-and-see" - before paying for the service?
Have you read through the Wuala Business User Manuals section to see if that could help you solve the problem you have? Was it of any use?
Do you have an IT administrator, or is that also a part of your role?

ericalynne · « **Reply #20 on:** January 02, 2014, 06:51 PM »

I did do a business trial, but did not try to connecting to others part. I read the instructions and it looks so easy! I follow the instructions to invite and bring in the other members of the team and they don't get the invitations. I can send them the "secret" weblink and then they can view the files, but they cannot edit. Which is critical. I have read through the manuals, but it has not helped me with this problem. I am the owner, manager, coordinator, HR, chief bottle washer, and yes, I do all the computer stuff, such as it is. My team members know less about computers than I do. I have had to hold their hands through dropbox, skype, join.me, electronic storage, etc. I am pretty much self-taught.

Actually, now that you mention it, I didn't do the "business" trial. I thought I was doing the business trial, but it turns out all I was using was the personal part. It took several days and emails and screen shots to figure out that part. We had that part working, sort of, and then I moved the files over into the business section and set up the company and the groups and that is what isn't working.

My plan is to set up my secondary computer with its own personal wuala account and then try to work out the connectivity issues when I can see the recipient computer and fiddle with the different combinations and methods of connecting. If I learn anything new, I will try wuala tech support and wuala forum again.

I do appreciate your help.
Erica

IainB · « **Reply #21 on:** January 03, 2014, 06:48 AM »

A bit of a long shot here, but is it possible that you have inadvertently bought the "Personal" version of Wuala and not the Business version?
According to this comparison chart below, the Business version does offer the collaboration features you would expect, whereas the Personal version does not.
That could/might explain why you are not getting the Business functionality.

WUALA - Personal to Business cmparison.png

Cloud-storage - safe & secure? Consider Wuala (it's encrypted as well).

ericalynne · « **Reply #22 on:** January 03, 2014, 08:47 AM »

Here is the acknowledgement from Wuala. The XXs are mine, there is a real code there. On the Wuala Drive, it shows my company. But your point is a good one. In looking over the chart you sent, with the business model, I am supposed to get "prioritized support" and I surely am not getting that. In reviewing the email below, it also mention the sales team, so I guess I can contact them. Thanks again. Erica

Dear Safe Harbor Support Coordination,

Thank you for your purchase! Your Wuala Business Code:

XXXX-XXXX-XXXX-XXXX

By redeeming this code you will receive the following:

Storage: 100 GB
Users: 5
Valid: One year starting from the date of activation

Please follow the quick reference on how to redeem your code (http://cdn.wuala.com...roups__redeem_en.pdf) and review our user manual for further information (http://manuals.lacie...wuala-business/start).

Contact our sales team for any question you may have. We look forward to bringing Wuala to your company and appreciate your feedback.

Best regards,
Your Wuala Team

tomos · « **Reply #23 on:** January 03, 2014, 11:29 AM »

^ that situation is totally unacceptable for a business service.

For a business service, I would kick up a lot of a fuss - simply get *very* *very* demanding!

ericalynne · « **Reply #24 on:** January 03, 2014, 12:26 PM »

Thank you for the support, Tomos.

I usually start by asking nicely. My emails to wuala started out nicely, progressed to polite, but firm and in the last one I told them they had to provide more support or I was taking my business elsewhere. Still have not gotten a response.

Erica