2

I was going through SpiderOak security design.

It says:

When you first run the SpiderOak application on your computer, a series of strong encryption keys are generated. The keys are themselves encrypted with your password and stored (along with the data you backup) on our servers in their encrypted form.

The encryption keys are stored on their server encrypted with user password. Just in case user password is compromised, anyone can decrypt the encryption keys stored on their server and decrypt the data as well.

SpiderOak further mentions:

But most importantly, the keys are never stored plaintext on the SpiderOak server.

They are encrypted with 256 bit AES, using a key created from your password by the key derivation/strengthening algorithm PBKDF2 (using sha256), with a minimum of 16384 rounds, and 32 bytes of random data ("salt").

How secure is this design?

  • Is there a question here? Or just a general invitation to exchange ideas? Because if the latter (and it looks so), then it's what SE discourages. – techraf Sep 26 '16 at 7:10
  • @techraf You may please move this post to wiki. – Geek Sep 26 '16 at 7:59
3

UPDATE 2017-07-09: Thanks to those folk who have given updates regarding SpiderOak encryption keys.

That certainly reduces the risks but, as we've seen with LastPass, that doesn't necessarily eliminate it. And that's the point, you have to do your own risk and impact assessment when you store sensitive data in the Cloud. Choosing a supplier that has taken the time and money to obtain government and industry security certifications is a mitigating factor but might be more expensive.

Bottom line: if you choose a supplier with the lowest cost, you have to accept some compromises.


That approach would not seem to be the best one but it isn't that bad and certainly better than many cloud backup services do.

The best approach is for the keys to be generated by you locally so that the cloud service never has a copy. That way there is no way for the service to be able to decrypt your data.

In this case, you are having to put trust in the service that they won't and don't take a copy of the keys before they are encrypted and that their system is secure enough that the keys are protected when you unlock them.

I would say that this puts the risk at "low" given the track record of SpiderOak. But obviously, this depends on the data you are trusting them with. I certainly wouldn't consider it for highly sensitive data or really high value data. But for most uses, it would seem OK, though only you can really assess the risks/impacts for your data.

  • What highly sensitive data what would you consider? – Geek Sep 26 '16 at 7:54
  • Highly sensitive data would include data from a regulated industry such as health or finance or government. I might consider it for a small business outside such an industry where the impacts of a breach are less. But again, only you can understand the risks and impacts of your data. – Julian Knight Sep 26 '16 at 8:10
  • Sorry there is a mistake in my above comment. I wanted to ask which service you prefer for sensitive data. – Geek Sep 26 '16 at 8:40
  • Oh. Either a specialist "private cloud" provider or on-prem. Either is a LOT more expensive of course and so segmenting sensitive and non-sensitive data is the best way to control both cost and security. You might also remember that public Cloud providers tend to disappear occasionally so you always need an emergency plan for that if your data is at all valuable (which it must be or you wouldn't bother to back it up!) – Julian Knight Sep 26 '16 at 14:19
  • @David-G is correct: the design of Spider Oak is intended to prevent their ability to decrypt your data. The keys that S.O. stores on their server are encrypted by your password, which S.O. does not hold. – Elroy Flynn Jul 9 '17 at 3:43
1

Julian's response is incorrect. Spideroak encrypts your data (and pwd) locally (ie on the client side) before uploading to their servers. Therefore they cannot unencrypt your data under any circumstances. That is the whole point of Spideroak. In order for your data to be compromised someone would need access to your local client AND your password. I'm not sure that there are any solutions out there that would protect you from such a catastrophic breach.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.