I was going through SpiderOak security design.
When you first run the SpiderOak application on your computer, a series of strong encryption keys are generated. The keys are themselves encrypted with your password and stored (along with the data you backup) on our servers in their encrypted form.
The encryption keys are stored on their server encrypted with user password. Just in case user password is compromised, anyone can decrypt the encryption keys stored on their server and decrypt the data as well.
SpiderOak further mentions:
But most importantly, the keys are never stored plaintext on the SpiderOak server.
They are encrypted with 256 bit AES, using a key created from your password by the key derivation/strengthening algorithm PBKDF2 (using sha256), with a minimum of 16384 rounds, and 32 bytes of random data ("salt").
How secure is this design?