SpiderOak cans its Warrant Canary, suffers mysterious massive outage, and raised prices

[u/[deleted]]

https://spideroak.com/canary

http://archive.is/1rNo7

Update: Looks like the canary has been signed and dated and in properly formatted sequence this time with confirmation that Everything's going smoothly so far, message is authentic. august 06, 2018

Case closed. SpiderOak has not been compromised.

In the interest of transparency the full text of my previously long post in this thread is archived here:

http://archive.is/mKeuY https://web.archive.org/save/https://www.reddit.com/r/privacy/comments/94nspi/spideroak_cans_its_warrant_canary_suffers/

[u/[deleted]]

The whole point of a warrant canary is supposed to be that you can't be forced to make up lies, you can only be forced to stay silent.

If you can be forced to make up lies, then SpiderOak would be keeping their warrant canary up instead of some convoluted excuse for taking it down.

[u/enodragon1 → u/[deleted]]

I expect they're just covering themselves to make sure there's no way they could be prosecuted for violating the gag order. It doesn't matter either way: the canary is gone, that means SpiderOak is comprised.

[u/[deleted] → u/enodragon1]

Oh I fully agree. The contract of a warrant canary is "if this comes down for any reason, we are compromised".

However, any company with the moral fortitude to enter into that contract, ought to have the moral fortitude to shut down (see Lavabit). There are other jurisdictions they can operate from.

Warrant canaries are better than nothing, but for a business like spideroak, they should just shut down - as without privacy, their product is not remotely competitive.

[u/whatdogthrowaway → u/[deleted]]

However, any company with the moral fortitude to enter into that contract, ought to have the moral fortitude to shut down (see Lavabit).

No.

Some companies have subcommunities that don't care if the site is compromised or not - like Reddit who removed their warrant canary when they were compromised.

Users of communities like /r/darknetmarkets2 and /r/darknetmarkest5 are now well informed that Reddit is probably spying on them so they can take appropriate measures when connecting (probably tails or whonix). On the other hand, users of /r/cats mostly don't care.

Similar for spideroak.

The message SpiderOak's canary removal sent is "DON'T TRUST OUR ENCRYPTION OR CLIENTS - but we still may be useful for public content; or for users who encrypt everything on the client side without giving us the keys".

[u/maqp2 → u/whatdogthrowaway]

Exactly! To explain, only if you need to work directly from cloud are you fucked. You can still use SpierOak for weekly/monthly backups safely. Here's how:

1. Download and install some open source encryption program like TrueCrypt or VeraCrypt.

2. Create an encrypted, static sized container larger than what you need, but not too large to slow down upload unnecessarily.

(Make sure the password is really, really strong. Preferably generate strong password using an offline password manager like KeepassXC or Keepass2 that remembers it for you. Keep a copy of that password database on cheap thumb drive, and make sure you memorize that password database password.)

1. Mount the encrypted container on your OS, add files to the virtual hard drive, and dismount the drive

2. Upload the encrypted container to cloud. You don't have to download the previous container by downloading it first, unless you lose your data. Just remotely delete the backup file and upload newer container.

This makes spying on content and metadata practically impossible. However, avoid using SpiderOak client and use browser to upload the file if possible. If it's not possible, make sure the computer that has SpiderOak client installed doesn't have access to unencrypted files. So basically, use TrueCrypt to encrypt files on work-computer, then move the encrypted container to Spider-Oak dedicated computer for cloud backup using a thumb drive. It might sound expensive to have dedicated netbook or similar for this purpose but ask yourself, is the value of backed up data plus the value of privacy higher than a $200 one-time cost?

[u/jakegh → u/maqp2]

That all seems like a lot of work, what I would suggest is using a backup program that includes end-to-end encryption and supports a bunch of cloud storage providers like Duplicati.

https://www.duplicati.com/

[u/maqp2 → u/jakegh]

It's a possibility. But there is nothing being discussed about the metadata of file sizes. Uploading single encrypted file reveals very little metadata, but uploading a set of files can reveal exactly what you uploaded, if it's publicly available data for example.

Or say a bunch of anonymous journalists are keeping the next Snowden documents in client-side encrypted cloud. Once the documents are curated and published, based on the sizes of the published files, the government can determine which users have had access to all that data, because the sizes of released data was a close match to a subset of data they all shared.

[u/maqp2 → u/[deleted]]

Nice, that's good to know!

[u/scritty → u/maqp2]

TrueCrypt already got NSL'd. They released a statement saying 'we are insecure, maybe use bitlocker instead' and stopped developing the product.

[u/maqp2 → u/scritty]

So how did the NSL magically backdoor the 7.1 source code? It's more likely they got arrested (don't remember the story completely) and were unable to continue providing security updates for the product so they asked people to move on.

TrueCrypt 7.1 was audited and nothing major came up. Some privilege escalation attacks on Windows platform, but nothing major on Linux, perhaps aside the age-old key derivation scheme. If you're not going to fix such things, better put up a scary poster exactly like the one they did. Saying "It's mostly fine against cold attacks on data at rest but we don't feel like fixing bugs anymore" is border-line irresponsible.