GigaOM » SpiderOak

Secure cloud storage outfit Tresorit posts $10K hacker bounty

David Meyer — Thu, 11 Apr 2013 15:45:34 +0000

Popular cloud storage services such as Dropbox and Google Drive are terrifically easy to use, but only boast middling security (hence the existence of third-party client-side encryption services such as BoxCryptor). However, there are many rivals out there that offer much stronger client-side security and anonymity — Lacie’s Wuala, Spideroak and Kim Dotcom’s Mega all spring to mind.

So, if you’re an upstart in this business with serious security chops, how do you set yourself apart? Do what Tresorit is doing, and offer a bounty to any hacker who can breach your cryptography.

Tresorit was founded in 2011, received $1.7 million in funding last year from Euroventures and nine private investors, and is now freshly out of closed beta, with its storage being based on Azure. The firm has strong security cred as a spinoff of Hungarian security outfit CrySys Lab, which was responsible for identifying the notorious Duqu worm. And Tresorit is so sure of itself that, from April 15th, it will offer a $10,000 reward to any hacker that busts its cryptography.

“We’re positioning ourselves as an enterprise or small and medium business solution, but right now we’re targeting consumers too, because we need to reach credibility,” CEO István Lám explained to me. “That’s why we’re starting this campaign where we offer $10,000 to the first one who can hack this encryption.”

Crypto challenge

One issue with some Tresorit rivals, such as Mega and Wuala, is that they use something called “convergent encryption”, which essentially means they can deduplicate the stuff their customers are storing on their systems. In the case of Mega, whose customers frequently use the service for storing movie files (entirely legally, of course), this helps avoid a situation where the same multi-gigabyte file is stored thousands of times, thereby keeping down Mega’s costs.

Some security specialists are wary of this approach because they fear it can undermine user privacy.

“If 10,000 people upload the same movie to Mega, they only have to store one file,” Lám said. “That leaks information about who has the same file – you can track one [piece of] information from another. So, from the very beginning, we dropped the idea of convergent crypto because that’s simply unacceptable for us.”

Of course, Tresorit is ultimately going for a somewhat different user base; one that demands secrecy but that isn’t necessarily going to be uploading dozens of bulky movies. As such, while Mega famously offers 50GB of free storage, Tresorit’s free option maxes out at 5GB…

… Although, if you’re reading this before 23:59 GMT on May 20th 2013, you can get a free 50GB Tresorit account for life by signing up here. Just thought I’d mention that. Anyway…

In terms of business-friendly features, Tresorit uses public key cryptography to establish keys between people, so users can share access to files without sharing passwords. There are no master keys for bosses, but Lám said the company will soon introduce a “threshold cryptography” system, where at least two managers will need to be present in order to decrypt and open an employee’s account.

Right now the client is only available for Windows, but OS X, iOS and Android versions will arrive before June, as will the first paid-for premium Tresorit accounts. Lám declined to reveal the pricing or capacity for these accounts ahead of that launch.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Box will fight Google Drive with ecosystem push

Barb Darrow — Wed, 25 Apr 2012 13:03:18 +0000

With Google Drive hitting the cloud storage market like a gale force wind, Box continues to position itself as the preferred cloud storage supplier for business users. Toward that end, it’s polishing up its API; adding new partners to its OneCloud network and building alliances with two New York startup groups to boost its profile beyond Silicon Valley.

In the past few months, the jockeying among cloud storage vendors — newbies like LogMeIn and more established players like SpiderOak, Box, Microsoft, and others — has been off the charts. All of these companies are trying to make themselves the Dropbox of the enterprise, Dropbox being the cloud storage choice for millions of consumers.

New API aims to ease integration with third party apps

Box aims to accomplish this, in part, by making it easier for third-party ISVs to make Box their de facto back-end storage with a new “V2″ API, said Chris Yeh, VP of platform for Los Altos, Calif.-based Box. With the new API, it will be much easier for companies to deploy Box behind their apps –so the file-sharing and collaboration happen in Box, Yeh said.

A new “instant on” capability will also make it easier for users to opt for Box as the backend storage when they use other, affiliated applications. For example, up until now, each LinkedIn user had to create a Box account and log into it from LinkedIn. “With Instant Mode, LinkedIn sends Box the user’s email address and if we don’t have an account for you, we autocreate the account and a folder for you in LinkedIn,” Yeh said. “If the user approves it, it will show up to them as a Box folder within the LinkedIn account.

Finally, Box is working with TechStars and General Assembly, two New York-based groups that focus on tech startups. Box will sponsor TechStars’ HackStars program — which brings on experienced developers and designers to work with TechStars portfolio companies. And it will make Box resources available for members of both the TechStars and GA communities. General Assembly is a co-working effort that recently garnered a $4.25 million investment from DST Global’s Yuri Milner.

Yeh said the New York alliances will help establish Box beyond Silicon Valley, to bring startups aboard the platform for their own users, and also keep track of cool new technologies. Box has also been active in other startup havens, participating and sponsoring the recent AngelHack event in Cambridge, Mass. for example.

Whistling past Google Drive

The appearance of Google Drive, after many fits and starts, looms over any and all cloud storage efforts now. And, while most of the reverbs about the new arrival focused on its impact on Dropbox, the rest of the market, including Box, is on high alert.

While Box CEO Aaron Levie downplayed the Google threat in some arenas, he also posted a blog called “When elephants attack” that deals with the Google threat. In the post, Levie took pains to point out less-than-stellar Google projects like Google Wallet, Wave and Google Health.

Seelie wrote that it’s impossible for smaller, innovative companies to avoid the “elephants” in technology which need to enter any and all large markets. But he said Box’s history of focusing on business users — especially CIOs who pay for value-added storage and collaboration services — will keep it in good stead. Levie wrote:

“If we avoided all markets with competitors that are larger or better funded, the world would be all but devoid of innovation. So we’re taking a different, yet highly recommended approach: “Climb a large tree. Preferably one without thorns, stinging ants, or lions.” Our tree just happens to be filled with CIOs.

The one problem with that statement is that of all of the 10 million users Box claims, it’s far from clear how many actually pay for the service. Box does not break out that information.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Dispatches from Cloud Connect 2012: AWS under attack

Jo Maitland — Thu, 23 Feb 2012 22:00:42 +0000

Amazon, the market leader, plays at the infrastructure level. But there was a lot of talk at Cloud Connect about Platform-as-a-Service (PaaS) offerings, where cloud folks think the real action will ultimately lie. The company will soon have to address these shifts as well as trends on the enterprise side around security, control and transparency that are pushing many organizations toward the private cloud.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

SpiderOak takes on Amazon S3 in archival storage

Barb Darrow — Wed, 15 Feb 2012 14:00:12 +0000

SpiderOak says its new Nimbus.io cloud storage service will offer consumers and businesses a cheaper way to archive their data. Yes, cheaper than Amazon.

When it comes to storing cold data — the stuff that companies offloaded to tape — the need for speed is not paramount. Businesses just have to make sure their stuff is safe for when they need it. It is SpiderOak’s view that Amazon charges too much for that kind of storage.

The Nimbus.io service will cost $0.06 per GB — including both data transport and storage costs. That is roughly half as much as Amazon’s S3 cloud storage service, which starts at $0.125 for 1TB/month, with the price falling as volume rises. But there is also an associated data transfer cost after 1GB of data transferred of $0.120 per GB/month up to total 1 TB/month. (Amazon does offer a free storage tier for new customers for a year.)

While Amazon is undoubtedly the behemoth here, it is not necessarily the price leader even though it did lower S3 pricing a few weeks ago. Backblaze, another lean-and-mean competitor, also prices its storage below Amazon s3.

SpiderOak which has offered storage and backup services since 2007, decided there was a need to attack archival storage specifically. ”We define [archival] as data where the latency requirements for reads are not severe. A lot of people use S3 just for back-up purposes or for very large file storage,” said SpiderOak CTO Alan Fairless. “With most backup jobs you don’t care if it takes 15 minutes versus milliseconds,” he said. He did take exception to the tape analogy, however. “We’re a lot faster than that,” he said.

“We see the world as not necessarily leaving S3 completely, but we feel people are overpaying for their archival class data. It’s not accessed that often, so there’s no reason to pay S3 the additional money for that data,” said SpiderOak CEO Ethan Oberman.

Oberman also stressed the company’s strict privacy stance. “Under no circumstances can we view our customer data in any way, and that invisibility has been important in the enterprise market. Our competitors can’t make those claims,” he said.

The company hosts two data centers, in Chicago and Kansas City, for its services.

Nimbus.io will be available as both a commercial product and an open source project under the GNU Affero General Public License version 3 (AGPL). The client libraries, benchmark and testing code are covered by the GNU Lesser General Public License.

Amazon will remain the kingpin in cloud-based storage (as of the end of 2011, it claimed 762 billion objects stored on S3), but given the number of outside cloud storage providers that keep surfacing, it looks like the explosion of data being generated can float all those boats.

Photo courtesy of Flickr user mcfarlandmo

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.