On Wed, Jul 21, 2010 at 3:02 AM, C wrote:

On Tue, Jul 20, 2010 at 22:41, Greg Freemyer wrote:

...

One of the new features of 11.3 is SpiderOak integration:

http://en.opensuse.org/index.php?title=SpiderOak

Has anyone tried it yet.  I just ran the setup and it seemed very easy to get going.  I'm looking forward to using it.

I've been using it for several months.... it's running on all my computers (mix of 11.2, 11.3 and Ubuntu).  I've set it up to backup certain directories on each machine, and share one directory as common (so that if I'm on my desktop or laptop or netbook etc., I have the same content on each one).  It's working great.

One thing you do need to be careful of... or aware of - and this is discussed a fair bit on the SpiderOak forums - is your disk space on the SpiderOak servers can fill up rather quickly if you are using it to manage a lot of files.. or large files.  There is some bug in how it handles deleted files on the server side, and your count of available space is sometimes not credited back for deleted files... they are working on a fix (according to what I read on their forums).... so if you're using the 2GB space heavily, you may want to browse the SpiderOak forums and read up on the problem and the workaround.  I haven't run into the issue yet since my use is well under 2GB.

C.

Can I have multiple SpiderOak accounts on one PC? ie. My office PC has both company and personal docs I'd like to keep separate. My home PC has docs for my wife's one woman company, and she has a netbook dedicated to it. But it also has my personal docs. So the optimum for me would be 3 SpiderOak accounts and 5 (or more) PCs using it, but having some computers on 2 different accounts based on the folder I'm working in. Greg -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Wed, Jul 21, 2010 at 7:54 AM, James Hatridge wrote:

Hi all,

...

All,

One of the new features of 11.3 is SpiderOak integration:

http://en.opensuse.org/index.php?title=SpiderOak

Has anyone tried it yet.  I just ran the setup and it seemed very easy to get going.  I'm looking forward to using it.

fyi: I added this to the Wiki page 5-minutes ago, but I don't know when it becomes visible to the rest of you:

======= With openSUSE 11.3 it's as simple as installing the SpiderOak package via YaST or "zypper in spideroak". Then launching "SpiderOak".

Once setup, if left running in your taskbar it can monitor your files and back them up as needed. =======

That wiki page is clearly pretty basic, so we need to fill it in as we figure out more and more about how it works.

Thanks Greg

Thanks for pointing this program out. I will be sure to delete, burn, bury and otherwise do everything I can to keep this crap off my system. Anyone that backups private files on to systems that is not controlled personally by the owner is insane. Anyone using this system or any system like it now has no control over his files or system at all. Its bad enough that its very hard to surf the net etc without a  profile being built up on you. But just to hand over your files is really too much. Now any thug with a badge can go thru your files. Or any thug with enough money can too.

Sorry but no way in hell will I knowingly let this program on my system. Also I hope that SuSE makes sure that everyone know if and when it is installed on your system.

JIM in Germany

--

It does not seem to be part of a default pattern. And even if installed it does nothing until you go through a very obvious process of creating an account. And if you to that all of the data is transmitted and stored in encrypted form. SpiderOak states that they do NOT keep passwords at all. (They do keep the password hint you provide.) I don't recall which form of encryption they use, but pgp encryption as an example is secure enough for my needs. Greg -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Jim, Below is the info from their website. I'm not enough of an encryption expert to comment on how effective this is. === Encryption Specifications SpiderOak uses a layered approach to encryption, using a combination of 2048 byte RSA and 256 bit AES. Most importantly, however, the outer level keys are never stored plaintext on the SpiderOak server. They are encrypted with 256 bit AES, using a key created by the key derivation/strengthening algorithm pdkdf2 (using sha256), with 16384 rounds, and 32 bytes of random data ("salt"). This approach prevents brute force and pre-computation or database attacks against the key. This means that a user who knows her password, can generate the outer level encryption key using pdkdf2 and the salt, then decipher the outer level keys, and be on the way to decrypting her data. Without knowledge of the password, however, the data is quite unreadable. User Authentication Process Consider the scenario where a user has lost all of their data (an unrecoverable hard drive failure, for example) and needs to authenticate into their SpiderOak account to recover. SpiderOak servers have the user's data and encryption keys, but cannot read the contents of either because the encryption keys themselves are encrypted. The user knows her password, but does not have her own encryption keys locally. This requires a different approach from the traditional challenge/response authentication methods. When a client first creates their account, that signup process happens within the SpiderOak desktop application (so that the server does not play any role in the key generation process, and never knows the contents.) The first SpiderOak upload transaction the client creates contains the following data: salt1.rnd 32 bytes of random data, stored plain salt2.rnd 32 bytes of random data, stored plain publickey.key 2048 byte serialized RSA public key, stored plain challenge.key 32 bytes, output of pdkdf2(password, salt1) used in the construction of auth challenges keypair.key 2048 byte serialized RSA keypair, stored AES encrypted using pdkdf2(password, salt2) as key In the situation where a client must authenticate by simply proving that they know their password (and without telling us that password), this protocol is followed: The server sends a challenge, with these 3 data items: aes_encrypt(data=random1, key=challenge.key, iv=h(timestamp)) salt1 timestamp The client correctly answers the challenge by using the data in random1, which is a string of 32 random bytes, as the key to its own encrypted reply of the timestamp: aes_encrypt(data=time, key=random1, iv=h(timestamp)) The client can generate the contents of challenge.key using only pdkdf2(password, salt1), and thus has all available information required to answer the challenge. In this process, the only real information given by the server to a client is the contents of salt1, which is simply 32 bytes of random data, and should in no way aid in allowing an attacker to predict the password or key. In the client's response, she sends no additional information that was not already included in the server's challenge. Sometimes an exchange like this is called a zero knowledge proof of knowledge, or a zero knowledge password proof. === Greg -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Wed, Jul 21, 2010 at 8:54 AM, David C. Rankin wrote:

On 07/20/2010 03:41 PM, Greg Freemyer wrote:

...

All,

One of the new features of 11.3 is SpiderOak integration:

http://en.opensuse.org/index.php?title=SpiderOak

WTF? Who gets the $10? Is this Novell or are we advertising for some 3rd party money grubber?

$10 / 100 GB per month (after the first free 2GB) is SpiderOak's list price. I don't know if openSUSE gets a portion of that or not. (Is there a openSUSE foundation with its own finances yet? I believe that was in process a while ago.) fyi: Carbonite is roughly $4/machine per month plus $0.50/GB per month. So if you have 2 GB or less, SpiderOak is cheaper at free. For 2 GB to 12 GB on one machine Carbonite is cheaper since they have more granular pricing. But beyond that, SpiderOak wins. And if you have several hundred GB, $10/100GB is about the cheapest I've seen around. (I happened to do a survey about a year ago. I have about 500 GB in offsite backup I use. I did not come across SpiderOak at that time, so I'm not using it for that data at this point.) Greg -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Wed, Jul 21, 2010 at 9:43 AM, James Hatridge wrote:

Hi Greg et al,

...

It does not seem to be part of a default pattern.

That's good, I don't have 11.3 on yet, will upgrade this coming weekend.

...

And even if installed it does nothing until you go through a very obvious process of creating an account.

Are you sure? and  just because they say so is not enough for me.

...

And if you to that all of the data is transmitted and stored in encrypted form.  SpiderOak states that they do NOT keep passwords at all.  (They do keep the password hint you provide.)

I don't recall which form of encryption they use, but pgp encryption as an example is secure enough for my needs.

While pgp is ok, I don't know of any encryption good enough if the goverment thugs decide to open your files. Or for that matter the company itself might open them. Yes, of course they promise. BUT I heard of a case in the US or UK about a database from a gay teenager site that they promise would be private and safe etc etc etc. Then the site went out of business and they are selling the database to pay off bills. So much for that promise....

I actually know a little bit about cracking encryption. (My company owns commercial tools to do the job and we offer it as a service.) 1) If the government(s) have a way to crack pgp easily via a backdoor, they've done a great job of keeping it secret. 2) Brute force attacks are very, very inefficient. Many cpu years to crack a long password. But a short password of 5 or 6 characters can be cracked in an hour or less. But the fastest way of all is a rainbow table. So if your using a encryption solution for which rainbow tables are available, your just wasting your time. (Many / most pre-2000 encryption techniques now have rainbow tables available.) 3) One way to attack passwords that works surprisingly well: take your home PC / work PC, extract every single word from every single document / email and build a dictionary. It will likely have a couple hundred thousands words in it minimum. Now use that dictionary in addition to the normal language dictionary’s as the basis of dictionary based attacks. Thus if your password is "passw0rd" and you have it recorded in a unencrypted doc as "password" , then password will be added to the dictionary and passw0rd will be found via letter / number substitution attempts. So if you have to record your password somewhere, either use hints that are not very easily understood, or be sure they are themselves encrypted.

ALSO how safe is your backup from someone ADDING stuff to it? A good friend in the US was thrown in jail for photos that he did not put on his hard disk at work. Lucky for him he was able to prove to the judge that many people at his job had access to his HD. So they could not prove who put the photos on it. How would you feel if the thugs demanded you open your files and you did it. "I've got nothing to hide!" right? And the first thing that pops up is an under-aged photo.

Interesting point. Also applies to anyone dumb enough to use unencrypted wireless. I've heard of someone's unencrypted wireless being used surf CP and the owner of the wireless router being arrested. As with your case, they were able to prove it wasn't them.

...

Greg

Sorry Greg, there is no way in hell I would put files on a system I don't control.

Most corporate/private networks have been hacked at one time or another, so you need to stay away from them even if you "think" you control them. Especially if they use LDAP to share security control with a Windows network. The best firewall is an air-gap. ie. If you want to load a file on your PC, you put it on a external media and carry it to your PC. Before loading it in, you scan it with everything you've got. Most US top secret LANs are air-gaped I believe.

I don't encrypt my files (yet) but I heard about someone working on a way to set up a system so that if you give it one password you get into the normal file system, but if you give it another password you get another file system and it hides your real file system. Personally I like that idea as far as it goes. What I would like better would be that the second password (or even a third password) connects you to the safe file system and delete the first file system. That way, when the thugs use the old rubber hose decryption on you, you can give them the delete password and know that your info is safe/gone even if you are too. :(

There are a lot of commercial laptop drives that accept to passwords. One allows access to the encrypted data they hold. The other wipes the drive. See man hdparm for more info about drive security features it supports. (ie. both of those I think.)

Later!

JIM

Greg -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

IMHO, the raving against SpiderOak is a bit silly - are we're going to be this paranoid about what is a remarkably transparent and foolproof system for storing/encrypting data (SO can't even get you your own data back if you lose your password - since they don't store your password, and the password is required in order to decrypt the data, it is effectively bricked). The only disadvantage I see with SO is that if you lose your password, you lose your data. Obviously, we can speculate about SO's team being a bunch of liars and government sponsored thugs (although based on what I've seen in government IT ops, a scheme this well-thought-out is well out of their league). But then how do you know that all network hardware providers aren't all in the bag for the government as well? What if there are back-doors in your router or your network cards? What if there is a government trap door in your basement where agents routinely sneak in at night and spec out your house? What if the government has created autonomous non-physical entities that can walk through walls and decrypt your data by sneezing on your hard drive? But I digress. I've been using SO for a few months now - I've got a 200GB account and it's been working great - I'm hoping to use the opensuse discount code to upgrade my space soon. I particularly am fond of their "deduplication" strategy - SO is able to store any number of identical files in the space of one - all contiguous data blocks are stored only once. A marvelous concept, and it's saved me a lot of money. I still hope to setup a good local backup system, but I've had bad luck with HDDs - every one of my backup external drives has died within a couple years. My optical backups haven't fared much better. SO is certainly invaluable for my home IT setup. I just used it to transfer files to a new laptop - I simply selected the backup of the old laptop, and restored the data to the new laptop. Couldn't be simpler. I for one am very happy that SO is partnering with openSUSE and I hope to see more partnerships like this in the future. SpiderOak's customer support has been top-notch this far, and they seem very commited to open source - their multi-platform client is planned to be fully open sourced in the future. I also like how upfront they are about their privacy and security policies and techniques, instead of hiding it behind a nice slaes pitch ala Mozy et al. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Wed, Jul 21, 2010 at 18:17, Zachary Klein wrote:

IMHO, the raving against SpiderOak is a bit silly

No kidding... Jim: 1. No one says you have to use it, install it or launch the application. It's not mandatory nor does it harvest anything off your computer. 2. It's not anywhere near as scary as you make it out to be. 3. You choose what data to backup to SpiderOak if you set up an account. You have 100% control over what it stores, how often it stores it, file size limits and so on. 4. The data is encrypted and SpiderOak do not have your password any more than a webmail provider, the openSUSE Wiki, or Novell have your password. 5. The only way someone can add files to your SpiderOak backup is if... you invite them to a share, or.. they have your password. That's not really any different than someone having access to your machine or your server (via ssh for example). 6. It's not designed to be a 100% backup of every single file you have including all your personal data, your banking data, your birth certificate, the kitchen sink, and anything else you think of. It's a tool for backing up and/or sharing the data YOU want to put into it... nothing more. If the whole online or cloud computing thing bothers you this much, then you're going to have to disconnect from the Internet completely and throw away your mobile phone (eg Sony provides online backup of all your contacts from your Android phone... so they have a complete record of who/what etc.). Google Docs... Amazon S3... Ubuntu One.. Facebook... Linked In... etc etc... all pieces of the online world we're a part of. You can either manage what's available online as best you can or withdraw from it entirely. SpiderOak is a good balance between using cloud storage, and managing what's stored online. SpiderOak really is a decent product that does the job reliable, transparently and efficiently. The developers are easy to contact and are very responsive to issues and problems with SpiderOak.

I particularly am fond of their "deduplication" strategy - SO is able to store any number of identical files in the space of one - all contiguous data blocks are stored only once. A marvelous concept, and it's saved me a lot of money.

This is a rather neat idea. I've put it to the test a few times pulling down copies of documents from the history.. and it works.. I get the document version I want... yet on the server side it's taking up only a small percentage (ie barely any) more than the current file size. C. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Wednesday 21 July 2010 12:58:50 Brian K. White wrote:

The rejects are the best if the majority doing the rejecting are low and shortsighted.

+1 :) -- Regards, Rajko -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org