http://www.wired.com/wiredenterprise/2013/03/crypton
When you use a web application, you leave your data at the mercy of the company who runs it. Usually, this isn’t a problem, but not always. Last week, the web-based help desk application Zendesk was hacked, potentially exposing data from users of Twitter, Tumblr and Pinterest, which use the application for customer support.
Part of the problem is that a web app gathers so many eggs in one basket. If someone hacks a service provider, it can affect many different people.
But if each user’s information was encrypted so that only that user could see it — locking out even the service provider — then we could reduce the risk of putting our data in these centralized web services. That’s the aim of Crypton, a new open source project that hopes to make it easier for app developers to add this type of encryption to their applications.
It’s not unlike the approach used by Kim Dotcom’s new service Mega. When you upload a file to Mega, it’s encrypted and the key is stored by the service. But the key itself is encrypted by a passphrase that isn’t stored on Mega. That means even Mega’s staff can’t look at the data without your passphrase.
Mega is doing this to limit their liability in case of piracy, but the same principle could be applied to just about any service that stores user data.
Crypton was created by SpiderOak, a company that operates an online store service that’s similar to Box or Dropbox. CTO Alan Fairless says SpiderOak was a Mega-like security system well before the launch of the Kim Dotcom service. But SpiderOak isn’t using Crypton per se — though the plan is to move to the open source tool, according to CEO Ethan Oberman.
The goal of Crypton is to make it trivial for any developer to add encryption to an application — even if the developer doesn’t have extensive experience with such things. “We love using and creating cloud applications, and we’d prefer not to to wait another five years for awareness to progress among developers and meaningful privacy to be a standard feature in cloud apps,” the project’s site says.
Crypton’s developers emphasize that it isn’t ready for production yet, and hasn’t had a full security review. But it’s ready, it could give developers a common code base that has been reviewed by experts, freeing them from having to re-invent the wheel every time they build a new application.
Crypton isn’t alone in trying to give users more control over the data they store in web applications. Least Authority offers a tool for users who want to encrypt data they store in the Amazon S3 cloud. And Unhosted takes a very different approach: it makes it possible to separate a web application from web storage. For example, you could use a Google Docs-style word processor hosted on one server, but the data would be stored on a server run by a completely different company or organization. If someone hacked the word processor server, there would be no data for them to harvest.
But Crypton’s approach may be easier for end users because all the encryption is handled by the provider, and they wouldn’t have to worry about signing up for separate hosting accounts.
Unhosted founder and developer Michiel Jong says that he’s happy to see other open source projects trying to solve this problem, but has some reservations. “Average users are probably not ready to really memorize a passphrase,” he says. “They will often expect to have some sort of password recovery method.”
The project’s developers also points to some other hurdles, such as the difficulty of doing truly secure encryption in a web browser, which has plagued projects like Cryptocat. The team says it’s mostly concerned with making it harder for someone who gains access to a remote server to also tap the data stored there — not with protecting users from people trying to eavesdrop on their internet connections.
Another potential problem with a centralized solution like Crypton is that if a problem is found, then every app that uses it could be vulnerable. But this is true of any application relying on common open source libraries.
It’s still early days for Crypton and it’s not ready for live service just yet. But the idea is a welcome one.
When you use a web application, you leave your data at the mercy of the company who runs it. Usually, this isn’t a problem, but not always. Last week, the web-based help desk application Zendesk was hacked, potentially exposing data from users of Twitter, Tumblr and Pinterest, which use the application for customer support.
Part of the problem is that a web app gathers so many eggs in one basket. If someone hacks a service provider, it can affect many different people.
But if each user’s information was encrypted so that only that user could see it — locking out even the service provider — then we could reduce the risk of putting our data in these centralized web services. That’s the aim of Crypton, a new open source project that hopes to make it easier for app developers to add this type of encryption to their applications.
It’s not unlike the approach used by Kim Dotcom’s new service Mega. When you upload a file to Mega, it’s encrypted and the key is stored by the service. But the key itself is encrypted by a passphrase that isn’t stored on Mega. That means even Mega’s staff can’t look at the data without your passphrase.
Mega is doing this to limit their liability in case of piracy, but the same principle could be applied to just about any service that stores user data.
Crypton was created by SpiderOak, a company that operates an online store service that’s similar to Box or Dropbox. CTO Alan Fairless says SpiderOak was a Mega-like security system well before the launch of the Kim Dotcom service. But SpiderOak isn’t using Crypton per se — though the plan is to move to the open source tool, according to CEO Ethan Oberman.
The goal of Crypton is to make it trivial for any developer to add encryption to an application — even if the developer doesn’t have extensive experience with such things. “We love using and creating cloud applications, and we’d prefer not to to wait another five years for awareness to progress among developers and meaningful privacy to be a standard feature in cloud apps,” the project’s site says.
Crypton’s developers emphasize that it isn’t ready for production yet, and hasn’t had a full security review. But it’s ready, it could give developers a common code base that has been reviewed by experts, freeing them from having to re-invent the wheel every time they build a new application.
Crypton isn’t alone in trying to give users more control over the data they store in web applications. Least Authority offers a tool for users who want to encrypt data they store in the Amazon S3 cloud. And Unhosted takes a very different approach: it makes it possible to separate a web application from web storage. For example, you could use a Google Docs-style word processor hosted on one server, but the data would be stored on a server run by a completely different company or organization. If someone hacked the word processor server, there would be no data for them to harvest.
But Crypton’s approach may be easier for end users because all the encryption is handled by the provider, and they wouldn’t have to worry about signing up for separate hosting accounts.
Unhosted founder and developer Michiel Jong says that he’s happy to see other open source projects trying to solve this problem, but has some reservations. “Average users are probably not ready to really memorize a passphrase,” he says. “They will often expect to have some sort of password recovery method.”
The project’s developers also points to some other hurdles, such as the difficulty of doing truly secure encryption in a web browser, which has plagued projects like Cryptocat. The team says it’s mostly concerned with making it harder for someone who gains access to a remote server to also tap the data stored there — not with protecting users from people trying to eavesdrop on their internet connections.
Another potential problem with a centralized solution like Crypton is that if a problem is found, then every app that uses it could be vulnerable. But this is true of any application relying on common open source libraries.
It’s still early days for Crypton and it’s not ready for live service just yet. But the idea is a welcome one.
