SpiderOak Blog

I do it like this:

- Password database in KeePass (the mainline version, not KeePassX or one of the other spinoffs)

- Database requires both password and key file to unlock

- Key file only lives on a USB thumb drive, which lives on the keychain in my pocket

- Database lives in a folder that is auto-synced to my various devices via SpiderOak (https://spideroak.com/)

- Password autofill provided by KeeFox (http://keefox.org/)

Using a password and a key file provides a "kinda sorta 2FA" solution, since the key file is tied to a physical artifact (the thumb drive, "something I have") while the password provides "something I know." It's not perfect, however, since the key file could theoretically be separated from the thumb drive if someone got ahold of it.

A better 2FA solution would be one that incorporates a key that's completely tied to the physical token. However, I haven't found a great consumer-oriented product along those lines yet, despite much looking. The YubiKey is the closest, but after buying two of them and spending hours fighting with them, I eventually gave up trying to make them work; they force a choice between their one-time-password (OATH) implementation, which is theoretically awesome but in practice very finicky, and just using a static password stored on the key, which isn't really any better than my USB stick solution.

I chose SpiderOak for syncing the database over alternatives like Dropbox, primarily because SpiderOak appears to actually give a…

Hello Alan,

I have a quick question for you which might be of interest to others as well:

Why isn't SpiderOak open source yet?

I've read your FAQ answer[1] on this, however it doesn't really give a concrete explanation, besides "soon" and "licencing concerns" which is definitely disappointing.

I currently use my own, EncFS based sync solution, however I'd love to be able to use SpiderOak, or a third party open source application which supported syncing with SpiderOak (if you'd ever consider exposing an API/Protocol which allowed such.)

This is the only reason I'm not using your service currently, however I love the concept and hope you'll take it into consideration. It's likely I'm not the only one with similar concerns.

[1]: https://spideroak.com/faq/questions/35/why_isnt_spideroak_open_source_yet_when_will_it_be/

Sorry, but there's no way I'd allow any cloud service to hold my password vault, and recommending it to end users seems like a colossally bad idea.

I'd want at least two layers of different encryption types (generated by distinct software) protecting any such file if it were to be stored in the cloud. That way if one software package or one encryption algorithm were compromised, there would at least be a chance the other layer would protect it.

So at the moment I put my vault on my laptop and copy it directly to my phone, but I don't copy it into the cloud, ever.

I might consider using something like SpiderOak [1] in conjunction with a Keepass encrypted container, for instance. But I haven't even done that.

[1] https://spideroak.com/

I've been hoping for Backblaze to launch a "pro"/"enterprise" tier that allowed for this kind of use. Unfortunately (for me) it would appear they prefer to stay within their chosen niche: home user backups.

The service I'm aware of that is closest to what you describe is spideroak[1]. Last I used them (years ago) they were a little too slow, and had some other minor kinks -- but might be worth checking out again now.

It looks like they've also finally made good on delivering Nimbus.io -- both as source and as a service (as I said, it's been years since I looked at Spideroak...):

https://nimbus.io/

https://github.com/SpiderOak/nimbus.io

[1] https://spideroak.com/

The language Apple uses indicates that your personal data that apple recieves is at least at some point in clear unencrypted form, and that they then choose to encrypt it for cloud storage. The language indicates they could decrypt it if they choose. All of their statements during the San Berdeno Apple vs Gov debate a year ago clarified they had complete access to all cloud based content. There are examples of cloud like services that are able to provide online syncronization and sharing services without being able to access your data, and the language they use is very different. Examples

https://send.firefox.com/

https://spideroak.com/

https://protonmail.com/

I would consider it not safe because it was on of the companies mentioned on the NSA slides.
You can still sync your Keepass(x) file with Dropbox if you have a good password (key file is recommended) on the database file.

Instead of Dropbox you can also use https://spideroak.com/
They have a really handy program which let you control a lot of things and they are a "zero knowledge" cloud provider, all your data is encrypted.
Snowden recommends them: http://www.theguardian.com/technology/2014/jul/17/edward-snowden-dropbox-privacy-spideroak
For $12 dollar a month you get 1 TB, which you can use as a safe off-site backup location.