This talk presents the results of a security review performed back in late 2017 of the encrypted cloud storage application SpiderOak ONE.
The main motivation for this work was to examine to what extent the security claimed by the company, matched the security provided by the application. To that end, we developed two threat models and examined the security of SpiderOakONE in each of them. One model assumes the server does what it's supposed to, yet it will try to learn information by looking at the data its users are storing. The other model assumes the server may act inconsistently, by for sending wrong responses to the application during operation.
We found that in both cases, issues exist that partially or totally reveal the content of user's files to the server.
All issues that were found have been reported in a responsible manner and subsequently fixed.
Speakers for Can you trust your encrypted cloud? An assessment of SpiderOakONE's security:
Metadata for Can you trust your encrypted cloud? An assessment of SpiderOakONE's security
To be recorded: YesURLs for Can you trust your encrypted cloud? An assessment of SpiderOakONE's security
Recording: https://www.youtube.com/watch?v=5SCuzF0CqgE
Schedule for Can you trust your encrypted cloud? An assessment of SpiderOakONE's security
- Sunday, Aug 11th, 2019, 15:00 (CEST) - Sunday, Aug 11th, 2019, 16:00 (CEST) at Speakers Tent