FileKit: An open source end-to-end encrypted cloud storage service in JavaScript

Re:FileKit: An open source end-to-end encrypted cloud storag... by espadrine on Thursday August 29, 2019 @03:34PM (#20832819)

My understanding of FileKit is that you do trust the Tanker server, but only for delivering JS and handling identities.

It only contains public keys and encrypted DEKs (data encryption keys); see this image: https://docs.tanker.io/filekit/latest/going-further/file-enc...

The file content should therefore only be accessible by holders of private keys for which the file was encrypted.

[ Parent | on HN ]

Re:FileKit: An open source end-to-end encrypted cloud storag... by tptacek on Thursday August 29, 2019 @03:34PM (#20832823)

There's no difference between trusting the server to deliver Javascript cryptography source code and trusting the server with your secrets. The server can just deliver code (in a number of different ways) to compromise those secrets.

[ Parent | on HN ]

Re:FileKit: An open source end-to-end encrypted cloud storag... by danShumway on Thursday August 29, 2019 @04:56PM (#20833572)

Well... there's no technical difference.

My understanding from the Apple/FBI fiasco is that it's an open question whether the US government is legally able to compel you to write and deliver custom code to your clients. But any local judge can issue you a warrant to hand over encrypted customer data that you're holding the key to.

But IANAL, maybe my take on that is overly simplistic.

[ Parent | on HN ]

Re:FileKit: An open source end-to-end encrypted cloud storag... by blastrock on Thursday August 29, 2019 @05:46PM (#20834022)

Actually, Filekit is meant to be integrated into an application, and that application is responsible for delivering JS and handling identities, not the Tanker server.

[ Parent | on HN ]