In a game of picking one's battles, that seems like an easy win; I'll worry about contempt charges and rubber hoses some other day.
A provider can give you all the assurances in the world, but the real assurance is using your own encryption with your own best practice and controlling the data store as it exists on the providers filesystem.
This is why it's important to give users a raw, open filesystem that they can manipulate any way they see fit, and not a fancy, highly abstracted backing store with a pretty GUI on the front.
Without a substantive commitment to open standards and open platforms, this is just a PR move.
Taking advantage of Norway's laws is fine, until the day that those laws go sour on you.
For any person who is not being forced into giving their keys up, encrypting their own files must be safer than hoping a cloud provider won't freely hand them over to the US government.
This is especially true for non-US citizens, who seem to have no protection at all. Even the earlier whistle-blowers don't consider us anything but open season: http://www.usatoday.com/story/news/politics/2013/06/16/snowd...
Fine. If you're foreign, encrypt your files and store them anywhere you like. If you're a US citizen, do the same and know that the government only has them when they force you to hand the keys over.
(Barring them being able to hack them some other way, e.g. simply grabbing your keys off your machine.)
A couple of people have been convicted of refusing to hand over their encryption key.
It's worth noting that this is a separate offence, so there's a determinate prison sentence. You can't be held in contempt of court for refusing to hand it over.
You'd have to keep it on a separate storage medium. And if you have to hand out the done medium, what's preventing them to get your second medium? And if you are able to keep that second medium secret and safe, why don't you store the whole unencrypted data on it in the first place?
Either way: OTPs are really cool, but I don't think they have any relevance here.
Cheers.
"Of the 15 individuals served, 11 did not comply with the notices. Of the 11, seven were charged and two convicted."
Whilst they may have been incarcerated since the report, at the least it would seem that there is some evidence based procedure to determine "guilt" in terms of whether you are able to produce the key or not.
Sure, if the government was going after someone like Steve Muller (http://www.wired.com/threatlevel/2008/04/gsm-researcher/) you'd want him to be able to keep his stuff from prying eyes.
What about a Suadi National accused of plotting terror attacks in NYC? Would you want the same laws applied to him? Or would you want to able to force someone like this to de-crypt their files in order to stop an attack?
I really don't know what the right answer is, but sometimes laws intended to keep us safe, also give shelter to bad guys.
Americans inherently know this. We were brought up with the idea that freedom isn't free and that the price of liberty is eternal vigilance. Just because it is more convenient to violate the civil liberties of all to catch a few bad actors doesn't mean it is what our country is all about.
Europeans often find that sentiment ridiculous. But that is just the cost of privacy and liberty - one that our forefathers were welcome to pay.
This is the license:
Unless specified otherwise in individual files, the contents of this package is covered by the following copyright, license, and disclaimer:
Copyright 2006, 2007, 2008, 2009, 2010, 2011 Colin Percival All rights reserved.
Redistribution and use in source and binary forms, without modification, is permitted for the sole purpose of using the "tarsnap" backup service provided by Colin Percival.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
So not really open source software in any sense that I understand.
[NB My comments is not intended as a criticism of tarsnap or Colin's licensing policy - he wrote it so, in my book, he can license it any way he wants.]
(emphasis mine) This sounds like there are no restrictions on distributing modified source / binaries.
s1kx's caveat ("Of course you will have to trust CloudBerry not to put a backdoor in their Software") therefore doesn't apply (as strongly, anyway) to Tarsnap.
Better not use an encryption with ties to the US government then ;)
http://www.jottacloud.com/faq/
"Yes, all datatraffic between your computer and Jottacloud is encrypted with 256 bits AES high grade encryption, which makes it virtually impossible for unauthorized persons to use the information being sent."