There's enough in their service description to not trust them.

The way the system is described, you encrypt a file on your device, upload both the key and the file to the cloud, then the receiver downloads both the file and the key.

Look at the diagrams here: https://www.virtru.com/how-virtru-works

The "encryption key storage" is central to how the whole thing works. It's also a dumb idea. The only thing I can think is that it allows a file to be delivered out-of-band, but the inescapable fact is that decryption material is available to at least one other party.

I assumed it was asymmetric like pgp, but you're right they dont mention it anywhere. That is rather puzzling. wtf.

Actually they seem to mention it's symmetric:

    Each email or file has its own unique key, which is stored
    in and protected by a keystore in my butt. By default, 
    the Virtru keystore is used, but advanced users will be 
    able to operate their own key stores.

Our base case is indeed symmetric for each message (the key distribution is over Elliptic Curve Diffie Hellman Ephemeral).

The number one reason why we allow for symmetric message keys is to allow you to send an encrypted message to anyone, even if they don't have public keys somewhere. Distributing and using private/public keys in a trusted AND easy to use way is a problem we're currently working to solve, and will add as soon as we get that done in a way that doesn't make our software so hard to use that people stop using it.

We don't have a problem with symmetric encryption. We have a problem with the key being stored on your servers, effectively nullifying encryption.

Now, I'm not saying it's an easy problem; kudos to you for tackling it. It's just that

- if you have the keys to the payload

- if you don't provide open-source client code

then no one can honestly trust your service. Don't forget that what you're primarily doing with is trust.

Will Ackerly of Virtru here. I appreciate the sentiment, as my comfort level is much higher when working with open software.

We're being as aggressive as we can be about getting code up to snuff for open release, and in the mean time if you are interested in checking out our source, please ping me at [email protected]. We're working with a few folks in the community and looking for others to help get these out there as soon as possible, particularly or latest release, our android client, which is built on K-9 and we think belongs back in the open community it was built upon.

In the mean time we are wrapping up work on an initial release of our TDF.js code, on the heels of an audit from iSec partners of our broader browser extension code. We believe that when it is released it really ought to come with good docs and Getting Started tutorials. We are supporting a very large number of platforms with a small team and we're trying hard to prioritize right.

-Will