>I think the suggestion was that a client integrate encryption functionality locally, generating and using a key that exists only on a user's computer (or, alternatively, is backed up with AES (or similar) using a passphrase the service doesn't know). You don't have to have access to the key.
yeah. That's also what I am suggesting. but you don't need the provider's help to do that. it's easy enough to encrypt a davfs mount locally on your own box; the provider just needs to support some standard (like webdav.) Then it's up to the user to figure out what client they trust to encrypt the data before it's uploaded.
My point is that if the providers control the encryption (e.g. by providing a proprietary client that has access to the key) you have a lot less protection than if you do the encryption independent of your provider.
Comments
>I think the suggestion was that a client integrate encryption functionality locally, generating and using a key that exists only on a user's computer (or, alternatively, is backed up with AES (or similar) using a passphrase the service doesn't know). You don't have to have access to the key.
yeah. That's also what I am suggesting. but you don't need the provider's help to do that. it's easy enough to encrypt a davfs mount locally on your own box; the provider just needs to support some standard (like webdav.) Then it's up to the user to figure out what client they trust to encrypt the data before it's uploaded.
My point is that if the providers control the encryption (e.g. by providing a proprietary client that has access to the key) you have a lot less protection than if you do the encryption independent of your provider.