Flaw #3 and the 'shortsighted solutions' for #1 address this. Keeping quotas and logs leaks information about what you are storing. For example, if you keep statistics on the largest file a user has, then it dramatically reduces the number of files that the user's "true" file can hide in. This is a class of "side channel attack" (look that up for more on the subtle issues introduced).
So uploading was covered in #2 in the post. #3 is the downloading/user possession aspect. I am familiar with the DMCA which would reduce the scope the companies liability for #2; however, it does compel them to be compliant which hurts users (covered in #3) and there a variety of subtle situations where the DMCA wouldn't help them. Note that google makes copies of your music (in GMusic) instead of hash matching for similar reasons where Apple secured an expensive license to do this. Certainly Bitcasa doesn't have any special deals like that. So yes, to your point the DMCA reduces liability but I maintain that it is still a potential flaw (which is what the title of that paragraph is).
Keeping quotas and logs leaks information about what you are storing
Who does it leak information to? how? what information anyway? and why is any of this a problem?
For example, if you keep statistics on the largest file a user has, then it dramatically reduces the number of files that the user's "true" file can hide in.
I don't understand what you are saying. Are you claiming that Bitcasa is some kind of steganographic cloud?
and there a variety of subtle situations where the DMCA wouldn't help them
Like what? Are Bitcasa any more vulnerable than every cloud storage provider (other than Apple which, as you say, appears to be a special case)?
This shows that they have to know who has access to each file, even if they don't want to. That is a privacy issue that other services are immune to because they don't actually make the claims that bitcasa does.
Where are all these claims listed that you appear to be arguing against? All I see in their (very limited) marketing materials is a mention of client-side encryption, which they do indeed seem to implement.
Comments
Flaw #3 and the 'shortsighted solutions' for #1 address this. Keeping quotas and logs leaks information about what you are storing. For example, if you keep statistics on the largest file a user has, then it dramatically reduces the number of files that the user's "true" file can hide in. This is a class of "side channel attack" (look that up for more on the subtle issues introduced).
So uploading was covered in #2 in the post. #3 is the downloading/user possession aspect. I am familiar with the DMCA which would reduce the scope the companies liability for #2; however, it does compel them to be compliant which hurts users (covered in #3) and there a variety of subtle situations where the DMCA wouldn't help them. Note that google makes copies of your music (in GMusic) instead of hash matching for similar reasons where Apple secured an expensive license to do this. Certainly Bitcasa doesn't have any special deals like that. So yes, to your point the DMCA reduces liability but I maintain that it is still a potential flaw (which is what the title of that paragraph is).
Keeping quotas and logs leaks information about what you are storing
Who does it leak information to? how? what information anyway? and why is any of this a problem?
For example, if you keep statistics on the largest file a user has, then it dramatically reduces the number of files that the user's "true" file can hide in.
I don't understand what you are saying. Are you claiming that Bitcasa is some kind of steganographic cloud?
and there a variety of subtle situations where the DMCA wouldn't help them
Like what? Are Bitcasa any more vulnerable than every cloud storage provider (other than Apple which, as you say, appears to be a special case)?
This shows that they have to know who has access to each file, even if they don't want to. That is a privacy issue that other services are immune to because they don't actually make the claims that bitcasa does.
the claims that bitcasa does
Where are all these claims listed that you appear to be arguing against? All I see in their (very limited) marketing materials is a mention of client-side encryption, which they do indeed seem to implement.