Dropbox is currently one of the biggest file-hosting cloud services in the world. It started out as an idea of two MIT students back in 2007 and it has become one of the most valuable startups in the US and the whole world, estimated to be worth more than $10billion.
Dropbox is reported to have more than 500 million registered users in 2016; individuals, schools, libraries, and companies…all putting the safety of their documents in the hands of the Dropbox.
Such immense popularity comes at great risk. Dropbox is in the crosshairs of many hackers and cybercriminals who will do anything at their disposal to get access to those files.
Over the years Dropbox had many security incidents and scandals making anyone who’s internet-safety aware think about transferring to some other cloud service.
July 2011 Privacy Policy update – Dropbox updated their Terms of Service letting them use people’s files (work, photos, videos, books, scientific researches, works of fiction) whatever they wanted for, without any permission from the original owner.
June 2013 PRISM program – In June 2013 The Washington Post and The Guardian published documents suggesting that the National Security Agency (NSA) was considering including Dropbox in PRISM (a classified Internet surveillance program).
July 2014 Snowden comment – In July 2014, former NSA employee Edward Snowden referred to Dropbox as a “hostile to privacy” because the encryption model Dropbox had implemented enabled them to give the data to government agencies. In that interview, Snowden recommended a competing cloud service called SpiderOak.
August 2016 password leak – In August 2016, 68 million Dropbox accounts were compromised when their e-mails and passwords were published online. Immediately after that, many independent security researchers confirmed that those accounts have indeed been hacked and their data disclosed.
January 2017 “accidental” data restoration – In January 2017, a number of users reported that their deleted folders and files from 2011 and 2012 were brought back after 5 years. Casually, Dropbox employees covered the story blaming it on a bug that “was preventing some files and folders from being fully deleted off our servers”.
There have been many more incidents which I won’t be covering. The fact that Dropbox could be giving away our files to government agencies brings me to the point I’m trying to make.
Dropbox is far from being safe for anyone, and if Edward Snowden (aka. whistleblower, former CIA and NSA employee) is right, we should all consider transferring to safer cloud alternatives.
One of the reasons to be worried about the actual security of your files is that companies are earning money by selling your data to advertising companies, your own data, without even asking you. It doesn’t just have to be commercials.
It would be really simple for a certain politician to buy your data and know what you like or hate, so they can orchestrate their speech so most of you get to like them, turning you into a walking slave. Which is why we need a more secure alternative to Dropbox.
Tresorit
Tresorit is an end-to-end encrypted, ultra-secure cloud service where you can store, share and sync files from anywhere, anytime, with ease. Tresorit is made for individuals, businesses, and teams of more than 100 users, coming in at many different plans and prices, with a free service offering you 5GB of space at the same security standard as others.
It is available on Windows, iOS, Linux, Android, MacOS and lets you sync your data across your devices. As a Swiss company, Tresorit is subject to Swiss jurisdiction. Switzerland is well known around the World for its policy of neutrality and data protection laws that put almost any country to shame.
Tresorit is certified for ISO 27001 (International Standardisation Organization) which describes ways of handling the data security in companies. It is also in compliance with GDPR, HIPAA, and many other data protection requirements.
Being end-to-end encrypted means that only you have access to the data. Your files are encrypted even before they leave your device when being uploaded to the cloud with the Advanced Encryption Standard algorithm using 256-bit keys.
Your files will be saved on Tresorit’s servers as encrypted pieces of data that even if hacked, can’t be read. The only way to read the data is by using the specific key which isn’t stored on Tresorit in any other way but encrypted. This means that you aren’t expected to trust Tresorit that they won’t use your data, because even if they wanted, they can’t.
Since Tresorit is made to be used by businesses and teams, there are additional measures of security to provide that your encryption keys stay safe when working in a team. It is up to the individual user if he will leak a key to someone who might cause harm.
Additionally, the keys are newly generated every 3 months just to add another layer of protection against the possible use of supercomputers to generate the key.
Zero-knowledge authentication is a way of handling files, encryption keys, and user passwords in such a way that they are never transmitted or stored in an unencrypted or unhashed form. It would take several human lifetimes to break this protection, which is why, if you forget your password, there is no way to recover your data without your personal consent in special occasions.
There is also a client-side protection system guaranteeing that the folders’ content can’t be changed without your knowledge, even in case Tresorit systems get hacked. You can apply Message Authentication Code (MAC) to each file, with a key known only to you and those you share your key with, but not the server.
With all those protocols, Tresorit is confident enough to allow sharing files via a link. Files and folders you send with a link have the very same end-to-end encryption protection as your other files. On top of that, there are additional password protections, download limits, and expiry dates that provide further protection of confidential files.
One more thing that Tresorit is amazing for is backing up your data. Since the files on their servers are encrypted, they feel safe holding them even when you’ve accidentally deleted them or if your business fell victim to a malware attack. This feature allows you to get your data back no matter what happens.
Such flexibility combined with the insane amounts of security and clever ideas makes Tresorit one of the best choices for running a business.
“More than 1,000 hackers, including MIT, Stanford and Harvard have failed to break into Tresorit’s system.” – TNW
Check out Tresorit.
PCloud Crypto
PCloud Crypto is a feature to an already popular cloud storage solution that is available across all platforms and devices, both computers and smartphones. PCloud is a file-sharing and file-storing platform used by many companies across the world.
It allows you to sync all your data and access it from any device. With the addition Crypto, the only way someone can get your data is if they steal your device, even then they would need your passcode.
With PCloud Crypto you can encrypt all the data you own or think is sensitive in a way where you are the keyholder so no one but you can read what’s encrypted. This means that when sending a file to the server it first gets scrambled and encrypted before even accessing the router you’re connected to. This basically makes this service be a Zero Knowledge one.
I’ve mentioned this “Zero Knowledge” many times before but haven’t really talked about what it’s supposed to mean. When a service that handles its customers’ data is in compliance with the Zero-Knowledge privacy standard it means that the company will not and can not be asked to give the data to anyone. Your government can’t see it, your Internet provider can’t see it, not even developers have access to your key.
One more thing that puts PCloud Crypto above others is its multi-layered protection that served as a protection from many different kinds of attack. On top it all, your data is additionally protected with the password only you are supposed to know.
The app itself is really simple to use. When you have PCloud Crypto, there will be a specific folder where you store all the data you want to keep for yourself. All data in that folder is then encrypted with their military-grade file security.
There is no way for such protection to be hard to use, on the contrary…PCloud Crypto is as simple as dragging and dropping a file into your secure folder.
To assure you of PCloud Crypto’s strength they have challenged hackers from all parts of the world, professors and students from Berkeley, Boston, MIT, and 613 other companies. The one who manages to hack their security system gets a $100.000 reward and most probably a job.
The price of PCloud Crypto is added to the price of the PCloud plan you’re already using. They even offer a lifetime plan for their service, we can tell your their confidence is completely justified.
Check out PCloud Crypto
Sync.com
Sync is one more way to get hold of your files and to be sure no one but you has access to them. It is a free, end-to-end encrypted cloud service that gives you 5GB of storage with the possibility to choose between different business/personal plans.
Each of those plans offers different kinds of file sharing and controllability alongside the ability to collaborate. It also supports synchronization across all devices and platforms: Windows, Mac, iPhone, iPad, Android and the web (through the browser). With Sync you can send files and documents to anyone regardless of their size even if they don’t have a Sync account.
With more than 750 thousand users their priority is the safety of your files.
Being able to share files with your friends and co-workers using links does not compromise the safety, but if the data is especially important you can easily add more layers of protection. Thanks to the simple user interface, setting a password, expiry date, download count and notifications is super easy.
- Password makes sure that even when someone has the link they will need a password to open it, similar to how sometimes you need a password to extract a compressed with WinRar.
- The expiry date makes sure that the link stops being valid after a certain time.
- Download count limits the number of times this certain file can be downloaded, so even if someone has the right link and a password they won’t be able to download it.
- Notifications are there to tell you when the link is opened, so you can stop any unauthorized access to your files.
You can also limit permissions to read-only and read-write, which makes Sync just that more versatile.
With the integration of Windows and Mac, you can use the apps you’re already familiar with, like the ones in Microsoft Office and Adobe creative suite. Sync is all about the ease of use, simple but powerful and secure.
In the case of ransomware or hardware failure, you have the ability to backup any file to any of its previous states in the timeline. You can even bring back deleted files in case they get accidentally deleted or lost.
In case you decide to pay for the premium Sync you get the administrator account, with tools to easily add or remove user accounts for each of your employees. Each employee gets 2TB of storage, all encrypted and secure.
Sync is end-to-end encrypted, meaning that the server doesn’t know what you’re uploading because all the files get encrypted before even leaving your device. With most cloud services that aren’t end-to-end encrypted, the server administrators have the encryption key, which means that they can decrypt and use your data at any time.
It also represents a huge hazard in case the servers get hacked because no server is unhackable. In the case of Sync and other end-to-end encrypted services, even if the servers get taken over, the hacker won’t be able to read your personal information just like the developers couldn’t.
Sync is safe to use no matter where your business operates.
Check out Sync.com
OwnCloud
OwnCloud is, as they say on their website, the last cloud collaboration, file syncing, file sharing, and data privacy platform you’ll ever need. It is a number 1, open source file sharing platform with over 25 million users worldwide.
“Open source” means that the code, the building blocks of the program are public. The developers are letting you see how their app works, so you can be 100% sure that they are not doing anything that would harm you. As such, they gained the trust of many renowned companies from around the World like Fujitsu, Daimler, and many others.
OwnCloud is perfect for managing lots of sensitive data that needs to be used and shared on a daily basis on different locations, from different devices (Apple, Android, Windows, Linux), all while maintaining the security of those files.
OwnCloud is basically what it sounds like. Since it is enterprise-ready, it can be installed on your server, managed by you or your IT department. It is basically your own cloud, and since it is so flexible it can be implemented to any kind of productive work.
Since it is open-source, it allows IT to extend the program to complete virtually any task that your company needs it to. It can even be modified to feature a company logo. OwnCloud lets your information stay where it is, but at the same time allow secure sharing of those files across all your employees and community. It also lets you track and control any traffic down to a single file.
It is in compliance with the German Bundesdatenschutzgesetz (BDSG), Health Insurance Portability and Accountability Act (HIPAA), The Financial Industry Regulatory Authority (FINRA), General Data Protection Regulation (GDPR), and other data protection acts.
Unlike other Dropbox alternatives, this service is mostly for Enterprise purposes, and it is perfect at that because it’s free. The software itself is free, all you need is a server. OwnCloud even offers a free start-up guide for ones interested.
“ownCloud is 3-4-5 steps ahead of people with similar solutions. We ran it through the ringer and it really showed its flying colors. We tested multiple scenarios and [the ownCloud technical team] even brought in developers when necessary. ownCloud really stands behind its product and really got behind us – even though we were only testing at that point.”
-Rob Crockett, Network Administrator
Check out OwnCloud
NextCloud
NextCloud is one of the World’s leading file sync and online collaboration programs, combining the convenience and simplicity of Dropbox and Google Drive with the security, privacy, and control. Just like OwnCloud, NextCloud is an open-source, self-hosting solution, letting you know exactly where your data is, who has access to it, and doesn’t let a single file leak.
When a service like this is open-source, it adds many layers of security because the community is constantly working on upgrading the app itself.
With NextCloud you can even host your own cloud at home, pick a server of your choice and that is where your files will be. NextCloud will run on that server, protect your data and give you access to them from your browser, Windows, Linux, iOS, Android etc.
You can also sync your data with other websites like Dropbox, which lets you to completely transfer from Dropbox to NextCloud.
One of NextCloud’s biggest concerns is the security of their customer’s files.
NextCloud is equipped with a number of unique, innovative security technologies that are there to protect from brute force attacks ( Attacks in which computers are left to run trying combination after combination).
NextCloud also has integrated end-to-end, client-side encryption to protect the data even when an eavesdropper is latched onto a connection between the user and the server.
Nothing can prove the security of NextCloud like the fact that they are part of the USD 5000 Security Bug Bounty Program which has a price waiting for anyone who manages to hack NextCloud’s security systems.
Check out NextCloud
SpiderOak
I’ve mentioned this one before; Edward Snowden suggested that people replace Dropbox with SpiderOak. He preferred SpiderOak for a reason. It is a cloud-based backup and storage solution for businesses, home use, and enterprise.
For over 10 years, their goal was to create a software based on one and simple belief: “The world is a better place if software is trustworthy and secure”. SpiderOak lets you share files, communicate, collaborate and organize with simplicity but with the highest, most restrictive compliance regulations.
In those 10 years, their goal wasn’t only the creation of a safe, simple-to-use app for storing data, their goal was to create a line of products specifically suited for different individuals and their specific needs.
All those, together with their obsession with internet security made them the number one choice for most companies and individuals.
SpiderOak comes with Browser, Desktop, and smartphone interface, giving you the ability to access your files from anywhere, at any time. Access is not all you’ll have, it also automatically backs up your files and lets you monitor any traffic with your data at the moment, such as syncing, downloading, uploading or backing up.
This software makes sure that the administrators, developers, and the server itself are not a threat to you because of the end-to-end encryption and the principle of No Knowledge. Basically, SpiderOak lets you store data on their servers without them even knowing what it is.
No data is allowed to leave your computer towards the servers before being encrypted, and won’t be decrypted until you ask so. It’s not just end-to-end encryption it’s No Knowledge System.
Your Password is hashed with multi-round and salted PBKDF2. Hashing is a process of converting an input of any length into a seemingly random string of fixed size using a mathematical function. Salting is a way to make cracking a password even harder, protecting them from any possible rainbow table attacks.
Your Keys are unlocked with your password. Created with AES-256 in CFB mode and HMAC-SHA-256. Your data is encrypted with a different key for each folder, file, and directory. SpiderOak went a mile further to even encrypt all your traffic.
All this doesn’t mean much to you because you can’t really see it with your eyes, but behind the curtains hides the whole artillery of defensive mechanisms put there by SpiderOak. Which is why it is recognized as one of the safest cloud services in existence.
Check out SpiderOak
Boxcryptor
Boxcryptor is a very useful, free for non-commercial use (on 1 cloud service and 2 devices) app that encrypts your cloud data regardless of which cloud your data is on. It’s a smart choice for those who are already accustomed to a certain cloud service and don’t wish to transfer to a different one.
This program takes an insecure cloud service like Dropbox and encrypts data before sending it there, increasing the level of protection against data thieves.
With its Zero Knowledge encryption, it practically puts the encryption powers into your hands, still allowing you to do collaborative work and share files while maintaining data security across all devices.
As an additional measure of security, it has an optional two-factor authentication system implemented.
Boxcryptor is compatible with 30 different cloud service providers, which is super simple and convenient. This is perfect for companies that have established their systems on a certain cloud service but they wish for more security. However, do note that they use their own proprietary encryption – not an open source standard. Therefore, it’s not as easy to validate their claims about how good their encryption is.
Check out Boxcryptor
Cryptomator
Cryptomator is a “Pay what you want”, open-source encryption service that encrypts your files before updating onto a cloud. Practically, turning any cloud into a Zero Knowledge one.
Transparent encryption means that you won’t even notice that your files are any different than usual but the place containing your encrypted files resides somewhere on your cloud folder. Cryptomator gives a virtual hard disc using which you can access your files.
Since every file is encrypted individually, making a change to one file won’t result in a need for the whole cloud folder to be updated but just the one segment of it.
Setting Cryptomator up is fairly simple as well.
All you need to do is create folders on your cloud, assign a passphrase and that’s it. You can use drag & drop to store your data on the virtual hard disc on your computer and you can sleep freely without the fear of your data being used for machine learning or selling commercials.
Local storage is susceptible to damage or even complete loss in case of hardware failure, fire or flood. We thrive to have our memories and files stored somewhere more permanent, that is where online cloud services come into play. But as we’ve seen…many of them use our personal information to turn a profit or to control us politically.
We must protect our data like our grandparents protected their memory boxes. Stay safe, encrypt your data.
Check out Cryptomator
