| |||||||||||||
ownCloud 4 releasedownCloud 4 releasedPosted May 22, 2012 16:26 UTC (Tue) by aggelos (subscriber, #41752)Parent article: ownCloud 4 released Took a look at the encryption plugin and I gotta wonder what the point is. Encryption has to happen server side, so whoever controls the server trivially has access to all the data when you try to decrypt anything. The key is encrypted with the user's password (the unsalted hash of which is stored in the db, apparently?) and is generated by calling mt_rand(10000,99999) (a PRNG) 4 times in a row and concatenating, so offline attacks should work just fine. Am I misreading the code? What's the usecase here?
(Log in to post comments)
ownCloud 4 released Posted May 22, 2012 19:56 UTC (Tue) by ledow (guest, #11753) [Link]
I'm not sure the password is stored unsalted to be honest. The hash looks pretty unusual to me and doesn't correspond to anything I could generate with SHA1 or MD5, for example.
That said, the encryption is still useless anyway, because if you read the files from the server, it's only a small step to compromise anyway.
It's worth deploying on a SSL-only server so that you don't transmit your password or data transparently, but if it's on your own server (kinda the point of "owncloud"), I'd assume you had access to everything anyway. Part of the reason I like the idea - I don't have to rely on DropBox or similar to release my files if something goes wrong.
ownCloud 4 released Posted May 22, 2012 20:04 UTC (Tue) by aggelos (subscriber, #41752) [Link]
No, the password is hashed (they use http://www.openwall.com/phpass/, which transparently generates a salt and stores it along w/ the hash).
Like you though, I still don't see what this toy encryption (there are other problems too) has to offer, other than checking an Encryption [x] checkbox.
ownCloud 4 released Posted May 22, 2012 20:34 UTC (Tue) by AlexHudson (subscriber, #41828) [Link]
Presumably it's to go alongside the external storage options. It may not do much if someone hacks your owncloud, but it means you can trust your external storage isn't readable.
ownCloud 4 released Posted May 22, 2012 21:18 UTC (Tue) by aggelos (subscriber, #41752) [Link]
Not with this implementation you can't :/
ECB Posted May 23, 2012 6:47 UTC (Wed) by tialaramex (subscriber, #21167) [Link]
Looks like electronic codebook mode. AKA "I don't know what I'm doing" mode.
As Wikipeda handily illustrates with a picture of Tux, ECB doesn't do what you naively expect (because it can't) even when provided with a high quality block cipher primitive and a strong key.
There are a bunch of hard problems that ownCloud ought to want to solve. But solving already hard problems with PHP isn't going to happen, so they seem to have satisfied themselves with making it customisable, you can have the Wrong Thing™ in any flavour and colour scheme you like.
ownCloud 4 released Posted May 28, 2012 9:35 UTC (Mon) by jospoortvliet (subscriber, #33164) [Link]
why not? (i honestly want to know as i hoped to use this)
ownCloud 4 released Posted Jun 28, 2012 20:23 UTC (Thu) by MarkWilliamson (guest, #30166) [Link]
You can create shared web links to files give downloads to people without logins; I guess maybe if you could encrypt stuff before doing so that would have usecases.
|
|||||||||||||