Anonymous Zero-Knowledge Encrypted Cloud Storage

Nikolas5476@lemmy.world · 11 days

Source code and details: https://github.com/umutcamliyurt/Lethean

Lethean is a zero-knowledge encrypted storage app with no accounts, no email. Your passphrase is the only credential and never leaves the browser. Upload photos and videos, browse them in a gallery, and play them fully decrypted in memory, the server only ever sees ciphertext.

Features

No user account required
AES-256-GCM for client-side encryption
Ciphertext padding to hide file size metadata
Argon2id for key derivation
Duress code for wiping the vault under coercion

Access tokens

Browsing a vault requires only its vaultId. Uploading additionally requires an operator-issued access token (10 GB quota by default), provisioned server-side.

A freshly issued token binds permanently to the first vault that uploads with it; a bound token cannot be reassigned.

givesomefucks@lemmy.world · 11 days

People really need to learn “the cloud” just means “a hard drive someone else owns”…

It’s always weird when people start pushing cloud based apps for privacy/security. Because at the end of the day, you’re handing all your data to some dude you don’t know, along with almost certainly identifiable information.

Nikolas5476@lemmy.world · 11 days

Sometimes it’s better not to keep sensitive data on your own device in the first place, for example when crossing country borders. With zero-knowledge encryption, nobody except the person who has the encryption key can view the contents of files, so where the data is stored is less important. Lethean’s duress password feature also lets a user nuke their vault if they are under coercion.

CorrectAlias@piefed.blahaj.zone · 10 days

The UI, this post, and a lot of the code seems like slop. The last thing I would ever fucking do is upload my files to a vibe-coded cloud service.

I can literally see no reason to use this, personally. Not when better options that are actually audited (or even self hostable) exist.

Nikolas5476@lemmy.world · 10 days

Give us better self-hostable zero-knowledge cloud storage options if you have them. Proton Drive is partially vibe-coded and as far as I know, there aren’t any truly FOSS zero-knowledge cloud services other than this (Lethean is also self-hostable).

prole@lemmy.blahaj.zone · 10 days

Did you make this? If so, I always find it curious that people like this cannot just take the advice/criticism they asked for.

Zero-knowledge refers to a very specific type of encryption, and it has to work.

Putting faith in anything that was vibecoded for something like zero knowledge encryption seems like a very bad idea.

And yet that specific advice just cannot ever be accepted and brought on. The response is always defensive.

I appreciate that you saw the need for something, and took initiative to try to make it… However, unless you’ve got experience with developing this kind of encryption, and didn’t just offload any of it to an LLM, then I worry it’s doing more harm than good.

In the case of something like this, having no option is better than having an option that confidently tells you it works while you have no idea what’s actually happening under the hood.

Nikolas5476@lemmy.world · 10 days

I did make this and i understand the codebase well. Using AI to create documentation doesn’t invalidate the quality of my code.

prole@lemmy.blahaj.zone · 10 days

Ok then if that’s the case, you should have clarified that AI wasn’t used in coding the important stuff, but just documentation.

Because I think that’s where most people’s concern was. That is, trusting LLM for a specific type of privacy application.

Nikolas5476@lemmy.world · 10 days

Thanks for pointing this out

0x0@infosec.pub · 10 days

Just use something like tomb instead with any cloud at all

https://github.com/dyne/tomb/tree/master