Privacy Guides
Filen & Mega - Cloud Storage Provider #466
-
|
Filen is an End-to-End Encrypted Cloud Storage Provider with Open Source Apps based in Germany. I don't know what to talk about this. But I think it should be listed in Cloud Providers. Even, Nate at the TheNewOil Recommneds this. You can check their Website for Full Details. You can also list Mega because it has also Open Source Apps. |
Beta Was this translation helpful? Give feedback.
Replies: 0 comments 13 replies
-
|
I don't recommend listing Filen. I reported various serious security vulnerabilities to them, which they didn't disclose, and I didn't review all of the code and don't even know JavaScript. Unfortunately, they also didn't listen to my recommendations properly, which led to poorer design decisions when it came to fixing things. On top of that, prior to me complaining, they didn't have a whitepaper, and they still aren't advertising their bug bounty program the last time I checked. Edit: They're now advertising their bug bounty program in their whitepaper, but they don't specify what the rewards are, unlike programs on HackerOne for example. |
Beta Was this translation helpful? Give feedback.
-
|
Better make it somewhat Public in their Subreddit. So, They might Care or look into it. |
Beta Was this translation helpful? Give feedback.
-
|
To be clear, I reported the issues to them, and they said they fixed them. I saw several commits indicating fixes, but I never looked thoroughly because they told me not to worry since they were going to try and get an audit. However, their whitepaper and responses to my messages indicate that they didn't follow all of my recommendations. With that said, things have definitely improved for the better, but I still wouldn't use their service personally based on the fact that such vulnerabilities existed in the first place when they could have easily been prevented if the developers had done sufficient research, they ignored some of my questions, and they didn't publicly disclose the issues, presumably to protect their reputation. I also don't use Reddit, and I doubt they'll take kindly to me discussing this at all considering they appear to have tried to keep it hush-hush. |
Beta Was this translation helpful? Give feedback.
-
|
Just a quick note: MEGA and Filen are "source-available", not free and open-source software (FOSS). Both of them have their own made-up software license which is non-free . Source: MEGA License , |
Beta Was this translation helpful? Give feedback.
-
|
It seems Filen has changed their license to AGPL-3.0 . Now it is truly FOSS. |
Beta Was this translation helpful? Give feedback.
-
|
It was changed when they released their new mobile apps. |
Beta Was this translation helpful? Give feedback.
-
|
Please see #345 for more information on why both services should probably not be listed. |
Beta Was this translation helpful? Give feedback.
-
|
Filen still hasn't released their audit report as far as I know, although it's been several months since they said one had been done. Alongside that, it has more usability problems than something like MEGA. |
Beta Was this translation helpful? Give feedback.
-
|
What usability Problems ? |
Beta Was this translation helpful? Give feedback.
-
|
I'm afraid I can't name specifics having not used the service long enough to test things, but people seem to be saying that it's slower and such. |
Beta Was this translation helpful? Give feedback.
-
How can you claim something without any proof? Do you have a link to those people who said that then? |
Beta Was this translation helpful? Give feedback.
-
|
Well, It doesn't seem to in the New Mobile Apps. Eagerly waiting for the New Desktop, TBH. |
Beta Was this translation helpful? Give feedback.
Please see #345 for more information on why both services should probably not be listed.