Wuala's Security: Introduction

The following series is written by Luzius, Bernd and Mastermind Posativ. Follow Posativ on Twitter or read his blog about Wuala.

Wuala uses an elaborate encryption scheme to protect the privacy of its users. All files stored in Wuala get encrypted on your computer before the upload starts. No one - not even we as the provider - can see your files. At the same time, it is possible to share select folders with other users thanks to the Cryptree key management system. Thus, offering full privacy and the ability to share files at the same time, clearly makes us unique.

Some online storage providers have security claims on their website that sound very similar to ours. For example, they claim that their employees don't have access to your data. What they mean by that, is that their employees are not allowed to access it, but technically, they are still able to read your „securely“ stored data. As a rule of thumb, if a service has a "forgot password" feature to email you your password, they can access your data. Since they can send it to you, they can also send your password to any other email address, including one of their own, and then use it to access your data. This is not the case with Wuala. We don't know your password and cannot help you in case you forget it. If you lose your Wuala password, your data is gone forever.

In the following blog series, we will introduce you to Wuala's encryption. For a technical in-depth explanation of our key management, we recommend to read the Cryptree paper (presented at the Symposium for Reliable Distributed Systems 2006).