2

Looking for an alternative to UbuntuOne, I found that the official Chinese distro, Ubuntu Kylin, has announced a cloud service from Kingsoft KuaiPan, with its own "customed app". This sync client is only partially translated into english, but it was quite easy to get 1TB extra: 512GB installing their apk in my Android phone (which I uninstalled as soon as I got the extra storage) and 512GB binding it with wechat (a service I don't use anyhow). It is no doubt a generous amount of free space which derives mainly from a cloud storage war in China.

UbuntuKylin Systray

Apart from a slight memory leak, I must acknowledge how well this service integrates in Unity. A screenshot of the KuaiPan folder in Nautilus (note the Ubuntu logo):

Kuaipan folder in Nautilus

Provided that Canonical somehow endorses this service, I can imagine that it is reliable at least to some extent. My natural question is to what degree? Of course, if I were paranoid, I wouldn't share any personal file on any server beyond my sight. However, I'd like to know

  1. if KuaiPan provides end-to-end encryption; and

  2. how this service handles storage and files (i.e. if they have a “master key” to see/open them)

In case they don't offer a secure connection, please let me know if there is a way to take advantage of this service, for instance, using it as a backup protected with password.

Ed Villegas
  • 3,343
  • 1
  • 20
  • 29
  • I don't see where Canonical _supports_ that service. – dobey Apr 09 '14 at 13:53
  • I stated that Canonical supports this service from the fact that Canonical announced: “Coming soon — Kingsoft Kuaipan cloud storage service, complete with 100GB of free storage for every user.” It is written in http://www.ubuntu.com/desktop/ubuntu-kylin – Ed Villegas Apr 09 '14 at 14:09
  • Ubuntu-Kylin is the Asian addition of Ubuntu. Thats all i know about Kylin :/ – blade19899 Apr 09 '14 at 14:17
  • It's a service targeted specifically to the Chinese market, and included by default in the Chinese remix of Ubuntu. It's not any different than say Kubuntu including ownCloud by default. I don't know if any Kylin developers or Kingsoft support personnel watch Ask Ubuntu, so you'd probably be better off asking Kingsoft support your questions, even if the question isn't exactly off topic for Ask Ubuntu. – dobey Apr 09 '14 at 14:20
  • I don't understad why @dobey deleted the "ubuntone-alternatives" tag, since there are a lot of people looking precisely for something to replace it. One alternative is this Kuaipan cloud which is —or will soon be— included *by default* in the Chinese Ubuntu "remix". It is noteworthy that in www.ubuntu.com the Kylin flavor is the only one ready to download apart from the main and the server editions (no mention of gnome/kde/xfe/openbox). – Ed Villegas Apr 09 '14 at 14:42
  • Because while this is an alternative to U1 file sync, tags that are "foo-alternatives" are not good tags, and are opinionated. For many, it might not be an alternative. – dobey Apr 09 '14 at 17:35
  • "Opinionated", according to the freedictionary, means "holding stubbornly and often unreasonably to one's own opinions". Thus, I can't see your point. You've deleted both tags: "ubuntuone" and "ubuntuone-alternatives". However, U1 is closing and many people are looking for an alternative. How do you think they will find one? Maybe for you —or to some others— this service is not a *good* or a *reliable* service, but *it is* an alternative to U1 (as you acknowledge as well). I was precisely inquiring this, because Canonical has considered it a viable alternative at least to the Chinese public. – Ed Villegas Apr 09 '14 at 17:59
  • 1
    I've done some strace, it uses some type of ssl, hard to tell if it's for the data or just authentication. second one, even if they had don't think they'd tell you.. – kmassada Apr 11 '14 at 18:12
  • you can always use local encryption for extra security. – Registered User Apr 12 '14 at 05:30
  • 1
    https://one.ubuntu.com/ uses highgrade encryption(camellia-256) while **connection to http://www.kuaipan.cn is not encrypted at all**. This means that the website is many times insecure than Ubuntu-one. Also when you get more than what you should(1TB or 2TB), there has to be something wrong going underneath. kuaipan maybe safe for privacy-unconcerned users, but the best thing for any one else is to either create a small server in a group(eg. 10Tb between 5 friends) or to use a external drive(take it everywhere) or to quit using such services completely. – Registered User Apr 12 '14 at 06:19
  • If you're interested in privacy, the you should absolutely check SpiderOak: [Dear Ubuntu One Users: What SpiderOak Can Do For You](https://spideroak.com/blog/20140402145558-dear-ubuntu-one-users-spideroak-can) – landroni Apr 12 '14 at 12:39
  • @PatilAditya — As far as I know, Kingsoft offers 1TB because there is a "cloud" war in China among the main providers. I will edit the question with this info. On the other hand, how can you add "local encryption" (before uploading, I guess)? – Ed Villegas Apr 12 '14 at 15:18
  • @EdVillegas inherently no if you are running this outside of China, and even then due to the political stance on information the information will be accessible to the government of China. In other words your information will not be secure as far as worrying about someone else reading your data. However this is true, as we have seen for other government agencies. The political atmosphere in China is different and must be taken into consideration. I do not want to bash any govt. just say that the stance on IA will be different when considering different govts. Your info. will be ctrl'd diff.. – No Time Apr 18 '14 at 05:30
  • @EdVillegas (cont..)on diff. systems. – No Time Apr 18 '14 at 05:31

1 Answers1

0

Kuaipan communicates with the servers hosted at http://kuaipan.cn.

While Ubuntu's servers, hosted at http://one.ubuntu.com use 256-bit encryption, Kuaipan uses an unguarded internet connection. Using Kuaipan would be heck as scary for people who upload their personal data to the cloud.

While the promise of 1 TB does look alluring, do note that Kuaipan is hosted in mainland China, not Hong Kong. China's national internet censoring system, often dubbed as the Great Firewall of China, will have access to your data. Hong Kong and Macau, being SARs or Special Administrative Regions fall out of the censoring policy.

I'd suggest you use something like a VPN to hide your IP from Kuaipan, and not use that 1-2 TB to store sensitive data. Avoid making it your primary cloud service, and specially restrict it's access to your PC as long as their security encryption stays like this.

P.S. Just because Ubuntu Kylin is bundled with Kuaipan does not mean that Canonical endorses it. You are left to use Kuaipan at your own risk.

About encryption: A screenshot from Safari for iOS. The padlock with the omnibox displays that encryption is available.

Ubuntu One:enter image description here

Kuaipan: enter image description here

You can try this with any good browser and yet you'll fail to find any encryption on Kuaipan. Even if there is, it uses a certificate which is not verified by a global authority like VeriSign, Thawte, Entrust etc.

Mayukh Nair
  • 476
  • 2
  • 14
  • Would you elaborate how do you know that KuaiPan uses an “ungarded connection”? I'm still wondering this because there is no information I can find/understand. It seems natural to rise suspicions whenever a company offers no explicit information regarding how they manage stored data. However, I don't speak Chinese and so I'm not quite sure if there is such info. On the other hand, I disagree with you on the point of “endorsement”: Canonical states that they've “worked closely with Kingsoft“. For me *that means* that Kingsoft is *somehow* trustworthy; otherwise they wouldn't work together. – Ed Villegas Apr 17 '14 at 23:49
  • The home page (at least) isn't HTTPS, which might raise some questions. – saiarcot895 Apr 17 '14 at 23:51
  • Browsers like Chrome or Firefox display a padlock in case the connection is encrypted, but this is not the case with Kuaipan. And though Canonical iscollaborating with Kingsoft, in case of any disputes Canonical will not be held liable. – Mayukh Nair Apr 18 '14 at 23:24
  • See my edits. And yeah, about trustworthy: even Steve Jobs collaborated with John Sculley on trust and yet they fell out. That does not mean that endorsement means you should place trust on a platform. There are hundreds of companies who collaborated and then fell out, like VW and Suzuki, or Apple and another company which made iPod compatible Windows software. – Mayukh Nair Apr 19 '14 at 07:36
  • @EdVillegas So what have you planned? Have you decided to try Kuaipan? THat, of course, is as you wish but do remember, there's always a chance that there may be an attack on those servers by hackers (or the government) and Kingsoft could do little to protect your data in such moments. The reason you should still stick to Dropbox, Drive, iCloud is not because they are more popular names, but because they have 24-hour security teams, tried-and-tested encryption, technology that gets routinely patched to prevent attacks like Heartbleed and have faced thousands of attacks. – Mayukh Nair Apr 20 '14 at 00:04