From: Zooko O'Whielacronx Date: Sun, 2 Aug 2009 02:27:33 +0000 (-0700) Subject: docs: about.html: edit (hopefully improve) the "What Makes Tahoe-LAFS Different"... X-Git-Tag: allmydata-tahoe-1.5.0~5 X-Git-Url: https://git.rkrishnan.org/?a=commitdiff_plain;h=a12ca6e228eb1d045dd2cc0f750496cbb5804ef0;p=tahoe-lafs%2Ftahoe-lafs.git docs: about.html: edit (hopefully improve) the "What Makes Tahoe-LAFS Different" copy --- diff --git a/docs/about.html b/docs/about.html index 820598e4..61813405 100644 --- a/docs/about.html +++ b/docs/about.html @@ -9,19 +9,18 @@

Welcome to Tahoe-LAFS

Welcome to Tahoe, the Least-Authority Filesystem. Tahoe-LAFS is the first cloud storage technology with provider-independent security.

Welcome to Tahoe-LAFS, the first cloud storage system with provider-independent security.

provider-independent security?

Every seller of cloud storage services will tell you that their service is secure. But what they mean by that is something fundamentally different from what we mean. What they mean by "secure" is that they try really hard not to misuse the power to read or modify your data. This turns out to be hard. Bugs, misconfigurations, and operator error can accidentally expose your data to another customer or to the public, or can corrupt your data. Criminals routinely gain illicit access to corporate servers. More insidiously, employees of the service provider itself may read or modify your data out of carelessness, avarice, or mere curiousity. The most conscientious of these service providers spend considerable effort and expense trying to mitigate these risks.

What we mean by "security" is something different. The service provider never has the ability to read or modify your data in the first place. Never. If you use Tahoe-LAFS, then all of the threats described above are non-issues to you. Not only is it easy for the service provider to avoid exposing or corrupting your data, but in fact they couldn't do so if they tried. This is what we call provider-independent security.

All that, and we don't sacrifice convenience or ease-of-use! Here's how it works.

Every seller of cloud storage services will tell you that their service is "secure". But what they mean by that is something fundamentally different from what we mean. What they mean by "secure" is that after you've given them the power to read and modify your data, they try really hard not to let this power be misued. This turns out to be difficult! Bugs, misconfigurations, or operator error can accidentally expose your data to another customer or to the public, or can corrupt your data. Criminals routinely gain illicit access to corporate servers. More insidiously, employees of the service provider itself may violate your privacy out of carelessness, avarice, or mere curiousity. The most conscientious of these service providers spend considerable effort and expense trying to mitigate these risks.

What we mean by "security" is something different. The service provider never has the ability to read or modify your data in the first place. Never. If you use Tahoe-LAFS, then all of the threats described above are non-issues to you. Not only is it easy and inexpensive for the service provider to maintain the security of your data, but in fact they couldn't violate its security if they tried. This is what we call provider-independent security.

This guarantee is integrated naturally into the cloud storage framework and doesn't require you to perform a manual pre-encryption step or cumbersome key management. (After all, having to do cumbersome manual operations when storing or accessing your data would nullify one of the primary benefits of using cloud storage in the first place.)

Here's how it works.

The filesystem is encrypted and spread over multiple servers in such a way that it continues to function even when some of the servers are unavailable, malfunctioning, or malicious.

A "storage grid" is made up of a number of storage servers. A storage server has local attached storage (typically one or more hard disks). A "gateway" uses the storage servers and provides access to the filesystem over HTTP(S) or (S)FTP.

Users do not rely on storage servers to provide confidentiality nor integrity for their data -- instead all of the data is encrypted and integrity-checked by the gateway, so that the servers can neither read nor modify the contents of the files.

Users rely on storage servers for availability. The ciphertext is erasure-coded and distributed across N storage servers (the default value for N is 10) so that it can be recovered from any K of these servers (the default value of K is 3). Therefore only the simultaneous failure of N-K+1 (with the defaults, 8) servers can make the data unavailable.