Add Internxt drive to "Cloud Storage Providers" section in Privacy Guides

[TechPro424]

Internxt Drive seems like a good recommendation, as they claim that they use AES-256 encryption and also have E2EE.
However, I am just a normal user and barely know anything about things like cryptography. I request someone with more knowledge on these subjects to do more research and find out if Internxt Drive is a good recommendation or not.

Internxt Drive homepage: https://internxt.com/

[ph00lt0]

This honestly looks really promising, I can't find any audit of the cryptographic implementation, that would be useful.
It seems also to be self-hostable given what I have seen on their github. That would make it a really good replacement for Nextcloud.

One minus point for the fact that they have their own coin

[Mohamad20ZX]

I agree with you but it will be successful in 2030

[jermanuts]

@samuel-lucas6 https://web.archive.org/web/20170910111107/https://internxt.io/whitepaper.pdf (September 2017)
https://neironix.io/documents/whitepaper/8e5a53c88a24b00efa677ef442c57063.pdf (February 2018)

started getting 403 forbidden after recent years through archive.org .

[samuel-lucas6]

@jermanuts Nice job. That says AES-CTR with 2 MB chunks sent to different machines and SHA-256 for detecting tampering. That's incredibly vague and doesn't sound good.

[jermanuts]

it was a google dork to find neironix site
Internxt "whitepaper"

Thanks.

[HACKERALERT]

@samuel-lucas6 I'm not really sure, I just took a quick look although I believe it is just AES-CBC, I haven't found any HMAC usage (don't quote me on that though, more research is needed and I'm not a JS person). Here's a few source files containing some cryptography: https://github.com/internxt/drive-web/tree/master/src/app/crypto/services. utils.ts is a good starting point.

And yes, I agree CryptoJS isn't a very good option when others exist (in case this hasn't been mentioned, monitoring network requests on Filen show it is using CryptoJS as well). So both Internxt and Filen will be extremely slow since it is software-based cryptography. I have tried both and can confirm pretty slow speeds, although that may be influenced by the potato Intel Pentium in my laptop 😄 .

TL;DR: I also don't recommend Internxt. (I'll edit my previous response to clarify this)

Off-topic (I'm short on time so I'll just put it here): Filen is rewriting their desktop, mobile, and web clients, so any previous audits are probably going to be invalid by the time they push out their latest updates. There's a status update in r/Filen_io about this.

[julianfairfax]

I've used Internxt in the past and found it was a lot more unstable than something like Filen. It took forever to upload my data for seemingly no good reason, complained about empty files, doesn't support symlinks, and exclusively uploads their mobile app to the Google Play Store, with no releases on GitHub, and no proper instructions on how to build a working version of it (see internxt/drive-mobile#64)

If we're going to include more cloud storage options, something like Filen, which I currently use, would be a much better fit. Their server isn't open source, but their website and apps are. I haven't had any issues with them so far, and they actually upload their apps on GitHub as releases, so you can download them from their or from third-party F-Droid repositories.

[ph00lt0]

Regarding Internxt upload, I have actually tested it and can't say I share this experience but perhaps it has improved since you last used it?

[julianfairfax]

For the Filen discussion you should be here: #345.

That's a closed issue so I don't really see a point in commenting on it. But the concerns seem to be resolved, so I have left a comment in a discussion regarding it instead: https://github.com/privacyguides/privacyguides.org/discussions/1621#discussioncomment-3486370

Regarding Internxt upload, I have actually tested it and can't say I share this experience but perhaps it has improved since you last used it?

I mean, I can test it again, but the last time I did was only a month ago. It does actually work, which is better than it used to be. But not for empty files or symlinks (unless that has of course changed since then), and the speed is still slower than Filen's upload speed.

There's also the part where the mobile app is only installable from the Google Play Store, and is impossible to build (at least for me, but let me know if you understand how to). This isn't really acceptable for a "privacy-respecting" and "open source" app in my opinion.

[ph00lt0]

I don't see the issues you mention tbh with you @julianfairfax
Issues can be reopend, the app can be downloaded from Aurora?

When it comes to symlinks this has nothing to do with privacy and is simply a convenience thing.

[julianfairfax]

I don't see the issues you mention tbh with you @julianfairfax

You don't see how it's only on the Google Play Store? Read internxt/drive-mobile#64 and see for yourself how it's not on the releases: https://github.com/internxt/drive-mobile/releases.

Don't see how it can't be built? Read internxt/drive-mobile#64 (comment) and see for yourself how none of these values are filled in anywhere or obvious: https://github.com/internxt/drive-mobile/blob/master/env/.env.example.json

Don't see how this isn't an issue? Well how can an app claim to be open source if it's pretty much impossible to build their source code? With the app only being on the Play Store, we have no way of knowing if what we're installing is the same as what we would get if we built if from source.

Issues can be reopend, the app can be downloaded from Aurora?

That is not a solution. Aurora is a frontend for the Google Play Store, so it's connecting your device to it, and you're still relying upon it. Open source apps should be buildable, and as a bonus, are welcome to be released on GitHub/GitLab and F-Droid. Internxt is none of these things.

When it comes to symlinks this has nothing to do with privacy and is simply a convenience thing.

Of course it has nothing to do with privacy, but it has something to do with the quality of the service. If we're going to recommend a service we should recommend the best one.

[ph00lt0]

There are very valid reasons not to be using F-Droid, see https://wonderfall.dev/fdroid-issues/ Your arguement about not knowing what you are running in fact is a lot higher would you be using F-Droid.

Google Play is much more secure, and if you use Aurora I really do not see the problem from a privacy perspective. The fact that you connect to Google is really not interesting. Focus on the real issue here, what are you trying to protect and from whom? Google doesn't get any data from you that is useful by you using Aurora. Neither are they well able to distinguish you from other users.

We do not have a requirement for reproducible builds AFAIK. Neither being open source is a requirement, although encouraged. Github releases would definitely be awesome but it is not such a big deal as you make it seem.

I think the problems with Filen have been perfectly discussed in the other discussion.

[matchboxbananasynergy]

It seems that people who have actually looked into the nitty gritty of Internxt do not recommend it for the time being. I don't think it makes sense to list this right now. If things change, we may revisit this in the future.