An open-source software project aims to give software developers a simple way to wrap encryption into their applications to thwart online surveillance efforts.
The project, called Crypton, comes from SpiderOak, a company known for its Dropbox-like online storage and synchronization service. SpiderOak differentiates itself by encrypting data in a such a way that none of its employees can access it, unlike Dropbox, where a few employees do have limited access to some kinds of data.
Crypton started out as an internal tool that SpiderOak needed for some of its other software projects, said CEO Ethan Oberman. The company wanted a way for data to be securely encrypted without the need for users to download a separate program.
SpiderOak also wanted to create an easy way for application developers to utilize encryption, which can be notoriously complex and prone to implementation errors.
”We wanted to develop more of a privacy platform that other developers and companies could use to integrate privacy in their applications without having to be cryptographers,” Oberman said. “We want people to understand the power of privacy and understand it is not an interference and not an inhibitor to product development.”
Crypton is essentially a framework that allows applications to encrypt data within a web browser before it is sent to a remote server.
Advancements in web browsers over the last few years have made Crypton possible. The JavaScript engines in web browsers are much more powerful and can handle intensive encryption tasks such as generating the key needed to lock and unlock encrypted data, Oberman said.
Users have peace of mind that even if a company was subpoenaed by a court, the company would not be able to decrypt the data, making it useless, Oberman said. The encryption keys remain on a user’s computer.
The same approach is being used by Mega, the online storage service from Kim Dotcom that succeeded his controversial Megaupload service.
How secure data is from prying eyes and spies has become increasingly discussed after extensive U.S. government surveillance programs were revealed in June by former NSA contractor Edward Snowden.
”There are portions of our digital lives or our documents or things that are important to us that we do really want to retain privacy over,” Oberman said.
SpiderOak plans to use Crypton for a secure instant messaging application and collaboration program it is working on, Oberman said. Crypton will work with desktop, web and mobile applications.
An early version of the code is on GitHub, and a more complete version should be available in about six weeks. SpiderOak plans to license it under the AGPL version 3, which allows people to use Crypton for open-source projects for free.
If a company wants to build a closed-source commercial service with Crypton and not contribute code changes back to the community, it can choose to pay SpiderOak a license fee, Oberman said.