Comparison of Mega, iDrive, and Sync

Mega, iDrive, and Sync are all end-to-end encrypted cloud storages. However, they each have their quirks.

Mega

With Mega, anyone who has access to your computer can permanently delete your files
Mega is a file hosting service offered by Mega Cloud Services Limited, a company based in Auckland, New Zealand. It was founded by Kim Dotcom and others, although Dotcom later pulled out.

Mega offers true end-to-end encryption, a responsive smartphone app, and great upload speeds (tested in Europe). However, the service has an essential flaw: The desktop app allows accessing the user account on the Web without additional password verification. That means that if you lose your computer, someone finds it, and plugs your hard drive into his computer, he can access your Mega account. From there, he can delete files irreversibly. He can even download the recovery key. In other words: When your computer is compromised, so is your data.

That may seem natural, but then again: what is the purpose of a cloud backup if it is no more secure than your computer? What Mega should do is require the password (or at least the second factor of 2-factor-authentication) before granting access to the user account. I explained them the problem and the proposed solution, but they replied saying they do not believe Mega has a problem.

The issue can to some degree be mitigated by installing not the desktop app, but only the command line interface MEGAcmd. This interface does not allow clicking through to the Web interface. But even then, an attacker, a malware, or you yourself (by accident) can execute mega-rm -r -f /. This command will delete the entire remote storage, the entire local storage, all backups, and all version-history of all files. The rubbish bin can be emptied similarly. Thus, a command of only 15 characters can annihilate your entire local and remote storage irreversably.

iDrive

With iDrive, you cannot share files and folders once end-to-end encryption is on.
IDrive is an online backup service by iDrive Inc., a technology company based in California. It offers end-to-end encrypted file storage and a responsive app.

I have not tested for the desktop app backdoor. However, iDrive fails on another criterion: it does not allow collaborating with other users. First, it does not allow sharing folders with other users in order to work together on the same data. Second, it does not even allow sharing download links to files and folders (this works only for non-end-to-end-encrypted objects).

You may want to ask why it makes any sense to share data that is so private that you keep it end-to-end encrypted. The answer is that there is data that you want to share with a friend, but with no-one else. That is where end-to-end encrypted sharing comes in handy.

Furthermore, iDrive keeps only 30 versions of your files. That may sound like a lot, but if you work on any document for an hour, and you have the habit of saving it frequently (as you should), then chances are that you cannot go back to how the document was an hour ago.

Sync.com

How your Sync mobile phone app looks a large part of the time.
Sync.com is a Canadian company that has been offering end-to-end encrypted file storage since 2011.

Sync offers all the security features that iDrive and Mega offer, but it does not suffer from their drawbacks. You can share files and folders, via link or via collaboration, while keeping the end-to-end encryption. And the desktop app does not let you through directly to the user account (the second factor of two-factor authentication is required).

The drawback? The mobile phone app is painstakingly slow! (At least when you access it from Europe.) Navigating into a folder can take 10 seconds — meaning that going into some 6-level structure takes easily one minute. Also, the interaction with the native Files app on iOS is buggy and fails more often than it works.

Others

So what about the others? As far as I could see:

Verdict

So what's the verdict?

I personally stay with Sync.com. While the app is slow, the service supports at least all the security features that I need. Your own preferences may differ, of course.