Right, thanks for clearing up! I didnt catch that it was in some other date format.
Aha! That was not super clear to me but makes sense, i guess. Although I guess password reset isnt the most usefuk feature in that scenario.
Well i think it is probably best to enforce it that was not my comment. I meant that the sign up flow would best guide the user to set it up. It could perhaps allow for skipping.
I do personally think MFA is an essential security measure these days. Where passkeys are obviously preferred for anti phishing and UX.
1 Like
ah, yes, to at least have it as an option in the signup flow is a good idea, thanks for the suggestion!
And yes, I agree, Passkey is superior to TOTP in most aspects. Passkey-support is on our roadmap already
1 Like
So what you’re saying is, you’re coming for Ente’s throat? Just kidding. 
I welcome this kind of competition. Hopefully Ente and ZeitKapsl will compel Proton Drive to up their game when it comes to storing photos and videos. This looks very promising! And the pricing seems quite competitive, especially for the lower tiers.
1) Out of curiosity, what does ZeitKapsl mean? And it what language is it?
With everything that has been going on with GrapheneOS, and other privacy companies in the EU, I have come to realize that not all EU countries are created equal when it comes to privacy protections.
My understanding is that EU law supersedes national law, but that EU countries can pass stronger laws, as long as they don’t infrige EU laws. That’s why some EU countries have better privacy protection than others, because local laws strengthen existing EU laws. With that in mind, can you tell us:
2) Under which EU countrie(s) is ZeitKapsl based?
Loosely off-topic, but I love that cryptographers are re-appropriating the shorthand crypto.
I have seen cryptocurrency enthusiasts online complain about it being used for cryptography, when the latter was first.
That is a great policy. We’ve seen how venture capital can spoil a really cool project (Skiff).
This is going to sound silly, but I really appreciate that you don’t present your annual plans as monthly costs. To be specific, I don’t have an issue with companies showing how much annual plans cost monthly. I have an issue with them emphasizing that information over the annual cost, because to me, it is misleading, and the latter is what users will be actually paying. Hence, IMO, it should be what they see first.
Another detail I appreciate is you being on Mastodon. I think it’s very important for privacy companies and public figures, not only to be on it, but to be active on it. Quite a few influential privacy voices fail at this, unfortunately.
I look forward to trying out your service!
My best guess is Austria.
3 Likes
Yeah the company behind it seems to be based in Vienna, Austria.
1 Like
How is this project doing? Has it been audited?
It looks pretty good.
It looks like there was an audit but only the web app?
1 Like
Hi,
sorry for the late reply, caught me just in the summer holidays.
Yes, it has been audited, we also wrote up a blog post that should be more digestible than the full report if you are just interested in the bigger picture: Security Audit: CHECK
The scope was bigger than the web app. It is described in section 3.1, but here is the full scope that we gave them with priorization:
- crypto-architecture review, including a formal protocol verification (“I1: Analysis of flows using formal methods” in the report) as well as a review of the implementations for the web app (crypto.js) and the shared go core for the apps (core/pkg/crypto)
- web-app security review with a focus on XSS (since a XSS vulnerability would break our security model)
- security review of our (not-yet open-sourced) server, including our in-house admin panel and support system
- with the remaining time budget, the apps (iOS, Android, desktop, cli) including the shared go core were reviewed.
1 Like
very late to reply here, but the most pressing questions (legal residence (it’s indeed Austria) and meaning of the name 
) have been answered by the community 
I appreciate you noticing this. I fully agree, showing yearly plans as yearly costs feels more honest, also from our side. The yearly plan is also a commitment to the yearly price (we are of course accommodating regarding refunds if users quality expectations are not met, but it is a single upfront charge anyway)
1 Like
(not-yet open-sourced) server
Do you have plans to open source it? If so would it be in the nearer future or more distant?
There’s no concrete plan nor final decision at the moment.
To be honest, we don’t see a good reason for open sourcing the server at the moment:
- For self-hosting, there are plenty of excellent solutions (e.g. Immich and Photoprism, which are actually tailored for self-hosting)
- For trust purposes, it doesn’t really make sense as well:
- The open source client apps are where the encryption happens, ideally you don’t have to trust our servers
- You couldn’t verify whether we deployed the same code we publish on our own servers anyway
On the other side, there’s a real business risk: As a bootstrapped startup, our co-founders invested a lot of their own time and money on which we yet have to break even. So there’s a risk someone hosts the same service and undercuts us in price.
If someone comes up with a convincing reason to do so (read this as an invitation ), or once we reach break-even, we might open source it.
2 Likes
Is there a plan to publish builds on Codeberg or whatever sometime soon? I was considering trying this, but AFAICT the Android app is only published on the Play Store.
Hi,
yes, we’re currently in the process setting up a full build-pipeline. We started in this branch a few weeks ago, right now the progress there seems to be stalled because we are currently integrating ffmpeg and vips as statically linked libraries directly into the Android builds (replacing the unreliable Media3 & ImageDecoder), which impacts the whole build process. Once we have finalized that in the coming weeks, there will be builds for every future release (probably on codeberg directly, in a format that is Obtanium-friendly anyhow).
2 Likes