Bitcasa Review: Version 1.1.0.0


I have been looking for a cloud storage, backup, and syncing solution for some time.

This post reviews Bitcasa 1.1.0.0; hopefully future versions will fix some of these bugs.

This post reviews Bitcasa 1.1.0.0; hopefully future versions will fix some of these bugs.

I heard about Bitcasa’s much-hyped “infinite storage,” and decided to give it a chance. Here’s the high Level Take-away:

  • I do not yet regret paying Bitcasa $100: The value proposition of paying $100 per year to meet my ever increasing storage needs is compelling.
  • I really like that Bitcasa encrypts my data; for real.
  • I plan to use Bitcasa for video and image storage and backup. I’ll use Dropbox for syncing, sharing, and collaboration.
  • Bitcasa 1.1.0.0 is a step beyond beta. It lacks the intuitive feature set and interface of Dropbox.
  • There is no “off” switch.
  • Bitcasa is not Enterprise-ready.
  • “Mirroring” is buggy.
  • Bitcasa 1.1.0.0 is a memory hog, and will cause significant system degradation while uploading.
  • Once it’s on Bitcasa’s (Amazon) cloud, don’t ever count on being able to delete it.
  • I’m going to stick with Bitcasa for a while. I think it’s got a lot of potential.

Paying for the same hard drive every year doesn’t make sense

First, let me tell you why I find Bitcasa’s model so appealing. Once I purchase a hard drive, I shouldn’t have to buy it again next year. That’s why I’m an avid user of the free version of Dropbox. I’ve got somewhere around 11.5GB of free space, which I use to back up sync and share. But the idea of paying for the same storage again and again just doesn’t appeal to me. Yes, I know that I’m also paying for near universal access to my files, but that value proposition just doesn’t hold water for me.

I’ve found that the 99% of the files I need to access and share on a regular basis are primarily office documents—Word, Excel, PowerPoint, etc. These files tend to be relatively small, and I can easily fit them within my 11.5GB Dropbox allotment. But the remaining 1% of my files take up terabytes of hard drive space. I want a safe backup for family photos and videos, even though I’m not going to access them on a daily basis. Even if I theoretically purchased “unlimited” space from Dropbox, I would still be limitied to the size of my local hard drive, since Dropbox only syncs local drives and does not provide additional cloud storage.

Consequently, I’m not willing to pay a recurring fee for static storage every year. But I am willing to pay for ever-increasing storage needs every year, especially if I can free up local hard drive space for other needs. So the idea of paying $100 per year for unlimited storage makes sense to me.

Although I understand how Bitcasa offers “infinite” storage, I don’t quite understand how Bitcasa’s business model intends to deal with enterprise clients who will want to store Petabytes per month, assuming they have the bandwidth.

They’ve got the right idea about privacy

From my understanding, Bitcasa encrypts your files using a hash of the file itself as a key (please correct me if I’m way off base). This means that Bitcasa doesn’t actually know the contents of your files, but can still know if your file matches a file that has already been uploaded. This way, instead of storing 5,000 copies of Bieber’s latest hit, they can save space by storing just one and linking it to 5,000 accounts. In contrast to Dropbox, Bitcasa doesn’t know that it’s a Bieber MP3; they just know it’s the same file. I appreciate that.

This means that I’m much more likely to store sensitive documents on Bitcasa. Although I still have to worry about securing my Bitcasa username and password.

From a privacy perspective, Bitcasa has the right idea, though I think their privacy representations are a little over-the-top:

“To be clear, aside from the rare exceptions we identify in our Privacy Policy, no matter how the Services change, we won’t share your content with others, including law enforcement, for any purpose unless you direct us to.”

(Bitcasa Legal Policy, emphasis added). Presumably Bitcasa won’t share your content with law enforcement because it can’t share it with law enforcement.

That’s actually a slight exaggeration. For example, let’s say that two parties are in a dispute. Party A says that Party B stole Document C and stored it on Bitcasa’s cloud. A court could certainly order Party A to give Document C to Bitcasa, which Bitcasa would upload, and its systems would instantly know how many other copies of Document C exist on the server, who owns it, when it was uploaded, etc. That information would then be open to discovery.

While I don’t really have a problem with that sort of particularized discovery, I could easily imagine Bitcasa having to build tools to allow parties like the RIAA to upload MP3s to see who has a copy, if ordered by a court. I think Bitcasa is on the right track with privacy and security; I just think that some of their promises are a little over-the-top.

Update below: Dom points out that blind encryption may be a fabrication, since Bitcasa can create low-res previews of files; this can’t be done without access to the original file.

“Mirroring” is not like Dropbox

“Mirroring” is when you designate a folder to be synced on Bitcasa. I thought it would work like Dropbox, but I was wrong.

All Folders in My Documents are mirrored... and I can't unmirror them

All Folders in My Documents are mirrored... and I can't unmirror them

When I installed Bitcasa, the setup asked whether I wanted to mirror my hard drive or key folders, like My Documents. I checked “yes,” and finished the installation. Very quickly I had second thoughts and decided to cancel the mirroring.

I unmirrored My Documents, then deleted the “Mirrored Documents” file, but somehow Bitcasa re-mirrored it and started uploading without my knowledge. I unmirrored again. Ironically, even though Bitcasa re-mirrored My Documents and uploaded it, the folder didn’t appear in my Infinite Drive.

Bitcasa helpfully stores daily versions of files; but won't let you delete them.

Bitcasa helpfully stores daily versions of files; but won't let you delete them.

Try as I might, I could not un-mirror the folders. On occasion Bitcasa would indicate that a folder was un-mirrored, only to re-mirror it moments later. I panicked, and deleted the “Mirrored” folder on my Infinite Drive, and expected the uploading to stop, but uploading continued at 5Mbps (my max FiOS upload speed at the time), for 10 more hours. I could not stop it. There was no “off” switch.

Even though I had unmirrored my files, the icons continue to be marked “Mirrored,” but if they were mirroring, I could not see where they were mirroring to, because there was no “Mirrored Files” folder on my Infinite drive. And in the online interface, the “Delete” option was grayed out. For several hours I felt like I had lost control of my computer, and that Bitcasa was sucking it to the cloud, and there was nothing I could do about it. For the record, I attribute this to an immature product UI and feature set, rather than any malicious intent.

If you want to unmirror a subfolder, you're out of luck.

If you want to unmirror a subfolder, you're out of luck.

I hopped on Twitter and engaged with @BitcasaSupport. Here is a synopsis of that conversation:

Me: How do I stop Bitcasa from mirroring my entire drive? Where’s the off switch? Should I just uninstall and reinstall?
BitcasaSupport: Sorry for the confusion – you can only unmirror via the desktop app, which you can download here: http://bit.ly/YGcr3C. When you right click on the folders mirrored, select Stop Mirroring to Bitcasa from the Bitcasa contextual menu.
Me: That’s what I tried- “stop mirroring” is grayed out everywhere. I chose “Mirror whole computer” on install. But I don’t know all of the local locations that Bitcasa is mirroring. It’s quite frustrating.
I mirrored my computer, then unmirrored it, but @Bitcasa continues to suck 5Mbps from my computer for 10 hrs. Very concerned. Why does @Bitcasa continue to suck up 5Mbps of my files without my consent? Can I stop it?
I had to kill the process to stop it from uploading. I have no idea what its been uploading for the past several hours. Is there any record of what has been uploaded, and how long @Bitcasa keeps it?
I am able to see old versions of my files, but the Delete button is grayed out. That is a problem because there are uploaded files that I never intended to upload. Is there a way to get rid of those files?

Support then opened a ticket for me, and addressed some of my concerns. In short:

  • I had to completely uninstall Bitcasa, manually deleting folders. Fortunately I did not have to edit the registry.
  • There is no “off” switch. Bitcasa chooses when and whether to upload.
  • You cannot unmirror sub-folders. You must unmirror the top folder… if you can remember which one is the “top folder.”
  • I still have no idea what Bitcasa was uploading for 10 hours after I had told it to stop mirroring everything. And I won’t ever have a way of knowing for sure.
  • There is currently no way to delete old versions of documents, even if you didn’t want them online in the first place.

Bitcasa is a Resource Hog

Bitcasa will take over your machine while uploading.

Bitcasa will take over your machine while uploading.

I think this image says it all. Bitcasa significantly degrades performance when it’s uploading. To give you an idea of how much it affects performance, I am writing this article in Notepad right now, because my browsers and word processors are too painfully slow.

When I asked support about this issue, they replied that a recent instability fix created the memory problems. “We’re currently working to improving the memory usage of the application without hindering upload stability, and anticipate that improvements will be made very soon.”

You need a fat pipe to upload all of your junk

I mentioned earlier that I have a 15Mbps down/ 5Mbps upload internet connection. I learned that it takes a long time to upload several terabytes of data at 5Mbps. I upgraded to 50Mbps down/ 25Mbps up so that I won’t have to wait a month to upload (nevermind that my pipe is testing at 25 down/ 21 up–curse you, Verizon!). I thought this was worth mentioning because the cost of an Infinite drive may well exceed $100 per year, if you include the cost of additional bandwidth.

Even with a 21Mbps available, Bitcasa rarely uses that much. Occasionally uploads have spiked at 21Mbps, but as I type, my upload speeds are averaging 3Mbps. The last day or two, they’ve averaged 6Mbps. Not surprisingly, Bitcasa support is quick to point out the many factors that affect upload speed… none of which are them. While I have no problem blaming Verizon for many of my problems, I have a hard time believing that my ISP is solely responsible for a 85-90% degradation in my upload speeds. Sorry, Bitcasa, I still think you’re the choke point.

Still Hopeful

Notwithstanding the mild drama, I’m still hopeful that Bitcasa will pull through. As I mentioned earlier, I think they’ve got the value proposition right, and I think they’re on the right track for privacy and security. They can have my $100.

Update: More to Worry About

Since I originally posted, helpful commenters Dom and Craig (below) make a couple of sobering points that significantly undermine my confidence in Bitcasa:

  • Blind encryption may be a lie: Bitcasa publishes previews of files and videos. This cannot be done without access to the original file.
  • Security by URL Obscurity: There is no way to password protect, time limit or even know when someone downloaded a file links.
  • No list of shared URLS: You’d better remember which files you shared via link, because Bitcasa sure ain’t going to tell you!
  • Shared URLs are indexed: Even though the robots.txt requests no indexing, many search engines ignore the request, or liberally interpret the request. Bottom line- links may be searchable, so beware before you share.
  • Rookie Security Errors: Full error reporting is currently turned on by default, meaning that errors expose django configs, mysql dbs and password, and Apache configs, usernames etc. They fixed this error within 10 minutes of notification via Twitter. But their MySQL db username and password may still be in the wild.

Very unimpressed. Bitcasa, get your act together.

  1. #1 by Dom on June 9, 2013 - 9:35 am

    IMHO the claim that they encrypt data server side is false. Bitcasa has the ability to make previews of your images and to live-stream your videos at a lowered bit rate. That cannot be done without access to the original, non encrypted version, of your media files !

  2. #2 by Craig on July 23, 2013 - 7:56 pm

    I’m a subscriber but haven’t put down the $100 for yearly package. For a company that touts security where even the employees cannot access your data, what I’m about to say is disappointing. Bitcasa shares files via URL. There is no way to password protect, time limit or even know when someone downloaded a the file. Security by URL obscurity is not the way to go (At very least make the URL super long). This data is easily found and I think many are under the impression it is somewhat secure. I only spent 5 minutes trying to figure way to find other user’s data, look here:

    https://ixquick.com/do/search?q=host%3Al.bitcasa.com

    Links after links of people’s files. It just takes a malicious coder to index all the file names and create a little database. Then they could do searches such “tax”, “mortgage”, “medical”, etc. No I’ve told people this how is someone suppose to protect themselves? They can delete the links not in use. But how? You cannot get a list of files you shared. You must remember the specific link and browse to it delete one by one. Pure madness. All I got from their support is a brand new feature request.

  3. #3 by Titus on July 23, 2013 - 8:10 pm

    Oh, geez. I agree with all of your points, which is why I knew enough to avoid linkifying my files. But I didn’t realize that they are indexable, even if http://l.bitcasa.com/robots.txt says otherwise.
    And it’s also pretty sloppy to leave full debug error reporting on, e.g.: http://l.bitcasa.com/7OaWoH8c/help_webmail.html.

    I hope that they don’t automatically linkify every file by default. Even if they say they don’t, they’ve made so many rookie security errors that I just can’t bring myself to take them at their word.

  4. #4 by greg on August 1, 2013 - 6:53 pm

    Just wanted to clarify something on the encryption. Bitcasa has implemented true Trust No-One security (meaning their employees couldn’t even decrypt your files) with two specific exceptions:

    1) If you choose to share a file: your client software re-encrypts that file with a new key and gives that key to bitcasa so that they can decrypt the file when people want to download it from your share link. Here you’re explicitly sharing the file, so I don’t see a problem with this. They still don’t have access to your other files

    2) To give you previews of files on your phone and the web: When using the mobile client or the web client your client software takes a copy of the file allocation table and encryption hashes, creates a version of it just for the folder or section of files that you’re currently trying to access, encrypts that with the server’s public key, and gives it to the server. Thus the server gets the temporary ability to decrypt the files you’re currently looking at on the web or in the mobile client. These hash tables are only ever stored in RAM on the server side, so even Bitcasa’s employees would have to do a physical memory dump of the server to get this data. It is wiped from memory as soon as you close the app or log out of the web site.

    The second example is more problematic. The company has made a specific trade off between security and functionality for the customers, and I think they’ve come out comfortably in the middle. You get the features you’d expect (being able to preview files online) while it is still incredibly difficult for their employees or law enforcement to ever get that decrypted data or the hashes (they’d need to freeze the memory on the server and dump it)

    However – if you REALLY want “trust no-one” security, simply never use the mobile app or the web interface. If you never use those, you never give them temporary access to your files. If you only ever interact with the service through the desktop client software, it truly is TNO.

(will not be published)