Separately, how do you deal with the fundamental weakness of browser based security?[2] You say that the software will be open source, but will there be any mechanism to verify that the served javascript libraries on any particular visit match the sources on github? Will there be any minimization / compilation that would make such verification difficult or impossible to accomplish?
[1] http://www.thoughtcrime.org/blog/lavabit-critique/
[2] see e.g. http://www.matasano.com/articles/javascript-cryptography/
For your second question, all resources for the site, including javascript, are served over SSL. This will prevent about 99% of MITM tampering attacks. While we can't overcome the inherent weakness in SSL, or guarantee against compromise on the server-side, we are working on a browser extension which will check the code you receive from the server against what is in the repository, so you can at least be alerted of any inconsistencies.
And since the website is all open-source, we're going to make it simple to host it yourself, if you want to be extra-sure that it's not compromised.
EDIT: By "website" I'm referring to the frontend, in-browser code
This is the Lavabit way, I believe. However, it could be solved using a browser extension.
Also, open-source it now! I've been in the process of launching something similar (think, client-side encrypted Evernote/Pinterest geared towards programmers/creatives/collaboration) and a lot of the great feedback I've gotten is from people checking out the source. Most of the people who care about the crypto aspects these days are the ones with 1s and 0s running through their heads, at least a good portion. They're going to want to see code.
Best of luck on the kickstarter!
To play the devil's advocate, if you're already a happy user of tarsnap then you (like me, in fact) are probably quite comfortable on the command-line, and may even prefer it. As of right now Cryptic doesn't have a command-line utility, although building one is definitely on our radar! But until then you may find it more comfortable. Thanks for checking us out though!
1. The kickstarter is for an upcoming cloud version of Cryptic?
2. Parts are open source (Eclipse), but not intended for self-hosting?
1. The kickstarter is to fund development and servers for the online file storage + web app.
2. Anything client side will be open sourced, and can be self-hosted. You could host the Cryptic site right now locally, and use a local version to interface with cryptic servers.
So the storage is always provided by you, and that is what the client pay for in GB increments?
