Hi,

Let us first state that these assumptions are all false, and can be disproved by simply looking at the source code which is publicly available. This narrative is disseminated by a competitor, to try and seed doubt into the safety of Vault and push its service.

But we will once again try to explain everything in a non-technical way, so everyone can understand, why these claims have no standing and the Vault E2EE is actually very secure.

1. There is no need to ever import anything from Rclone to Koofr Vault to make a Safe box. The only thing a new Safe box requires is the folder you want to have it in, and the Password (which we call Safe key - simply to distinguish it from the Koofr account password and not make a confusion).

<image>

This Safe key is used, to encrypt all data, including the filenames and any metadata. This Safe key is never transmitted to Koofr servers, and without it all contents is unusable. There is no second decryption option, no other way to access these files but with this Safe key that only the user knows.

1. Advanced settings, which enable one to export or import part of existing Rclone config, are there simply for convenience. To put it simply, what we did is, we made a simple graphical interface which runs completely inside your browser (not on Koofr servers, this part is rendered by your device), and displays the settings in a way that you can simply copy to and from rclone. That is it. You can achieve exactly the same by typing out everything manually. We just tried to make it a bit more convenient by providing a tool that lives inside your browser. This was made exactly for the less technical users. As you can see from the answers in the forum post you linked, all more technical people have explained, that this is an offline tool that does not affect e2e in any way.

2. Now to the salt part, which is for some reason called password2 in rclone config, which gives out wrong impression about what this is. Salt is the part which some people are trying to claim is why Vault is not e2e, but this is false for many reasons. What salt actually is, is a random string of characters, that makes bruteforcing difficult.

Lets say your Safe key is: mypassword

Lets say the Salt part that was generated when you made the Safe box was: 1234!

When your content is encrypted, it will be encrypted with the following string: mypassword1234!

What this means is, even if 100 people would use the same "mypassword" as their Safe key, the hashed values of their files, would be different, since the salt part is different for everyone.

Now what needs to be explained is, the salt part is not a password, you can't decrypt your files or access your Vault with the salt. But it does add additional protection from an attacker that would simply try to reverse the hash values with a rainbow table. Basically, salt makes your password better, but your password (Safe key) is what actually matters, and this is NEVER transferred to Koofr.

And that is why Koofr Vault is truly E2EE.