Защищённый почтовый сервер Nomx: мошенничество за $200

Алексей, "хорошее" (классическое, проверенное тысячелетиями) у вас шифрование — передавать файл, dsn и token по http; где ключ шифрования является конкатенацией dsn+token (на самом деле это не совсем хорошее шифрование):

https://flash.so/update.php
https://flash.so/2.0/mac/FlashSafe.zip
http://telegrammy.net/group/devops_ru/page2381.htm#238013 (Constantine): "FlashSafe.app\Contents\Resources\electron.asar"

http://telegrammy.net/img2/150/150855.jpg =
https://habrastorage.org/files/2ba/91f/2ce/2ba91f2ce62f433ab87e85942a7ca920.jpg

http://telegrammy.net/img2/150/150853.jpg =
https://habrastorage.org/files/14a/82a/8d4/14a82a8d462947b4bc39f8e0ba676a90.jpg

const apiUrl = 'http://api.flash.so/api.php';
..
function auth() {
    var d = usb.findByIds(2414, 2055); 
        d.getStringDescriptor(3, function(e, dt) {
            dsn = dt;
            token = dsn;
            for (var i = 0; i < 10; i++) {
                token = crypto.createHash('md5').update(token).digest("hex");
            } 
..
    if (isEncrypted == 1) {
        inputStream
            .pipe(crypto.createCipher('aes-256-cbc', new Buffer(dsn+token))) 
..
          .on('finish', function() {
                var uploadingStream = fs.createReadStream(outFN);
                var form = new FormData();
                form.append('method', 'UpdateFile');
                form.append('dsn', dsn);
                form.append('token', token);
                form.append('hash', hash); 
..
                form.submit(apiUrl, ...

За эту "премиум" идею просят подписку в размере около 100 долларов ежегодно:

https://flash.so/index.php

Premium security… The highest level of security, right in your pocket. Flashsafe is a portable, unlimited cloud storage device with hardware encryption.… ANNUAL SUBSCRIPTION $97

Никаких гарантий, хранение в S3 и/или Azure и заявленная возможность дедупликации ("encrypted data cannot be deduplicated"). Бесконечные объемы которые могут быть увеличены за плату...

https://flash.so/terms.html

If at any time FLASHSAFE reasonably believes in its sole discretion that you are using the Service beyond this scope, FLASHSAFE may terminate your access to the Service
third parties we work with to provide the Services, for example Amazon, Microsoft, which provides our storage space
As such, you grant, and you represent and warrant that you have the right to grant, to FLASHSAFE an irrevocable, nonexclusive, royalty-free and fully paid, worldwide, sublicenseable license to reproduce, distribute, publicly display and perform, prepare derivative works of, and otherwise use your digital belongings, solely for the purposes of providing you with the Services.
Files. We collect and store the files you upload, download, or access with the FLASHSAFE Service (“Files”). If you add a file to your FLASHSAFE that has been previously uploaded by you or another user, we may associate all or a portion of the previous file with your account rather than storing a duplicate.
Some photos and videos you place in FLASHSAFE may contain recorded location information. We may use this information to optimize your experience.
We may also share your information to (i) comply with laws or to respond to lawful requests and legal process, (ii) to protect the rights and property of FLASHSAFE our agents, customers, and others including to enforce our agreements, policies, and terms of use or (iii) in an emergency to protect the personal safety of its customers or any person.
you may… delete it by making the change on your account settings. In some cases we may retain copies of your information if required by law.
we encrypt the transmission of that information using secure socket layer technology (SSL).… No method of electronic transmission or storage is 100% secure
FLASHSAFE offers you the option of increasing your account storage space for a fee.
FLASHSAFE uses Amazon S3 and Microsoft Azure for data storage.
We encrypt the data that you store on FLASHSAFE using AES-256, which is the same encryption standard used by banks to secure customer data. Data is encrypted on the client before it is uploaded.
Your files are sent between FLASHSAFE’s desktop clients and our servers over a secure channel using 128-bit SSL (Secure Sockets Layer) encryption
While we’re very confident in our technology, we recognize that no system can guarantee data security with 100% certainty. For that reason, we will continue to innovate to make sure that our security measures are state of the art, and we will investigate any and all reported security issues concerning FLASHSAFE’s services or software.