[zeveb]

Yup. I want to be able to run the cloud service on my own hardware.

Now, if they offered actually-secure client-side encryption (with no backdoors or sidechannels to strip said encryption, unlike e.g. Mozilla do with their accounts), then I might still be interested, but I'd still rather run it on my own hosts.

[HappyTypist]

What's the issue with Mozilla?

[zeveb]

They use a protocol where they never have access to your password (and the secrecy of all the data they store for you hinges on the secrecy of your password), which sounds awesome, except that they serve a webpage to handle logins to their accounts, which means they can (& can be compelled to) serve you JavaScript which sends them your password out-of-band.

These two factors (all secrecy depending on your password and their ability to get your password) mean if you can remember your password, then Mozilla can brute-force your password, and if you have a strong password (e.g. 7HlipLbGliwUmUdWHKeq4p), then Mozilla can — or can be compelled to — serve you targeted JavaScript and steal it.