How did the internet get so dumbed down? Cloud this and web app that and now nobody knows how to research or install any normal software. Or do anything that isn't shiny packaged at $10+ a month?
In my eyes, it's not secure because the AES key is stored, albeit encrypted by a password, on the server side along with a file of the password hashes. Even when best practices are followed, it's still relatively easy for an attacker to recover passwords from their hashes via a brute force attack.
If the goal was actually to create something very secure, I would say that the keys would need to stay entirely on the client side, but this of course has its own usability problems. As it is, I'm curious as to how password resets can be carried out.
That being said, it's probably relatively secure as long as the cloud provider isn't raided or coerced to act badly. They can reasonably say that the data is encrypted and that they don't have access to the key.
I would be interested to see what the crypto looks like when the site is used for file sharing (e.g. I upload once, then post a link for many to download). Or am I just assuming that there's an option for this use case?