Given a scenario, e.g. my Dropbox was hacked, and the hacker has access to my EncFS encrypted texts, and probably the history of it as well. Is that what was mentioned as "two or more snapshots" and "different times"?
Whether it applies depends on how the storage system would work. As far as I can tell, EncFS itself has no backup/versioning capability. Assuming that is the case, a storage system which supports history could implement it in one of two ways:
- Do the versioning on top of EncFS. So the versioning system itself is stored in the encrypted filesystem.
- Do it on a level below EncFS. So different versions of the filesystem exist.
In the former case, an attacker who only gained access to the system once could not see two copies of the ciphertext. In the latter they could.
In the real world, it is possible both would be used. E.g. if versioning is done on top of EncFS, but whole system backups are also stored. An attacker who got access to backups would be in a better position to break the encryption.
However, the audit details several weaknesses that even an attacker who only got access to a single snapshot could exploit, so I would disagree with the conclusion you quoted. For example, an attacker could punch holes in files without being noticed, and if the filesystem was large enough could find IV collisions leaking information on plaintext.
Is EncFS good for online storage services?
I would argue that it is not. It is probably better than nothing and if only passive attackers need to be protected against it may even be secure. However, even the README points to some more modern alternatives. (Without saying EncFS is insecure or anything.)