121–130 of 144 posts
What's the best way to encrypt files, GunPG, openssl, ccrypt, some AES256 command line utility, or some backup can do it automatically? I do want to encrypt part of my backup before upload them to the cloud.
I'm a digital nomad, and I decided I wanted to store all of my data as securely as possible without relying on Google/Amazon/Microsoft/Apple. Here's my setup, in case anyone finds it useful. I store all of my data in Nextcloud hosted on a VPS. It's virtually impossible to guarantee the security of data on a running VPS, so my sensitive data is also encrypted with Cryptomator, so I don't have to trust my VPS host (but…
Wondering something, if you are using cryptomator and a VPS - so you don't own your data and use a higher level encryption - why not using the cloud storage services (i.e Dropbox, icloud etc.) ?
First, I want to be able to use open source, audited clients that allow me to access my data in a transparent and flexible way on all of my devices. I don't want to use a closed source sync client that doesn't give me full control over how my data is synced.
Second, and more important, if you don't control your encryption keys, you don't control your data.
Storing my data on a VPS doesn't mean that I don't own it. I still have full control over it, and if the VPS disappears, I still have redundant copies.
I also have a ZFS NAS and a separate backup server for the NAS that only gets turned on once a week. I disagree about his recommendation to avoid encryption. I keep the NAS and backup server drives encrypted. It’s not a big deal to unlock the drives at boot with a password and I’ve never had any issues with it. If someone breaks in and steals one of the servers, at least they won’t have access to years of all of my d…
In the future I plan on doing something similar to what you have, with a powerful ZFS server and my current server accessing the main server using a read-only interface as a second backup. It does take work to maintain, and I don't look forward to the day when I have a full server failure and need to scramble to replace the unit, restore from backups, and all that. Ideally I would have a pair of servers to handle that eventuality... and down the rabbit hole we go.
Ultimately, I guess this all is a tradeoff - I know many engineers who swear on their cloud services, and they simply don't have the time and experience to maintain dedicated servers. While Synology devices and FreeNAS make things simpler, that's for a best-case scenario as you need the technical knowledge to deal with the issues that will eventually pop up. Honestly the cloud is what I recommend for all but the most technical folk, with the addition of external disks off-site for the most critical files.
> These tools work really great, until they don't! Huh? Whats the problem? How is ZFS any different because its lower level? > ZFS without ECC memory is no worse than any other file system without ECC memory. You really do need ECC memory unless you are ok with your pool becoming corrupt every 6 months or so. Im just saying this from my experience of running a ZFS server without ECC, the data wasn't critical so I lef…
I've run ZFS for quite a few years now on laptops and lower-end machines that can't use ECC memory and I've never had corruption, unrecoverable files/pools, etc.
https://jrs-s.net/2015/02/03/will-zfs-and-non-ecc-ram-kill-y...
>Not only does encryption during data recovery make everything much more difficult, but should you pass away, your family members might not have the skills required to access the data Uh, trust me, that's a good thing.
If I can't delete my browsing history before I pass on, you bet your bottom dollar I'm not letting my family have my keys!
Earlier quoted context omitted.
How common an occurence is that? How often is an unimportant, middle class person's data at risk, really? Enough that you'd want to spin up your ZFS storage? Hypothetically, let's say I had my entire life on Google. I have a unique password for it, backed up by 2FA, without the SMS/Authenticator fallback. What's the long term consequence? Google knows everything about me? They already do anyway. Someone can steal my…
Everyone has their own opinions on this and their own threat vectors for their own personal situation. The following is my opinion based on my own situation which I believe to apply to the average person: I think it is safe to assume that Google does some sort of data mining on the data you upload. If that bothers you, self hosting everything isn't your only option -- you can also encrypt everything before uploading…
[1] https://twitter.com/demilogic/status/1358661840402845696?lan...
> These tools work really great, until they don't! Huh? Whats the problem? How is ZFS any different because its lower level? > ZFS without ECC memory is no worse than any other file system without ECC memory. You really do need ECC memory unless you are ok with your pool becoming corrupt every 6 months or so. Im just saying this from my experience of running a ZFS server without ECC, the data wasn't critical so I lef…
I stored 2tb of actively used data on zfs without ecc ram from freebsd 8 to 12. I had no noticeable corruption. I only post this because there is a weird assumption that not using ecc ram is a death sentence for your zfs data. I use ecc ram now and I think it's the proper way to do zfs, but let's not pretend you forfeit your data by not using ecc.
But from all filesystems ZFS works best of all when you do not have ECC RAM.
The 'requirement' that ZFS needs ECC RAM to work properly is one of the biggest myths of the Internet ...
Earlier quoted context omitted.
Got it. So perhaps after the Duplicity files have been incrementally uploaded to the remote datacenter, for the cold storage backup of those files rather than simply duplicating the Duplicity files I should unpack them and then rearchive them into a single flat encrypted archive.
>>I should unpack them and then rearchive them into a single flat encrypted archive. Which is a duplicity full back up (that one would normally do once a month or so). Deduplication is an additional potential point of failure.
Wrong. Not encrypting your backups when your daily use systems are encrypted makes no sense. Seriously. Why go through the hassle of figuring out a password, when one can steal the unencrypted off site backup?
You want simple encryption? Me too! Use dm-crypt/LUKS. It's been in every modern Linux distro for at least 10 years. If you can plug your encrypted external drive into a live/freshly installed Linux desktop and a encryption prompt comes up, you're in luck!