Live data from Hacker News

How I encrypt my data in the cloud

robertclarke.com

31–40 of 100 posts

Re: How I encrypt my data in the cloud

#33

I think the best approach is never save unencrypted data on cloud. Always encrypted on client first. But by that way we lost dedup capability, so we have to do everything, such as encryption, dedup and compression on client side. I made an in-app file system dedicated for that purpose. https://github.com/zboxfs/zbox

> But by that way we lost dedup capability This depends on how secret do you want your data to be. You could use block-based encryption/compression and backup. That way you can still dedup encrypted result. If anyone can inject data into your system and monitor the backup, they could learn when they hit collisions, but for most personal backup cases that's irrelevant.

if you encrypt in a way that enables the service to do dedupe, you are either reusing IVs and encryption keys across items (bad) and leaking information that two items are the same item.

Re: How I encrypt my data in the cloud

#34
I use Nextcloud on Synology with WebDAV. It is encrypted on the filesystem level.

Then I use a bunch of free cloud providers (including TransIP STACK who gave 1 TB for free at some point) together with Cryptomator [1] which is a cross-platform (Windows, Linux, macOS, Android, and Cyberduck/Mountainduck also support it) Java program. The advantage of it, is it abstracts the filesystem and WebDAV. So you see the decrypted data on a separate filesystem layer, allowing all your normal applications to work. It is also FOSS and gratis.

Is it the best option? I don't know. I like the mentioned advantages. I've never used Arq, for example, but it not working on Linux and Android is a dealbreaker for me.

As for cold wallets, quoting the article:

> Offline wallets are the best way to go for storing a larger amount of cryptocurrency. I use ColdTi wallets to store multi-sig private keys. ColdTi is essentially just a slab of titanium that comes up with a punch set that can be used as a fire-proof seed backup. Very handy :)

These are useless in a case of fire.

[1] Already mentioned multiple times in other posts at the time I wrote this. https://cryptomator.org

Re: How I encrypt my data in the cloud

#35

I think the best approach is never save unencrypted data on cloud. Always encrypted on client first. But by that way we lost dedup capability, so we have to do everything, such as encryption, dedup and compression on client side. I made an in-app file system dedicated for that purpose. https://github.com/zboxfs/zbox

> But by that way we lost dedup capability This depends on how secret do you want your data to be. You could use block-based encryption/compression and backup. That way you can still dedup encrypted result. If anyone can inject data into your system and monitor the backup, they could learn when they hit collisions, but for most personal backup cases that's irrelevant.

Turning two blocks of cleartext with the same content into equal blocks of cyphertext is not great for encryption: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation...

Re: How I encrypt my data in the cloud

#36

"$4 per TB/month" so 16 X 12 = $192+tax not a insignificant amount even in a first world country and probably a deal breaker for people living in poorer countries.

Note that AWS offers archival storage for $1/TB-month and Google has promised $1.23/TB-month later this year. These prices are competitive with raw storage, so the alternative is to go without backup.

Re: How I encrypt my data in the cloud

#38

Or use Tarsnap.com - Online backups for the truly paranoid

It uses content-dependent splitting of blocks (for deduplication), and I'm too paranoid to accept that block-sizes will not reveal anything about my stored data.

https://www.tarsnap.com/download/EuroBSDCon13.pdf

Re: How I encrypt my data in the cloud

#39

"$4 per TB/month" so 16 X 12 = $192+tax not a insignificant amount even in a first world country and probably a deal breaker for people living in poorer countries.

Note that AWS offers archival storage for $1/TB-month and Google has promised $1.23/TB-month later this year. These prices are competitive with raw storage, so the alternative is to go without backup.

Do you have a link for the AWS 1/TB-month and Google? I'm interested.
Post reply on HN