How I encrypt my data in the cloud • Hacker News Board

Re: How I encrypt my data in the cloud

#41

Post by misterdata » Sat, Jul 06, 2019, 10:28 AM UTC

I have been running Resilio Sync [1] (formerly BitTorrent Sync) for a while now, it also supports an 'encrypted peer' and has support for all the major platforms.

[1] https://www.resilio.com

Re: How I encrypt my data in the cloud

#42

Post by reacharavindh » Sat, Jul 06, 2019, 10:29 AM UTC

Fnoord wrote: post #34

I use Nextcloud on Synology with WebDAV. It is encrypted on the filesystem level. Then I use a bunch of free cloud providers (including TransIP STACK who gave 1 TB for free at some point) together with Cryptomator [1] which is a cross-platform (Windows, Linux, macOS, Android, and Cyberduck/Mountainduck also support it) Java program. The advantage of it, is it abstracts the filesystem and WebDAV. So you see the decryp…

I just tried boxcryptor in my Ubuntu Workstation. It was burning through 40%+ CPU on all 4 cores while it is not being actively used! Don't know if it is a simple bug or just designed without an eye for resource usage.

On the other hand, I ended up learning about scrypt(written by Collin Percival, who works on FreeBSD a lot and runs Tarsnap), and restic which in layman's view appears to be a better borg.

Re: How I encrypt my data in the cloud

#43

Post by imiric » Sat, Jul 06, 2019, 10:31 AM UTC

I wouldn't trust a closed-source tool like Boxcryptor for encryption of sensitive data. Cryptomator looks interesting, though it's still a relatively new tool, and I'd be hesitant to rely on it.

For my personal backups I use a combination of tar, pixz, and GnuPG. There's no fancy deduplication, and it's definitely not efficient, but it's relatively simple and I can restore individual files with ease.

I run a variation of the following command occasionally:

  tar -C / \
    --exclude='dev/*' \
    --exclude='home/*/.cache' \
    --exclude='lost+found' \
    --exclude='mnt/*' \
    --exclude='proc/*' \
    --exclude='run/*' \
    --exclude='sys/*' \
    --exclude='tmp/*' \
    --exclude='var/cache/*' \
    --exclude='var/lib/docker*' \
    -cvf - . | pixz | gpg2 -e -r $PGPID \
    | ssh host 'cat > /backup/root.tpxz.gpg'

Then I generate an encrypted index file for quick lookups, create checksum and PAR2 repair files, and upload all of it to Wasabi, while keeping a local copy.

Wasabi may not be the cheapest storage solution, but they have no egress charges, which makes recovery a non-issue. Good speeds and S3 compatibility are also great. Don't want to run an ad for them, just a happy customer.

Re: How I encrypt my data in the cloud

#44

Post by burmecia » Sat, Jul 06, 2019, 10:31 AM UTC

viraptor wrote: post #28

burmecia wrote: post #10

I think the best approach is never save unencrypted data on cloud. Always encrypted on client first. But by that way we lost dedup capability, so we have to do everything, such as encryption, dedup and compression on client side. I made an in-app file system dedicated for that purpose. https://github.com/zboxfs/zbox

> But by that way we lost dedup capability This depends on how secret do you want your data to be. You could use block-based encryption/compression and backup. That way you can still dedup encrypted result. If anyone can inject data into your system and monitor the backup, they could learn when they hit collisions, but for most personal backup cases that's irrelevant.

I don't think the encrypt-then-dedup is a safe way to protect data privacy. In this case, identical blocks need to produce same cipher text, this will actually leak your data pattern even though it is encrypted. A better way I think is using randomly-seeded derived keys to encrypt each block, thus the identical blocks' cipher text will always be different.

Re: How I encrypt my data in the cloud

#45

Post by kreetx » Sat, Jul 06, 2019, 10:39 AM UTC

reacharavindh wrote: post #42

Fnoord wrote: post #34

I use Nextcloud on Synology with WebDAV. It is encrypted on the filesystem level. Then I use a bunch of free cloud providers (including TransIP STACK who gave 1 TB for free at some point) together with Cryptomator [1] which is a cross-platform (Windows, Linux, macOS, Android, and Cyberduck/Mountainduck also support it) Java program. The advantage of it, is it abstracts the filesystem and WebDAV. So you see the decryp…

I just tried boxcryptor in my Ubuntu Workstation. It was burning through 40%+ CPU on all 4 cores while it is not being actively used! Don't know if it is a simple bug or just designed without an eye for resource usage. On the other hand, I ended up learning about scrypt(written by Collin Percival, who works on FreeBSD a lot and runs Tarsnap), and restic which in layman's view appears to be a better borg.

This is really weird, what might it be doing?

Re: How I encrypt my data in the cloud

#46

Post by petronio » Sat, Jul 06, 2019, 10:41 AM UTC

misterdata wrote: post #41

I have been running Resilio Sync [1] (formerly BitTorrent Sync) for a while now, it also supports an 'encrypted peer' and has support for all the major platforms. [1] https://www.resilio.com

I also use Resilio Sync for distributing backups with encrypted peers, but I use Borg to backup into the folder for compression, de-duplication, and really easy PIT recovery. I've also added rdiff-backup on one of the encrypted peers in case the write host gets hit with ransomware and the backup overwritten.

Re: How I encrypt my data in the cloud

#47

Post by pnutjam » Sat, Jul 06, 2019, 10:58 AM UTC

amelius wrote: post #38

sandGorgon wrote: post #5

Or use Tarsnap.com - Online backups for the truly paranoid

It uses content-dependent splitting of blocks (for deduplication), and I'm too paranoid to accept that block-sizes will not reveal anything about my stored data. https://www.tarsnap.com/download/EuroBSDCon13.pdf

Try cryFS. https://www.cryfs.org/

Re: How I encrypt my data in the cloud

#48

Post by pnutjam » Sat, Jul 06, 2019, 11:00 AM UTC

noisy_boy wrote: post #16

I used to put my data on dropbox but I'm increasingly not comfortable putting my personal data on devices out of my control. Now I just do a daily local rsync backup. I also use syncthing to keep the documents, music and photos in sync between my laptop and phone (with all that, my phone's 128GB storage is less than 60% utilized).

I sync to a homeserver and back that up with Borg using a time4vps storage server.

Re: How I encrypt my data in the cloud

#49

Post by kayoone » Sat, Jul 06, 2019, 11:00 AM UTC

imiric wrote: post #43

I wouldn't trust a closed-source tool like Boxcryptor for encryption of sensitive data. Cryptomator looks interesting, though it's still a relatively new tool, and I'd be hesitant to rely on it. For my personal backups I use a combination of tar, pixz, and GnuPG. There's no fancy deduplication, and it's definitely not efficient, but it's relatively simple and I can restore individual files with ease. I run a variatio…

i guess a main point for Boxcryptor is easy access through mobile apps, does your solution provide that?

Re: How I encrypt my data in the cloud

#50

Post by pnutjam » Sat, Jul 06, 2019, 11:01 AM UTC

brian_herman__ wrote: post #9

I’ve heard getting your data recovered from a Synology nas is difficult if not impossible

That's true with any hardware level raid. Do raid in software or better yet, use btrfs.