Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I encrypt my data in the cloud

robertclarke.com

Post reply on HN
Print view View original

51–60 of 100 posts

Re: How I encrypt my data in the cloud

#51

Post by russfink »

imiric wrote: post #43

I wouldn't trust a closed-source tool like Boxcryptor for encryption of sensitive data. Cryptomator looks interesting, though it's still a relatively new tool, and I'd be hesitant to rely on it. For my personal backups I use a combination of tar, pixz, and GnuPG. There's no fancy deduplication, and it's definitely not efficient, but it's relatively simple and I can restore individual files with ease. I run a variatio…

I never heard of pixz... cool! For anyone else like me, this comparison is worth a read: https://www.rootusers.com/gzip-vs-bzip2-vs-xz-performance-co...

Re: How I encrypt my data in the cloud

#52

Post by sreitshamer »

m0zg wrote: post #37

I just do Backblaze with a client-side key. Cheap and effective. I do wish they had a Linux daemon client. I'd pay more for that.

FYI, to restore your files with Backblaze, you'll have to give them your key. They then decrypt your files and leave them in an unencrypted zip file on their servers for you to download.

Re: How I encrypt my data in the cloud

#53

Post by imiric »

kayoone wrote: post #49
imiric wrote: post #43

I wouldn't trust a closed-source tool like Boxcryptor for encryption of sensitive data. Cryptomator looks interesting, though it's still a relatively new tool, and I'd be hesitant to rely on it. For my personal backups I use a combination of tar, pixz, and GnuPG. There's no fancy deduplication, and it's definitely not efficient, but it's relatively simple and I can restore individual files with ease. I run a variatio…

i guess a main point for Boxcryptor is easy access through mobile apps, does your solution provide that?

Accessing backups via Termux and SSH on Android is easy enough for me, but certainly not user friendly in the popular sense.

Though I'm OK with trading some usability features for security and peace of mind.

Re: How I encrypt my data in the cloud

#54

Post by FigmentEngine »

liquid9 wrote: post #39
votepaunchy wrote: post #36

Earlier quoted context omitted.

Note that AWS offers archival storage for $1/TB-month and Google has promised $1.23/TB-month later this year. These prices are competitive with raw storage, so the alternative is to go without backup.

Do you have a link for the AWS 1/TB-month and Google? I'm interested.

"S3 Glacier Deep Archive This new storage class for Amazon Simple Storage Service (S3) is designed for long-term data archival and is the lowest cost storage from any cloud provider. Priced from just $0.00099/GB-mo (less than one-tenth of one cent, or $1.01 per TB-mo), the cost is comparable to tape archival services. Data can be retrieved in 12 hours or less, and there will also be a bulk retrieval option that will allow you to inexpensively retrieve even petabytes of data within 48 hours." https://aws.amazon.com/about-aws/whats-new/2019/03/S3-glacie...

Re: How I encrypt my data in the cloud

#55

Post by diafygi »

imiric wrote: post #43

I wouldn't trust a closed-source tool like Boxcryptor for encryption of sensitive data. Cryptomator looks interesting, though it's still a relatively new tool, and I'd be hesitant to rely on it. For my personal backups I use a combination of tar, pixz, and GnuPG. There's no fancy deduplication, and it's definitely not efficient, but it's relatively simple and I can restore individual files with ease. I run a variatio…

Isn't this basically what Duplicity does? It uses GPG to encrypt files before sending them to the remote server.

https://www.nongnu.org/duplicity/

Re: How I encrypt my data in the cloud

#56

Post by GordonS »

xchaotic wrote: post #31

"$4 per TB/month" so 16 X 12 = $192+tax not a insignificant amount even in a first world country and probably a deal breaker for people living in poorer countries.

4TB is a lot of personal data - $192/y for that isn't cheap, but I wouldn't call it expensive either for a first world country. And I suppose syncing masses of personal data to an archive across the world is kind of a 1st world problem.

Re: How I encrypt my data in the cloud

#57

Post by viraptor »

kochthesecond wrote: post #33
viraptor wrote: post #28

Earlier quoted context omitted.

> But by that way we lost dedup capability This depends on how secret do you want your data to be. You could use block-based encryption/compression and backup. That way you can still dedup encrypted result. If anyone can inject data into your system and monitor the backup, they could learn when they hit collisions, but for most personal backup cases that's irrelevant.

if you encrypt in a way that enables the service to do dedupe, you are either reusing IVs and encryption keys across items (bad) and leaking information that two items are the same item.

You must not reuse IV between different blocks, but that does not stop you from using the same IV for the same block. Yes, you leak information about matching blocks - it's up to your use case whether you care about it.

Re: How I encrypt my data in the cloud

#58

Post by viraptor »

burmecia wrote: post #44
viraptor wrote: post #28

Earlier quoted context omitted.

> But by that way we lost dedup capability This depends on how secret do you want your data to be. You could use block-based encryption/compression and backup. That way you can still dedup encrypted result. If anyone can inject data into your system and monitor the backup, they could learn when they hit collisions, but for most personal backup cases that's irrelevant.

I don't think the encrypt-then-dedup is a safe way to protect data privacy. In this case, identical blocks need to produce same cipher text, this will actually leak your data pattern even though it is encrypted. A better way I think is using randomly-seeded derived keys to encrypt each block, thus the identical blocks' cipher text will always be different.

Yes, if that's more important to you than dedup savings, then you should definitely do that.

Re: How I encrypt my data in the cloud

#59

Post by sterwill »

diafygi wrote: post #55
imiric wrote: post #43

I wouldn't trust a closed-source tool like Boxcryptor for encryption of sensitive data. Cryptomator looks interesting, though it's still a relatively new tool, and I'd be hesitant to rely on it. For my personal backups I use a combination of tar, pixz, and GnuPG. There's no fancy deduplication, and it's definitely not efficient, but it's relatively simple and I can restore individual files with ease. I run a variatio…

Isn't this basically what Duplicity does? It uses GPG to encrypt files before sending them to the remote server. https://www.nongnu.org/duplicity/

Pretty much, and it stores additional indexes so it can do incremental backups. It supports many different storage targets, including S3, which I use.

Re: How I encrypt my data in the cloud

#60

Post by hrunt »

Perceptes wrote: post #4

I'd never heard of Boxcryptor. Does anyone else use this? I'm not sure I understand why I need to sign up for an account to use it if its entire purpose is to do client-side encryption. Also, it's not quite the same functionality, but this also reminds me: For a long time I've used Knox (by AgileBits, the same company that makes 1Password) for encrypted disk images, but they no longer sell or maintain it. It works ju…

Boxcryptor[1] started out as an EncFS[2] implementation. At the time, EncFS was the only real good solution for file-based encryption. Solutions like TrueCrypt are disk-based, which means for cloud syncing solutions like Dropbox, one file -- the entire disk volume -- gets synced, and every time a file changes, the entire disk gets synced again. EncFS encrypts individual files, which works great for file-based syncing services.

Boxcryptor offered a client for macOS, Windows, Android, and iOS that worked really well, and if you needed Linux support, one could install EncFS and use it transparently on that platform. Boxcryptor charged for a creating volumes with more advanced EncFS settings, but if you created the EncFS volume with those advanced settings using EncFS itself (e.g. on a Linux machine), the free version of Boxcryptor could read and write those volumes with those settings.

In 2013, the people who ran Boxcryptor wrote a second version that implemented a proprietary, unpublished encryption and/or file management scheme. They relegated the previous version to an unmaintained Boxcryptor Classic product and eventually removed it.[3] The proprietary version is what is offered today.

IF you want Boxcryptor-like functionality today, the EncFS4win project[4] is a good solution for Windows. EncFS can be installed via Homebrew[5] on macOS and its volumes mounted via a shell script or some FUSE GUI managers. You can install EncFS on Linux and use gencfsm[6] for a GUI manager. The Windows, macOS, and Linux implementations all use FUSE for exposing the encrypted files via a native filesystem interface. For Android, Encdroid provides an application browser for volumes. I am unaware of an iOS solution. I use the FUSE systems to keep certain sensitive cloud documents synced between my Windows, macOS and Linux machines while still being able to edit and use them like normal files on those systems.

EncFS does have a few attack vectors they have been slowly addressing. It also suffers from the same problem that all cloud-synced file-based encryption systems suffer; someone could restore your cloud files to a previous known version without your knowledge. The file-based encryption does not prevent what is in effect a replay attack. A research paper proposed a solution -- CryFS[7] -- with some solutions for this problem, but the implementation is immature.

(edited for formatting)

1. https://www.boxcryptor.com/en/

2. https://vgough.github.io/encfs/

3. https://www.boxcryptor.com/en/blog/post/6-years-of-boxcrypto...

4. https://encfs.win/

5. https://formulae.brew.sh/formula/encfs

6. https://moritzmolch.com/apps/gencfsm/

7. https://www.cryfs.org/

Post reply on HN