How I encrypt my data in the cloud • Hacker News Board

Re: How I encrypt my data in the cloud

#81

Post by joyjoyjoy » Sat, Jul 06, 2019, 3:35 PM UTC

pella wrote: post #75

joyjoyjoy wrote: post #73

I found it extraordinary difficult to build your own encrypted cloud. Options: 1. Truecrypt container. CON: Upload takes to long 2. ecryptfs CON Always had problems getting it to work. AFAIK it is not under current development anymore. 3. Run a FS in a mounted contaner (Filesystem in a FILE). Slow. Not very stable. Under no circumstance use ext4 or something like it, if you really want to try this, use ZFS to avoid d…

> 4. CryptFS. Great Idea but slow as "CryFS solves all of these issues, but because of the increased security it is a bit slower. It is also a very new project and currently only available for Linux and Mac, but has experimental Windows support in the newest version. So if you don't need Windows support today, you can give it a try." https://www.cryfs.org/comparison/

I tried. I have a 100MBit line. With no encryption I have a very good speed. To get things working I came down to 1% or somethings and very sluggish.

I also remember that my internet provider blocks many ports and I had to use my VPN to get required ports to working. This again scaled things down a little. I found CryFS not usable on Linux

Re: How I encrypt my data in the cloud

#82

Post by plg » Sat, Jul 06, 2019, 3:46 PM UTC

Arq? I know it’s Mac specific. What about an Arq -> google-cold-storage solution?

Re: How I encrypt my data in the cloud

#83

Post by imiric » Sat, Jul 06, 2019, 3:54 PM UTC

C14L wrote: post #74

imiric wrote: post #43

I wouldn't trust a closed-source tool like Boxcryptor for encryption of sensitive data. Cryptomator looks interesting, though it's still a relatively new tool, and I'd be hesitant to rely on it. For my personal backups I use a combination of tar, pixz, and GnuPG. There's no fancy deduplication, and it's definitely not efficient, but it's relatively simple and I can restore individual files with ease. I run a variatio…

I used to do it this way too, but recently switched to `encfs` and simply sync the encrypted directories. So only modified files (with encrypted filenames and content) are sync'ed.

Interesting, though that wouldn't work for off-site / cloud backups, unless you could upload the encrypted EncFS volume somehow, or don't mind leaking some file information to your storage provider if you're uploading the underlying encrypted filesystem as-is.

I use EncFS for other purposes, but be aware of its security issues[1]. This report was influenced by the founder and CTO of Boxcryptor, so I'd take it with a grain of salt, but I'd still avoid using EncFS for any important data.

[1]: https://defuse.ca/audits/encfs.htm

Re: How I encrypt my data in the cloud

#84

Post by unethical_ban » Sat, Jul 06, 2019, 4:03 PM UTC

joyjoyjoy wrote: post #73

I found it extraordinary difficult to build your own encrypted cloud. Options: 1. Truecrypt container. CON: Upload takes to long 2. ecryptfs CON Always had problems getting it to work. AFAIK it is not under current development anymore. 3. Run a FS in a mounted contaner (Filesystem in a FILE). Slow. Not very stable. Under no circumstance use ext4 or something like it, if you really want to try this, use ZFS to avoid d…

That is why I like ZFS: Its send/recv function can do block level syncing, so while the first upload will take a while, subsequent syncs will be much smaller.

Of course, unless you stand up your own VM with a ZFS partition, there are few cloud options for ZFS.

Re: How I encrypt my data in the cloud

#85

Post by trulyrandom » Sat, Jul 06, 2019, 4:09 PM UTC

StavrosK wrote: post #32

I use Borg and rsync.net [1]. I recently switched to Restic which is pretty much the same as Borg but doesn't need a corresponding server, it can back up to dumb storage. It's been going well, I think I prefer it to Borg. [1] https://www.stavros.io/posts/holy-grail-backups/

You can also use sshfs in combination with borg to eliminate the need for the server to support borg.

Re: How I encrypt my data in the cloud

#86

Post by eeeeeeeeeeeee » Sat, Jul 06, 2019, 4:19 PM UTC

tdurden wrote: post #7

Arq [1] works very well for me, it is compatible with various cloud providers as well as personal servers. 1. https://www.arqbackup.com/

I have been using Arq for years and it has saved me numerous times. I backup to Amazon Drive, which is about $60/year, but it supports most of the major object store providers.

Re: How I encrypt my data in the cloud

#87

Post by eeeeeeeeeeeee » Sat, Jul 06, 2019, 4:21 PM UTC

xchaotic wrote: post #31

"$4 per TB/month" so 16 X 12 = $192+tax not a insignificant amount even in a first world country and probably a deal breaker for people living in poorer countries.

That's a fairly normal price. I pay $60/year for Amazon Drive, which has a 1TB limit (no charge for data transfer), that I don't even come close to approaching.

Re: How I encrypt my data in the cloud

#88

Post by willtim » Sat, Jul 06, 2019, 4:44 PM UTC

I've been working on my own encrypted and de-duplicated backup solution using libsodium. It's early days and progress is slow with limited spare time, but it works well enough for my own use already. I wanted to avoid any closed source or even lesser-used open-source encryption.

https://github.com/willtim/Atavachron

Re: How I encrypt my data in the cloud

#89

Post by StavrosK » Sat, Jul 06, 2019, 4:46 PM UTC

trulyrandom wrote: post #85

StavrosK wrote: post #32

I use Borg and rsync.net [1]. I recently switched to Restic which is pretty much the same as Borg but doesn't need a corresponding server, it can back up to dumb storage. It's been going well, I think I prefer it to Borg. [1] https://www.stavros.io/posts/holy-grail-backups/

You can also use sshfs in combination with borg to eliminate the need for the server to support borg.

That doesn't work as well because borg needs fast local access to the files in order to do deduplication etc. If you use SSHFS, it's going to be much slower, IIRC.

Re: How I encrypt my data in the cloud

#90

Post by hedora » Sat, Jul 06, 2019, 5:07 PM UTC

imiric wrote: post #83

C14L wrote: post #74

Earlier quoted context omitted.

I used to do it this way too, but recently switched to `encfs` and simply sync the encrypted directories. So only modified files (with encrypted filenames and content) are sync'ed.

Interesting, though that wouldn't work for off-site / cloud backups, unless you could upload the encrypted EncFS volume somehow, or don't mind leaking some file information to your storage provider if you're uploading the underlying encrypted filesystem as-is. I use EncFS for other purposes, but be aware of its security issues[1]. This report was influenced by the founder and CTO of Boxcryptor, so I'd take it with a…

My cursory audit of encfs (not written up) revealed that, if you use it in the natural way for backup (reverse mount an unencrypted directory, and rsync the virtual, encrypted file system that exposes), then it does not use per-file salt, so each file with the same contents is encrypted to the same ciphertext.

This was years ago. It might be fixed.