Always encrypt client-sidr before upload
this post was submitted on 25 Mar 2024
63 points (94.4% liked)
Privacy
31980 readers
325 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
Would cryptomator work for that?
Cryptomator is made for that exact purpose.
I would suggest using any cloud storage provider with a third party client, that automatically encrypts your files before uploading them, ensuring the cloud provider does not have any kind of access to your keys.
I personally use gocryptfs then mirror that to B2, but IIRC rclone and some other third party alternatives have built-in pre-upload encryption options that are easier to setup and use
I asked a very similar question earlier and the consensus is to encrypt before you upload. That way you care more about reliability than privacy
Make sure you test an actual restore. A backup that cannot be restored is useless.
Absolutely. But this will likely just be media
And make sure your encryption keys are stored securely. You don't want a house fire or something to destroy your keys and your data.
What are good places to store your encryption keys? I am trying to find solutions that aren't just store a piece of paper in some security deposit box.
Some options:
- encrypted file stored on a free tier data storage (many are free for the first year)
- Tarsnap - dedups so storage is cheap; for keys, this would be pennies per month
encrypted file stored on a free tier data storage (many are free for the first year)
I am confused, aren't you just pushing the problem further up the chain? Now you need to worry about storing the key that decrypts the file storing the key you wanted to protect in the first place.
Same goes with tarsnap, now you need to worry about where to store the tarsnap keys.
You'd use a password to encrypt the keys and/or store that key in your password manager.
Multiple pen-drives with encrypted storage holding keys; how does that sound? Good idea?
Flash loses memory over many years. I'd use like 3 different mediums and always keep a hash of the key with the key.
As long as they're physically separated so you don't get screwed if there's a fire or something. And if you're DIY-ing, use multiple separate places (friends houses, work, etc).
I am using B2 now - I started using it before they added the encrypted buckets and am using restic to encrypt everything. It's nice because I don't really have to trust Blackblaze at this point aside from them not losing my data.
I've since additionally turned on encryption on my buckets, but as far as I know they store the key for you, so in terms of privacy it's not the best.
+1 for restic. I've been using it for four years now and have never encountered an issue, including during my yearly restore practice run.
As far as B2 bucket encryption is concerned, I wouldn't trust it as far as I can throw it. Quite honestly, it could just be a fancy checkbox on their website without any actual encryption, and we wouldn't be able to tell. Either way, a compromise of Backblaze would put your data at risk.
Use rclone crypt with any provider
does encryption/decryption take time ?
It's happening in background, you only see plain files and encrypted ones getting uploaded. It's seamless
This is what I am doing to offsite backup my files. B2 has great pricing!
If you encrypt your data before uploading it to B2 you should be fine. Unless you run it yourself on your own server, you can't be sure that your data will be unreadable by anyone poking around unless it's encrypted.
I've been using B2 for my offsite backups for a couple of years now (since 2018), and both Duplicity and Restic encrypt data before shipping it over. I wrote about it here.
I figure I'll ask here instead of making a new post:
Does anyone know of any storage services that accept anonymous payment (cash, Monero, etc) and don't associate with an account? I'm willing to pay a premium since it would only be for a relatively small amount of data (mostly keys and whatnot). Bulk, uninteresting data would be encrypted and stored on a less expensive host like Backblaze or whatever.
Find a trusted friend
Put a server with them
Encrypt en route and at rest.
None that I know of. https://rsync.net seems to do a lot less data sharing than Backblaze, though, after having read both their privacy policies.
It's an interesting idea. I suppose you're thinking of something like what Mullvad VPN does with their physical pre-paid cards? You buy a card, that provides you an account number, and you're good to go?
Yup, pretty much. I wouldn't even mind if it was hosted at a place like Backblaze and just resold, like Bitlaunch does for servers.