3 ms·
GEEZ. At first I wondered "is that really the way to disclose a vulnerability?", and then I saw that the date was 2013 and it doesn't really matter at this poin
by kmfrk 11y ago
GEEZ. At first I wondered "is that really the way to disclose a vulnerability?", and then I saw that the date was 2013 and it doesn't really matter at this point.
- ausjke 11y agoIt started in 2013 but the issue persists ever since, so I think it still matters. The thing I don't get is that why can't I just aes-encrypt my file and upload somewhere for secure-backup, there is no way to break it unless you gave out your aes key.
- mappu 11y agoSo you transmitted AES(original) to the server, now what do you do when you want to update your file? Transmitting AES(updated) to the server is bandwidth-inefficient and storage-inefficient. Transmitting DIFF(AES(original), AES(updated)) gives you no filesize benefit. You can do AES(DIFF(original, updated)) but that requires your local client to have the original file, or enough of it indexed to produce the diff - and it means that restoring the latest file means restoring a giant chain of increments - which means you'll probably want to periodically reupload the original file - which is bandwidth-inefficient and storage-inefficient. You can transmit the encryption key to the server and have it rollup diffs. But that's not a good idea if you don't really trust your server (got some cheap cloud storage?) The solution to this problem is to use a deduplication algorithm like content-defined chunking, as seen in attic/restic/obnam/tarsnap.
- ausjke 11y agoLearned something new. Thanks!