7 ms·

Backblaze: to decrypt your backup, send us your private key passphrase

31 points by noja 10y ago

tyingq 10y ago
The title is obviously editorialized and making a statement of some sort. But the linked page is a long FAQ that seems reasonable after a cursory read. It's not the ideal setup for everyone, but they don't seem to be hiding anything. What am I missing here?
- nailer 10y ago
  They should provide the encrypted backup to you, you decrypt it yourself. Backblaze should never see your unencrypted data.
  - tyingq 10y ago
    They seem to be saying it's not that way because their customer base is more aligned around convenience. So it's structured where they can't see your data.... until/unless you need a restore. Is there another well known service that does this completely right? (honest ask, not a challenge) Edit: sounds like there isn't anything in their budget price range that does it well either. Sounds like it should be a goal to provide it, but hard to fault them too hard.
    - throw_away 10y ago
      https://www.tarsnap.com/ https://www.tarsnap.com/ It's weird that they would go through all this other effort and then have this obvious fail right at the end. Sure, I understand convenience for, say, a web UI or a mobile interface maybe, but it's really odd that they wouldn't have implemented the obvious, client-side-only version first.
    - LeoPanthera 10y ago
      I backup to rsync.net, which is basically dumb storage. I use borg, which dedupes/compresses/encrypts, and then uploads.
    - rocqua 10y ago
      Tarsnap is a service known for being done right. It's build by the former security officer of freeBSD. It's fully aimed at power-users though. I'm sure all of my family would be more secure on backblaze because they couldn't set up tarsnap right. For myself though, I use tarsnap.
      - shawkinaw 10y ago
        By my math, Tarsnap is about 10x too expensive for my usage. The $5/mo I pay for Backblaze would get me 20 GB of storage on Tarsnap and no bandwidth, that's pretty poor.
        rocqua 10y ago
        Back when I decided, backblaze didn't work nicely with headless linux. If that changed I might consider changing. Currently I only use it to back-up the non-huge parts of my home directory and /etc. This keeps costs reasonable to me. I know these prices are pretty close to the actual cost of storage, which is amazon S3. I suppose backblaze can do better by handling their own storage.
        cookiecaper 10y ago
        There are lots of options to store to most cloud backends nowadays. Check out rclone and duplicity.
      - cryptarch 10y ago
        It doesn't really help if you have multiple terrabytes of data, $250-$1000/month for 1-4TB is definitely a no-go for me...
  - alkonaut 10y ago
    That should be an option at least. I.e. "warning with this option you are responsible for the key, rather than trusting it to us with a password". I wouldn't want to be responsible for safeguarding the key to my own data if I could help it though. Or put another way: The whole reason I'm using cloud backup is because I can't be trusted with important data.
  - raverbashing 10y ago
    Yes, but this is not the service they provide If this is not sufficient, then don't use the service. It's that simple It's funny how they have to keep answering questions about this when this is not how they do stuff. They focus on easy of use. If a person is not happy with the way they do stuff then they're free to GPG stuff and upload it to wherever they think is best.
    - developer2 10y ago
      The reason people are taken aback by their service is that if they're going to store the private key on the server, then they shouldn't even be using client-side encryption to send the backups in the first place. It doesn't provide an additional layer of security to use asymmetric crypto the way they are using it. So why do they have it at all? To make their service sound more secure than it really is. The service is essentially using false advertising to trick nontechnical users, and that is what turns people off. You either use private keys that remain with the client, or you don't use asymmetric crypto in the first place. They're trying to mix security with convenience by eliminating the security aspect, leaving only convenience with a false sense of security.
      - tyingq 10y ago
        Some people are taken aback. I can see their dilemma. Lots of clients are probably backing up the same PC where the key would be if they used "private keys that remain with the client". Then, they would have to deal with the blowback there when the most common scenario where a restore is needed happens. A backblaze customer's drive is dead/wiped/whatever. Right when the user needs their files back, the same drive(s) that were lost also has the private key. It seems like a reasonable solution given that constraint, and that their demographic is people wanting a cheap solution. Security isn't pushed on their front page at all really. I'd agree with your comments if they were leading with a "super secure" message. Their setup appears secure other than restoral, and you get to make the choice at that point to weigh the risk. You also have the choice of not setting a pass phrase, but encrypting your own data before upload if you want.
        10y ago
2bluesc 10y ago
Currently to restore your data you need to provide your private key: > As you prepare a restore, you must type in your private passphrase into the restore server. Seems like a pretty fundamental architecture fail here. Later the site goes on to acknowledge this: > We actually want to improve this to provide a password encrypted ZIP file for download, and then the FINAL improvement is to actually allow you to download the private encryption key, download the encrypted files, and provide the pass phrase in the privacy of your computer. We hope to add this functionality in the future.
- cryptarch 10y ago
  > ZIP Are they serious? Security conscious users a) still have to give up an encrypted copy of their private key, ripe for cracking, and b) they are supposed to download all their terrabytes of data in zip form, presumably over HTTP with no resume option? Smh...
  - mrchucklepants 10y ago
    They state the downloads are sent over HTTPS. They also have a downloader that allows for resumable downloads [1]. [1] https://help.backblaze.com/hc/en-us/articles/217665908-How-to-Use-the-Backblaze-Downloader-Mac- https://help.backblaze.com/hc/en-us/articles/217665908-How-t...
  - loeg 10y ago
    Additionally, zip password security (non-AES) is known to be poor. (And AES encrypted zip isn't widely supported.)
  - atYevP 10y ago
    Yev from Backblaze here -> The .zip option is the fastest way for folks to get their data back quickly - it's downloaded over HTTPS and we have a Downloader (which can restart interrupted downloads [browsers can only do so much] if they are larger). Folks with A LOT of data to restore usually opt for a USB Flash Key or a USB Hard Drive restore - which is sent, encrypted, via FedEx. Usually that one is used for complete system failures or recoveries.
Neliquat 10y ago
A suprising oversight, but I have noticed in the heat of the moment few customers care. Without friction, the incentive is not there, given all the fires they likely fight 24/7. Looks like someone just gave them incentive. Hopefully an opprotunity to address this and look good, backblaze has always seemed better at the (tech) public facing game than most.
- cookiecaper 10y ago
  It's not really an oversight. There's just not a good option that normal people will actually use. You could have the keyfile exist only on the consumer's computer, but then when their computer crashes, the exact reason they installed Backblaze, they aren't going to be able to access it. You could tell them to make a copy of the keyfile and store it in a safe deposit box at their local bank, but that's an additional recurring cost for the box and an additional time cost, and what if they can't get to the box when they need to restore? etc. This is one of those situations where security and convenience are diametrically opposed. If Backblaze doesn't keep a copy of your keyfile and you didn't complete steps B-D to make and keep a secure backup, you're screwed. Most consumers are better off trusting Backblaze to keep that data safe for them. You could say that they should offer this as a secondary mode of operation, but then people would say "Yes, I want the most security possible! Yes!" and then they'd sing quite a different tune when they get their backups back and can't actually use them, and Backblaze already has enough problems with their customer service dept. If you want full client-side encryption, use B2 and hook up something like duplicity to automatically difference and encrypt your files before you upload them.
timcederman 10y ago
BackBlaze's lax approach to security and unreasonable requests for what data I should provide for them to debug a bug in their client is why I switched to CrashPlan. (said bug also caused me to exhaust my 1TB Comcast cap several months in a row, BackBlaze was unresponsive and unapologetic throughout the whole process)
- cryptarch 10y ago
  Do you happen to know if CrashPlan's encryption is any better? AFAIK AES in CBC-mode is a no-no because it betrays which blocks of data are identical, and that's what BlackBlaze uses.
  - timcederman 10y ago
    Without inspecting the system, hard to say for sure, but on paper it's much better. https://support.code42.com/CrashPlan/4/Configuring/Security_Encryption_And_Password_Options https://support.code42.com/CrashPlan/4/Configuring/Security_... I really liked the fact that I could set my own key too.
  - rocqua 10y ago
    That is not the case. That would be ECB mode. CBC stands for cipher-block-chaining. Where you xor the plaintext with the ciphertext of the last block before encryption specifically to prevent identical blocks from yielding identical ciphertext. There are some issues with CBC regarding the fact that it can't really be parralelized. It also lacks authentication as opposed to the newer GCM mode. In general though, AES-256 CBC is essentially THE standard best practice proven form of encryption.
    - cryptarch 10y ago
      Oh, thanks for the info, I mixed those up.
- cookiecaper 10y ago
  Backblaze has repeatedly refused to add something as simple as pagination to their B2 web interface, a feature that takes less than an hour to implement and which most people would not dream of going live without, and their support people are terse and uncooperative. I've more or less stopped using them for this reason. They have a lot of employees who read HN and I'm sure they're cool guys, but I think they really need to reconsider their performance in customer experience.
hackerhasid 10y ago
i don't understand why they went through all this trouble of encrypting things client-side if they're just going to store the private key on their own servers! what actual benefit is there to this service? the fact that data is encrypted in-transit? i assume every backup provider does that via https/etc!
- rocqua 10y ago
  The private key can be encrypted by a password, presumably this encryption is done client-side. This means the data is also secure in their datacentre at rest. That is, until you provide backblaze with your password to actually access your data. Essentially, until you need the data that is backed-up, no-one can get to it.
  - jlgaddis 10y ago
    My SSH keys are also protected by a passphrase, but you certainly won't find me uploading them to the Internet.
    - rocqua 10y ago
      If it uses pbkdf2 with sufficient rounds and a decent password (say 5 words from diceware) it should be perfectly safe to upload the keys. Better to keep them offline and keep ownership of the key as a second factor certainly, but encrypted keys can be a fully acceptable single factor.
rocqua 10y ago
BackBlazes stand on this, from the link: Question: I Don't Trust You, but I am Expecting an Honest Answer. "If I opt to password-protect my private key, are BackBlaze servers still able to decrypt my data? (For instance, by sending the password to the server where my private key is stored and decrypting the private key on the server) Or is my data only able to be decrypted on the client?" Answer: ABSOLUTELY NOT. Once the password is set do not forget it, there is no way to recover it. Once protected by a private encryption key Backblaze can only decrypt the backup files when the user supplies the password. This is done during the restore process and the supplied password is never saved on our systems, although never to disk, only to RAM. What it Comes Down to is Trust, but, Unfortunately, I Just Can't Trust You. "Having the private key outside my computer is unacceptable. The unfortunate thing is that I can't trust you. I'm not allowed to trust you. So, I guess my question is why do I have to? It makes most sense that I shouldn't -have- to trust you..." I understand. What you are describing is conceptually perfect and provably more secure than what Backblaze provides , unfortunately it is not easy to use. Backblaze focuses on ease of use. It is backup for people who need backup and "pretty good security" and who aren't computer professionals. It is not a perfect choice for all users on earth, you are unfortunately outside our scope. Take our default security model -> it is about as secure as a Facebook account. It uses a username and password. You can recover (reset) your password if you have access to your email. That mode is good for many, many people on earth, people who have pictures of their children they don't want to lose. Music they would rather not repurchase. And a few Quicken docs that they would not like a malicious person to have, but they will not DIE if somebody reads them. And it's SUPER convenient to recover their password. What a great system! Our second level is really, really much more secure. You cannot recover the password to access to your email account does not give you access to the backup, and even a malicious hacker in our datacenter could not possibly compromise your data. Now while it is more secure, it is also harder to use -> if you forget that password you have actually lost the backup, your wedding photos are gone forever. That's very secure, but it's not as secure as what you describe. We stand by our reputation as trustworthy, careful programmers who have worked in the security field for over a decade. You can check us out on LinkedIn, through colleagues that have worked with us, through the publicly traded companies that have acquired our companies in the past. Here is our team page: https://www.backblaze.com/team.html https://www.backblaze.com/team.html We live and work in Silicon Valley, we've been here for 20 years, and we plan to keep doing this for a long, long time, and therefore we have LOTS of interest in keeping our reputations rock solid and utterly clean. Previously we fought phishing fraud, fought email viruses, and fought spam at a company called MailFrontier. We are totally customer focused and all around good people, ask ANYBODY. If you come here to our offices, I'll buy you a cup of coffee.
brianwski 10y ago
Brian from Backblaze here, glad to answer any questions. To clarify, Backblaze produces four different products/modes for different customers with different needs and requirements. We want customers to choose what is appropriate for them. One size does not fit all: 1) Online Backup ($5/month) where every file is encrypted on your laptop BEFORE being sent to Backblaze and your backup is secured by your username/password - where you can recover your password if you have access to your email account. (We support two-factor auth which provides an additional optional layer of protection.) 2) Online Backup ($5/month) where every file is encrypted on your laptop BEFORE being sent to Backblaze and your backup is secured by your username/password AND your private encryption key is secured by a "passphrase" that is not recoverable in any way, shape, or form. (Two-factor auth is also optional here.) 3) B2 Object storage (half of 1 cent/GByte/month) where you store your file completely unencrypted, and this can be "private" (only accessible by username/password) or "totally public accessible by knowing the URL". A good application of this is serving up a web page to the public - you really WANT people to see all the contents! 4) B2 Object storage (half of 1 cent/GByte/month) where Backblaze has zero knowledge. You cannot browse your file hierarchy because Backblaze doesn't know your filenames. You cannot preview your images. You cannot recover your passwords. There is no other option other than downloading the encrypted blobs and applying whatever decryption algorithm you decided on (we have no ability to know what that is). Ok, so I think some (many?) people in the security field think that Backblaze should ONLY offer mode #4 (and maybe #3 to serve up public websites). I happen to disagree and I personally feel that products #1 and #2 are useful and appropriate for some customers. But everybody is welcome to their opinion and we want to be completely open as to what exactly is occurring and what we are offering as a service. Personally I think #2 is an excellent trade off of security vs convenience. Your data is as impervious to attack as a zero knowledge system in #4 for years upon years. Then one day your laptop is stolen or crashes and you want your files back. You want all 4 TBytes back - so you order one of our free (encrypted) USB hard drives to be FedEx'ed to your home with all your data. To kick this process off FOR THE FIRST TIME EVER you tell us your passphrase (up until this very moment it really has been zero knowledge). At this moment you are opening a window of SLIGHTLY lowered security that slams shut after a few hours. For those few hours of preparing your 4 TByte restore, if an undetected hacker had compromised the one restore server in the Backblaze data center that your job was on, that hacker could possibly get access to your files. But then the reduced security window slams shut, we NEVER write your passphrase to any disk so it has now vaporized and we do not remember it, and if a hacker hacks into our system the following day you are STILL completely impervious. But again, as long as you fully understand the implications of #3 I am COMPLETELY supportive if you instead choose #4 which is our "Zero Knowledge" offering.
CodeWriter23 10y ago
I don't understand why BackBlaze would decrypt on their premises rather than offload that processing to the client computer. I mean they've shaved every other cost in their system to the bone to achieve a low cost product for the consumer, but the one area where the rubber meets the road, they chose to incur the cost of decryption. I understand the vital convenience tradeoff of storing the private key. I might be willing to make that trade too if not for the various 'bleed vulnerabilities known and yet to be discovered, that threaten to disclose my passphrase to evil haXor$ when the time comes to transmit my passphrase to BB. And when you combine those two concepts together, it really only leads me to the conclusion that this is defective by design in order to support surveillance requests. Even ones that can only be satisfied when the user types in their PEM passphrase. Prove me wrong by implementing that so-called "FINAL improvement" noted at the end of that KB entry.
- tyingq 10y ago
  My guess is that their average customer is backing up data that's on the same drive that the keys would be on. Such that the keys would be lost in the same event that would have the customer wanting a restore . There are many ways around that, none very elegant. They picked what they felt exposed the least amount of awkwardness. Only expose a flaw in the somewhat rare case of a restoral.
  - brianwski 10y ago
    Brian from Backblaze here. > they've shaved every other cost in their system to the bone to achieve a low cost product for the consumer In addition to making sure you have a backup you can restore from, we always want Backblaze to be: 1) fast (low impact on your system performance), 2) easy, 3) inexpensive. You only focused on the inexpensive part. To be super easy, we need to be as easy as it is to sign into your Gmail account -> username and password and that is it. Then for the more security conscious (just like Gmail) we offer two factor authentication, and go even further than Gmail goes by providing the ability to set a private passphrase. > their average customer is backing up data that's on the same drive that the keys would be on This is correct. We could require the customers to remember their own private encryption key on a USB thumb drive and store it at their bank in a safety deposit box, but that would SEVERELY decrease the number of customers Backblaze has. > this is defective by design in order to support surveillance requests. Backblaze has never had a surveillance request. Plus, if you set a private passphrase we literally could not comply because we simply could not decrypt your data. We really, REALLY don't want to know what is in your backup and we take great pains to not know. Seriously, it is a liability to us to know what is in your backup. It is a liability to have the ability to decrypt your backup. You can also check out our team at https://www.backblaze.com/company/team.html https://www.backblaze.com/company/team.html and ask around about us. We have been in the same 30 mile radius in Silicon Valley for 25 years (working at Apple computer, Silicon Graphics, HP, Oracle, GE, etc), and we have been doing online backup for ten years now. We take our customer privacy VERY seriously, and our personal reputations are extremely important to us. We are the good guys and we try our best to do right by our customers.

31 points by noja 10y ago

The title is obviously editorialized and making a statement of some sort. But the linked page is a long FAQ that seems reasonable after a cursory read. It's not the ideal setup for everyone, but they don't seem to be hiding anything. What am I missing here?

nailer 10y ago
They should provide the encrypted backup to you, you decrypt it yourself. Backblaze should never see your unencrypted data.
- tyingq 10y ago
  They seem to be saying it's not that way because their customer base is more aligned around convenience. So it's structured where they can't see your data.... until/unless you need a restore. Is there another well known service that does this completely right? (honest ask, not a challenge) Edit: sounds like there isn't anything in their budget price range that does it well either. Sounds like it should be a goal to provide it, but hard to fault them too hard.
  - throw_away 10y ago
    https://www.tarsnap.com/ https://www.tarsnap.com/ It's weird that they would go through all this other effort and then have this obvious fail right at the end. Sure, I understand convenience for, say, a web UI or a mobile interface maybe, but it's really odd that they wouldn't have implemented the obvious, client-side-only version first.
  - LeoPanthera 10y ago
    I backup to rsync.net, which is basically dumb storage. I use borg, which dedupes/compresses/encrypts, and then uploads.
  - rocqua 10y ago
    Tarsnap is a service known for being done right. It's build by the former security officer of freeBSD. It's fully aimed at power-users though. I'm sure all of my family would be more secure on backblaze because they couldn't set up tarsnap right. For myself though, I use tarsnap.
    - shawkinaw 10y ago
      By my math, Tarsnap is about 10x too expensive for my usage. The $5/mo I pay for Backblaze would get me 20 GB of storage on Tarsnap and no bandwidth, that's pretty poor.
      - rocqua 10y ago
        Back when I decided, backblaze didn't work nicely with headless linux. If that changed I might consider changing. Currently I only use it to back-up the non-huge parts of my home directory and /etc. This keeps costs reasonable to me. I know these prices are pretty close to the actual cost of storage, which is amazon S3. I suppose backblaze can do better by handling their own storage.
        cookiecaper 10y ago
        There are lots of options to store to most cloud backends nowadays. Check out rclone and duplicity.
    - cryptarch 10y ago
      It doesn't really help if you have multiple terrabytes of data, $250-$1000/month for 1-4TB is definitely a no-go for me...
- alkonaut 10y ago
  That should be an option at least. I.e. "warning with this option you are responsible for the key, rather than trusting it to us with a password". I wouldn't want to be responsible for safeguarding the key to my own data if I could help it though. Or put another way: The whole reason I'm using cloud backup is because I can't be trusted with important data.
- raverbashing 10y ago
  Yes, but this is not the service they provide If this is not sufficient, then don't use the service. It's that simple It's funny how they have to keep answering questions about this when this is not how they do stuff. They focus on easy of use. If a person is not happy with the way they do stuff then they're free to GPG stuff and upload it to wherever they think is best.
  - developer2 10y ago
    The reason people are taken aback by their service is that if they're going to store the private key on the server, then they shouldn't even be using client-side encryption to send the backups in the first place. It doesn't provide an additional layer of security to use asymmetric crypto the way they are using it. So why do they have it at all? To make their service sound more secure than it really is. The service is essentially using false advertising to trick nontechnical users, and that is what turns people off. You either use private keys that remain with the client, or you don't use asymmetric crypto in the first place. They're trying to mix security with convenience by eliminating the security aspect, leaving only convenience with a false sense of security.
    - tyingq 10y ago
      Some people are taken aback. I can see their dilemma. Lots of clients are probably backing up the same PC where the key would be if they used "private keys that remain with the client". Then, they would have to deal with the blowback there when the most common scenario where a restore is needed happens. A backblaze customer's drive is dead/wiped/whatever. Right when the user needs their files back, the same drive(s) that were lost also has the private key. It seems like a reasonable solution given that constraint, and that their demographic is people wanting a cheap solution. Security isn't pushed on their front page at all really. I'd agree with your comments if they were leading with a "super secure" message. Their setup appears secure other than restoral, and you get to make the choice at that point to weigh the risk. You also have the choice of not setting a pass phrase, but encrypting your own data before upload if you want.
      - 10y ago

2bluesc 10y ago

Currently to restore your data you need to provide your private key: > As you prepare a restore, you must type in your private passphrase into the restore server. Seems like a pretty fundamental architecture fail here. Later the site goes on to acknowledge this: > We actually want to improve this to provide a password encrypted ZIP file for download, and then the FINAL improvement is to actually allow you to download the private encryption key, download the encrypted files, and provide the pass phrase in the privacy of your computer. We hope to add this functionality in the future.

cryptarch 10y ago
> ZIP Are they serious? Security conscious users a) still have to give up an encrypted copy of their private key, ripe for cracking, and b) they are supposed to download all their terrabytes of data in zip form, presumably over HTTP with no resume option? Smh...
- mrchucklepants 10y ago
  They state the downloads are sent over HTTPS. They also have a downloader that allows for resumable downloads [1]. [1] https://help.backblaze.com/hc/en-us/articles/217665908-How-to-Use-the-Backblaze-Downloader-Mac- https://help.backblaze.com/hc/en-us/articles/217665908-How-t...
- loeg 10y ago
  Additionally, zip password security (non-AES) is known to be poor. (And AES encrypted zip isn't widely supported.)
- atYevP 10y ago
  Yev from Backblaze here -> The .zip option is the fastest way for folks to get their data back quickly - it's downloaded over HTTPS and we have a Downloader (which can restart interrupted downloads [browsers can only do so much] if they are larger). Folks with A LOT of data to restore usually opt for a USB Flash Key or a USB Hard Drive restore - which is sent, encrypted, via FedEx. Usually that one is used for complete system failures or recoveries.

Neliquat 10y ago

A suprising oversight, but I have noticed in the heat of the moment few customers care. Without friction, the incentive is not there, given all the fires they likely fight 24/7. Looks like someone just gave them incentive. Hopefully an opprotunity to address this and look good, backblaze has always seemed better at the (tech) public facing game than most.

cookiecaper 10y ago
It's not really an oversight. There's just not a good option that normal people will actually use. You could have the keyfile exist only on the consumer's computer, but then when their computer crashes, the exact reason they installed Backblaze, they aren't going to be able to access it. You could tell them to make a copy of the keyfile and store it in a safe deposit box at their local bank, but that's an additional recurring cost for the box and an additional time cost, and what if they can't get to the box when they need to restore? etc. This is one of those situations where security and convenience are diametrically opposed. If Backblaze doesn't keep a copy of your keyfile and you didn't complete steps B-D to make and keep a secure backup, you're screwed. Most consumers are better off trusting Backblaze to keep that data safe for them. You could say that they should offer this as a secondary mode of operation, but then people would say "Yes, I want the most security possible! Yes!" and then they'd sing quite a different tune when they get their backups back and can't actually use them, and Backblaze already has enough problems with their customer service dept. If you want full client-side encryption, use B2 and hook up something like duplicity to automatically difference and encrypt your files before you upload them.

timcederman 10y ago

BackBlaze's lax approach to security and unreasonable requests for what data I should provide for them to debug a bug in their client is why I switched to CrashPlan. (said bug also caused me to exhaust my 1TB Comcast cap several months in a row, BackBlaze was unresponsive and unapologetic throughout the whole process)

cryptarch 10y ago
Do you happen to know if CrashPlan's encryption is any better? AFAIK AES in CBC-mode is a no-no because it betrays which blocks of data are identical, and that's what BlackBlaze uses.
- timcederman 10y ago
  Without inspecting the system, hard to say for sure, but on paper it's much better. https://support.code42.com/CrashPlan/4/Configuring/Security_Encryption_And_Password_Options https://support.code42.com/CrashPlan/4/Configuring/Security_... I really liked the fact that I could set my own key too.
- rocqua 10y ago
  That is not the case. That would be ECB mode. CBC stands for cipher-block-chaining. Where you xor the plaintext with the ciphertext of the last block before encryption specifically to prevent identical blocks from yielding identical ciphertext. There are some issues with CBC regarding the fact that it can't really be parralelized. It also lacks authentication as opposed to the newer GCM mode. In general though, AES-256 CBC is essentially THE standard best practice proven form of encryption.
  - cryptarch 10y ago
    Oh, thanks for the info, I mixed those up.
cookiecaper 10y ago
Backblaze has repeatedly refused to add something as simple as pagination to their B2 web interface, a feature that takes less than an hour to implement and which most people would not dream of going live without, and their support people are terse and uncooperative. I've more or less stopped using them for this reason. They have a lot of employees who read HN and I'm sure they're cool guys, but I think they really need to reconsider their performance in customer experience.

hackerhasid 10y ago

i don't understand why they went through all this trouble of encrypting things client-side if they're just going to store the private key on their own servers! what actual benefit is there to this service? the fact that data is encrypted in-transit? i assume every backup provider does that via https/etc!

rocqua 10y ago
The private key can be encrypted by a password, presumably this encryption is done client-side. This means the data is also secure in their datacentre at rest. That is, until you provide backblaze with your password to actually access your data. Essentially, until you need the data that is backed-up, no-one can get to it.
- jlgaddis 10y ago
  My SSH keys are also protected by a passphrase, but you certainly won't find me uploading them to the Internet.
  - rocqua 10y ago
    If it uses pbkdf2 with sufficient rounds and a decent password (say 5 words from diceware) it should be perfectly safe to upload the keys. Better to keep them offline and keep ownership of the key as a second factor certainly, but encrypted keys can be a fully acceptable single factor.

rocqua 10y ago

BackBlazes stand on this, from the link: Question: I Don't Trust You, but I am Expecting an Honest Answer. "If I opt to password-protect my private key, are BackBlaze servers still able to decrypt my data? (For instance, by sending the password to the server where my private key is stored and decrypting the private key on the server) Or is my data only able to be decrypted on the client?" Answer: ABSOLUTELY NOT. Once the password is set do not forget it, there is no way to recover it. Once protected by a private encryption key Backblaze can only decrypt the backup files when the user supplies the password. This is done during the restore process and the supplied password is never saved on our systems, although never to disk, only to RAM. What it Comes Down to is Trust, but, Unfortunately, I Just Can't Trust You. "Having the private key outside my computer is unacceptable. The unfortunate thing is that I can't trust you. I'm not allowed to trust you. So, I guess my question is why do I have to? It makes most sense that I shouldn't -have- to trust you..." I understand. What you are describing is conceptually perfect and provably more secure than what Backblaze provides , unfortunately it is not easy to use. Backblaze focuses on ease of use. It is backup for people who need backup and "pretty good security" and who aren't computer professionals. It is not a perfect choice for all users on earth, you are unfortunately outside our scope. Take our default security model -> it is about as secure as a Facebook account. It uses a username and password. You can recover (reset) your password if you have access to your email. That mode is good for many, many people on earth, people who have pictures of their children they don't want to lose. Music they would rather not repurchase. And a few Quicken docs that they would not like a malicious person to have, but they will not DIE if somebody reads them. And it's SUPER convenient to recover their password. What a great system! Our second level is really, really much more secure. You cannot recover the password to access to your email account does not give you access to the backup, and even a malicious hacker in our datacenter could not possibly compromise your data. Now while it is more secure, it is also harder to use -> if you forget that password you have actually lost the backup, your wedding photos are gone forever. That's very secure, but it's not as secure as what you describe. We stand by our reputation as trustworthy, careful programmers who have worked in the security field for over a decade. You can check us out on LinkedIn, through colleagues that have worked with us, through the publicly traded companies that have acquired our companies in the past. Here is our team page: https://www.backblaze.com/team.html https://www.backblaze.com/team.html We live and work in Silicon Valley, we've been here for 20 years, and we plan to keep doing this for a long, long time, and therefore we have LOTS of interest in keeping our reputations rock solid and utterly clean. Previously we fought phishing fraud, fought email viruses, and fought spam at a company called MailFrontier. We are totally customer focused and all around good people, ask ANYBODY. If you come here to our offices, I'll buy you a cup of coffee.

brianwski 10y ago

Brian from Backblaze here, glad to answer any questions. To clarify, Backblaze produces four different products/modes for different customers with different needs and requirements. We want customers to choose what is appropriate for them. One size does not fit all: 1) Online Backup ($5/month) where every file is encrypted on your laptop BEFORE being sent to Backblaze and your backup is secured by your username/password - where you can recover your password if you have access to your email account. (We support two-factor auth which provides an additional optional layer of protection.) 2) Online Backup ($5/month) where every file is encrypted on your laptop BEFORE being sent to Backblaze and your backup is secured by your username/password AND your private encryption key is secured by a "passphrase" that is not recoverable in any way, shape, or form. (Two-factor auth is also optional here.) 3) B2 Object storage (half of 1 cent/GByte/month) where you store your file completely unencrypted, and this can be "private" (only accessible by username/password) or "totally public accessible by knowing the URL". A good application of this is serving up a web page to the public - you really WANT people to see all the contents! 4) B2 Object storage (half of 1 cent/GByte/month) where Backblaze has zero knowledge. You cannot browse your file hierarchy because Backblaze doesn't know your filenames. You cannot preview your images. You cannot recover your passwords. There is no other option other than downloading the encrypted blobs and applying whatever decryption algorithm you decided on (we have no ability to know what that is). Ok, so I think some (many?) people in the security field think that Backblaze should ONLY offer mode #4 (and maybe #3 to serve up public websites). I happen to disagree and I personally feel that products #1 and #2 are useful and appropriate for some customers. But everybody is welcome to their opinion and we want to be completely open as to what exactly is occurring and what we are offering as a service. Personally I think #2 is an excellent trade off of security vs convenience. Your data is as impervious to attack as a zero knowledge system in #4 for years upon years. Then one day your laptop is stolen or crashes and you want your files back. You want all 4 TBytes back - so you order one of our free (encrypted) USB hard drives to be FedEx'ed to your home with all your data. To kick this process off FOR THE FIRST TIME EVER you tell us your passphrase (up until this very moment it really has been zero knowledge). At this moment you are opening a window of SLIGHTLY lowered security that slams shut after a few hours. For those few hours of preparing your 4 TByte restore, if an undetected hacker had compromised the one restore server in the Backblaze data center that your job was on, that hacker could possibly get access to your files. But then the reduced security window slams shut, we NEVER write your passphrase to any disk so it has now vaporized and we do not remember it, and if a hacker hacks into our system the following day you are STILL completely impervious. But again, as long as you fully understand the implications of #3 I am COMPLETELY supportive if you instead choose #4 which is our "Zero Knowledge" offering.

CodeWriter23 10y ago

I don't understand why BackBlaze would decrypt on their premises rather than offload that processing to the client computer. I mean they've shaved every other cost in their system to the bone to achieve a low cost product for the consumer, but the one area where the rubber meets the road, they chose to incur the cost of decryption. I understand the vital convenience tradeoff of storing the private key. I might be willing to make that trade too if not for the various 'bleed vulnerabilities known and yet to be discovered, that threaten to disclose my passphrase to evil haXor$ when the time comes to transmit my passphrase to BB. And when you combine those two concepts together, it really only leads me to the conclusion that this is defective by design in order to support surveillance requests. Even ones that can only be satisfied when the user types in their PEM passphrase. Prove me wrong by implementing that so-called "FINAL improvement" noted at the end of that KB entry.

tyingq 10y ago
My guess is that their average customer is backing up data that's on the same drive that the keys would be on. Such that the keys would be lost in the same event that would have the customer wanting a restore . There are many ways around that, none very elegant. They picked what they felt exposed the least amount of awkwardness. Only expose a flaw in the somewhat rare case of a restoral.
- brianwski 10y ago
  Brian from Backblaze here. > they've shaved every other cost in their system to the bone to achieve a low cost product for the consumer In addition to making sure you have a backup you can restore from, we always want Backblaze to be: 1) fast (low impact on your system performance), 2) easy, 3) inexpensive. You only focused on the inexpensive part. To be super easy, we need to be as easy as it is to sign into your Gmail account -> username and password and that is it. Then for the more security conscious (just like Gmail) we offer two factor authentication, and go even further than Gmail goes by providing the ability to set a private passphrase. > their average customer is backing up data that's on the same drive that the keys would be on This is correct. We could require the customers to remember their own private encryption key on a USB thumb drive and store it at their bank in a safety deposit box, but that would SEVERELY decrease the number of customers Backblaze has. > this is defective by design in order to support surveillance requests. Backblaze has never had a surveillance request. Plus, if you set a private passphrase we literally could not comply because we simply could not decrypt your data. We really, REALLY don't want to know what is in your backup and we take great pains to not know. Seriously, it is a liability to us to know what is in your backup. It is a liability to have the ability to decrypt your backup. You can also check out our team at https://www.backblaze.com/company/team.html https://www.backblaze.com/company/team.html and ask around about us. We have been in the same 30 mile radius in Silicon Valley for 25 years (working at Apple computer, Silicon Graphics, HP, Oracle, GE, etc), and we have been doing online backup for ten years now. We take our customer privacy VERY seriously, and our personal reputations are extremely important to us. We are the good guys and we try our best to do right by our customers.