4 ms·

"Backups? Forget it. This is the Dark Web. Winzen told ZDNet that there ain’t no such thing as backups on Daniel’s Hosting, by design:" I'm wondering why encry

"Backups? Forget it. This is the Dark Web. Winzen told ZDNet that there ain’t no such thing as backups on Daniel’s Hosting, by design:" I'm wondering why encrypted backup is not an option for them?

foepys 8y ago
If the user isn't the sole owner of the key, encryption is pretty much worthless for such services. At this point users can do the backups themselves.
TrueDuality 8y ago
The dark web is designed to be anonymous. Long term persistence of anything that might hold details about the users of the sites are taboo in the extreme. Since this is a hosting provider for the dark web (and one that advertises they don't do backups, logs, etc), they don't know what the content of the sites or databases involve. Keep backups of that content is an additional liability for their business. Site owners for all hosting providers, including when you're running on clouds like AWS, should put thought into their backup strategies independently of guarantees from their provider. For providers like AWS you will likely use their storage options for backups such as S3, but you are taking a risk especially if you're storing in the same region. Everything in this industry is a series of trade offs, you need to be aware of what trade offs you're making at any given time.
- FooHentai 8y ago
  >Everything in this industry is a series of trade offs, you need to be aware of what trade offs you're making at any given time. >loudest 'Amen' in recorded history emanates from my cubicle
cronix 8y ago
For the same reason why the NSA siphons up all data from the net, encrypted or not, and stores it. They know one day they'll be able to crack todays crypt. Being able to decrypt a backup 5 or 10 years from now will still provide a lot of useful data, whether it came from the darknet or someones icloud backup while it was in transit to Apples servers. Encryption really only protects you from "today", not what will happen to it in the future. It's one reason I kind of chuckle to myself when people put such high regard into companies that proclaim to be more self conscious about protecting user data and what they do with it. It doesn't really matter if the data is still being collected and stored for later decryption. It's basically just a "delay" of when it can be read. The only thing stopping them, currently, is not having enough qbits in a quantum computer. Things are going to get, strange. https://www.youtube.com/watch?v=vNV_3PkA9WM https://www.youtube.com/watch?v=vNV_3PkA9WM
- siliconunit 8y ago
  Just xor bit by bit against real random noise,embed it in a massive stream of other pure random, remember the offset, if it's really that important..
  - Eliezer 8y ago
    Don't roll your own crypto. If that was much better encryption, everyone would be using it.
    - taylorfinley 8y ago
      I think we all agree rolling your own crypto is dangerous, but what siliconunit described is just a one time pad. Assuming your key data is truly random and unknown to your attacker, isn't this kind of the gold standard for uncrackable cyphered communication?
      - jpatokal 8y ago
        In theory, but getting that stream of "real random" and above all distributing that one time pad securely to the recipient (chicken, meet egg) so they can read the message make this highly impractical.
        vectorEQ 8y ago
        dont need the random really. just need an offline method for exchanging the pad :D or just use an unexpected channel like radio or so to send it
      - Eliezer 8y ago
        If interpreted that way, storing the noise and memorizing the offset, it amounts to having a privately stored one-time pad to be used as key... with a passphrase with as many bits in it as the offset. That’s probably not a lot of bits. You are better off storing the data, encrypted with a real pass phrase, wherever you would have stored the random noise stream that is needed to read the data in any case. Don’t roll your own crypto.

foepys 8y ago

If the user isn't the sole owner of the key, encryption is pretty much worthless for such services. At this point users can do the backups themselves.

TrueDuality 8y ago

The dark web is designed to be anonymous. Long term persistence of anything that might hold details about the users of the sites are taboo in the extreme. Since this is a hosting provider for the dark web (and one that advertises they don't do backups, logs, etc), they don't know what the content of the sites or databases involve. Keep backups of that content is an additional liability for their business. Site owners for all hosting providers, including when you're running on clouds like AWS, should put thought into their backup strategies independently of guarantees from their provider. For providers like AWS you will likely use their storage options for backups such as S3, but you are taking a risk especially if you're storing in the same region. Everything in this industry is a series of trade offs, you need to be aware of what trade offs you're making at any given time.

FooHentai 8y ago
>Everything in this industry is a series of trade offs, you need to be aware of what trade offs you're making at any given time. >loudest 'Amen' in recorded history emanates from my cubicle

cronix 8y ago

For the same reason why the NSA siphons up all data from the net, encrypted or not, and stores it. They know one day they'll be able to crack todays crypt. Being able to decrypt a backup 5 or 10 years from now will still provide a lot of useful data, whether it came from the darknet or someones icloud backup while it was in transit to Apples servers. Encryption really only protects you from "today", not what will happen to it in the future. It's one reason I kind of chuckle to myself when people put such high regard into companies that proclaim to be more self conscious about protecting user data and what they do with it. It doesn't really matter if the data is still being collected and stored for later decryption. It's basically just a "delay" of when it can be read. The only thing stopping them, currently, is not having enough qbits in a quantum computer. Things are going to get, strange. https://www.youtube.com/watch?v=vNV_3PkA9WM https://www.youtube.com/watch?v=vNV_3PkA9WM

siliconunit 8y ago
Just xor bit by bit against real random noise,embed it in a massive stream of other pure random, remember the offset, if it's really that important..
- Eliezer 8y ago
  Don't roll your own crypto. If that was much better encryption, everyone would be using it.
  - taylorfinley 8y ago
    I think we all agree rolling your own crypto is dangerous, but what siliconunit described is just a one time pad. Assuming your key data is truly random and unknown to your attacker, isn't this kind of the gold standard for uncrackable cyphered communication?
    - jpatokal 8y ago
      In theory, but getting that stream of "real random" and above all distributing that one time pad securely to the recipient (chicken, meet egg) so they can read the message make this highly impractical.
      - vectorEQ 8y ago
        dont need the random really. just need an offline method for exchanging the pad :D or just use an unexpected channel like radio or so to send it
    - Eliezer 8y ago
      If interpreted that way, storing the noise and memorizing the offset, it amounts to having a privately stored one-time pad to be used as key... with a passphrase with as many bits in it as the offset. That’s probably not a lot of bits. You are better off storing the data, encrypted with a real pass phrase, wherever you would have stored the random noise stream that is needed to read the data in any case. Don’t roll your own crypto.