3 ms·

Client side encryption is critical. CrashPlan has no business having the ability to inspect file contents.

by xfitm3 7y ago

teh_klev 7y ago
Perhaps they're just looking at the file extensions, looks like they also check the source folder paths as well: https://support.code42.com/CrashPlan/6/Troubleshooting/What_is_not_backing_up?#Admin_excludes https://support.code42.com/CrashPlan/6/Troubleshooting/What_... And the thing is it's not practical to encrypt every file such as VM images every time your backup is scheduled to run. And also Crashplan's client already encrypts your data client side before squirting up to its cloud. I don't know if they store your encryption key(s) cloudside or not, would be pertinent for them not to. That all said, I doubt I'd be inclined to use them, preferring Tarsnap instead I think.
- bayareanative 7y ago
  End-to-end encryption of metadata and data costs almost nothing these days. In terms of liability, knowing anything about clients' data or metadata present unreasonable risks. SpiderOak, Tarsnap, BackBlaze... I still have to due-diligence Rsync.net, iCloud and Box. Dropbox, Microsoft, Google Drive, Mozy, iDrive and now Crashplan are no-go's.
  - teh_klev 7y ago
    > End-to-end encryption of metadata and data costs almost nothing these days. Oh sure. But from what I can discern from Crashplan's website, the encryption appears to be end-to-end, i.e. their client side app does the encryption (and hopefully the keys are only stored locally, so once the data is in their cloud no-one can peek at your data - ala Tarsnap). Realistically you cannot pre-encrypt every file on the machine you're backing up as the parent commenter suggested (show me an encryption app that can properly handle locked/in-use files - especially on Windows), you need to have some trust that the backup provider you're using can be trusted and be trusted not to communicate your encryption key to their cloud as well. But I agree, Dropbox etc...I wouldn't dream of using them "as-intended" with their client apps because I can't trust they're not looking at stuff they're not supposed to be. The only time I work with these products is via my web browser.
    - dividuum 7y ago
      I guess that's why you'd want to use tarsnap, borg or restic. All of their source code is available and ready for inspection and no trust is required if you have the time and capability to verify their claims.

Client side encryption is critical. CrashPlan has no business having the ability to inspect file contents.

by xfitm3 7y ago

Client side encryption is critical. CrashPlan has no business having the ability to inspect file contents.

Perhaps they're just looking at the file extensions, looks like they also check the source folder paths as well: https://support.code42.com/CrashPlan/6/Troubleshooting/What_is_not_backing_up?#Admin_excludes https://support.code42.com/CrashPlan/6/Troubleshooting/What_... And the thing is it's not practical to encrypt every file such as VM images every time your backup is scheduled to run. And also Crashplan's client already encrypts your data client side before squirting up to its cloud. I don't know if they store your encryption key(s) cloudside or not, would be pertinent for them not to. That all said, I doubt I'd be inclined to use them, preferring Tarsnap instead I think.

bayareanative 7y ago
End-to-end encryption of metadata and data costs almost nothing these days. In terms of liability, knowing anything about clients' data or metadata present unreasonable risks. SpiderOak, Tarsnap, BackBlaze... I still have to due-diligence Rsync.net, iCloud and Box. Dropbox, Microsoft, Google Drive, Mozy, iDrive and now Crashplan are no-go's.
- teh_klev 7y ago
  > End-to-end encryption of metadata and data costs almost nothing these days. Oh sure. But from what I can discern from Crashplan's website, the encryption appears to be end-to-end, i.e. their client side app does the encryption (and hopefully the keys are only stored locally, so once the data is in their cloud no-one can peek at your data - ala Tarsnap). Realistically you cannot pre-encrypt every file on the machine you're backing up as the parent commenter suggested (show me an encryption app that can properly handle locked/in-use files - especially on Windows), you need to have some trust that the backup provider you're using can be trusted and be trusted not to communicate your encryption key to their cloud as well. But I agree, Dropbox etc...I wouldn't dream of using them "as-intended" with their client apps because I can't trust they're not looking at stuff they're not supposed to be. The only time I work with these products is via my web browser.
  - dividuum 7y ago
    I guess that's why you'd want to use tarsnap, borg or restic. All of their source code is available and ready for inspection and no trust is required if you have the time and capability to verify their claims.