4 ms·

I would suggest using restic over TarSnap for encrypted backups -- it gives you more flexibility with where your backups will be stored since TarSnap is pretty

by cyphar 7y ago

I would suggest using restic over TarSnap for encrypted backups -- it gives you more flexibility with where your backups will be stored since TarSnap is pretty integrated with Colin Percival's online service and is also unfortunately not free software. But it's also an as-simple-as-possible cryptosystem. Filippo did a quick lookthrough and said that it seemed sane from a crypto perspective[1]. [1]: https://blog.filippo.io/restic-cryptography/ https://blog.filippo.io/restic-cryptography/

tptacek 7y ago
Restic is also fine.
JoshTriplett 7y ago
I'm using Restic, and it mostly works. Unfortunately, it uses an absurd amount of memory, proportional to the size of your backup store. So, don't use it to back up a small VPS. If you do, "export GOGC=20" can help a little, but it'll still use a lot of memory.
always4getpass 7y ago
Any opinions about rclone? It seems to be fine for my mediocre backup needs
- cyphar 7y ago
  rclone is fine (in fact I use rclone with restic to synchronise my restic backup repository on BackBlaze B2) but it doesn't encrypt or deduplicate your backups -- it's just a synchronisation tool like rsync.
  - always4getpass 7y ago
    What about its 'crypt' encryption backend? Afaik it uses scrypt which was designed for tarsnap
    - cyphar 7y ago
      Ah, I wasn't aware it had an encryption backend. Just looking at the documentation I'm quite worried -- why on earth is there an "obfuscate" mode? I would suggest using restic. It doesn't have any weird modes, it simply encrypts everything and there isn't any weird need to specify (for instance) that you want things like metadata or filenames encrypted. Also backups are deduplicated using content-defined-chunking -- giving you pretty massive storage savings. If you really need rclone since it supports some specific feature of your backend -- restic supports using rclone as a synchronisation backend (or you can do what I do, which is to batch-upload your local restic backup every day).
      - namibj 7y ago
        It's a choice between plaintext filenames or no plaintext filenames. You might want to crypt your nudes, but still access normal pictures unencrypted through the provider's web interface.
bnf 7y ago
I wish that restic supported asymmetric keys. I'm uncomfortable storing the key alongside the backup tool, even if it just gets injected at runtime. If a nefarious party gets the key all my backups from that key are vulnerable. I suspect that it's probably hard to add that functionality because you can't do the deduplication without decrypting the prior backups (or at least an index). That would also explain the memory usage JoshTriplett mentions.

by cyphar 7y ago

tptacek 7y ago

Restic is also fine.

JoshTriplett 7y ago

I'm using Restic, and it mostly works. Unfortunately, it uses an absurd amount of memory, proportional to the size of your backup store. So, don't use it to back up a small VPS. If you do, "export GOGC=20" can help a little, but it'll still use a lot of memory.

always4getpass 7y ago

Any opinions about rclone? It seems to be fine for my mediocre backup needs

cyphar 7y ago
rclone is fine (in fact I use rclone with restic to synchronise my restic backup repository on BackBlaze B2) but it doesn't encrypt or deduplicate your backups -- it's just a synchronisation tool like rsync.
- always4getpass 7y ago
  What about its 'crypt' encryption backend? Afaik it uses scrypt which was designed for tarsnap
  - cyphar 7y ago
    Ah, I wasn't aware it had an encryption backend. Just looking at the documentation I'm quite worried -- why on earth is there an "obfuscate" mode? I would suggest using restic. It doesn't have any weird modes, it simply encrypts everything and there isn't any weird need to specify (for instance) that you want things like metadata or filenames encrypted. Also backups are deduplicated using content-defined-chunking -- giving you pretty massive storage savings. If you really need rclone since it supports some specific feature of your backend -- restic supports using rclone as a synchronisation backend (or you can do what I do, which is to batch-upload your local restic backup every day).
    - namibj 7y ago
      It's a choice between plaintext filenames or no plaintext filenames. You might want to crypt your nudes, but still access normal pictures unencrypted through the provider's web interface.

bnf 7y ago

I wish that restic supported asymmetric keys. I'm uncomfortable storing the key alongside the backup tool, even if it just gets injected at runtime. If a nefarious party gets the key all my backups from that key are vulnerable. I suspect that it's probably hard to add that functionality because you can't do the deduplication without decrypting the prior backups (or at least an index). That would also explain the memory usage JoshTriplett mentions.