4 ms·

I use an S3-comptaible hoster with the rclone client which supports encryption/decryption on the fly. That is, I don't even need to trust my S3 provider. For s

by enz 5y ago

I use an S3-comptaible hoster with the rclone client which supports encryption/decryption on the fly. That is, I don't even need to trust my S3 provider. For syncing between devices, I guess `rclone sync` should do the trick.

drevil-v2 5y ago
Is there a guide to set this up? Thanks in advance
- enz 5y ago
  Yup: basically you need to set up a regular S3 backend (guide here: https://rclone.org/s3/ https://rclone.org/s3/), and then you can set up a "crypt" over it (guide here: https://rclone.org/crypt/ https://rclone.org/crypt/).
fulafel 5y ago
You're leaking quite a lot of information to the provider if the encryption is per-object. Not saying this necessarily matters in your use case, but good to be aware of the limitat a lot can be deduced from file sizes, timeline of accesses, and access pattens of files. And most importantly of course you're still trusting the provider for availability. For example if you saved a folder of mp3 files using the rclone crypt functionality that you downloaded from a known BitTorrent, it would be easy for an adversary to match that set of known sized objects with high confidence at the storage provider end, or from observing encrypted network traffic (which in the S3 case leaks object size through traffic patterns) and deducing object sizes from there.
- enz 5y ago
  Thanks for the advice. I didn't know that. In my case, it does not matter much (my data is mostly produced by myself). But, sure, it is good to be aware of that fact!
- indrora 5y ago
  There's methods to use S3-like platforms without leaking data. Restic does this by packing blocks of data together and encrypting them instead of doing it on a per-file basis. This allows for deduplication at a block level and functionally making the contents ambiguous noise.

4 ms·

I use an S3-comptaible hoster with the rclone client which supports encryption/decryption on the fly. That is, I don't even need to trust my S3 provider. For s

by enz 5y ago

drevil-v2 5y ago
Is there a guide to set this up? Thanks in advance
- enz 5y ago
  Yup: basically you need to set up a regular S3 backend (guide here: https://rclone.org/s3/ https://rclone.org/s3/), and then you can set up a "crypt" over it (guide here: https://rclone.org/crypt/ https://rclone.org/crypt/).
fulafel 5y ago
You're leaking quite a lot of information to the provider if the encryption is per-object. Not saying this necessarily matters in your use case, but good to be aware of the limitat a lot can be deduced from file sizes, timeline of accesses, and access pattens of files. And most importantly of course you're still trusting the provider for availability. For example if you saved a folder of mp3 files using the rclone crypt functionality that you downloaded from a known BitTorrent, it would be easy for an adversary to match that set of known sized objects with high confidence at the storage provider end, or from observing encrypted network traffic (which in the S3 case leaks object size through traffic patterns) and deducing object sizes from there.
- enz 5y ago
  Thanks for the advice. I didn't know that. In my case, it does not matter much (my data is mostly produced by myself). But, sure, it is good to be aware of that fact!
- indrora 5y ago
  There's methods to use S3-like platforms without leaking data. Restic does this by packing blocks of data together and encrypting them instead of doing it on a per-file basis. This allows for deduplication at a block level and functionally making the contents ambiguous noise.