4 ms·

Is the author just ignoring the fact that you can (and should!) have multiple encrypted backups, including password protected versions of the encryption key? Th

Is the author just ignoring the fact that you can (and should!) have multiple encrypted backups, including password protected versions of the encryption key? The entire premise falls apart the moment you assume a reasonable backup strategy.

crazygringo 4y ago
I would guess that less than 1% of the population has multiple encrypted backups, included password protected versions of the encryption key. To some HN'ers what you describe is a "reasonable backup strategy". But to every person I know who doesn't work in tech, what you're describing, not only are they unaware of even these concepts, but they wouldn't have the slightest idea of how to even go about them. Multiple encrypted backups? So if less than 1% of people do something, I don't think it's reasonable to call it reasonable. :)
- tristor 4y ago
  > I would guess that less than 1% of the population has multiple encrypted backups, included password protected versions of the encryption key. A quick search concludes that while the consumer-focused cloud backup market in the US is only seeing incremental growth (17% CAGR), it currently represents around $15B/yr. [1] If you just do some back of napkin math based on the yearly cost of a Backblaze subscription ($70)[2] you can pretty easily come out with a rough estimate of the amount of devices/users utilizing "encrypted backups" which roughly applies to all major players in the consumer/device cloud backup space. $15B / $70 = 200M devices. The population of the US is ~350M, so roughly 60% of Americans have an "encrypted cloud backup", and I'd say that is actually a /very/ conservative estimate, considering that iOS accounts for 55% of the mobile market share in the US currently and by default enables automated backups to iCloud for connected devices. It also doesn't capture variance in pricing structure, devices that are managed by businesses and have enforced backup policies, and non-cloud based backups (Time Machine, et al). Conservatively though, 2 out of every 3 computing devices (inclusive of tablets and smartphones) you interact with in the wild in the US have "encrypted backups" in addition to whatever default disk encryption is enabled. There's a lot of stuff being slung around in this subthread that makes me think people's mental models are still set in 2008, not in 2023. My 70s parents have full disk encrypted devices which are backed up via encrypted cloud backups and use a password manager, and I've done little to no coaching, because it's the DEFAULT state of many of their devices and heavily encouraged for enablement during onboarding for devices where it is not default. Have you gone through the OOBE on a new Macbook lately? You are encouraged to connect it to your iCloud account, then enable FileVault 2 with a recovery key stored in iCloud, and then to enable iCloud backups. Of course, there's some dark patterns associated due to the revenue model of iCloud for Apple, but it's also something directly beneficial to the end user. [1]: https://www.prnewswire.com/news-releases/cloud-backup-and-recovery-market-size-to-grow-by-usd-14-59-billion--33-of-the-market-growth-to-originate-from-apac--technavio-301556640.html https://www.prnewswire.com/news-releases/cloud-backup-and-re... [2]: https://www.backblaze.com/backup-pricing.html https://www.backblaze.com/backup-pricing.html
  - crazygringo 4y ago
    You're missing the "multiple" part. How many non-tech people are backing up their laptop to Backblaze and a second service or encrypted external drive? You're also missing part of the "encrypted" part, where the whole point of the article is that it's only effectively encrypted if the cloud provider doesn't have the key (and therefore becomes riskier). And Backblaze doesn't enable private encryption keys by default. Apple doesn't either by default for things like iOS backup. So yes, what's standard is a single cloud backup that is encrypted at rest, but where the provider still has keys to access it. In contrast, I very much stand by my less than 1%, if it's encrypted with a private key to multiple backup destinations, which is what the parent I was responding to was describing.
- _Algernon_ 4y ago
  In that case they'll lose the data no matter whether it is encrypted (at some point in the future). I fail to see how encryption makes that worse.
  - crazygringo 4y ago
    If you have a single unencrypted backup, for the vast, vast majority of people they'll never lose data. It's common for personal devices to break or get lost. It's also common to lose/forget a private key. So it's pretty easy to lose a device and then also discover already you'd lost/forgetten your key a while ago. But it's vanishingly rare for big-name consumer cloud services to lose data. And then it's astonishingly unlikely that a cloud service loses your backup and you then you break/lose your personal device before making a new backup. Does that clarify how you're much more likely to lose data because of encryption?

crazygringo 4y ago

I would guess that less than 1% of the population has multiple encrypted backups, included password protected versions of the encryption key. To some HN'ers what you describe is a "reasonable backup strategy". But to every person I know who doesn't work in tech, what you're describing, not only are they unaware of even these concepts, but they wouldn't have the slightest idea of how to even go about them. Multiple encrypted backups? So if less than 1% of people do something, I don't think it's reasonable to call it reasonable. :)

tristor 4y ago
> I would guess that less than 1% of the population has multiple encrypted backups, included password protected versions of the encryption key. A quick search concludes that while the consumer-focused cloud backup market in the US is only seeing incremental growth (17% CAGR), it currently represents around $15B/yr. [1] If you just do some back of napkin math based on the yearly cost of a Backblaze subscription ($70)[2] you can pretty easily come out with a rough estimate of the amount of devices/users utilizing "encrypted backups" which roughly applies to all major players in the consumer/device cloud backup space. $15B / $70 = 200M devices. The population of the US is ~350M, so roughly 60% of Americans have an "encrypted cloud backup", and I'd say that is actually a /very/ conservative estimate, considering that iOS accounts for 55% of the mobile market share in the US currently and by default enables automated backups to iCloud for connected devices. It also doesn't capture variance in pricing structure, devices that are managed by businesses and have enforced backup policies, and non-cloud based backups (Time Machine, et al). Conservatively though, 2 out of every 3 computing devices (inclusive of tablets and smartphones) you interact with in the wild in the US have "encrypted backups" in addition to whatever default disk encryption is enabled. There's a lot of stuff being slung around in this subthread that makes me think people's mental models are still set in 2008, not in 2023. My 70s parents have full disk encrypted devices which are backed up via encrypted cloud backups and use a password manager, and I've done little to no coaching, because it's the DEFAULT state of many of their devices and heavily encouraged for enablement during onboarding for devices where it is not default. Have you gone through the OOBE on a new Macbook lately? You are encouraged to connect it to your iCloud account, then enable FileVault 2 with a recovery key stored in iCloud, and then to enable iCloud backups. Of course, there's some dark patterns associated due to the revenue model of iCloud for Apple, but it's also something directly beneficial to the end user. [1]: https://www.prnewswire.com/news-releases/cloud-backup-and-recovery-market-size-to-grow-by-usd-14-59-billion--33-of-the-market-growth-to-originate-from-apac--technavio-301556640.html https://www.prnewswire.com/news-releases/cloud-backup-and-re... [2]: https://www.backblaze.com/backup-pricing.html https://www.backblaze.com/backup-pricing.html
- crazygringo 4y ago
  You're missing the "multiple" part. How many non-tech people are backing up their laptop to Backblaze and a second service or encrypted external drive? You're also missing part of the "encrypted" part, where the whole point of the article is that it's only effectively encrypted if the cloud provider doesn't have the key (and therefore becomes riskier). And Backblaze doesn't enable private encryption keys by default. Apple doesn't either by default for things like iOS backup. So yes, what's standard is a single cloud backup that is encrypted at rest, but where the provider still has keys to access it. In contrast, I very much stand by my less than 1%, if it's encrypted with a private key to multiple backup destinations, which is what the parent I was responding to was describing.
_Algernon_ 4y ago
In that case they'll lose the data no matter whether it is encrypted (at some point in the future). I fail to see how encryption makes that worse.
- crazygringo 4y ago
  If you have a single unencrypted backup, for the vast, vast majority of people they'll never lose data. It's common for personal devices to break or get lost. It's also common to lose/forget a private key. So it's pretty easy to lose a device and then also discover already you'd lost/forgetten your key a while ago. But it's vanishingly rare for big-name consumer cloud services to lose data. And then it's astonishingly unlikely that a cloud service loses your backup and you then you break/lose your personal device before making a new backup. Does that clarify how you're much more likely to lose data because of encryption?