4 ms·

I enabled Advanced Data Protection and put the recovery key in an encrypted 7zip file, then uploaded that file to Onedrive and Backblaze also picked it up. Ever

by ls612 3y ago

I enabled Advanced Data Protection and put the recovery key in an encrypted 7zip file, then uploaded that file to Onedrive and Backblaze also picked it up. Every now and then I have a reminder on my phone to test-decrypt the recovery key locally to make sure I don't forget the encryption key.

jackson1442 3y ago
Do you think “the vast majority of people” know (or even want to know) how to create an encrypted 7zip file, let alone do a dry run of decryption at some regular cadence? You can barely convince the average user to set up their own backups, and of the users that do, how many do you think test their backup recovery procedures?
fbdab103 3y ago
I do not know your threat model, but maybe keep a physical backup of the key?
- ls612 3y ago
  I’m not sure what that would solve? I’m fairly confident in my backup system it follows 3-2-1 so a paper printout seems unnecessary and would possibly weaken security?
  - fbdab103 3y ago
    It would eliminate that fear of forgetting the key. Again, it comes down to your threat model. Key stored in more locations is potentially compromising security, but is a trade-off everyone has to consider. It still prevents disinterested drag-net style data leakage. If you are targeted by the big bad, I doubt my operational security would be sufficient to protect me from a motivated attacker. I suspect that there are vulnerabilities in my TPM/random number generators/encryption software that are exploitable. An evil maid or even just a camera positioned over my keyboard would probably be sufficient to grab my data. Plus those $5 wrenches.
    - ls612 3y ago
      Yeah my threat model is that nobody cares about surveilling me in particular right now, and I’m not in a jurisdiction where rubber hose cryptography is very realistic. ADP will protect me easily from most attacks short of someone blowing a zero day on me.

by ls612 3y ago

jackson1442 3y ago

Do you think “the vast majority of people” know (or even want to know) how to create an encrypted 7zip file, let alone do a dry run of decryption at some regular cadence? You can barely convince the average user to set up their own backups, and of the users that do, how many do you think test their backup recovery procedures?

fbdab103 3y ago

I do not know your threat model, but maybe keep a physical backup of the key?

ls612 3y ago
I’m not sure what that would solve? I’m fairly confident in my backup system it follows 3-2-1 so a paper printout seems unnecessary and would possibly weaken security?
- fbdab103 3y ago
  It would eliminate that fear of forgetting the key. Again, it comes down to your threat model. Key stored in more locations is potentially compromising security, but is a trade-off everyone has to consider. It still prevents disinterested drag-net style data leakage. If you are targeted by the big bad, I doubt my operational security would be sufficient to protect me from a motivated attacker. I suspect that there are vulnerabilities in my TPM/random number generators/encryption software that are exploitable. An evil maid or even just a camera positioned over my keyboard would probably be sufficient to grab my data. Plus those $5 wrenches.
  - ls612 3y ago
    Yeah my threat model is that nobody cares about surveilling me in particular right now, and I’m not in a jurisdiction where rubber hose cryptography is very realistic. ADP will protect me easily from most attacks short of someone blowing a zero day on me.