5 ms·

I really like the practicality of my G-Drive, but these things scare me. What do you recommend for permanent online access and backup of your data? Do you encr

I really like the practicality of my G-Drive, but these things scare me. What do you recommend for permanent online access and backup of your data? Do you encrypt your private photos etc?

iso-8859-1 14y ago
We've been over this so many times... Backup != Dropbox and the like. Ask HN: What's your favorite online-backup tool?: http://news.ycombinator.com/item?id=1946416 http://news.ycombinator.com/item?id=1946416 See this thread from a week ago: http://news.ycombinator.com/item?id=4224518 http://news.ycombinator.com/item?id=4224518 In short: If you are a hacker or care about security and have money: SpiderOak or Tarsnap Source code: Git If you are poor and care about security: Dropbox with TrueCrypt (be careful that you don't mount simultaneously) None of the above and lazy: Dropbox vanilla (better terms, non-evil non-giant company)
- Numberwang 14y ago
  Thanks for the reply and sorry for not checking the history. This is my first visit to HN.
  - icebraining 14y ago
    I firmly recommend Tarsnap. Even though it's paid, it's fairly cheap (at least by European/US standards) since you only pay exactly what you use, the client application is open source and it's a one-man-show by Dr. Colin Percival, cperciva here on Hacker News: http://news.ycombinator.com/user?id=cperciva http://news.ycombinator.com/user?id=cperciva It's not for everyone, though: At the present time, Tarsnap does not support Windows (except via Cygwin) and does not have a graphical user interface.
- maayank 14y ago
  "Dropbox with TrueCrypt (be careful that you don't mount simultaneously)" What scenario do you refer to? Why would it be bad to run a non-paused Dropbox client and mount a TrueCrypt volume inside it at the same time?
  - sp332 14y ago
    If you mount the TC volume on two computers at once, and change them, Dropbox might keep one copy or the other, or upload two copies with one named *-conflict.
  - barik 14y ago
    I'm starting to suspect that the people who keep recommending TrueCrypt for day-to-day usage on Dropbox fall into the camp of "Do as I say, not as I do." Because if they are actually using TC the way they suggest, they might as well use FTP. First, I created a small 64 MB TrueCrypt partition. I then mounted the partition in TC. I noticed immediately that the tc file has an exclusive lock, so any changes in your TC partition will never be synced until the partition is unmounted! If your use case is to mount your partition immediately upon login, work for the day, and then shutdown, Dropbox will never have an opportunity to sync your partition. My next test was to mount the TC partition simultaneously (Desktop and Laptop). Then I run into conflicts, as another posted mentioned. Because of the exclusive file lock, if you mount simultaneously on two machines, you will start getting duplicate -conflict files when unmounting either of the partitions, since the other is still locked. It's not immediately clear from examination which TC partition is actually the most recent one. And may Gods have mercy on you if at any time you edit both partitions before they sync. Even if you're willing to live with these annoyances, there is now the trade-off of which partition size to create. Too large of a partition and syncing can take a long time, even if you make minimal file changes (because of chaining, there is not a 1 bit -> 1 bit change in TC partitions). Too small of a partition, and you'll have to keep resizing it or creating new ones. What a hassle. The only use case which seems to work well for me, is for minimally modified files, like for annual tax returns. Here, a TrueCrypt container makes sense and works quite well because the partition is basically read-only and unlikely to be simultaneously or even regularly mounted. So for those people who keep suggesting TrueCrypt, I'm curious, do you actually use it, and if so, how? The suggestions for file-level encryption (encfs) appear to be much more sane.
    - maayank 14y ago
      Thank you for the detailed review! Indeed, it seems like one of those problems where solutions seem obvious (use TrueCrypt!) until you experiment or think about it more deeply.
- gizmo686 14y ago
  You could also use dropbox,where the dropbox folder is only writen to by a script that encrypts the data. I have a dropbox folder where I put the files I want to store, then every night, I have a script that automaticly encrypts the files that were added/changed and puts that in an a dropbox.enc folder that gets synced with the server. If someone were to make this into an actual product, it sould be relatively simple to make the encryption happen as soon as a file changes and avoid the latency.
trekkin 14y ago
SpiderOak, Tarsnap, Dropbox + Truecrypt if you don't mind binary clients; web apps with client-side encryption such as aes.io if you don't want to install anything.
- justauser 14y ago
  Thanks for sharing aes.io. That's the first I've heard of this service. Since their a web app with client-side encryption, I presume their using javascript. If so, any idea how they address the problems mentioned in this post ( http://rdist.root.org/2010/11/29/final-post-on-javascript-crypto/ http://rdist.root.org/2010/11/29/final-post-on-javascript-cr... ). Update: Looks like they are using some kind of embedded flash. Does that mean a flash or actionscript cryptography implementation?
  - trekkin 14y ago
    Disclosure: I'm the founder of aes.io :) To answer your questions: 1. all encryption/decryption is done in JS. BouncyCastle java source code is used (slightly tweaked for performance) - it is compiled into JS using Google's GWT compiler. 2. flash is only used for triggering file save dialog, similarly to downloadify, in browsers that do not support HTML5 alternatives. In Chrome, which supports <a download>, flash is not used (100% JS/HTML5) 3. problems mentioned in the post you referenced can be generalized into two groups: (a) hijacking the server to serve "trojaned code", and (b) inherent JS limitations such as the absence of proper PRNG. Concern (a) is valid. However, most client systems have auto-updating software products installed, with auto-updating enabled (browsers auto-update themselves; anti-viruses and OSes do the same, etc. - the Flame worm was using Windows Update to sneak in, I think). It is a universal issue in the modern "connected" world, and most users have to live with this threat if they want to use the Internet in any meaningful way; I can't imagine a person eyeballing the source of every patch they compile/apply on their system. Concern (b) is not really valid now, IMHO. As mentioned above, it is possible to use a solid open-source crypto library either directly (e.g. Stanford Crypto JS library) or compile one into JS, to use proper PRNG, etc. With proper testing (standard/published test vectors; cross-platform tests - encrypt in JS and decrypt in java, etc.) it is possible to make good crypto in JS. And things like side-vector attacks do not look relevant here, as the attacking code needs to run on the client, which means the client has been compromised already.
msh 14y ago
jungledisk or spideroak.
hachiya 14y ago
* tarsnap: uses encryption, paid. http://tarsnap.com http://tarsnap.com * brackup: uses encryption, host yourself. http://code.google.com/p/brackup http://code.google.com/p/brackup * Camlistore is worth keeping an eye on. Looks like a next-generation all-purpose low level CMS. By the same author of brackup, Brad Fitzpatrick. http://camlistore.org/ http://camlistore.org/
Produce 14y ago
Rent a fracking server and be done with all these third parties. I'm sure that there's a simple, OSS web based file explorer for when you need to browse the files in Firefox. SSHFS will let you mount the drive as if it was native. The cloud is massively overrated for stuff like this.
gurkendoktor 14y ago
I use BoxProtect on OS X and pure EncFS on Windows. The latter was so easy that you should probably ignore BoxProtect because it's closed source. See the bottom of this page: http://www.boxprotect.com/?lang=en http://www.boxprotect.com/?lang=en The advantage of EncFS is that it's not a huge binary blob, instead you transparently store files with garbled names and garbled contents, but an otherwise untouched directory structure. I'm not sure if TrueCrypt can do that too.

I really like the practicality of my G-Drive, but these things scare me. What do you recommend for permanent online access and backup of your data? Do you encrypt your private photos etc?

iso-8859-1 14y ago

We've been over this so many times... Backup != Dropbox and the like. Ask HN: What's your favorite online-backup tool?: http://news.ycombinator.com/item?id=1946416 http://news.ycombinator.com/item?id=1946416 See this thread from a week ago: http://news.ycombinator.com/item?id=4224518 http://news.ycombinator.com/item?id=4224518 In short: If you are a hacker or care about security and have money: SpiderOak or Tarsnap Source code: Git If you are poor and care about security: Dropbox with TrueCrypt (be careful that you don't mount simultaneously) None of the above and lazy: Dropbox vanilla (better terms, non-evil non-giant company)

Numberwang 14y ago
Thanks for the reply and sorry for not checking the history. This is my first visit to HN.
- icebraining 14y ago
  I firmly recommend Tarsnap. Even though it's paid, it's fairly cheap (at least by European/US standards) since you only pay exactly what you use, the client application is open source and it's a one-man-show by Dr. Colin Percival, cperciva here on Hacker News: http://news.ycombinator.com/user?id=cperciva http://news.ycombinator.com/user?id=cperciva It's not for everyone, though: At the present time, Tarsnap does not support Windows (except via Cygwin) and does not have a graphical user interface.
maayank 14y ago
"Dropbox with TrueCrypt (be careful that you don't mount simultaneously)" What scenario do you refer to? Why would it be bad to run a non-paused Dropbox client and mount a TrueCrypt volume inside it at the same time?
- sp332 14y ago
  If you mount the TC volume on two computers at once, and change them, Dropbox might keep one copy or the other, or upload two copies with one named *-conflict.
- barik 14y ago
  I'm starting to suspect that the people who keep recommending TrueCrypt for day-to-day usage on Dropbox fall into the camp of "Do as I say, not as I do." Because if they are actually using TC the way they suggest, they might as well use FTP. First, I created a small 64 MB TrueCrypt partition. I then mounted the partition in TC. I noticed immediately that the tc file has an exclusive lock, so any changes in your TC partition will never be synced until the partition is unmounted! If your use case is to mount your partition immediately upon login, work for the day, and then shutdown, Dropbox will never have an opportunity to sync your partition. My next test was to mount the TC partition simultaneously (Desktop and Laptop). Then I run into conflicts, as another posted mentioned. Because of the exclusive file lock, if you mount simultaneously on two machines, you will start getting duplicate -conflict files when unmounting either of the partitions, since the other is still locked. It's not immediately clear from examination which TC partition is actually the most recent one. And may Gods have mercy on you if at any time you edit both partitions before they sync. Even if you're willing to live with these annoyances, there is now the trade-off of which partition size to create. Too large of a partition and syncing can take a long time, even if you make minimal file changes (because of chaining, there is not a 1 bit -> 1 bit change in TC partitions). Too small of a partition, and you'll have to keep resizing it or creating new ones. What a hassle. The only use case which seems to work well for me, is for minimally modified files, like for annual tax returns. Here, a TrueCrypt container makes sense and works quite well because the partition is basically read-only and unlikely to be simultaneously or even regularly mounted. So for those people who keep suggesting TrueCrypt, I'm curious, do you actually use it, and if so, how? The suggestions for file-level encryption (encfs) appear to be much more sane.
  - maayank 14y ago
    Thank you for the detailed review! Indeed, it seems like one of those problems where solutions seem obvious (use TrueCrypt!) until you experiment or think about it more deeply.
gizmo686 14y ago
You could also use dropbox,where the dropbox folder is only writen to by a script that encrypts the data. I have a dropbox folder where I put the files I want to store, then every night, I have a script that automaticly encrypts the files that were added/changed and puts that in an a dropbox.enc folder that gets synced with the server. If someone were to make this into an actual product, it sould be relatively simple to make the encryption happen as soon as a file changes and avoid the latency.

trekkin 14y ago

SpiderOak, Tarsnap, Dropbox + Truecrypt if you don't mind binary clients; web apps with client-side encryption such as aes.io if you don't want to install anything.

justauser 14y ago
Thanks for sharing aes.io. That's the first I've heard of this service. Since their a web app with client-side encryption, I presume their using javascript. If so, any idea how they address the problems mentioned in this post ( http://rdist.root.org/2010/11/29/final-post-on-javascript-crypto/ http://rdist.root.org/2010/11/29/final-post-on-javascript-cr... ). Update: Looks like they are using some kind of embedded flash. Does that mean a flash or actionscript cryptography implementation?
- trekkin 14y ago
  Disclosure: I'm the founder of aes.io :) To answer your questions: 1. all encryption/decryption is done in JS. BouncyCastle java source code is used (slightly tweaked for performance) - it is compiled into JS using Google's GWT compiler. 2. flash is only used for triggering file save dialog, similarly to downloadify, in browsers that do not support HTML5 alternatives. In Chrome, which supports <a download>, flash is not used (100% JS/HTML5) 3. problems mentioned in the post you referenced can be generalized into two groups: (a) hijacking the server to serve "trojaned code", and (b) inherent JS limitations such as the absence of proper PRNG. Concern (a) is valid. However, most client systems have auto-updating software products installed, with auto-updating enabled (browsers auto-update themselves; anti-viruses and OSes do the same, etc. - the Flame worm was using Windows Update to sneak in, I think). It is a universal issue in the modern "connected" world, and most users have to live with this threat if they want to use the Internet in any meaningful way; I can't imagine a person eyeballing the source of every patch they compile/apply on their system. Concern (b) is not really valid now, IMHO. As mentioned above, it is possible to use a solid open-source crypto library either directly (e.g. Stanford Crypto JS library) or compile one into JS, to use proper PRNG, etc. With proper testing (standard/published test vectors; cross-platform tests - encrypt in JS and decrypt in java, etc.) it is possible to make good crypto in JS. And things like side-vector attacks do not look relevant here, as the attacking code needs to run on the client, which means the client has been compromised already.

msh 14y ago

jungledisk or spideroak.

hachiya 14y ago

* tarsnap: uses encryption, paid. http://tarsnap.com http://tarsnap.com * brackup: uses encryption, host yourself. http://code.google.com/p/brackup http://code.google.com/p/brackup * Camlistore is worth keeping an eye on. Looks like a next-generation all-purpose low level CMS. By the same author of brackup, Brad Fitzpatrick. http://camlistore.org/ http://camlistore.org/

Produce 14y ago

Rent a fracking server and be done with all these third parties. I'm sure that there's a simple, OSS web based file explorer for when you need to browse the files in Firefox. SSHFS will let you mount the drive as if it was native. The cloud is massively overrated for stuff like this.

gurkendoktor 14y ago

I use BoxProtect on OS X and pure EncFS on Windows. The latter was so easy that you should probably ignore BoxProtect because it's closed source. See the bottom of this page: http://www.boxprotect.com/?lang=en http://www.boxprotect.com/?lang=en The advantage of EncFS is that it's not a huge binary blob, instead you transparently store files with garbled names and garbled contents, but an otherwise untouched directory structure. I'm not sure if TrueCrypt can do that too.