5 ms·

Tarsnap - Online backups for the truly paranoid

phamilton 13y ago
I know scrypt is awesome, but isn't encrypted traffic still problematic if all traffic is being recorded? If the NSA Rubaiyat has virtually unlimited resources, doesn't tarsnap eventually break down as a safe way to backup data? I'd love to hear Colin chime in.
- cperciva 13y ago
  Depends what exactly you mean by "virtually unlimited". A direct attack on the crypto in Tarsnap is ~ 2^128 operations, which is beyond even the wildest guesses of NSA's computing capacity. In practice, they would attack in another direction -- e.g., exploit a vulnerability in your web browser to take over your computer and steal your keys.
bifrost 13y ago
The only problem with tarsnap is that it uses AWS, or did as of the last time I talked with Colin. I would love to see it move off onto a less personally annoying service, but its service to do with as he pleases.
- locusm 13y ago
  Why do you find it annoying? I think Colin encrypts all user data if privacy is a concern... Im using Duplicity but am looking at tarsnap.
  - blibble 13y ago
    the tarsnap client running on your box encrypts the data before it's ever transmitted, that's part of what makes tarsnap cool (along with the deduplication)
  - bifrost 13y ago
    Because AWS is part of the problem, not part of the solution (right now) and I'd prefer not to give them money indirectly if I can help it. If there was an "anything but AWS" option, I'd gladly take it.
    - snowwrestler 13y ago
      AWS is incidental to both the problem and solution because the problem is an authorized and legal government program. No matter who holds your data, it will be subject to the same access if the government wants it. There are only two solutions: 1) Encrypt your data before sending to the cloud, so that server access becomes irrelevant. (This is what Tarsnap does.) 2) Change the law to stop or change the programs. Neither can be accomplished by Amazon or any other single provider.
      - bifrost 13y ago
        > Neither can be accomplished by Amazon or any other single provider. Not true at all, many storage services operate without government interference, rsync.net is a great example. Just because $largeprovider is trojaned doesn't mean everyone else will be.
        snowwrestler 13y ago
        If a company operates inside the borders of the U.S.--and rsync.net does--it is subject to U.S. law. If they receive a FISA letter they will give up the data because U.S. law says that they have to, or go to jail.
        GalacticDomin8r 13y ago
        > If they receive a FISA letter they will give up the data because U.S. law says that they have to, or go to jail. A bullshit artist should never make an empirical claim lest they be asked to prove it.
        13y ago
finnw 13y ago
Previous submission: https://news.ycombinator.com/item?id=5767116 https://news.ycombinator.com/item?id=5767116
- cperciva 13y ago
  I thought the dupe detector was supposed to prevent the same link being posted twice just two weeks apart... not that I'm objecting to the extra traffic, of course.

I know scrypt is awesome, but isn't encrypted traffic still problematic if all traffic is being recorded? If the NSA Rubaiyat has virtually unlimited resources, doesn't tarsnap eventually break down as a safe way to backup data? I'd love to hear Colin chime in.

cperciva 13y ago
Depends what exactly you mean by "virtually unlimited". A direct attack on the crypto in Tarsnap is ~ 2^128 operations, which is beyond even the wildest guesses of NSA's computing capacity. In practice, they would attack in another direction -- e.g., exploit a vulnerability in your web browser to take over your computer and steal your keys.

bifrost 13y ago

The only problem with tarsnap is that it uses AWS, or did as of the last time I talked with Colin. I would love to see it move off onto a less personally annoying service, but its service to do with as he pleases.

locusm 13y ago
Why do you find it annoying? I think Colin encrypts all user data if privacy is a concern... Im using Duplicity but am looking at tarsnap.
- blibble 13y ago
  the tarsnap client running on your box encrypts the data before it's ever transmitted, that's part of what makes tarsnap cool (along with the deduplication)
- bifrost 13y ago
  Because AWS is part of the problem, not part of the solution (right now) and I'd prefer not to give them money indirectly if I can help it. If there was an "anything but AWS" option, I'd gladly take it.
  - snowwrestler 13y ago
    AWS is incidental to both the problem and solution because the problem is an authorized and legal government program. No matter who holds your data, it will be subject to the same access if the government wants it. There are only two solutions: 1) Encrypt your data before sending to the cloud, so that server access becomes irrelevant. (This is what Tarsnap does.) 2) Change the law to stop or change the programs. Neither can be accomplished by Amazon or any other single provider.
    - bifrost 13y ago
      > Neither can be accomplished by Amazon or any other single provider. Not true at all, many storage services operate without government interference, rsync.net is a great example. Just because $largeprovider is trojaned doesn't mean everyone else will be.
      - snowwrestler 13y ago
        If a company operates inside the borders of the U.S.--and rsync.net does--it is subject to U.S. law. If they receive a FISA letter they will give up the data because U.S. law says that they have to, or go to jail.
        GalacticDomin8r 13y ago
        > If they receive a FISA letter they will give up the data because U.S. law says that they have to, or go to jail. A bullshit artist should never make an empirical claim lest they be asked to prove it.
        13y ago

finnw 13y ago

Previous submission: https://news.ycombinator.com/item?id=5767116 https://news.ycombinator.com/item?id=5767116

cperciva 13y ago
I thought the dupe detector was supposed to prevent the same link being posted twice just two weeks apart... not that I'm objecting to the extra traffic, of course.