9 ms·

While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girl

While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girlfriend) that are clueless about such dangers. Are there any recommendations of a simple way to at least enable automated backups of local documents to the cloud on a windows box?

mistercow 13y ago
I think that you could use Box for this pretty effectively. With their $15/month business plan, you get 1TB of storage and can apparently set any directory as a "workspace", which presumably includes the home directory. For most users, that would be more sufficient to keep everything backed up and the syncing process is supposed to be the same kind of transparent deal as Dropbox (which would also be a good solution, except that you can't set an arbitrary directory as your Dropbox folder).
- synthos 13y ago
  until it encrypts the workspace and that gets synced. Although, I suppose you might have a previous revision as I know dropbox supports versioning for some (all?) kinds of files.
  - mistercow 13y ago
    Yeah, I'm pretty sure you'd have previous versions to work with. It would be important to check though.
thenomad 13y ago
Not technically a true backup system, I think, but Dropbox is pretty easy to use and is a lot better than nothing.
misterbwong 13y ago
Look into one of the many cloud based backup providers. I don't have any specific recommendations but here's a list off the top of my head: 1. http://www.carbonite.com/ http://www.carbonite.com/ 2. http://www.crashplan.com/ http://www.crashplan.com/ 3. http://www.backblaze.com/ http://www.backblaze.com/
- rosser 13y ago
  From the Reddit article linked above [1]: "Backup solutions like Carbonite are no good against this as they will commit the encrypted files to the cloud." You need "cold" backups to get around this without paying. [1] http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care_feeding_of_your_cryptolocker/ http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care...
  - thenomad 13y ago
    I'm assuming that Carbonite doesn't have a Dropbox-like version retention system? Or does this virus get around that?
  - pavel_lishin 13y ago
    I was under the impression that Crashplan's backups included limited versioning?
    - secabeen 13y ago
      They do. I wouldn't even call them limited. They're pretty extensive, up to and including never remove deleted files.
  - mey 13y ago
    Backblaze maintains previous versions of files on a rolling basis of 4 week window. This includes deleted files. I do not work for backblaze, but I am a happy user.
ballard 13y ago
Tarsnap is the only sensible backup provider given the recent history of warantless secret searches in America. SpiderOak is also a contender for file sharing. Both use end-to-end encryption knowable only to the end-user.
- dasil003 13y ago
  I can't afford to have my family photos backed up to tarsnap. Let the NSA have 'em.
  - ballard 13y ago
    It's funny you mention that.... I implore 'cperciva to consider a glacier-level service. It is hard to compete with backblaze, but capping network bwdth is proly one way to skin that cat.
- renata 13y ago
  CrashPlan supports this, although it is not the default.
  - scott_karana 13y ago
    It's also not auditable: Tarsnap, while not OSS, has easily available source code for perusal and personal use, if I recall.
    - temp1346 13y ago
      The crashplan JARs decompile pretty easily - I had a go a few months ago, and they weren't obfuscated. Highlights: The crypto is pretty bad - it's using blowfish in CBC mode with a static IV of 0c22384e5a57412b (convert each byte to decimal...). The client-server protocol use 32 bit nonces and MACs, which is. License key validation works by decrypting some packed data from the key after converting the alphabet back to hex. The key is blowfish-cbc encrypted data and the only validation done is verifying the padding - about 1 in 256 randomly generated ones will have valid padding, and the length is not checked.
pbhjpbhj 13y ago
There's list of a some backup solutions relevant to personal backup (as opposed to enterprise level solutions) here, costs for most providers given too and a brief overview of differentiating features - http://alicious.com/cloud-backup-solutions/ http://alicious.com/cloud-backup-solutions/. I quite like duplicati. Slightly opaque to set-up but I'm using it with SkyDrive for some files as at the time of set-up SkyDrive gave me the most free storage with the lowest level of pain [for me] setting up.
ingenium 13y ago
I really like SpiderOak https://spideroak.com https://spideroak.com I have mine set to backup every 4 hours. It versions the files as well so you can restore to a previous backup.

mistercow 13y ago

I think that you could use Box for this pretty effectively. With their $15/month business plan, you get 1TB of storage and can apparently set any directory as a "workspace", which presumably includes the home directory. For most users, that would be more sufficient to keep everything backed up and the syncing process is supposed to be the same kind of transparent deal as Dropbox (which would also be a good solution, except that you can't set an arbitrary directory as your Dropbox folder).

synthos 13y ago
until it encrypts the workspace and that gets synced. Although, I suppose you might have a previous revision as I know dropbox supports versioning for some (all?) kinds of files.
- mistercow 13y ago
  Yeah, I'm pretty sure you'd have previous versions to work with. It would be important to check though.

thenomad 13y ago

Not technically a true backup system, I think, but Dropbox is pretty easy to use and is a lot better than nothing.

misterbwong 13y ago

Look into one of the many cloud based backup providers. I don't have any specific recommendations but here's a list off the top of my head: 1. http://www.carbonite.com/ http://www.carbonite.com/ 2. http://www.crashplan.com/ http://www.crashplan.com/ 3. http://www.backblaze.com/ http://www.backblaze.com/

rosser 13y ago
From the Reddit article linked above [1]: "Backup solutions like Carbonite are no good against this as they will commit the encrypted files to the cloud." You need "cold" backups to get around this without paying. [1] http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care_feeding_of_your_cryptolocker/ http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care...
- thenomad 13y ago
  I'm assuming that Carbonite doesn't have a Dropbox-like version retention system? Or does this virus get around that?
- pavel_lishin 13y ago
  I was under the impression that Crashplan's backups included limited versioning?
  - secabeen 13y ago
    They do. I wouldn't even call them limited. They're pretty extensive, up to and including never remove deleted files.
- mey 13y ago
  Backblaze maintains previous versions of files on a rolling basis of 4 week window. This includes deleted files. I do not work for backblaze, but I am a happy user.

ballard 13y ago

Tarsnap is the only sensible backup provider given the recent history of warantless secret searches in America. SpiderOak is also a contender for file sharing. Both use end-to-end encryption knowable only to the end-user.

dasil003 13y ago
I can't afford to have my family photos backed up to tarsnap. Let the NSA have 'em.
- ballard 13y ago
  It's funny you mention that.... I implore 'cperciva to consider a glacier-level service. It is hard to compete with backblaze, but capping network bwdth is proly one way to skin that cat.
renata 13y ago
CrashPlan supports this, although it is not the default.
- scott_karana 13y ago
  It's also not auditable: Tarsnap, while not OSS, has easily available source code for perusal and personal use, if I recall.
  - temp1346 13y ago
    The crashplan JARs decompile pretty easily - I had a go a few months ago, and they weren't obfuscated. Highlights: The crypto is pretty bad - it's using blowfish in CBC mode with a static IV of 0c22384e5a57412b (convert each byte to decimal...). The client-server protocol use 32 bit nonces and MACs, which is. License key validation works by decrypting some packed data from the key after converting the alphabet back to hex. The key is blowfish-cbc encrypted data and the only validation done is verifying the padding - about 1 in 256 randomly generated ones will have valid padding, and the length is not checked.

pbhjpbhj 13y ago

There's list of a some backup solutions relevant to personal backup (as opposed to enterprise level solutions) here, costs for most providers given too and a brief overview of differentiating features - http://alicious.com/cloud-backup-solutions/ http://alicious.com/cloud-backup-solutions/. I quite like duplicati. Slightly opaque to set-up but I'm using it with SkyDrive for some files as at the time of set-up SkyDrive gave me the most free storage with the lowest level of pain [for me] setting up.

ingenium 13y ago

I really like SpiderOak https://spideroak.com https://spideroak.com I have mine set to backup every 4 hours. It versions the files as well so you can restore to a previous backup.