4 ms·

>encryption lets me back up files to cloud services that I don't trust Any recommendation on an accessible, audited, client for Windows users? Running some com

>encryption lets me back up files to cloud services that I don't trust Any recommendation on an accessible, audited, client for Windows users? Running some company's random binary, especially when you log in and they can identify you, implies a fair amount of trust. Tarsnap's the best one I know of and it's not really accessible for most users.

simoncion 11y ago
Not sure what you mean by "accessible", so I'll go from easiest to least easy: Truecrypt has been audited, works on Windows, and appears to offer an encrypted file container that you can attach to a Windows drive letter. What you could do is create the container, let DropBox (or whatever) sync the file containing the container, then perform your file operations within the container. Depending on your needs, there's also GPG4Win, which comes recommended by the GPG project maintainers. AFAIK, GPG hasn't been subject to an extensive audit, but it is venerable, open source, and developed in the open. (Yeah, so was OpenSSL, I know. ;) ) I don't know that there's a way to make a transparently encrypted container with GPG as there is in TrueCrypt, so I suspect that you'd have to: * Copy your encrypted files * Decrypt them * Edit them * Reencrypt them * Copy them to the sync directory. Sounds like a bit of work to me. If you were on Linux, you could probably use dm-crypt on a loop device, and just sync the underlying encrypted file, but -again-, I have no idea how much auditing has been done on the underlying code (and this fails your "for Windows users" requirement). Oh, BTW, I replied to our Erlang thread. If you're interested in taking a second look at Erlang, I link to a few things in the comment that might be interesting to you.
- MichaelGG 11y ago
  Dropbox isn't audited. They have a poor track record for security (lying about internal access then trying to downplay). So even if you encrypt with truecrypt, you're running the Dropbox binary for uploading, and it can do anything - in short, you're trusting them. I've not found an open source tool that does block level backups with diff/compression support. Getting the client experience right is hard and not a whole lot of fun, so I'm guessing there's little incentive for companies to open source that valuable part. Thanks for the info on Erlang.
  - pjc50 11y ago
    I keep a list of cloud sync solutions I've looked at for a similar use case: https://github.com/pjc50/pjc50.github.io/blob/master/secure-clouds.md https://github.com/pjc50/pjc50.github.io/blob/master/secure-... I'm still not quite satisfied either.
  - simoncion 11y ago
    Oh! You were looking for audited sync clients. Yeah, I've got nothing there. Edit: I would ask "How hard could it be to solve 90% of the problem?", but various BigCos have had spectacular failures in recent memory, so I guess the problem is pretty damn hard. I wonder how terrible using git as the backbone for one's sync software would be.
    - pjc50 11y ago
      There's git-annex for that. I've not tried it myself.
      - simoncion 11y ago
        I had heard about git-annex before, but never had looked into it. This sounds pretty neat! I wonder what its horrifying data-eating failure modes are! :D

simoncion 11y ago

Not sure what you mean by "accessible", so I'll go from easiest to least easy: Truecrypt has been audited, works on Windows, and appears to offer an encrypted file container that you can attach to a Windows drive letter. What you could do is create the container, let DropBox (or whatever) sync the file containing the container, then perform your file operations within the container. Depending on your needs, there's also GPG4Win, which comes recommended by the GPG project maintainers. AFAIK, GPG hasn't been subject to an extensive audit, but it is venerable, open source, and developed in the open. (Yeah, so was OpenSSL, I know. ;) ) I don't know that there's a way to make a transparently encrypted container with GPG as there is in TrueCrypt, so I suspect that you'd have to: * Copy your encrypted files * Decrypt them * Edit them * Reencrypt them * Copy them to the sync directory. Sounds like a bit of work to me. If you were on Linux, you could probably use dm-crypt on a loop device, and just sync the underlying encrypted file, but -again-, I have no idea how much auditing has been done on the underlying code (and this fails your "for Windows users" requirement). Oh, BTW, I replied to our Erlang thread. If you're interested in taking a second look at Erlang, I link to a few things in the comment that might be interesting to you.

MichaelGG 11y ago
Dropbox isn't audited. They have a poor track record for security (lying about internal access then trying to downplay). So even if you encrypt with truecrypt, you're running the Dropbox binary for uploading, and it can do anything - in short, you're trusting them. I've not found an open source tool that does block level backups with diff/compression support. Getting the client experience right is hard and not a whole lot of fun, so I'm guessing there's little incentive for companies to open source that valuable part. Thanks for the info on Erlang.
- pjc50 11y ago
  I keep a list of cloud sync solutions I've looked at for a similar use case: https://github.com/pjc50/pjc50.github.io/blob/master/secure-clouds.md https://github.com/pjc50/pjc50.github.io/blob/master/secure-... I'm still not quite satisfied either.
- simoncion 11y ago
  Oh! You were looking for audited sync clients. Yeah, I've got nothing there. Edit: I would ask "How hard could it be to solve 90% of the problem?", but various BigCos have had spectacular failures in recent memory, so I guess the problem is pretty damn hard. I wonder how terrible using git as the backbone for one's sync software would be.
  - pjc50 11y ago
    There's git-annex for that. I've not tried it myself.
    - simoncion 11y ago
      I had heard about git-annex before, but never had looked into it. This sounds pretty neat! I wonder what its horrifying data-eating failure modes are! :D