News for hackers. Stuff that matters.
Re:Ice cold archive storage by jsnell on Thursday April 11, 2019 @09:57AM (#19634563)
Encrypt backup data with a per-user key, keep the keys only in hot storage, delete the key when a user is deleted.
Re:Ice cold archive storage by anoncake on Friday April 12, 2019 @03:59AM (#19642933)
Wont that make the backups useless in case of a data loss (i.e. always)?
Re:Ice cold archive storage by jsnell on Friday April 12, 2019 @07:10AM (#19643747)
You don't keep a single copy of each key, but store enough redundant copies to get the proper number of nines. Preferably that's redundant geographically, in terms of storage technology, and in write frequency.

The important part is just that the keys don't end up in long term cold storage. Either it's only retained for a short period (e.g. tape backups that get rotated after two weeks), or it supports live deletion.