The PGP Problem

Re:The PGP Problem by cyphar on Tuesday July 16, 2019 @11:27PM (#20456162)

I would suggest using restic over TarSnap for encrypted backups -- it gives you more flexibility with where your backups will be stored since TarSnap is pretty integrated with Colin Percival's online service and is also unfortunately not free software. But it's also an as-simple-as-possible cryptosystem. Filippo did a quick lookthrough and said that it seemed sane from a crypto perspective[1].

[1]: https://blog.filippo.io/restic-cryptography/

[ Parent | on HN ]

Re:The PGP Problem by JoshTriplett on Wednesday July 17, 2019 @01:41AM (#20456802)

I'm using Restic, and it mostly works. Unfortunately, it uses an absurd amount of memory, proportional to the size of your backup store. So, don't use it to back up a small VPS.

If you do, "export GOGC=20" can help a little, but it'll still use a lot of memory.

[ Parent | on HN ]

Re:The PGP Problem by tptacek on Tuesday July 16, 2019 @11:32PM (#20456178)

Restic is also fine.

[ Parent | on HN ]

Re:The PGP Problem by bnf on Thursday July 18, 2019 @09:20AM (#20469442)

I wish that restic supported asymmetric keys. I'm uncomfortable storing the key alongside the backup tool, even if it just gets injected at runtime. If a nefarious party gets the key all my backups from that key are vulnerable.

I suspect that it's probably hard to add that functionality because you can't do the deduplication without decrypting the prior backups (or at least an index). That would also explain the memory usage JoshTriplett mentions.

[ Parent | on HN ]

Re:The PGP Problem by always4getpass on Wednesday July 17, 2019 @04:24AM (#20457543)

Any opinions about rclone?

It seems to be fine for my mediocre backup needs

[ Parent | on HN ]

Re:The PGP Problem by cyphar on Wednesday July 17, 2019 @04:26AM (#20457554)

rclone is fine (in fact I use rclone with restic to synchronise my restic backup repository on BackBlaze B2) but it doesn't encrypt or deduplicate your backups -- it's just a synchronisation tool like rsync.

[ Parent | on HN ]

Re:The PGP Problem by always4getpass on Wednesday July 17, 2019 @04:37AM (#20457605)

What about its 'crypt' encryption backend?

Afaik it uses scrypt which was designed for tarsnap

[ Parent | on HN ]

Re:The PGP Problem by cyphar on Wednesday July 17, 2019 @04:49AM (#20457652)

Ah, I wasn't aware it had an encryption backend. Just looking at the documentation I'm quite worried -- why on earth is there an "obfuscate" mode?

I would suggest using restic. It doesn't have any weird modes, it simply encrypts everything and there isn't any weird need to specify (for instance) that you want things like metadata or filenames encrypted. Also backups are deduplicated using content-defined-chunking -- giving you pretty massive storage savings. If you really need rclone since it supports some specific feature of your backend -- restic supports using rclone as a synchronisation backend (or you can do what I do, which is to batch-upload your local restic backup every day).

[ Parent | on HN ]

Re:The PGP Problem by namibj on Wednesday July 17, 2019 @05:00AM (#20457697)

It's a choice between plaintext filenames or no plaintext filenames.

You might want to crypt your nudes, but still access normal pictures unencrypted through the provider's web interface.

[ Parent | on HN ]