What's questionable about it? It seems that they use modern AEAD ciphers in a reasonable way.

I'm more concerned about the repository format and config file (i.e. attack surface, since the repo is potentially untrusted).

Performance is actually better than Restic, and performance-critical parts of Borg are written in C or use C libraries.

> What's questionable about it? It seems that they use modern AEAD ciphers in a reasonable way.

No, using one key per repository and a persistent message counter is not a reasonable design.

https://borgbackup.readthedocs.io/en/stable/internals/securi...

For what threat model does this matter?

"When the above attack model is extended to include multiple clients independently updating the same repository, then Borg fails to provide confidentiality (i.e. guarantees 3) and 4) do not apply any more)."

Edit: I've posted this a bunch of times here, pretty much every time it caught my eye when someone said this tool has good crypto, and by now I'm used to people just downvoting it and saying it doesn't matter because obviously no one ever would use it like that and the design is fine etc. (isn't the point of deduplication to save disk space?)

From OPs link:

> If we perform similar backups to the same remote destination over SSH (Borg) and SFTP (Restic), the initial backups take roughly the same time, but the subsequent incremental backups take something like 10x longer with Restic.

Also I'm wary of encrypting personal backups. I think the chances of me forgetting a password that I used literally once are quite high, and what's the point of a backup if you can't actually access it?

I'm worried about that too, but you can deal with it by making the system that automates your backups also test your memory of the password (while still creating a non-interactive backup even if you ignore the prompt). Alternatively, reuse a password that you regularly use offline, like a disk encryption or SSH passphrase.

Or use a password manager..

I would also like to know more about why you think Borg's encryption is questionable. I'm not familiar with Borg's internals, but there's not much one could do wrong here, as it should just be simple symmetric encryption. Does it not use a strong cipher? Is the cipher used incorrectly? Is the key derivation method weak?