> Restic can't pull backups

There's ways to pull backups. You'd use ssh forwarding and/or the REST backend for append-only backups. See this comment:

https://github.com/restic/restic/issues/299#issuecomment-456...

Could you explain why you find their encryption scheme 'lackluster'? I'm not seeing that conclusion in the linked document.

Borg uses static AES keys and requires a way to store nonces because of this. In a multi-client scenario there is no way to do that without trusting the server to some extent, so the encryption is vulnerable to nonce reuse.

> When the above attack model is extended to include multiple clients independently updating the same repository, then Borg fails to provide confidentiality (i.e. guarantees 3) and 4) do not apply any more).

Yeah, that's an issue which can be avoided by using 1 repo per client.

There are some ideas on the issue tracker for fixing this long term (like random nonces, session keys, ...), but that stuff will have to wait until after borg 1.2 (which soon goes into release candidate phase).