up vote 4 down vote favorite
share [g+] share [fb]

I have read several recommendations of online backup services. These indeed sound attractive options as they provide a means for off-site backups, and I would expect they ensure your data is backuped thoroughly. However, I particularly dislike the thought of publishing my data online. Is it possible to use an online backup service while keeping your data private?

link|improve this question
If you ONLY want to use an online backup then also consider how you're going to restore that when needed. (And he, you're the first "0% accept rate" I encountered. Lovely pink colour though.) – Arjan Sep 8 '09 at 11:47
1  
"0% accept rate": That is because I hate to choose for others which of all answers is The Right One. – Dimitri C. Sep 8 '09 at 11:54
1  
But "accepting" just means "this answer worked for me". But you've already had this discussion over on meta - meta.stackoverflow.com/questions/18054/… so repeating here won't help. – ChrisF♦ Sep 8 '09 at 13:07
@ChrisF: you're are right, but I wasn't trying to reopen the discussion. – Dimitri C. Sep 8 '09 at 13:39
feedback

migrated from superuser.com Oct 1 '10 at 14:56

This question came from our site for computer enthusiasts and power users.

9 Answers

up vote 7 down vote

Yes and No,

Pretty much every online service has encryption to prevent your documents being compromised if a server or hard drive goes missing (assuming they do all the back ups and fault tolerance their end).

However, if you can decrypt / get it using software, it pretty much always means that they would also be able to.

Your only real bet is to encrypt it yourself using something like Truecrypt, and backing up the encrypted version (just don't backup a plain text file with the encryption key!.. Can't tell you how many times I have seen people do that!)

If you really think that a place is dodgy and will read your items, perhaps they would not be the correct place for you. However, if you are like me and just over suspicious of everyone, encrypt or do not use these services!

link|improve this answer
Thanks for your answer. I have thought about the TrueCrypt solution. However, is it possible to do a synchronization with this solution without copying the whole image over and over again? – Dimitri C. Sep 8 '09 at 10:53
probably not, you could zip / rar individual files and put a password on them, but when I last looked, zip/rar security could be broken really easy. – wilhil Sep 8 '09 at 11:00
A few sites allow you to provide your own seed that they say they use to encrypt the file before they even get it. You create a passkey file that you have to provide anytime you want to interact with your account. If they're doing what they say, they can't decrypt it without cracking the encryption algorithm. – mikezx6r Sep 8 '09 at 11:59
If you don't trust the backup provider with your data, how can you trust them with the key to your data? (See Michael Borgwardt's answer.) – Randy Orrison Sep 8 '09 at 13:41
feedback
up vote 5 down vote

The only real safe way would be to use well-reviewed open source software (probably something rsync-based) and use an online service only as dumb repository for encrypted data.

The problem is that (as far as I'm aware) the dedicated backup services all require you to run a proprietary client. If they wanted your data, all they'd have to do is have that client run a keylogger to defeat any encryption you're doing yourself.

Unfortunately, those proprietary clients are much better than anything open source at making the backup process easy and unobtrusive.

link|improve this answer
feedback
up vote 3 down vote

You may also check out http://www.wuala.com/ not exactly a backup service, but an online storage service, where data is stored encrypted. So I'm not sure if it suites your needs.

link|improve this answer
feedback
up vote 2 down vote

You could encrypt your files (and keep the keys with you of course) like already suggested in most answers here.

You could use bcrypt to encrypt a group of files or individual files to avoid download and upload for each edit.

But, if the sum of your files is a small number, it would be safer and easier to use a TrueCrypt volume which contains a compressed (7z or tar.bzip2) pack of the files.

link|improve this answer
feedback
up vote 1 down vote

Further to Wil's answer, Dropbox is one service (and there must be others) which uses rsync to synchronize files - so only changes are uploaded. This should make syncing a truecrypt volume bearable.

Reference: https://www.getdropbox.com/help/8. They also have a page on using truecrypt.

Shameless whoring time: if you do sign up, you can use this referral link to get us both 250MB extra space: https://www.getdropbox.com/referrals/NTE5MDYzNjQ5

link|improve this answer
"This should make syncing a truecrypt volume bearable". Are you sure? I would expect that it is necessary to do a full file comparison of the whole volume for rsync to determine what parts are actually modified. – Dimitri C. Sep 8 '09 at 11:53
1  
I have a 50MB Truecrypt file that I sync with Dropbox. It seems to me that everytime I make changes in the TrueCrypt, it uploads the whole thing. Even though rsync attempts to do the right thing, binary files are likely to change everywhere, even with the smallest change – mikezx6r Sep 8 '09 at 11:58
1  
"binary files are likely to change everywhere": especially so with an encryption tool. – Dimitri C. Sep 8 '09 at 11:59
feedback
up vote 1 down vote

Yes, if you choose the right online backup provider.

If you ensure that they provide an SSL encryption connection to their server and the data is encrypted the other end, it is a good start.

One great example of secured online backups is Mozy Online Backup. It uses a secured SSL connection from your computer to the backup server and stores the data encrypted their end. Very secure. It is also free up to 2GB. Beyond that, costs are very low. Of course, this is just one example.

link|improve this answer
feedback
up vote 1 down vote

I recently asked about online backups on server fault to a different end. It brought to light rsync.net which might be attractive to you. They don't require a client to use, although they do provide a lightweight agent that can automate backups for you. If you desire, you can opt for your own tools to back up to them using ftp/sftp/scp/http. They pretty much just provide you access to a remote file server, and let you decide on how to put the data there. The tool they provide though allows for extensive configuration of backups as well as email reporting. Again, the tool isn't required, but is worth checking out. We have had a lot of trouble with Mozy for our remote servers, and are about to start migrating over to rsync.net.

link|improve this answer
feedback
up vote 1 down vote

Jungle Disk will encrypt your data. However, it is a bit more complicated to set up than services like Mozy and Carbonite, and it can easily get more expensive depending upon how much data you wish to store.

link|improve this answer
feedback
up vote 0 down vote

I still wonder about that people have not understood the most basic fact about crypto: if you want a trustable crypto solution, it must be OPEN SOURCE! There is no such thing as "you can trust our product with crypto" - so all the reviewers here that recommend services that do not offer the FULL sourcecode to their products, completely FAIL. To give a reommendation: use http://code.google.com/p/duplicati/ and have everything under control. Again, for the slow guys in the back rows: CRYPTO != TRUST. If a company is writing marketing blabla like "you can trust our product" without releasing the source, just forget it.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.