undefined | Better HN

0 pointsMichaelGG10y ago0 comments

>encryption lets me back up files to cloud services that I don't trust

Any recommendation on an accessible, audited, client for Windows users? Running some company's random binary, especially when you log in and they can identify you, implies a fair amount of trust. Tarsnap's the best one I know of and it's not really accessible for most users.

0 comments

4 comments · 1 top-level

simoncion10y ago· 3 in thread

Not sure what you mean by "accessible", so I'll go from easiest to least easy:

Truecrypt has been audited, works on Windows, and appears to offer an encrypted file container that you can attach to a Windows drive letter.

What you could do is create the container, let DropBox (or whatever) sync the file containing the container, then perform your file operations within the container.

Depending on your needs, there's also GPG4Win, which comes recommended by the GPG project maintainers. AFAIK, GPG hasn't been subject to an extensive audit, but it is venerable, open source, and developed in the open. (Yeah, so was OpenSSL, I know. ;) )

I don't know that there's a way to make a transparently encrypted container with GPG as there is in TrueCrypt, so I suspect that you'd have to:

* Copy your encrypted files

* Decrypt them

* Edit them

* Reencrypt them

* Copy them to the sync directory.

Sounds like a bit of work to me.

If you were on Linux, you could probably use dm-crypt on a loop device, and just sync the underlying encrypted file, but -again-, I have no idea how much auditing has been done on the underlying code (and this fails your "for Windows users" requirement).

Oh, BTW, I replied to our Erlang thread. If you're interested in taking a second look at Erlang, I link to a few things in the comment that might be interesting to you.

MichaelGGOP10y ago

Dropbox isn't audited. They have a poor track record for security (lying about internal access then trying to downplay). So even if you encrypt with truecrypt, you're running the Dropbox binary for uploading, and it can do anything - in short, you're trusting them.

I've not found an open source tool that does block level backups with diff/compression support. Getting the client experience right is hard and not a whole lot of fun, so I'm guessing there's little incentive for companies to open source that valuable part.

Thanks for the info on Erlang.

pjc5010y ago

I keep a list of cloud sync solutions I've looked at for a similar use case: https://github.com/pjc50/pjc50.github.io/blob/master/secure-...

I'm still not quite satisfied either.

simoncion10y ago

Oh! You were looking for audited sync clients.

Yeah, I've got nothing there.

Edit: I would ask "How hard could it be to solve 90% of the problem?", but various BigCos have had spectacular failures in recent memory, so I guess the problem is pretty damn hard.

I wonder how terrible using git as the backbone for one's sync software would be.

1 more reply

j / k navigate · click thread line to collapse