Hacker News Reader

Comment by mcphilip | Hacker News Reader

While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girlfriend) that are clueless about such dangers.

Are there any recommendations of a simple way to at least enable automated backups of local documents to the cloud on a windows box?

View on HN

Look into one of the many cloud based backup providers. I don't have any specific recommendations but here's a list off the top of my head:

1. http://www.carbonite.com/ 2. http://www.crashplan.com/ 3. http://www.backblaze.com/

From the Reddit article linked above [1]:

"Backup solutions like Carbonite are no good against this as they will commit the encrypted files to the cloud."

You need "cold" backups to get around this without paying.

[1] http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care...

I'm assuming that Carbonite doesn't have a Dropbox-like version retention system? Or does this virus get around that?

I was under the impression that Crashplan's backups included limited versioning?

They do. I wouldn't even call them limited. They're pretty extensive, up to and including never remove deleted files.

Backblaze maintains previous versions of files on a rolling basis of 4 week window. This includes deleted files.

I do not work for backblaze, but I am a happy user.

Tarsnap is the only sensible backup provider given the recent history of warantless secret searches in America. SpiderOak is also a contender for file sharing. Both use end-to-end encryption knowable only to the end-user.

I can't afford to have my family photos backed up to tarsnap. Let the NSA have 'em.

It's funny you mention that.... I implore 'cperciva to consider a glacier-level service. It is hard to compete with backblaze, but capping network bwdth is proly one way to skin that cat.

CrashPlan supports this, although it is not the default.

It's also not auditable: Tarsnap, while not OSS, has easily available source code for perusal and personal use, if I recall.

The crashplan JARs decompile pretty easily - I had a go a few months ago, and they weren't obfuscated.

Highlights:

The crypto is pretty bad - it's using blowfish in CBC mode with a static IV of 0c22384e5a57412b (convert each byte to decimal...).

The client-server protocol use 32 bit nonces and MACs, which is.

License key validation works by decrypting some packed data from the key after converting the alphabet back to hex. The key is blowfish-cbc encrypted data and the only validation done is verifying the padding - about 1 in 256 randomly generated ones will have valid padding, and the length is not checked.

Why on earth would anyone use symmetric crypto for license keys?

Probably a misguided attempt to keep less data in the database. The key in the client appears to be a test key - verification is server side.

The test key:

/com/code42/license/LicenseKey.java: private static final byte[] KEY = "Brian in the Conference Room with the Mouse. To be.".getBytes();

I assume this is some inside joke referring to Brian Bispala.

Noice. =) Expounding would kickass, both kinds. ; D

Thanks! That's really good to know...

I assume you're using a temp because of the DMCA?... :(

Because possible angry lawyers.

I like and have used Tarsnap in the past, but it's not like other providers prevent you from uploading encrypted archives, they just don't encrypt them themselves.

There's list of a some backup solutions relevant to personal backup (as opposed to enterprise level solutions) here, costs for most providers given too and a brief overview of differentiating features - http://alicious.com/cloud-backup-solutions/.

I quite like duplicati. Slightly opaque to set-up but I'm using it with SkyDrive for some files as at the time of set-up SkyDrive gave me the most free storage with the lowest level of pain [for me] setting up.

I think that you could use Box for this pretty effectively. With their $15/month business plan, you get 1TB of storage and can apparently set any directory as a "workspace", which presumably includes the home directory. For most users, that would be more sufficient to keep everything backed up and the syncing process is supposed to be the same kind of transparent deal as Dropbox (which would also be a good solution, except that you can't set an arbitrary directory as your Dropbox folder).

until it encrypts the workspace and that gets synced. Although, I suppose you might have a previous revision as I know dropbox supports versioning for some (all?) kinds of files.

Yeah, I'm pretty sure you'd have previous versions to work with. It would be important to check though.

Not technically a true backup system, I think, but Dropbox is pretty easy to use and is a lot better than nothing.

I really like SpiderOak https://spideroak.com

I have mine set to backup every 4 hours. It versions the files as well so you can restore to a previous backup.

Reply on news.ycombinator.com