blog.world3.net

Cloud backup security review – it’s bad

07/02/2020 – 13:08

Spideroak is broken so I’m looking at alternatives. Turns out there aren’t many services that get security right, and none that I’d call good.

Spideroak has proper zero-knowledge encryption. Everything is protected, including metadata such as file sizes. Unfortunately the client software is broken and they can’t fix it.

Backblaze only has basic encryption as far as I can tell, metadata is unprotected. https://www.backblaze.com/backup-encryption.html

I emailed iDrive about their security and they confirmed that they don’t fully encrypt metadata.

IASO Backup seems to be dead, website is down.

Crashplan is unclear, looks like maybe they protect metadata but the client is extremely limited and at $10/computer/month it’s not great value.

Jungle Disk is vague about their crypto, looks like metadata is unprotected.

KeepVault looks pretty basic and is insanely expensive.

Tarsnap has good security with what looks like zero knowledge backups, but is very expensive ($250/month for 1TB).

I emailed Sync and they confirmed that file sizes are available on the server side, so not zero-knowledge.

pCloud does per-file crypto, so not zero-knowledge.

tresorit lies about being zero knowledge, their support staff admitted that they can see file sizes.

Carbonite‘s web site is vague, I assume they have crap security or they would be touting it.

Elephant Drive has only basic encryption.

MSP360 might be okay, I have contacted their support to confirm. $50 for a 1 computer licence isn’t cheap and then you use your own choice of storage provider. I asked if I can use Google Archive storage at $1.25/TB/month.

Boxcrypter claims zero knowledge but it’s a lie, they actually charge extra for filename encryption and even then all the other metadata is unencrypted.

Cloudberry does not encrypt metadata.

Iperius is not clear, I might give it a try. They say they ZIP everything up so you get the security of a ZIP archive… At least with modern versions it’s reasonable I suppose.

Duplicati – we finally have a winner! Proper zero knowledge encryption, it’s open source and it works with a variety of storage providers.

By mojo | Posted in Uncategorized | Tagged backup, cloud | Comments (0)

Spideroak long term review

14/05/2016 – 22:15

Been using Spideroak for backups for about six months now. They were doing a special offer with unlimited space, and they offer zero-knowledge encryption (so the key never leaves your computer). Overall it’s pretty good but I have had some annoying issues with the client software.

The first major issue is that the client needs to create temporary files that are as large as the largest file in the backup set. It creates them in the default temporary directory, which is a really really bad idea. On Windows this is the user’s profile directory, and it can easily cause your system drive to fill up. This makes the app hang and Windows starts to have problems. Other apps will crash too, and it’s easy to lose data. I back up some pretty big files, like 100GB disk images and virtual machines, and the system drive on my server is only 40GB total.

There is a work around, which is to run Spideroak with a CLI parameter that tells it to use a different directory for its profile and temporary data. No way to configure it in the client, and it doesn’t handle this and a few other error conditions at all… It just hangs.

The second issue is that the client seems to have major problems communicating with the server when it needs to re-download data after a severe crash. Often it just hangs again. Sometimes you get an error message, but often the UI just craps out and the background task keeps going so you can’t restart it without manually killing that off first.

I have about 3TB of data and over 800,000 “versions” (mostly individual files, some multiple versions of the same file) and it seems to be struggling. The app mostly copes okay but does start using a lot of memory and getting rather slow. It does de-duplication so it needs to keep a lot of metadata around, but I can’t help feeling that it could be more efficient.

If they could just sort the client out then I’d have no hesitation recommending Spideroak.

By mojo | Posted in Uncategorized | Comments (0)

Failing to properly disable DMA breaks the ADC on an XMEGA

02/07/2013 – 11:33

Just debugged an annoying problem where the ADC would never trigger its conversion complete interrupt after I had been using DMA to collect samples from it. Turns out that even though the enable bit in DMA.CTRL had been cleared and the DMA system put in power saving mode it was still having some effect on the ADC. The solution was to not only clear the enable bit for the DMA controller, but to clear the channel enable bit and use the reset bit to clear both out completely.

By mojo | Posted in avr | Comments (0)

I call bullshit

27/01/2013 – 17:49

Spotted an “Editor’s pick” comment on the BBC News web site:

“Rachel :

This has been a problem for years, I recall being viewed as a nuisance for finishing class work & homework half way through the lesson at comp school. I was bored, frustrated and rebellious & ended up getting through 3 schools before leaving with no qualifications. I guess you could say that was a state education fail. I still ended up with a PhD from Cambridge but no thanks to the state system.”

The path from leaving school with no qualifications to getting in to Cambridge, let along getting a PhD from there, would make an incredible story if true. Worthy of a BBC News article, in fact. Unfortunately, Rachel almost certainly made it up as a lame “trump card” in the debate. I wonder if this is a British thing, just making stuff up so you can moan about how crap everything is, or if it happens everywhere.

I wish the BBC would apply the same scepticism and questioning to members of the public as they do to everyone else. I remember another person on Newsnight a while back complaining that when she went into hospital for an operation she was pushed down the queue because some black woman, new the country and unable to speak English, was prioritized ahead of her. No reason given for this prioritization, except the implied racism against white people and that immigrants somehow get everything first because because of the EU or something. No explanation of how she came to know the intimate details of this other person’s medical history in order to decide her own need was equal or more urgent. Gordon Brown was right, people like that are bigots who just love to hate, and the BBC loves to give them a platform without challenging their bullshit.

By mojo | Posted in BBC, idiots | Comments (0)

XMEGA ADC set-up

10/01/2013 – 16:44

Setting up the XMEGA ADC can be a bit confusing. There are two basic set-ups I use:

1. Single ended, GND to AREF with zero at GND, 0-2048 (11 bits). Set signed mode (CONVMODE bit) and single ended mode (SINGLEENDED bits).

2. Differential, GND to AREF with zero at MUXNEG, -2048 to +2048 (12 bits). Set signed mode (CONVMODE bit) and differential mode (DIFF bits).

By mojo | Posted in avr | Comments (0)

O PayPal, how I hate thee

28/11/2012 – 23:20

Whenever I pay for anything with PayPal the list of addresses contains every one I have ever entered, like places I haven’t worked at for years. There is no way to delete them, the only option is to call customer services on the phone. That is the official response on the PayPal forums.

I have to change the payment method from bank transfer to credit card as well. Bank transfers offer no protection beyond PayPal’s bullshit dispute resolution service, where as with a credit card the bank has some level of liability for fraud or even just faulty goods.

And… why… is… it… so… fucking… s… l… o… w… ?..

I really, really wish PayPal would just die. Google Checkout is much, much better. I wish more web sites would accept it. It is in their interest to do so – the fees are lower and the dispute resolution service is fair and reasonable.

By mojo | Posted in idiots, Internet | Comments (0)

Britain’s lost decade

08/08/2012 – 22:50

I think we are about half way through our lost decade now. At least I hope we are, 2018 should be the start of the recovery, assuming there is a change of course at the next election.

Exactly what happened to Japan has happened to us. It’s the kids I feel worst for, the ones just starting out after college or university and finding that there is no money, no jobs and no hope for at least another five years.

By mojo | Posted in politics | Comments (0)

The ioSafe is probably overkill

05/08/2012 – 23:22

The ioSafe is a fireproof and waterproof USB hard drive. The idea is that even if your house is burned down or flooded it will survive. It sounds like an excellent way to secure your backups, although it is a bit expensive at £170 for the 2TB version.

Thing is I don’t think there is really much need for something like that, at least for me. Between various services I have over 100GB of online storage available. Shitty download limits on Virgin make it a bit annoying to use them, but still. I have far more than 100GB of stuff to back up, but most of it is static so I can just stick it on a normal USB hard drive and keep that somewhere safe away from my house.

The ioSafe also doesn’t provide any protection against power surges, which are the biggest threat. It is also only good for a 3m fall, not much if you use it on the first floor of your home. If you have a lot of data that changes often I can sew how it could be handy I suppose.

By mojo | Posted in hardware | Comments (0)

kNet hacked?

12/07/2012 – 21:25

I had a rather disturbing email from Google a few days ago. They reported a URL on my web site that was being used for phishing. Sure enough when I loaded it there was a fake PayPal login page.

The page was on the mail.world3.net subdomain. This subdomain is set up automatically by kNet and I don’t have any access to it. I can’t delete it, can’t access the files on it via FTP or any other means, can’t control it in any way. I changed my passwords anyway, but was unable to do anything about the page. Naturally I contacted kNet immediately.

Unfortunately by the time kNet looked the page had been removed and in a panic I forgot to take a screenshot. They seemed sceptical and refused to acknowledge that the hack couldn’t have been using my credentials. After all, I have no access to the mail.world3.net subdomain. kNet seem to be in denial… But what other explanation is there?

By mojo | Posted in Internet | Comments (0)

Atmel ASF compiler flags

19/06/2012 – 16:57

The following need to be set up to add Atmel ADF USB CDC code, and possibly other code, to an existing project. In the optimization settings add “-fdata-sections”. In the symbols section add “BOARD=USER_BOARD” or whatever you are working with.

By mojo | Posted in avr | Comments (0)

たとえ溺れても梦はゆめでしかない

blog.world3.net

Spideroak long term review

Failing to properly disable DMA breaks the ADC on an XMEGA

I call bullshit

XMEGA ADC set-up

O PayPal, how I hate thee

Britain’s lost decade

The ioSafe is probably overkill

kNet hacked?

Atmel ASF compiler flags

Meta

Categories

Archives

Links:

June 2020
M	T	W	T	F	S	S
« Feb
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30