Hacker News Reader

Comment by aledalgrande | Hacker News Reader

Aside from legitimate DMCAs what I'm worried about is losing backupped files of any sort because some rogue individual files a complaint on stuff they don't own or because of an ML error and an inexistent customer service by Google. Also I don't really like the service to sneak onto any files I upload. What alternatives do we have for cloud file backup? I already do full backups, need something to sync files between devices.

View on HN

I use an S3-comptaible hoster with the rclone client which supports encryption/decryption on the fly. That is, I don't even need to trust my S3 provider.

For syncing between devices, I guess `rclone sync` should do the trick.

Is there a guide to set this up? Thanks in advance

Yup: basically you need to set up a regular S3 backend (guide here: https://rclone.org/s3/), and then you can set up a "crypt" over it (guide here: https://rclone.org/crypt/).

You're leaking quite a lot of information to the provider if the encryption is per-object. Not saying this necessarily matters in your use case, but good to be aware of the limitat a lot can be deduced from file sizes, timeline of accesses, and access pattens of files. And most importantly of course you're still trusting the provider for availability.

For example if you saved a folder of mp3 files using the rclone crypt functionality that you downloaded from a known BitTorrent, it would be easy for an adversary to match that set of known sized objects with high confidence at the storage provider end, or from observing encrypted network traffic (which in the S3 case leaks object size through traffic patterns) and deducing object sizes from there.

Thanks for the advice. I didn't know that. In my case, it does not matter much (my data is mostly produced by myself). But, sure, it is good to be aware of that fact!

There's methods to use S3-like platforms without leaking data. Restic does this by packing blocks of data together and encrypting them instead of doing it on a per-file basis. This allows for deduplication at a block level and functionally making the contents ambiguous noise.

An owncloud droplet or owncloud on a VPS. Or an owncloud paid instance. All depends on your budget and your needs and your time.

I totally switched off Dropbox when they limited the number of devices. Self host owncloud on a VPS, am very happy. From time to time I have to occ:upgrade something et voilà. Used for syncing, not backing up.

It helps that I can install and maintain it though, wouldn't recommend it to anyone without a bit of wed/IT experience or the time to lean some basics.

Just installed nextcloud, an owncloud fork today. Be warned, while server side encryption works, e2e is completely broken and has been for non brand new accounts for quite a while judging by the github issues.

I'm not sure how much should I trust a vps host. I can mess around with encryption all day long but they can compromise my mail server without me ever knowing.

> I'm not sure how much should I trust a vps host. I can mess around with encryption all day long but they can compromise my mail server without me ever knowing.

Basically, you can't. It all depends on your threat model.

edit: https://owncloud.com/features/end-to-end-encryption-2/ owncloud community and standard edition don't have e2e

Weird to think about it because some people trust VPSes with their entire business and not just their email and phone backup like I would.

The enterprise edition is out of my budget range unfortunately.

Maybe have a look at cryfs and encfs ? One of them is `optimized` for always on syncing and small chunks (can't remember which) and the other is deprecated (or a third one, can't remember at the moment).

But yeah, if you have a business... don't self host too much sensitive stuff, delegate if you can.

You wouldn't lose the content just the ability to share it, if I read it correctly, which is something I wouldn't normally want anyway. My backups are done with restic so Google can't tell what's present since it's encrypted.

This has been my take as well.

Honestly, if you're keen to share something you shouldn't, it's pretty trivial to host it via https://rclone.org as an http server. The only person accessing it off of Google drive is the original owner and gdrive can't tell that it's being shared beyond that.

SyncThing, Dropbox

From another comment it seems like Dropbox also can snoop and remove your files. Will check SyncThing thanks!

rsync and a dedicated server at OVH is starting to sound about right.

Rsync.net has an HN member discount if you ask, they have for years. They mention it on here sometimes

Would also highly recommend Tresorit for a similar E2EE service. (Not affiliated, just a happy customer)

nice, pricing looks decent too

There's a fantastic gadget for syncing your files between different devices....it's called a USB stick

Nextcloud/owncloud if you want to self-host

Reply on news.ycombinator.com