Hacker News Reader

> though borgbackup is still unable to back up to the same repo from multiple hosts at the same time

Wouldn't that mean that, when using encrypted backups, secrets would have to be shared across multiple clients?

If I'm understanding it correctly, it sounds like an anti-feature. Do other backup tools do that?

Yes, it seems to be the case; only the data in the server is encrypted, while the key is shared between clients sharing the same repository.

I'm not sure if content-addressed storage is feasible to implement otherwise. Maybe use the hash of the the unencrypted or shared-key-encrypted as the key, and then encrypt the per-block keys with keys of the clients who have the contents would do it. In any case, I'm not aware of such backup tools (I imagine most just don't encrypt anything).

CAS-based backup tools leak metadata like a sieve, so they're generally not the best choice for the most paranoid people, which should probably stick to uncompressed tar archives (or zips, which avoid compressing unrelated files together, which leaks data) padded to full 100 megs or so and then encrypted en bloc.

Reply on news.ycombinator.com