What does "military-grade encryption" even mean? Are your cloud backups really private?

Most competitors in the cloud backup space often claim "military-grade" encryption. This is a completely meaningless phrase and should not comfort anybody. DES and 3DES were "military-grade" and are today trivially cracked. The only reason you should trust anybody's assertions about data security is if they at least publish a white-paper on how their data security works. Even better is if the entire source code is made public that allows anybody to verify the assertions of encryption.

Additionally, encryption is an evolving subject and you need to stay on top of the subject and be prepared to always re-evaluate your assumptions of what is the best-of-breed solution for any given requirement. This is why during its relatively short history Underscore Backup for instance has upgraded its password hashing algorithm from PBKDF2 to Argon2 and it has moved from CBC to GCM encoding of the AES encryption.

There are a few tell-tale signs that most cloud backup solutions probably do have access to your data and I just thought I would point them out. If either of these two are true it is unlikely that your data could not be accessed by your cloud backup provider without your expressed consent.

• If they provide a web interface to access your backup that most likely means that your data can be accessed by the provider's back-end systems since unpacking an entire backup is unlikely.
• Unless you can and are managing your own encryption keys or are using public key encryption that means that the service itself will manage your encryption keys.

Given the Open Source nature of Underscore Backup and the publication of its threat model you should feel safe to trust the data in Underscore Backup is available only to you.

Photo by Towfiqu barbhuiya on Unsplash

Signal already added quantum safe encryption to its messaging platform

Signal recently announced that they have already added quantum safe public key crypto to their messaging platform. This is a great step forward for post quantum crypto and a good first proof of concept for the CRYSTALS-Kyber encryption protocl currently a finalist in the NIST post-quantum cryptography project.

As soon as a winner has been announced in the NIST competition has been announced you can expect that Underscore Backup will be upgraded to support it as an encryption algorithm for its backups. We are currently holding off because until the review is complete it is possible that a compromise might be found (Another finalist was recently compromised by academics). However, rest assured that Underscore Backup is closely monitoring this space with the goal of keeping our customers as safe as possible with current available technology and updates will be made available for free as always.

Photo by Fractal Hassan on Unsplash

What should you keep backups of?

Deciding what to back up is a tricky thing and can differ a lot depending on the user. Most personal backup solutions are designed for people who have most of their work in medium-sized files stored in a handful of folders on their computers such as office documents, some photos, etc.

Underscore Backup is designed for tinkerers who tend to fiddle on their computers all over the place and for whom it would be too time-consuming and error-prone to try to keep up with what changes you made ahead of time so aims to back up everything, big or small. It also allows you to have full control of your retention of historical changes and deleted files.

This might sound strange, but I can personally remember several times when I realized a few months after upgrading my computer that I wished I had remembered to copy that one file off of the old computer where I had tweaked an obscure settings somewhere to make it do something I wanted. To solve this the entire storage methodology for the application is specifically designed with multiple different storage techniques supported which will be chosen automatically depending on the data to support both millions of very small files and a few very large files (Several TB are no problem, once you start getting to PB it is not entirely efficient but could be easily extended if the need arises). It can also obviously handle any combination of the two, for instance, I have a single server where I store many large media files as well as several hundred thousand files of router packet logs.

Because of this, the default settings for Underscore Backup will back up everything in your home directory with a few explicit exclusions which are known to be very unlikely to contain useful data (Such as the browser cache folders for instance). Due to its efficient file handling, it can do this without causing your backup size to balloon excessively and still allowing you to efficiently browse, search, and restore any data you want.

Picture by Elisa Ventur on Unsplash

Version 2.3 with new MacOS app as well as many new features, stability, and security enhancements

The new 2.3 release is available to download now from the download page.

Major new features.

• Completely new MacOS UI implementation that is now just a regular application, not a package.
• Added the ability to run Linux and Windows platforms as a service or root while still controlling through a non-privileged application.
• Encrypt all API communication between UI and service.
• Implement a new secure custom authentication mechanism based on knowledge of backup password instead of separate credentials.
• Detect corrupt local repository and add a method to repair it.

Minor improvements.

• Sort schedule sets in order of the next scheduled run.
• Improved performance for Linux metadata storage.
• Option to disable backups when CPU load is high.
• Increased performance for uploading metadata logs.
• Several tweaks to button labels and status messages in UI.
• Improved performance for large directories and files on MacOS.

Notable bug fixes.

• Fixes to continuous backups for Linux and OSX.
• Fixed issue with eventual consistency that could sometimes cause a single log file to be left from old logs after performing a log optimization.
• Detect and remove orphaned backup files that are not referenced by any directory entry.
• Fixed issue with symbolic links (Junctions) on Windows.
• Fixed an issue where very long directory names could confuse the root path.

Also contains numerous minor bug fixes and tweaks.

Major performance improvements coming in version 2.3 soon

The next release will feature new handling of log uploads where this is now multithreaded. On a test system with a backup with aorund 5 million files and 50TB of data a log optimziation operation went from taking 90 minutes to 17 minutes or finishing almost 6 times faster than the previous release.

Other things also included in the new release will be improvements running as a service on Windows and Linux. Better handling of continuous backups. Detection and correction of corrupted local metadata repositories. This on top of a myrriad of other minor improvements and stability enhancements.

The new release is almost ready and you can try it out now with a release candidate from the download page.

A new version is coming soon with significant new functionality!

The new release includes a ton of new functionality such as the ability to run as a service on Windows and Linux as well as a completely new and better-integrated MacOS installer. All API traffic between UI and local service is encrypted. Detection and repair of local repository metadata have been added. You can try out the newest release candidate right now from the downloads page.