I thought, what would I want to be told if I was the customer?
1) The truth that there are holes in the process and here is a better solution if you need it.
or
2) That it is super secure unbreakable private key encryption.
I chose "1". I'll still stick to the story line but I will implement it in the next release.
Do you know it doesn't leave the users machine?
(I'm not asking that to be smart or anything.)
My point is that you are trusting the backup providers that it doesn't.
My main point is that you are trying to protect your data from the backup providers or their sloppy security. You aren't trusting them on one hand yet trusting them on the other that they don't store or save the key on their servers.
One popular online backup product can recover the key if you use their generated key. Which of course means they store it on their servers.
Honestly implementing private key encryption is trivial. My hesitation is that it only adds a level of security if the backup providers are trustworthy. The lack of trust of the backup providers is kind of why it is there.
Here is the scenario I envisioned that made me question it.
Let's say client X performs backups of their computer using service Y.
Service Y provides private key encryption. Client X types in his secret phrase and thinks that his/her data is secure.
Service Y must either require the secret phrase to be typed in each time the software is run or must store the key locally. They store it locally.
Someone comes with a court order demanding every reasonable effort to release the data to the court. Service Y may WANT to comply to catch bad guy client X. Or they may just not want to be held in contempt of court and get fined etc. Can they reasonably recover the key? My answer is yes service Y can reasonably recover the key. I don't believe the answer is yes if it is encrypted with a third party tool.
There are of course holes in the above scenario. You might need to automatically update the software to upload the key for that user etc. Perhaps they don't do automatic updates. They could also require an update just for that users account to function. My main point again is you are back to trusting the backup provider.
I found it highly ironic to be writing code to protect my potential customers to gain their trust without disclosing the inherent holes in that process.
My hesitation to adding private key encryption was purely on the side of NOT wanting to pretend that backup software with private key encryption protects their data against all scenarios.
But having written this post and explaining it frequently. I think I probably should just add it in.
It is mixed we backup the MBR in raw blocks. We back up files in Blocks or as a whole depending on the likely hood the file will be changed and the size of the file.
Yes we preserve permissions and ACLs for files.
What do we do if there are 1M changes in 100GB? It depends on where the changes are. We take a snapshot and any changes will be picked up in blocks of various sizes and only those changes are unloaded. So if most of the changes happened in 5GB then only 5GB would be uploaded. If they are spread out across the 100GB the whole 100GB could have to be uploaded.
We perform automatic updates. This is an option you can choose to opt out of.
Each user currently is its own account. We may offer group account management in the future.
We currently do not offer private key encryption. It offers no additional protection. Here it is from the website to save some typing "Private Key Encryption is a good way to protect sensitive data. In online Backup solutions not so much. There are many secure private key encryption programs some of which are open source and some that are free or both. What is wrong with Private key encryption in online backup solutions? When it is built in to online backup it defeats the purpose. You are giving the key to those intrusted (the online Backup provider) with encrypting and storing your data. This gives the uninformed a false sense of security. This is analogous to using a safe in your hotel room. You choose the combination (The password) and write it down on the safe for the cleaning staff (The backup program) to gather your valuables and place in the safe. They lock it and promise they haven't looked at the password. Most of us would never think of using a safe in a hotel room with that arangement. If you have ultra sensitive information on your PC we recommend that you use a third party application. If you have data that would cause you significant pain if it fell into the wrong hands, you should be encrypting it because unfortunately your PC could get stolen."
The technology does not do block compares. The only access to your data is through your account.
Yes, although it is not available for download yet. There is a windows pre-installation environment iso that you can use to restore or repair a disk.
Great catches on the privacy policy and terms. Those are definitely off from what I want in those documents. I will have those revised.
I will add screen casts and screen shots to the site. I will have to look into the invisibility issue. The icons will definitely get redone once I have someone decent to do them.
I can't really say anything yet. But you may be surprised where it is and how many places it is in the next three to six months.
For those of you paying attention. I posted this first under CRASCH and then again accidentally under VIPER.
I created the VIPER account a while ago when I wanted to share my successes with the community anonymously. The reason is that I really felt compelled to encourage my fellow hackers. I never ended up posting those. I must have written that post ten times though. I always ended up thinking it either felt like bragging or was not believable with the facts to back it up. Facts I still can't disclose because of NDAs.
Sorry for the duplicate. I thought it was inconvenient to have to cut and paste the link.
Fellow Hackers.
The product is Hybir Backup which is a full online backup service. It is windows only for now.
The site has all of the relevant information.
Comments and Questions are encouraged.
If you would like a free trial use HACKERNEWS as the promotion code.
I have lots of exciting news I have been unable to share with community just yet. But if you are where I was a year ago. I was told "NO" so many times I thought it was my nick name. Just keep going it is well worth it.
You can try Hybir Backup for free before we launch. www.hybir.com use the promotion code HACKERNEWS. Accounts are very limited.
It is windows only for now. The killer feature here is that it is full backup but extremely fast especially with backiing up the OS, popular programs and media files.
Hybir Backup can back up a clean install of windows 7 on my hardware in less time than it takes to install it (Less than 10 minutes) over broadband (2.0Mb)
You can roll back to a previous point in time in just a couple of minutes registry and all.
I thought, what would I want to be told if I was the customer?
1) The truth that there are holes in the process and here is a better solution if you need it. or 2) That it is super secure unbreakable private key encryption.
I chose "1". I'll still stick to the story line but I will implement it in the next release.