Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It leads to a bigger discussion, though, about what happens to your files when a cyberlocker (Megaupload, Dropbox) or backup provider (Backblaze) shuts down.

There's another submission on the HN fp that seems to tackle just that: http://news.ycombinator.com/item?id=3489313



I definitely agree that the lingering wide spread implications are quite serious as more of our data and services are hosted by third parties.

But for the Megaupload users, I would like to quote one of the boards I saw held up by SOPA protesters: "Dear congress it is no longer ok to not know how the internet works". Dear users, that goes for you to. And trusting your valuable data to a provider who is suspected of all kinds of shenanigans is naive. You get what you pay for.


In the case of Backblaze (which I use and highly recommend) wouldn't it just mean changing providers? As long as your hard drive doesn't fail before you get a full backup done with another solution you should be fine.


Yep, true! Unless you're in the same geographic region as their datacenter and you both get hit by an earthquake, or something.

I am also thinking about what happens in the case of a federal seizing -- I wonder if they would decrypt the data.


In the case of backblaze the private key stays on your local machine (so not even backblaze have access).


Sounds unlikely. If my hard drive crashes, how do I get my files back? (the whole point of the service)


The answer is in their documentation.

We generate a new 2048-bit RSA public/private key pair when our client is installed, store the public key on the local disk and transmit the private key to our datacenter via https. Then, for each backup session, we generate a new random 128-bit AES symmetric key which we use to encrypt the user’s data. We secure the 128-bit AES key by encrypting it with the user’s public key and transmit the encrypted file along with the encrypted key to our datacenter over https. We destroy the unencrypted 128-bit AES key at the end of each backup session and never write it to disk. To decrypt a file, the user’s private key is used to decrypt the 128-bit AES which is then used to decrypt the file.

http://blog.backblaze.com/2008/11/12/how-to-make-strong-encr...

With pictures and everything. I'm not one of their users, but that page was interesting to read.


> transmit the private key to our datacenter via https

So they can definitely decrypt your data.


You can specify your own password for the keystore. If you do this, they can't access the keys (well, outside of nefarious sniffing we'll assume for the moment they aren't doing). You also can't access your data if you forget it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: