Encrypting Cloud Files and everything I guess

[GWestphal]

Curious how other people do this:

I am becoming more and more jaded on companies intentionally or unintentionally giving up the ghost on my data. How does one protect the cloud files?

I know my local drives are encrypted with FileVault 2, but what about my iCloud data or Dropbox data or Gmail/Google Drive?

Is there anyway to make all that data encrypted at the file level so it can be easily synched but also only readable from the 4-5 computing devices of my choice?

I know Crashplan lets you use a custom key that they can't recover so you just have a bunch of garbage files on their server and if you loose your key, tough. Do dropbox, apple, google allow you to do the same thing? Taking the ability to decrypt user data out of their own hands?

 

[Rakehellion]

iCloud data is encrypted.
Google's ToS says they own all of your data anyway.
SpiderOak is another encrypted cloud syncing service.

You can use Disk Utility to create an encrypted disk image and store everything on there while keeping aliases of the files in convenient locations. When you access the alias, it'll automatically open the encrypted disk image where the file is stored.

 

[TheStu]

iCloud data is encrypted.
Google's ToS says they own all of your data anyway.
SpiderOak is another encrypted cloud syncing service.

You can use Disk Utility to create an encrypted disk image and store everything on there while keeping aliases of the files in convenient locations. When you access the alias, it'll automatically open the encrypted disk image where the file is stored.

I thought you wanted to use a SparseImage for that since it would grow as you needed it? It's been a while since I've looked into that though.

 

[Kaido]

Given the recent security info about OpenSSL, TrueCrypt, etc., I don't think you're really safe using anything. A better approach might be only backing up encrypted data. For example, Knox lets you create encrypted disk images (basically virtual hard drives), which you can then send to the cloud:

https://agilebits.com/knox

So you've got the cloud's encryption on top of your virtual disk's encryption. There's a variety of stuff out there like that.

 

[GWestphal]

I guess that's what I was asking, but uploading an entire vault is rather inconvenient from an upload/download perspective when one file in it changes. Any good streamlined way to encrypt at the individual file level so single files can be uploaded encrypted, but still read natively on the machine?

 

[Kaido]

I guess that's what I was asking, but uploading an entire vault is rather inconvenient from an upload/download perspective when one file in it changes. Any good streamlined way to encrypt at the individual file level so single files can be uploaded encrypted, but still read natively on the machine?

If you keep the encrypted vault in a cloud folder, that would work. For example, Dropbox creates a mirrored folder on your hard drive - store the password-protected virtual drive inside of that folder so that it auto-syncs to the cloud.

 

[GWestphal]

I know you can do that, but that's still misses the main requirement. That it be individual files and not containers of files. When I change a single 1KB text file, I want to upload just that file not a 2GB encrypted vault/container. Get what I mean?

 

[Kaido]

I know you can do that, but that's still misses the main requirement. That it be individual files and not containers of files. When I change a single 1KB text file, I want to upload just that file not a 2GB encrypted vault/container. Get what I mean?

Yeah, incremental vs. the entire container. Not sure if anything works like that, that isn't a dedicated, secure incremental cloud backup service.

Kickstarter? :awe:

 

[TreVader]

File vault is a killer if you don't have at least 4 cores and AES encryption optimization. I tried running it on my sandy bridge i5 MBA but it probably took a 30% hit in performance and it was intolerable.


I'm not gonna bother trying it on the P8600 machine.

 

[KeithP]

I know you can do that, but that's still misses the main requirement. That it be individual files and not containers of files. When I change a single 1KB text file, I want to upload just that file not a 2GB encrypted vault/container. Get what I mean?

A sparse bundle disk image is made up of "bands". Each band is about 8MB. The cloud service would be syncing 8MB chunks not the entire disk image. At least that is the way it works with DropBox.

-KeithP

 

[Kaido]

A sparse bundle disk image is made up of "bands". Each band is about 8MB. The cloud service would be syncing 8MB chunks not the entire disk image. At least that is the way it works with DropBox.

Nice! I wonder if that's custom Dropbox file server integration, or if that's just how it works. I'd imagine to a regular program, it just looks at it as a single image, so Dropbox would probably have some custom programming to extract the incrementally upgraded portions.