|
The thing with Backblaze - at least with their PC backup offering - is that all encryption/decryption of data at is done server-side. This means that they need the private key and passphrase so they can decrypt your data. By default, Backblaze keeps both the private key and its passphrase.
They do offer some option they call "private key" I believe, but that just allows you to set the passphrase for your private key. It order to access your data, you have to give Backblaze your passphrase so they can decrypt it (remember, all Backblaze encryption/decryption happens server-side, not client-side). So with this "private key" option, THEY have the private key and YOU have the passphrase to make that private key usable. That sounds more secure. But you have to give THEM your passphrase in order to be able to access your data. So really, the "private key" option does nothing to make your data more secure, although it initially sounds like it would.
Having to give them your private key (actually, the passphrase for your private key, because they always have the private key) nukes any private security you thought you had. They do not provide you with "end-to-end" encryption, or "zero knowledge" encryption.
I think for the typical computer user who doesn't know anything about security, encryption, etc. that Backblaze PC backup is a good thing. Backblaze is a big company that has been around for a long time. It is unlikely they would compromise your security and decrypt your data on a whim. They would lose many of their clients if word got out about them doing that. But the fact is - they COULD decrypt your data. Unless you chose the "private key" option and never gave them your passphrase. In that case they could not access your data. But then, neither could you. Making their whole service rather pointless. Still, even with the security holes mentioned, for the typical computer user, Backblaze is far better than nothing and probably provides a reasonable level of security. Not bulletproof security, but reasonable security. Really, the only breaches you'd have to worry about would come from Backblaze themselves. Or from a government subpona for your data from Backblaze. Even with a subpoena, Backblaze could not decrypt your data with the "private key" option and you not giving them your passphrase. But the subpoena could theoretically instruct Backblaze to capture your passphrase the first time you use it to access your data, and then they could fill the subpoena by decrypting at that point.
The above issue is what now haunts me about my security and backup setup. It is nice and secure. And I doubt anybody in my family could figure it out, even with detailed instructions, once I'm gone. Which means maybe I should give up on ultimate security and go for something not so bulletproof - like Backblaze. At least they should be able to help my family access our data when I'm gone. But another gotcha is that Backblaze apparently does not support Linux (which is what all of my computers and servers run). My wife have a laptop and desktop computer that runs Windows. But a lot of the stuff that she uses is actually hosted on a Linux server. She doesn't remember that and probably thinks it is actually local on her Windows computers.
Such is the life of a retired computer engineer who was heavy into corporate security. The most secure thing that I would do for myself is not necessarily the best solution for my less computer savvy family. It pains me to think about lessening security. But it also pains me to think I might have things so secure that even my family couldn't get to them after I'm gone.
|