Online Backup
I was recently listening to the radio and heard the technology guru talking about Carbonite. I’ve also recently heard mention of Mozy. Both of these are fully automatic online backup solutions which, once you install, back up every file written to your disk. Carbonite even keeps previous versions of files (and deleted files) for 30 days after modifications were made, just in case the problem is not corruption or loss, but user error.
Both services encrypt the files on the PC using Blowfish before transmission; typically with a key that is generated by (and archived by) the service. Mozy has, and Carbonite is planning to release, the capability of using your own encryption key which is not archived by their servers. Additionally, both transmit everything over SSL. (Why the second layer of encryption is necessary perplexes me.)
What happens when one of these companies’ key archives is stolen by a hacker or disgruntled employee? What if a large organization offered an employee 5 times their yearly salary to get another person’s key/data? How do we know they’re really doing the encryption properly, why aren’t they FIPS 140 validated? Why Blowfish and not AES? If I’m a corporation who doesn’t think these services are trustworthy, how can I make sure my employees don’t use one of these services to back up corporate data?
Both Carbonite and Mozy offer free trials, check them out if you wish. There are plenty of other competitors out there too. Automated online backup seems like an interesting idea, but still presents too many questions for me.
One thought on “Online Backup”
While the SSL will only encrypt the files during transmission, if you don’t encrypt the traffic to the server, you’re allowing an attacker to get access to the (poorly) encrypted data, and then brute force the key.
Anyway, from Carbonite’s FAQ:
What is Carbonite and who is it for?
Carbonite is Backup for Everyone™ — a simple, safe online backup service for casual home PC users, students, home office users, road warriors, etc. For five dollars a month, Carbonite will backup all the data on your PC (digital photos, music, office documents, and other valuable data) whenever your PC is connected to the Internet.
That may explain why they aren’t using strong cryptography…the service isn’t intended for a business audience. And, if a company doesn’t want their employees using the service, they should provide a better, more secure alternative.
P.S. – it’s hard to keep track of what you’ve written with this tiny comment box
Comments are closed.